topic Re: ISE TCP dump - limited filters in Network Access Control

ISE TCP dump - limited filters

Arne Bier — Mon, 09 Apr 2018 03:41:36 GMT

Hello

If I understand the ISE Admin Guide correctly, the ONLY expression that ISE supports is "ip host" ? I have misunderstood 'standard' to mean that ISE supports the standard tcpdump expressions 😞

It would be nice to be able to apply the standard filters - would this be considered a feature request?

Re: ISE TCP dump - limited filters

Greg Gibbs — Tue, 10 Apr 2018 00:53:24 GMT

It looks like this changed at some point (maybe with 2.3?) as I know I have used simple port filters in the past, but for some reason ISE won't take a port filter unless I also specify an 'ip host' filter. If you're trying to filter on a port, you might just include the ISE node IP address as a workaround.

Maybe one of the TME's that monitor the community page can provide some clarification if this is expected behaviour or should be considered a bug.

-Regards,

Greg

Re: ISE TCP dump - limited filters

Arne Bier — Tue, 10 Apr 2018 05:18:15 GMT

nice workaround

Re: ISE TCP dump - limited filters

Greg Gibbs — Tue, 10 Apr 2018 21:28:23 GMT

hslai, do you have any knowledge about or comment on this change of behaviour for the tcpdump filter?

Re: ISE TCP dump - limited filters

hslai — Tue, 10 Apr 2018 21:48:33 GMT

I am guessing it might be due to moving this utility from flash to HTML5.

CSCvd36140 is an enhancement to allow other options and currently internal but I will add an RNE and make it external.

Re: ISE TCP dump - limited filters

Damien Miller — Mon, 01 Jun 2020 18:43:50 GMT

This is unfortunately still a problem in 2.6 and 2.7. I wanted to capture all DHCP traffic via the TCPDump utility, sadly can't.

Re: ISE TCP dump - limited filters

Arne Bier — Tue, 02 Jun 2020 12:46:13 GMT

funny you say that ... today I used the crude tcpdump on the CLI and captured all the output to a text file - I was testing the SMTP and I found what I was looking for. But it did feel a bit 1984'ish ... there's a perfectly good Linux tcpdump just sitting under the covers ... now if only I could get my grubby paws on it ... 🙂

Re: ISE TCP dump - limited filters

Anurag Sharma — Tue, 02 Jun 2020 13:10:01 GMT

You will be pleasantly surprised in the next few months 🙂

Re: ISE TCP dump - limited filters

Damien Miller — Tue, 02 Jun 2020 15:04:55 GMT

Hsing-Tsu made a great suggestion. Because I am pcaping a single node the following worked from the GUI, "ip hose <psn ip> and port 67".

Eddie also suggested the CLI as an alternative, ex. "tech dumptcp 0 | inc "\.22 \>""

The next GUI doesn't have this issue 🙂

Re: ISE TCP dump - limited filters

stayd — Thu, 19 May 2022 10:06:32 GMT

Well ?

In 2022, ISE 2.7 with patch 7 does not still have this repaired.

So workaround with using ip host plus and port still works.

It seems it is BUG and that was not still fixed at all. What do you think now ?

Re: ISE TCP dump - limited filters

Arne Bier — Thu, 19 May 2022 20:23:31 GMT

Don't expect too much to get fixed in ISE 2.7. No matter what version of ISE you're on you're always at the mercy of Cisco making these tools available to you. All the while, the tools that can do the job are already there in Linux, but hidden from us (no access). Prime Infrastructure has root access, so does DNAC. Even a non-root shell would be nice.

Re: ISE TCP dump - limited filters

stayd — Wed, 15 Jun 2022 10:27:01 GMT

Can I expect it in version 3.1 ?