Comments on: CISCO Router Forensics http://raffy.ch/blog/2008/11/30/cisco-router-forensics/ Log visualization and log management as seen by Raffael Marty Thu, 26 Jan 2012 07:17:42 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: Nico http://raffy.ch/blog/2008/11/30/cisco-router-forensics/comment-page-1/#comment-16129 Nico Mon, 02 Mar 2009 12:04:06 +0000 http://raffy.ch/blog/2008/11/30/cisco-router-forensics/#comment-16129 Hm, you only realy need 1 command... show tech That should spit it all out..... Hm, you only realy need 1 command…

show tech

That should spit it all out…..

]]> By: Alex http://raffy.ch/blog/2008/11/30/cisco-router-forensics/comment-page-1/#comment-16011 Alex Wed, 07 Jan 2009 15:39:39 +0000 http://raffy.ch/blog/2008/11/30/cisco-router-forensics/#comment-16011 Many people still use RANCID to collect information about their routers (me included), which already does all the expect wizardry required. The commands that are run by rancid should be a good starting point. On the other hand, you could just pull the files that RANCID stores into Splunk (or go all the way and use Splunk as backend instead of CVS/SVN). Many people still use RANCID to collect information about their routers (me included), which already does all the expect wizardry required. The commands that are run by rancid should be a good starting point.
On the other hand, you could just pull the files that RANCID stores into Splunk (or go all the way and use Splunk as backend instead of CVS/SVN).

]]> By: Mike http://raffy.ch/blog/2008/11/30/cisco-router-forensics/comment-page-1/#comment-14187 Mike Wed, 10 Dec 2008 02:49:30 +0000 http://raffy.ch/blog/2008/11/30/cisco-router-forensics/#comment-14187 I've found expect to be of more trouble than it's worth for most scripts anymore, especially something like this. Assuming that the device has SSH enabled you should be able to run these commands directly without much interactivity (as Expect was designed for.) I’ve found expect to be of more trouble than it’s worth for most scripts anymore, especially something like this. Assuming that the device has SSH enabled you should be able to run these commands directly without much interactivity (as Expect was designed for.)

]]>