https://community.cisco.com/t5/network-security/how-to-capture-traffic-in-firepower-8000-series-firewall/m-p/4143517#M1073475 <P>Maybe you should insert "vlan" word at the filter to be able to capture dot1q tagged packets.</P> Sun, 30 Aug 2020 01:35:10 GMT rogerf100 2020-08-30T01:35:10Z https://community.cisco.com/t5/network-security/how-to-capture-traffic-in-firepower-8000-series-firewall/m-p/4090398#M1070413 <P>Hello,</P><P>How to capture-traffic in FirePower 8000 Series Firewall ? Below command does not work. But with system support trace command i verified traffic is moving. Just note that this is L2 Firewall.</P><P>&nbsp;</P><P>&gt; system support capture-traffic</P><P>Please choose domain to capture traffic from:<BR />0 - eth0<BR />1 - Core (Interfaces s4p3, s4p4, s4p1, s4p2, s3p3, s3p4, s3p1, s3p2, s2p3, s2p4, s2p1, s2p2)</P><P>Selection? 1</P><P>WARNING: Running tcpdump can cause performance degradation and lead to packet loss!</P><P>Please specify tcpdump options desired.<BR />(or enter '?' for a list of supported options)<BR />Options: -w cap.pcap -s 1518 -c 5000 host 10.7.22.25<BR />tcpdump: listening on nfe0.1.22:nfe1.1.22:nfe2.1.22:nfe3.1.22, link-type EN10MB (Ethernet), capture size 1518 bytes<BR />^C0 packets captured<BR />0 packets received by filter<BR />0 packets dropped by kernel<BR />NS NFM Errors<BR />Receive Errors: 0<BR />Transmit Errors: 0<BR />Tick Errors: 0</P> Thu, 21 May 2020 22:52:26 GMT https://community.cisco.com/t5/network-security/how-to-capture-traffic-in-firepower-8000-series-firewall/m-p/4090398#M1070413 subrun.jamil 2020-05-21T22:52:26Z https://community.cisco.com/t5/network-security/how-to-capture-traffic-in-firepower-8000-series-firewall/m-p/4143517#M1073475 <P>Maybe you should insert "vlan" word at the filter to be able to capture dot1q tagged packets.</P> Sun, 30 Aug 2020 01:35:10 GMT https://community.cisco.com/t5/network-security/how-to-capture-traffic-in-firepower-8000-series-firewall/m-p/4143517#M1073475 rogerf100 2020-08-30T01:35:10Z https://community.cisco.com/t5/network-security/how-to-capture-traffic-in-firepower-8000-series-firewall/m-p/4143530#M1073478 <P>I'm not positive that feature (capture) is supported on a classic Firepower 8000 series. Every reference I have seen talks about it being used on devices running FTD. It may also be a limitation of L2 inline mode vs. routed mode.</P> Sun, 30 Aug 2020 04:01:38 GMT https://community.cisco.com/t5/network-security/how-to-capture-traffic-in-firepower-8000-series-firewall/m-p/4143530#M1073478 Marvin Rhoads 2020-08-30T04:01:38Z