Telneting To Nm-Cids; Configuring Packet Capture - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Chapter 16 Configuring NM-CIDS
Disconnect from the router:
Step 6
router# disconnect
Press Enter to confirm the disconnection:
Step 7
router# Closing connection to 10.16.0.0 [confirm] <Enter>

Telneting to NM-CIDS

You can also Telnet directly to the router with the port number corresponding to the NM-CIDS slot. Use
the address you established when configuring the loopback 0 interface in
Interfaces on the Router, page
The port number is determined by the following formula: 2001 + 32 x slot number.
For example, for slot 1, the port number is 2033, for slot 2, it is 2065, and so forth.
To use Telnet to invoke a session to port 2033:
router# telnet 10.16.0.0 2033

Configuring Packet Capture

You must enable the desired interfaces (including subinterfaces) on the router for packet monitoring. You
can select any number of interfaces or subinterfaces to be monitored. The packets sent and received on
these interfaces are forwarded to NM-CIDS for inspection. You enable and disable the interfaces through
the router CLI (Cisco IOS).
Note If the router is performing encryption, the NM-CIDS receives the packets after decryption coming into
the router and before encryption leaving the router.
To configure packet capture on NM-CIDS, follow these steps:
Log in to the router console.
Step 1
View your interface configuration:
Step 2
router# show run
Identify the interfaces or subinterfaces that you want to monitor, for example, FastEthernet0/0.
Step 3
Note
Enter global configuration mode:
Step 4
router# configure terminal
Specify the interface or subinterface:
Step 5
router(config)# interface FastEthernet0/0
78-16527-01
16-2.
You can choose more than one interface or subinterface to monitor, but you can only edit one
interface at a time.
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
Configuring Packet Capture
Configuring IDS-Sensor
16-5