How to Remote port monitoring using Wireshark

Remote port monitoring using Wireshark

Step 1: Need to create RSPAN VLAN

SW1(config)# vlan 900

SW1(config-vlan)# remote span

SW1(config-vlan)# end

SW3(config)# vlan 900

SW3(config-vlan)# remote span

SW3(config-vlan)# end

NOTE:

-          The RSPAN Vlan needs to exist in the Vlan database of the source switch, the destination switch and all switches in the transit path between them. It also needs to be allowed on all Trunk ports between the source and destination switches.

-          The RSPAN VLAN cannot be VLAN 1 (the default VLAN) or VLAN IDs 1002 through 1005 (reserved for Token Ring and FDDI VLANs).

Need to configure the following commands on the switch which has the Internet port:

#no monitor session 1

#monitor session 1 source interface fastethernet 0/1

#monitor session 1 destination remote vlan 900

The source interface above will be your Internet port that you need to monitor and the Vlan ID for the remote VLAN will be your newly created RSPAN Vlan.

Then on the destination switch, i.e. the one you have the host who needs to see the packets:

#no monitor session 1

#monitor session 1 source remote vlan 900

#monitor session 1 destination interface fastethernet 0/10

The source Vlan will be the RSPAN Vlan and the destination interface will be the port that you want to output your packets to.

Verify

#Show monitor 1

Read More...

How to ping multiple ip addresses from cmd prompt

If you are working as a  Network/System administrator you might come across situations to monitor network connectivity of multiple machines in your network at same time.Companies having large network may use Network Monitoring tools like PRTG Monitor .

As we all know, ping is one of the most useful network debugging tools used for verifying IP-level connectivity.Normally when we want to ping multiple IP addresses, we open command prompts and start pinging to each IP.

If the ping command gets a response, then the connection is good, and you can concentrate on other problems.If you are getting RTO's [Request time out] there is some connectivity problem in the network

If we have to monitor connectivity of multiple IP addresses we need to open each cmd prompt and need to ping all IPs.There are lot of free software which allow you to ping multiple IPs at same time.But many of the companies will not allow admins to install and use third party softwares to do that.In such cases we can use batch files to ping multiple IPs at same time.You can PING as many IPs with a single click.

How to make a Batch file to ping multiple IP addresses

- Open a notepad 
- Type

START "Google Primary DNS" ping 8.8.8.8 -t
START "Google Secondary DNS" ping 8.8.4.4 -t  

-Save it as Sysnet.cmd in your desktop .You can use as many IP address you want.All IP addresses are opened in seperate windows when you click on the Sysnet icon on your desktop

Instead of  "Google Primary DNS" you can use any Title you want.
Instead of "8.8.8.8" and "8.8.4.4" you can use any IP address you want.
Instead of "Sysnet.cmd" you can use any Name.cmd you want.

If you are interested in free software to ping multiple IPs at same time,You can try PingInfoView which is a small, very useful and free utility that allows you to easily ping multiple host names and IP addresses, and watch the result in one table.

Related articles

• Basics : Common Networking terms
• Troubleshooting IP using ICMP (ping and traceroute)
• List of commands which can execute from cmd promt

Read More...

CCNP Notes : what is syslog

Netwok Monitoring with Syslog

Syslog is a powerful network monitoring tool which helps administrators to manage complex networks.it aggrigate logs/events from multiple sources and helps administrator to monitor from a single location.The logging server software must simplify log management, and help admins filter and focus on messages that truly matter

Syslog protocols are used to send logging/event messages to a separate network devices called syslog servers.

Syslog messages usually include information to help identify basic information about where, when, and why the log was sent: ip address, timestamp, and the actual log message.Syslog messages are plain text sent using UDP port 514. 

Every syslog message contains two parts, a severity level and a facility.  The severity level goes from 0 to 7 with 0 being the most severe to 7 being simply informational.Facilities are service identifiers that categorize events and messages for easier reporting

Syslog Priority (highest to lowest):

0	Emergency (highest)	system is ususable
1	Alert	action must be taken immediately
2	Critical	critical conditions
3	Error	error conditions
4	Warning	warning conditions
5	Notice	Normal but significant conditions
6	Informational	Informational messages
7	Debug (lowest)	debug level messages

The most common facilities related errors are

• IP
• OSPF
• SYS (operating system related)
• Route Switch Processor (RSP)
• Interface (IF)

Related articles

• Short note : Cisco IOS IP Service Level Agreements (SLAs)
• What is VLAN Hopping 
• Short note on RIP with Interview Questions 
• Spanning-tree protocol Notes with Interview Questions 
• VLAN explained with Interview Questions 
• How to Prepare for NETWORK ENGINEER INTERVIEW QUESTIONS 
• OSI Reference model interview questions 

Read More...