Web traffic monitoring

Similar Questions

• Check configuration on S170 L4 traffic monitor?

  You can check that I made this connection correctly on our new S170?  I'm greatly grateful in advance!

  On the switch, I created 1 session of the monitor with the following command:

  monitor session 1 source Fa6/0/38, 48/0/Fa2 interface

  control interface of destination session 1 item in gi1/0/40

  We have two 50 Mbps internet connections, firewalls are so only on 100meg (fa) ports GigE ports are at a premium and I don't want to lose the PoE ports (which are together).

  Fa6/0/38 is our main firewall connection side lan to the internet.  All traffic to the outside world of our local network must pass through here.

  FA2/0/48 is an asa firewall failover, if for some reason, the principal is down, traffic to the outside world would be through this port through the secondary firewall.

  Item in gi1/0/40 is a concert which is patched with the WSA S170 T1 port.

  The WSA network > Interfaces display a L4 Traffic Monitor wiring Duplex TYPE value: T1 (In/Out)

  Security Services > L4 Traffic Monitor enabled L4 traffic, and the traffic is controlled on all ports except ports web (HTTP/HTTPS).  Rules are correctly updated and licensing is enabled for this feature.

  So this setup correctly?  Is it possible to test?  Should I change the L4 monitor traffic to monitor all ports, or generally just you ports WCCP 80 / 443 of the firewall answer to all that filtering and use L4 for 'everything else '?

  When I go to the L4 Traffic Monitor reports, there is no data found.  Now probably because there is no suspicious activity or malware, but how can I be sure that it works?

  It looks like the game properly.

  I set mine to look at "Everything else."

  I do not know how to test to see if it alarms...

• WRT 1900 ACS - Impossible to carry web traffic through openvpn

  2.3.11 OpenVPN windows 7 X 86. Router information

  Firmware version:	1.0.0.169041
  Serial number:	18E1060B503339

  By default, OpenVPN only sends traffic over the VPN, which is intended for the VPN. Normal traffic to Web sites, for example, is not sent by the VPN. Which can be modified to send all traffic through the VPN?

  @alexdemon

  Router WRT1900ACS is a SOHO router. It doesn't have a feature of access rule where the web traffic can be managed and regulated. The tool of Parental control of your Linksys Smart Wi - Fi account is designed for local customers only.

  Note:

  OpenVPN can create the tunnel from the remote host to the main network and thus web traffic cannot be routed through the router firewall.

  Ann_18678
  Linksys technical support

• IBM IHS web servers monitoring

  Hi all

  Is there a cartridge for the monitoring of indicators of performance of IBM IHS web servers? Anyone built a cartridge personalized for that in the past who can share?

  Thank you

  Xiaoning

  Your first option for monitoring the IBM IHS web servers is ApacheSvr agent contained in the cartridge inherited from the BONE.

  This local agent monitors Apache (and Apache IHS derivatives) by analyzing the access log web server.

  You must specify the location of the access log and and the string format when you configure the agent.

  Custom web server referenced by Michael officer was written and is maintained by Bart van Knijff.

  This agent is excellent for remote monitoring of the web servers Apache (and IHS) who have the 'status' active module.

  Kind regards

  Brian Wheeldon

• web pages Monitor

  How to track the web pages that my child uses when I am with Microsoft family safety?

  The most effective way is the direct supervision.  Don't allow them to use the PC in complete privacy.

  http://www.canadiantech.info/sample-page-2/keep-your-computer-secure/youngsters-teenagers-and-safety/

  Young people, teenagers and security

  Security, adolescents and young people. Parents, do you a favor. Don't allow the use of a computer by them in private places. Best place to put a desktop computer they are using is in the kitchen or the living room. Laptops for them is especially risky. The Internet is a wonderful and beautiful place, but it has risks. Children and adolescents are not necessarily equipped to assess the dangers. They can get themselves in a lot of trouble. Supervise the use of the Internet.

  I highly recommend allowing the passwords on those computers.

• Need for detailed monitoring of IP traffic

  I bought the Nighthawk R7000 router for my parents and they love it. However, I am disappointed by its rather simplistic traffic monitoring tools. The only info. I can read the stock browser GUI is a few basic IP traffic counting such as daily, weekly and monthly totals through the router.

