In this article we will discuss the Router IP Traffic Export (RITE) feature that you can configure on Cisco routers to export packets to a remote destination where a network analyser is placed to monitor the traffic passing through the routers.

The packets can be exported to a network analyser or IDS for further inspection or accounting.

CCNA Training – Resources (Intense)

Let’s see the benefits:

  • It can be configured on a router.
  • It can export traffic received and sent from/to a WAN interface.
  • It allows granularity by specifying what type of traffic can be exported and by specifying sampling.

There are a few limitations on how this feature can be used:

  • The feature is available only to software-based routers.
  • The device where the traffic is exported must be in the same L2 domain as the device from where the data is exported.
  • The interface towards the device to which the data is exported must be Ethernet.

The steps to use the feature are:

  • Configure the profile by specifying the MAC address of the device where the packets will be exported and the interface over which the traffic will be exported.
  • Optionally, granularity can be used by specifying the sampling and the type of traffic.
  • Apply the profile to the interface from where the traffic will be exported.

So let’s start by taking a look at the topology.

The RITE profile will be attached on the interface F0/0 towards PC_1 and we will export packets entering and/or leaving the interface.

We will export the traffic flowing between PC_1 and PC_2:

root@PC_1:~# ping -c 5 10.10.12.100
PING 10.10.12.100 (10.10.12.100): 56 data bytes
64 bytes from 10.10.12.100: seq=0 ttl=63 time=18.149 ms
64 bytes from 10.10.12.100: seq=1 ttl=63 time=15.169 ms
64 bytes from 10.10.12.100: seq=2 ttl=63 time=16.266 ms
64 bytes from 10.10.12.100: seq=3 ttl=63 time=20.271 ms
64 bytes from 10.10.12.100: seq=4 ttl=63 time=19.073 ms

--- 10.10.12.100 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max = 15.169/17.785/20.271 ms
root@PC_1:~#

As mentioned, you will need the MAC address of the device where the traffic will be exported. The fastest method is to check the ARP table of the router:

R1#show arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.11.1              -   ca01.3155.0008  ARPA   FastEthernet0/0
Internet  10.10.11.100            0   0000.abfa.bd00  ARPA   FastEthernet0/0
Internet  10.10.12.1              -   ca01.3155.0006  ARPA   FastEthernet0/1
Internet  10.10.12.100            0   0000.ab25.0800  ARPA   FastEthernet0/1
Internet  10.10.100.1             -   ca01.3155.001c  ARPA   FastEthernet1/0
Internet  10.10.100.100           0   2a9b.7697.5f23  ARPA   FastEthernet1/0
R1#

Now, let’s configure RITE. You will need to specify under traffic-export profile the interface over which the traffic will be exported and the MAC address to which the exported traffic should be sent. Then you apply the profile to the interface that is being monitored:

R1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#ip traffic-export profile RITE 
R1(conf-rite)#interface FastEthernet1/0
R1(conf-rite)#mac-address 2a9b.7697.5f23
R1(conf-rite)#exit
R1(config)#interface FastEthernet0/0
R1(config-if)#ip traffic-export apply RITE
R1(config-if)#end
*Sep 16 21:00:37.505: %RITE-5-ACTIVATE: Activated IP traffic export on interface FastEthernet0/0
R1(config-if)#end
R1#

Because we didn’t specify the direction of the traffic that is being exported, only the incoming/input direction will be monitored by default. This means that we will export only five packets (the ICMP requests because they are on the input direction of F0/0):

R1#show ip traffic-export 
Router IP Traffic Export Parameters
Monitored Interface		FastEthernet0/0
	Export Interface		FastEthernet1/0
	Destination MAC address 2a9b.7697.5f23
	bi-directional traffic export is off
Input IP Traffic Export Information	Packets/Bytes Exported    5/420
	Packets Dropped           0
	Sampling Rate             one-in-every 1 packets
	No Access List configured
	Profile RITE is Active


R1#

And this can be seen as well on the packet capture from the device where the export is done:

Let’s change the profile and capture the bidirectional traffic:

R1#show running-config | section ip traffic-export profile
ip traffic-export profile RITE
  interface FastEthernet1/0
  bidirectional
  mac-address 2a9b.7697.5f23
R1#

