DEBUG MODE

Discussion in 'Cisco' started by ns, May 16, 2005.

  1. ns

    ns Guest

    Hi all,

    To view real time packet in my routers, some times, i run debug mode and
    terminal monitor to print result on session, and then, i run undebug all to
    stop debug.

    The problem is, this operation take a lot of memory/cpu.

    How can i view result of debug mode without impact performance of the router
    ?
    Maybe by sending result of debug mode to syslog server ? If yes how, can i
    do it ?

    ThankYou very much for your help

    Best Regards
    NS
    ns, May 16, 2005
    #1
    1. Advertising

  2. ns

    Jo Reed Guest

    http://www.cisco.com/en/US/products...eference_chapter09186a00800ee834.html#1017117

    "ns" <> wrote in message news:d6afbq$h75$...
    > Hi all,
    >
    > To view real time packet in my routers, some times, i run debug mode and
    > terminal monitor to print result on session, and then, i run undebug all
    > to
    > stop debug.
    >
    > The problem is, this operation take a lot of memory/cpu.
    >
    > How can i view result of debug mode without impact performance of the
    > router
    > ?
    > Maybe by sending result of debug mode to syslog server ? If yes how, can i
    > do it ?
    >
    > ThankYou very much for your help
    >
    > Best Regards
    > NS
    >
    >
    Jo Reed, May 16, 2005
    #2
    1. Advertising

  3. ns

    ns Guest

    Thanks a lot Jo for quick answer

    Cdly
    NS

    "Jo Reed" <> a écrit dans le message de
    news:7F3ie.8340$...
    >

    http://www.cisco.com/en/US/products...eference_chapter09186a00800ee834.html#1017117
    >
    > "ns" <> wrote in message

    news:d6afbq$h75$...
    > > Hi all,
    > >
    > > To view real time packet in my routers, some times, i run debug mode and
    > > terminal monitor to print result on session, and then, i run undebug all
    > > to
    > > stop debug.
    > >
    > > The problem is, this operation take a lot of memory/cpu.
    > >
    > > How can i view result of debug mode without impact performance of the
    > > router
    > > ?
    > > Maybe by sending result of debug mode to syslog server ? If yes how, can

    i
    > > do it ?
    > >
    > > ThankYou very much for your help
    > >
    > > Best Regards
    > > NS
    > >
    > >

    >
    >
    ns, May 16, 2005
    #3
  4. ns

    Chris Guest

    You can use an access-list to filter "debug ip packet" or just use a
    sniffer.
    Chris, May 16, 2005
    #4
  5. In article <d6afbq$h75$>, ns <> wrote:
    :To view real time packet in my routers, some times, i run debug mode and
    :terminal monitor to print result on session, and then, i run undebug all to
    :stop debug.

    :The problem is, this operation take a lot of memory/cpu.

    :How can i view result of debug mode without impact performance of the router

    In general, you cannot.

    :Maybe by sending result of debug mode to syslog server ? If yes how, can i
    :do it ?

    Sending anything to syslog takes memory and cpu and would have
    *some* performance impact.

    If performance is a problem, you need to avoid having the router
    do extra work to make the packet contents available. In some models
    and versions, there is no way to do that. In other models and
    versions, you can "span" or "rspan" without performance penalty.

    If you are proposing to send the debug messages via syslog, then
    your requirement is not really for 'real time' packet analysis.

    Do your routers support packet capture?
    --
    'ignorandus (Latin): "deserving not to be known"'
    -- Journal of Self-Referentialism
    Walter Roberson, May 16, 2005
    #5
  6. "Walter Roberson" <-cnrc.gc.ca> wrote in message
    news:d6ahge$a2t$...

    > Do your routers support packet capture?
    > --



    Not to high-jack someone else's thread, but what routers do this? I know
    that PIXes do, but I didn't know that any routers have that ability. I
    guess that I need to spend more time on Cisco's website..

    -Richard
    Richard Graves, May 17, 2005
    #6
  7. In article <ygbie.1585$>,
    Richard Graves <rgraves_22*NONONONO*@yahoo*NONONO*.com> wrote:
    :"Walter Roberson" <-cnrc.gc.ca> wrote in message
    :news:d6ahge$a2t$...

    :> Do your routers support packet capture?

    :Not to high-jack someone else's thread, but what routers do this? I know
    :that PIXes do, but I didn't know that any routers have that ability.