  For the last 6 months, I kept a monthly Diary of their Internet usage (they have service of Comcast 50 Mbps) and noticed an ever-growing increase in the use of about 60 GB of total traffic in June 2014 to now approximately 200 GB in November 2014. I asked them if they use more band bandwidth-heavy apps like YouTube videos, but they both say their general use is about the same as the return in the summer. Something strange is happening. They have some devices that I suspect may use a lot of this traffic - such as MagicJacks (2) for their VoIP home phone, but also a receiver of satellite w/Sling Apple use TV and DISH hopper.

  Y at - it to DD - WRT firmware I can use on the R7000 for IP traffic detailed stats for each device connected to the router (both wired and wireless)? If so, what is it? I've heard of Kong builds are the most stable, but they have this detailed logging of IP traffic feature I'm looking for?

  Here's a screenshot of the sample of a router ASUS using tomato firmware to show the kind of detailed report of IP traffic by device I'm looking for:

  

  http://www.DD-WRT.com/phpBB2/viewtopic.php?t=174706

  

• Monitoring data traffic

  someone at - there a HowTo idea data of the device traffic monitor?

  HowMuch sent/received by radio, wifi?

  I asked the same thing about the native forum:
  http://supportforums.BlackBerry.com/T5/native-development/network-traffic/TD-p/2287487

  no solution so far, however, and the developer of data monitor has failed.

• How to monitor tomcat 4.0 & 5.0

  Hi all:

  Foglight v5.6.5 cannot monitor tomcat 4.0 & 5.0. My client needs a lot.

  How can I meet the requirements.

  Tanks a lot.

  Hello

  You have the following options:

  1. execution of the Foglight Java agent in agent X mode, which will give you the JVM as well as seek time of traces and the degradation of the layer information.

  The information on this subject exist in this solution to support https://support.quest.com/SolutionDetail.aspx?ID=SOL68881

  You can also read the great explanation on X agent Brian Wheeldon wrote this response http://en.community.dell.com/techcenter/performance-monitoring/foglight-administrators/f/4788/t/19549840 area

  2 monitoring using JMX with jdk 1.5.x or higher agent (you will see that all information is published with JMX).

  3. you can always use the utility agents: Appmonitor follow the process running, webmonitor to monitor the availability of web pages and logfilter to check the log file for exceptions. If you Fxm/Fxv launched, you can monitor web traffic to the tomcat server.

  I hope this helps.

  Golan

• What is the recommended method to configure a web proxy to another server on the LAN?

  Hello

  I use Server to manage incoming web traffic, but also have another server running I want to use outside.

  I work in directly modifying the site configuration file and adding the ProxyPass and ProxyPassReverse directives but these overwritten when the site configuration is changed in the.app

  I want to implement this in a way that is not crushed and is more robust.

  Any advice would be very welcome.

  Thank you

  Gary

  I'm certainly not an expert in the field, but I think you can do what you're asking using the functionality of the Web application.

  You bring a plist to webapps folder and a conf file in the apache folder and then using.app, edit your Web site, and then click Change advanced settings and select the Web application that you created. It should not then be written more if you make any changes.

  The content of the conf file would proxy information in it:

  # of http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxypass

  RewriteEngine on

  RewriteCond% {HTTPS} = off

  RewriteRule. -[E = Protocol: http, E = port: 8000]

  RewriteCond% {HTTPS} = we

  RewriteRule. -[E = Protocol: https, E = port: 8010]

  ProxyPassReverse / http://secondserver.example.com:8000 /

  ProxyPass / http://secondserver.example.com:8000 /

  and the plist would be something like this:

  <? XML version = "1.0" encoding = "UTF-8"? >

  <! DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0 / / IN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd" > ""

  <!-see the manual pages for webapp.plist (5) and webappctl (8) for more information on this example webapp.plist->

  < plist version = "1.0" >

  < dict >

  includeFiles < key > < / key >

  < table > <! - include files are enabled in the virtual host then webapp - >

  < string > /Library/Server/Web/Config/apache2/httpd_yourwebapp.conf < / string > <! - name must match your conf file - >

  < / array >

  < key > name < / key >

  < string > com.example.secondserverwebapp < / string >

  displayName < key > < / key > <! - name displayed in app server - >

  < string > SecondServerWebApp < / string >

  installationIndicatorFilePath < key > < / key > <!-the presence of this file indicates web app is installed->

  < string > /Library/Server/Web/Config/apache2/httpd_yourwebapp.conf < / string >

  sslPolicy < key > < / key > <! - determines the behavior of the webapp SSL - >

  < number > 0 Integer < / integer > <!--0: by default, UseSSLWhenEnabled->

  <!--1: UseSSLAlways->

  <!--2: UseSSLOnlyWhenCertificateIsTrustable->

  <!--3: UseSSLNever->

  <!--4: UseSSLAndNonSSL->

  < / dict >

  < / plist >

  This is perhaps not completely right, but can direct you in the right direction, I hope that someone with more knowledge will be the chip in the meantime

• deploy the web service to xp embedded

  Hi all

  I struggle to run a web service on an xp embedded system. The web service works very well in my LV 2011 development environment and I have created an installer for my main application it is the lvws file is included as described in web services FAQ:

  http://zone.NI.com/DevZone/CDA/tut/p/ID/7747#toc12

  After the installation on the target computer, I can't access the web service. Also if you call localhost:3580, then I get an access error.

  But in the System Control Panel administrative tools, I can see that the server system OR like many Web server OR Web applications are started.

  For further investigation, I added the 'Distributed System Manager' to my Installer. With this tool, I see that all my web services deployed on my development system, but on the XP embedded system with TEN target is listed.

  I installed my application for a professional reference XP system to exclude that the problem is caused by embedded XP. But the behavior is exactly the same. So far, I tested only local so that settings security like firewalls and ports system should pose no problems. But to be sure I have disabled the firewall without success... I can't access the Web service. I have often found the suggestions in the forum to check if the web service is enabled. But I am not already and then access to http://localhost:3580.

  Any ideas?

  Thank you!

  This help document is somewhat outdated.

  You see 2 different problems: 1) you can not display the Configuration utility and do not install Web using localhost:3580 2) your web service monitoring.

  For the first number-->

  You probably did not understand the "Interface Web NI 2011 infrastructure" in your Setup program.  The doc to help you mentioned does not tell you to do, because it is not necessary for your web service works. However, if you want to change one of the settings of your web server after the installation, you will need this extra setup program.

  For the second question-->

  You probably didn't get your Spec to build Web services as a source file in your Setup program.  The help doc says to put your LVWS file as your installation source, but this is not correct. You must include the technical article to build real web service as a source file (not the web service create out of spec files, like LVWS).

  Let me know if any of these will help you.

  -Jared

• 8024F Port Mirroring not capture all traffic

  We have a router plugged into port Te1/0/21, that all our WAN traffic comes in our data center.  We have duplication of port configured to mirror Te1/0/22 of this port.

  control interface of destination session Te1/0/22 1
  control the source session interface 1 Te1/0/21

  We have a Sourcefire traffic monitoring device and when I do a tcpdump for this interface I see only ARP, STP and the interface of the switch http connections.

  We have mirrored on a N3024 that works very well for a different router.

  The 8024F is stacked with an another 8024F via ports 4 fibre first.  8 other ports on the 2 switches have fiber connections, then we have 7 fiber for rj45 connectors in each switch connect the CAT5e cable with other devices.  21-24 ports, we use the rj45 ports rather than the fiber on each switch port.

  The switch firmware is 4.2.2.3.

  Try adding this line to the config and see if it helps.

  session mode 1 #monitor console (config)

• VS web cache WCCP service numbers

  Hello

  I'm working on configuring WCCP for our LAN and I wonder if there are any differences in features between the use of 'ip wccp web cache' or 'ip wccp [number] "?

  (The plan is to have caching devices and using the WCCP, web traffic would be picked up and sent to the caching engines).

  Thank you for your time.

  Hi Martin,

  The WCCP service numbers are characterised by TCP port numbers, in the case of the web cache wccp, this will redirect all traffic to TCP port 80 of routers to Cisco Cache/CNSE devices.  Other third party WCCP clients will use wccp custom number (90-97), some of the groups most common wccp service are shown below:

  Name of the service	Service number	Protocol	Port	Priority
  Web cache	0	TCP	80	240
  DNS	53	UDP	53	202
  FTP-native	60	TCP		200
  promiscuity of TCP	61	TCP	*	34
  promiscuity of TCP	62	TCP	*	34
  HTTPS-cache	70	TCP	443	231
  RTSP	80	TCP	554	200
  WMT	81	TCP	1755	201
  MMSU	82	UDP	1755	201
  RTSPU	83	UDP	5005	201
  CIFS-cache	89	TCP	139, 445	224
  custom	90			220
  custom	91			221
  custom	92			222
  custom	93			223
  custom	94			224
  custom	95			225
  custom	96			226
  custom	97			227
  custom-web-cache	98	TCP	80	230
  reverse proxy	99	TCP	80	235

  Concerning

  Rubens

• Cisco WSA: Is it possible to use the web proxy in transparent mode without WCCP router?