Again, after a test with five ICMP packets, we can see that we exported five packets of input (the ICMP requests from PC_1 to PC_2) and 5 packets of output (the ICMP replies from PC_2 to PC_1):

R1#show ip traffic-export                                 
Router IP Traffic Export Parameters
Monitored Interface		FastEthernet0/0
	Export Interface		FastEthernet1/0
	Destination MAC address 2a9b.7697.5f23
	bi-directional traffic export is on
Output IP Traffic Export Information	Packets/Bytes Exported    5/420
	Packets Dropped           0
	Sampling Rate             one-in-every 1 packets
	No Access List configured
Input IP Traffic Export Information	Packets/Bytes Exported    5/420
	Packets Dropped           0
	Sampling Rate             one-in-every 1 packets
	No Access List configured
	Profile RITE is Active


R1#

This can again be seen on the packet capture from the network analyser host:

Now, let’s be more restrictive. We can use RITE to export samples from specific types of traffic.

In this case we want to export only one packet out of five ICMP packets sent from PC_1 to PC_2.

For this, we will create an access-list that will match the ICMP traffic sent from PC_1 to PC_2:

R1#show ip access-lists 
Extended IP access list 101
    10 permit icmp host 10.10.11.100 host 10.10.12.100
R1#

And then we reference it under profile configuration along with the sampling configuration:

R1(config)#ip traffic-export profile RITE 
R1(conf-rite)#incoming access-list 101 
R1(conf-rite)#incoming sample one-in-every 5
R1(conf-rite)#end
R1#

Let’s send ten ICMP packets from PC_1 to PC_2:

root@PC_1:~# ping -c 10 10.10.12.100
PING 10.10.12.100 (10.10.12.100): 56 data bytes
64 bytes from 10.10.12.100: seq=0 ttl=63 time=82.652 ms
64 bytes from 10.10.12.100: seq=1 ttl=63 time=15.164 ms
64 bytes from 10.10.12.100: seq=2 ttl=63 time=14.273 ms
64 bytes from 10.10.12.100: seq=3 ttl=63 time=17.044 ms
64 bytes from 10.10.12.100: seq=4 ttl=63 time=16.289 ms
64 bytes from 10.10.12.100: seq=5 ttl=63 time=13.240 ms
64 bytes from 10.10.12.100: seq=6 ttl=63 time=20.225 ms
64 bytes from 10.10.12.100: seq=7 ttl=63 time=17.190 ms
64 bytes from 10.10.12.100: seq=8 ttl=63 time=22.091 ms
64 bytes from 10.10.12.100: seq=9 ttl=63 time=15.391 ms

--- 10.10.12.100 ping statistics ---
10 packets transmitted, 10 packets received, 0% packet loss
round-trip min/avg/max = 13.240/23.355/82.652 ms
root@PC_1:~#

And then connect through SSH from PC_1 to PC_2:

root@PC_1:~# ssh root@10.10.12.100
root@10.10.12.100's password: 


root@PC_2:~#

Based on our new profile configuration, we should see only two ICMP packets (the two ICMP requests from PC_1 to PC_2). The access-list has two matches:

R1#show ip access-lists 
Extended IP access list 101
    10 permit icmp host 10.10.11.100 host 10.10.12.100 (2 matches)
R1#

And the stats show that we exported only two packets and dropped another 30. The dropped packets are the other 8 ICMP requests, the 10 ICMP replies and the SSH packets:

R1#show ip traffic-export 
Router IP Traffic Export Parameters
Monitored Interface		FastEthernet0/0
	Export Interface		FastEthernet1/0
	Destination MAC address 2a9b.7697.5f23
	bi-directional traffic export is off
Input IP Traffic Export Information	Packets/Bytes Exported    2/168
	Packets Dropped           30
	Sampling Rate             one-in-every 5 packets
	Access List        101 [extended IP]
	Profile RITE is Active


R1#

By checking the packet capture from the network analyser, we will see only two ICMP packets as expected:

You can enable debugging to see when exporting is done. This was enabled during the previous test:

R1#debug ip traffic-export events 
IP Traffic Export Events debugging is on
R1#
R1#RITE: exported input packet # 1

R1#RITE: exported input packet # 2

R1#

And this is almost everything about the Router IP Traffic Export feature.

In this article we discussed the utility of the feature, how to configure it and how to check the statistics to see if it’s working properly or not.

References: