Joe Marcus Clarke has created a
wonderful custom add-on for CiscoWorks.
Joe has used one of my favorite tools [
ethereal ] as the front end for this
utility and integrated it into CiscoWorks 2000.
JET can be downloaded at
http://cosi-nms.sourceforge.net/decode-progs.html.
You can access the JET tool through your CW2k Desktop via your Web
browser.
You must be logged into CiscoWorks 2000 as Admin to use JET.
JET is found by going to (in CD One Third, Fourth, and Fifth Editions):
Server Configuration->Diagnostics->Connectivity Tools->Packet
Capture.
Once launched, you will be presented with a screen listing currently
archived capture files. If no capture files have been archived, then
this screen will say that there are no capture files. From this
initial screen, you can Create a new capture, Delete an existing capture
file, or Update or refresh the list of archived capture files.
If you click Create, you will be presented with a screen that lets you
configure which packets should be captured.
If you have multiple interfaces on the machine, you must first select on
which interface you wish to capture.
The Address(es) field accepts one or more addresses (separated by a
single space) to match when capturing.
Next, you must decide whether or not you want to configure the protocol
and port on which to capture, or if you want to select from the
pre-configured list of common CiscoWorks 2000 applications.
By default the protocol/port selection is used.
Select the protocols, TCP, UDP, or ICMP, you would like included in
the capture.
Then, if desired, fill in the list of ports to capture on.
The Port(s) field accepts one or more TCP or UDP ports (sepatrated by
a single space).
click the Application radio button if you wish to select from a
pre-configured list of common CiscoWorks 2000 applications and select one
or more applications from the list.
Finally, you must specify when to stop the packet capture.
You can choose to terminate the capture after a set amount of time,
after the filter has captured a certain amount of data, or after a certain
number of packets have been captured.
By default, the capture will stop after 60 seconds (1 minute).
Each capture is saved on the server in the NMSROOT/htdocs/jet
directory.
These files are in binary libpcap format with a .jet extension.
You can download these files directly through your web browser, then
email them to the TAC for further analysis.
CAVEATS
----------------
JET is a troubleshooting tool.
It should not be used a general purpose sniffer.
On Solaris, JET installs a setuid root binary in /opt/CSCOpx/objects/jet/bin.
This binary is only executable by users in the casusers group, but if
this is still too risky, consider revoking its setuid privileges until you
need to use it.
JET is only accessible to CiscoWorks 2000 users that have System
Administrator privileges (e.g. admin). It is not recommended you try
and change this.