  Hello!

  I would like to use Cisco WSA as a web proxy in a transparent manner (without any configuration of client web browsers), but I do not have a WCCP router. So, is it possible?

  If so, how?

  Thank you

  Stephane Walker

  Hi, Stéphane

  The only alternative to WCCP is ACB (the policy-based routing). With a simple configuration on the router, you can redirect traffic defined also interesting by the WSA access list. On the ASO you must configure transparent mode (security-> Web Proxy Services-> the settings of-> Mode Proxy: Transparent). You should also make sure proxy listens on port 80 and HTTPS proxy is enabled (on port 443) If you want to redirect HTTPS traffic as well.

  Cisco router configuration example

  !
  access-list 110 permit tcp any any eq www
  !
  proxy-redirect allowed route map 10
  corresponds to the IP 110
  set ip next-hop xxx.xxx.xxx.xxx
  !
  interface ethernet0/1
  proxy-redirect IP policy route map
  !

  xxx.xxx.xxx.xxx is the IP address of the proxy in such a case and access-list 110 sets web traffic (HTTP-TCP/80) also interesting.

  The biggest drawback of this solution is the lack of troubleshooting. If the proxy will go down because some reason router will keep redirecting traffic causing the cutoff of internet access.

  Cisco routers out material should also have an option to configure policy routing based.

  / Artur

  PS. It is not possible to place the WSA online between the clients and the internet.

• ACL to prevent gnutela, outgoing kazaa, grokster traffic

  Hello

  I have a client who has a 3640 router edge style. It is an educational institution, the network administrator has really no students mind pulling the music down, he won't simply foreign guests pulling music out of the boxes, studying its network.

  I want to build on this 3640 access lists to prevent outbound connections for these music services...

  Inside the network numbers are 192.240.88.0 for example...

  pls help...

  It relly is dependent on your music file sharing protocol. For example, to configure an access list to block KazaA, access list statement would be something like

  access-list on refuse tcp host x.x.x.x any eq 1214

  ip access list allow a whole

  Here's more information you might help you. Some of this information is old and it might not be applicable. It would be wise to cross-check the same.

  App: Kazaa and Morpheus

  Block customers who connect with each other and the application is broken.

  -Deny TCP and UDP 1214

  App: WinMX

  This package is Napster-like and requires a central site to allow file sharing. This site by its IP blocking prevents its use.

  App: AudioGalaxy Satellite

  This package uses the top ports to find servers AudioGalaxy Satellite and FTP (TCP 21 and 20 TCP) to perform the actual file transfers. Also block the AudioGalaxy network block should help. Denying completely FTP will prevent this service as well.

  -Deny TCP and UDP TCP 41000-42000

  App: Napigator

  Napster as a tool, requires a central site to function. By blocking the central site of blocks Napigator.

  App: Freenet

  The only effective way to catch this kind of traffic is to watch traffic heading for the witnesses. Many PacketFilters allow research the first packet of a flow for the matches in the string. In General, the implementation of this type of filter is outside the scope of a simple how-to doc. The Protocol is built from the groundup to not rely on a specific port. For more information, refer to

  http://freenetproject.org.

  App: Napster

  Block access to the Central netblocks of Napster (these may change from time to time) that prevent the use of Napster:

  -Refuse any traffic and traffic to source.

  Block access to peer file sharing, filter only the default ports. This may break some (very dubious) internet use but would prevent his use of Napster if the network block above should change to another set of addresses.

  -Deny traffic to destination: 0.0.0.0/0 TCP 6699

  -Deny traffic from source: 0.0.0.0/0 TCP 6699

  -Deny traffic to destination: 6699 UDP 0.0.0.0/0

  -Deny traffic from source: 6699 UDP 0.0.0.0/0

  App: Aimster

  Blocking Aimster requires blocking AOL Instant Messenger (AIM). GOAL becomes harder to block without the use of a filter or a proxy that examines the TCP 80 (Web) traffic and check that in fact only HTTP traffic is passing on this port. Using the following filters do AIM (and Aimster) much more difficult to use.