    The Network Analysis Module (NAM) for one. NM-CIDS for another.
    And the "SVC-ADM" "Traffic Anomaly Detector Module".

    IOS with the RMON feature allows capture of packet headers
    ("rmon capture").


    There might be others; I am no IOS expert.
    --
    Feep if you love VT-52's.
    Walter Roberson, May 17, 2005
    #7
  8. ns

    ns Guest

    Thanks a lot for yours anwers

    Cdly
    NS
    ns, May 17, 2005
    #8
  9. ns

    ns Guest

    Hi All,

    I don't know if my routers support packet capture. I would like to find a
    standard solution for all cisco routers, also for catalysts L3.

    I tested by sending logging to syslog and saving logging on buffer. This two
    solutions work fine. Its betten than writing debug on the terminal monitor.

    So, it's work fine, i can run debug mode without having great problem

    ThankYou very much

    Cdly
    NS


    "Walter Roberson" <-cnrc.gc.ca> a écrit dans le message de
    news:d6c0ss$6rb$...
    > In article <ygbie.1585$>,
    > Richard Graves <rgraves_22*NONONONO*@yahoo*NONONO*.com> wrote:
    > :"Walter Roberson" <-cnrc.gc.ca> wrote in message
    > :news:d6ahge$a2t$...
    >
    > :> Do your routers support packet capture?
    >
    > :Not to high-jack someone else's thread, but what routers do this? I know
    > :that PIXes do, but I didn't know that any routers have that ability.
    >
    > The Network Analysis Module (NAM) for one. NM-CIDS for another.
    > And the "SVC-ADM" "Traffic Anomaly Detector Module".
    >
    > IOS with the RMON feature allows capture of packet headers
    > ("rmon capture").
    >
    >
    > There might be others; I am no IOS expert.
    > --
    > Feep if you love VT-52's.
    ns, May 18, 2005
    #9
  10. ns wrote:

    > I don't know if my routers support packet capture. I would like to find a
    > standard solution for all cisco routers, also for catalysts L3.
    >
    > I tested by sending logging to syslog and saving logging on buffer. This two
    > solutions work fine. Its betten than writing debug on the terminal monitor.


    There is the (undocumented) 'debug ip packet dump' which logs a hexdump
    of matching packets.

    The following bit of Perl will massage it into something text2pcap (part
    of Ethereal: http://www.ethereal.com/) can turn into a libpcap format
    file which tcpdump or Ethereal can read.

    ---------------------- Cut here ----------------------------


    #!/usr/bin/perl

    # Convert Cisco dump file format to something text2pcap can read.
    # Author: Hamish Moffatt <>.
    # License: GPL (see www.gnu.org).

    sub dumppkt () {
    for ($i = 0; $i < scalar(@pkt); $i++) {
    if ($i % 16 == 0) {
    printf "\n%08X", $i;
    }

    printf " %02X", $pkt[$i];
    }

    }

    while(<>) {
    chomp;

    unless (m/[0-9A-F]{8}:/) {
    rly do her in?ØA DROPPRIVS=yes@Á-capture_wbai* interparse*
    msn/À‰ dumppkt;
    undef @pkt;
    next;
    }

    # Strip the offsets and ASCII dump
    $hex = substr $_, 10, 35;

    # Remove all spaces
    $hex =~ s/ //g;

    # Convert hex bytes on this line
    while ((length $hex) > 0) {
    push @pkt, hex (substr $hex, 0, 2, "");
    }

    }

    dumppkt;
    print "\n";


    -------------------------- Cut here ------------------------------

    Regards,

    Marco.
    M.C. van den Bovenkamp, May 18, 2005
    #10
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?Zm9ybXVsYWlj?=

    changing from domain mode to workgroup mode

    =?Utf-8?B?Zm9ybXVsYWlj?=, Nov 6, 2005, in forum: Wireless Networking
    Replies:
    4
    Views:
    4,619
    Kalevi
    Nov 5, 2007
  2. Echy

    Safe mode Vs normal mode

    Echy, Aug 26, 2005, in forum: Firefox
    Replies:
    6
    Views:
    1,368
  3. Brian
    Replies:
    1
    Views:
    427
    The Poster Formerly Known as Kline Sphere
    Dec 27, 2004
  4. English Patient
    Replies:
    3
    Views:
    1,808
    Old Gringo
    Oct 4, 2004
  5. Brian
    Replies:
    2
    Views:
    309
    The Poster Formerly Known as Kline Sphere
    Dec 27, 2004
Loading...

Share This Page