Hello!
In the troubleshooting episode of the CCENT show, when troubleshooting ACLs, in order for Don to figured why his pings towards where still going out to 4.2.2.1 in despite of the deny ACL, he had to recreate the ACL and add the "log" option at the end of an ACE specifically design to tackle this issue; I think it was something like: (config-if)#access-list 101 permit ip any host 4.2.2.1 log
Anyway, I was wondering if there is another way to look at the incoming IPs for a particular interface, so that we don't need to create an ACL just to see this. Maybe using debug?
Thanks
-
Another way of seeing incoming traffic for a particular interface
-
You'll have to use some type of packet capturing software to do so. The debugs help to report just about every statistic that cisco can do but it doesn't report on regular traffic for source and destination.
The log at the end of the command just allows us to see specifically how often that ACL entry was hit. If you could do it would be like a
debug ipwhich is not something you would want to do on a production device this could easily cause your device performance degradation or even reboots if it overwhelms the amount of RAM and the CPU. -
Thanks so much for your prompt answer @Ronnie-Wong !