  Block ICQ/AIM client traffic

  -Deny traffic to destination: 5190 TCP 0.0.0.0/0

  -Deny traffic from source: 5190 TCP 0.0.0.0/0

  -Deny traffic to destination: 5190 UDP 0.0.0.0/0

  -Deny traffic from source: 5190 UDP 0.0.0.0/0

  Given that the OBJECTIVE can also use TCP 13, 23, 80, 113 and others, it might be preferable to blocklist AOL sites altogether or only allow DNS lookups. This break solution good enough access to AOL from use with care. The best solution is described above, filter 5190 TCP and UDP 5190 but also use of filters or proxies that do not allow non-HTTP traffic using TCP 80.

  App: iMesh

  Blocking access to the central server iMesh breaks iMesh.

  App: eDonkey

  Customers to block the connection to the server

  -Deny traffic to destination: 0.0.0.0/0 TCP 4661

  -Deny traffic from source: 0.0.0.0/0 TCP 4661

  -Deny traffic to destination: 4665 UDP 0.0.0.0/0

  -Deny traffic from source: 4665 UDP 0.0.0.0/0

  Block customers who connect with each other

  -Deny traffic to destination: 4662 TCP 0.0.0.0/0

  -Deny traffic from source: 4662 TCP 0.0.0.0/0

  App: Gnutella (BearShare, Limewire, ToadNode, Gnucleus and other)

  When left with the default settings, Gnutella can be blocked as follows.

  Block customers who connect with each other

  -Deny traffic to destination: 0.0.0.0/0 TCP 6345-6349

  -Deny traffic from source: 0.0.0.0/0 TCP 6345-6349

  -Deny traffic to destination: 0.0.0.0/0 UDP 6345-6349

  -Deny traffic from source: 0.0.0.0/0 UDP 6345-6349

• How to configure to allow users in my web server behind a PIX 501

  I have 1 web server, 4 web hosting sites. IP addresses are like:

  the area of the web server itself: 192.168.111.11

  1 web site on this box has IP 192.168.111.101

  2nd ............................................ 192.168.111.102

  3rd ............................................. 192.168.111.103

  4th ............................................. 192.168.111.104

  My OUTSIDE interface (say) 205.200.20.5

  My INSIDE interface has 192.168.111.1

  I want to leave the outside web traffic in my web server box that hosts 4 sites. I only let people with HTTP and HTTPS.

  How should I do and for purposes of flexibility, say also tomorrow I want to host my site on a different web server #3 but always with the same IP address, can I selectively route certain web traffic to the boxes in different web server?

  Also, I want to open another port, say, 8080 for administrative purposes. Can I route HTTP or HTTPS, addressed to some port # to the Web server also?

  You will need to create static port mapped, but if you have only the external IP address a people can connect to, they will need to connect to a specific port in the URL to differentiate which internal web server, they really want to go.

  For example:

  > static (inside, outside) tcp 205.200.20.5 80 192.168.111.101 80 netmask 255.255.255.255

  > static (inside, outside) tcp 205.200.20.5 81 192.168.111.102 80 netmask 255.255.255.255

  > static (inside, outside) tcp 205.200.20.5 82 192.168.111.103 80 netmask 255.255.255.255

  > static (inside, outside) tcp 205.200.20.5 80 83 192.168.111.104 netmask 255.255.255.255

  maps of connections to 205.200.20.5 on port 80 through to port 80 on 192.168.111.101. Connections inbound to port 81 will be mapped through to port 80 on 192.168.111.102. Connections incoming on port 82 will be mapped through to port 80 on 192.168.111.103 and so on.

  You cannot map just all incoming traffic on port 80 to 4 different internal web servers, cause how the PIX will know which send traffic to.

  To allow access, as well as the static shown bove, you must:

  > list of allowed inbound tcp access any host 205.200.20.5 eq 80

  > list of allowed inbound tcp access any host 205.200.20.5 eq 81

  > list of allowed inbound tcp access any host 205.200.20.5 eq 82

  > list of allowed inbound tcp access any host 205.200.20.5 eq 83

  > list of allowed inbound tcp access any host 205.200.20.5 eq 443

  > interface entering outside acess group

  HTTPS is also going to be a problem, to do the same on HTTP, you need to use different ports to differentiate what specific internal web server that you want to that they go (and allow these ports in your "incoming" ACL above).

  To port 8080, just follow these steps:

  > static (inside, outside) 205.200.20.5 tcp 8080 192.168.111.10x 8080 netmask 255.255.255.255

  > list of allowed inbound tcp access any host 205.200.20.5 port 8080

  As you can probably guess, this won't work very well if you have only one external IP address, because users will not know to specify a specific port number so that they get through an internal host specific. You may have a single external address for each web server internal to this work in reality.