topic Re: Firepower CLI: Capture vs. Capture-Traffic in Network Security

Firepower CLI: Capture vs. Capture-Traffic

cpaquet — Thu, 03 Sep 2020 00:48:26 GMT

Would someone help me understand the difference of: > capture and > capture-traffic. When would I use one over the other?

The only differences I see are:

1. capture focuses on one interface

2. capture-traffic can be much more verbose, and has dozens of options to augment the granularity of information.

Anything else? Am I missing something?

Thanks.

Cath.

Re: Firepower CLI: Capture vs. Capture-Traffic

Marvin Rhoads — Thu, 03 Sep 2020 03:53:37 GMT

The commands differentiate between a LINA (ASA subsystem) type capture at the ingress or egress interface vs a Snort capture which happens after the packets are passed to the Snort subsystem via the DAQ.

Re: Firepower CLI: Capture vs. Capture-Traffic

cpaquet — Thu, 03 Sep 2020 21:28:22 GMT

Wow. Outstanding explanation Marvin. Could you become the Writer-in-Chief of the Command Reference Guide for Firepower? 😉