topic Re: Capture files on FTD itself in Network Security

Capture files on FTD itself

cpaquet — Fri, 23 Apr 2021 14:27:22 GMT

where are captured files stored on FTD? What is the path to the directory to see them? Once on the directory, could the command file delete xxxx be used to delete them?

I personally think that it's easier to manage capture via the UI, but need to know how to delete those files from CLI.

Thank you.

Re: Capture files on FTD itself

balaji.bandi — Fri, 23 Apr 2021 14:56:10 GMT

Most cases they stored in below folder, you can check

/ngfw/var/common/

Re: Capture files on FTD itself

cpaquet — Fri, 23 Apr 2021 21:10:58 GMT

Hi BB,

see screen capture.

The captured file is not in the path:

/ngfw/var/common/

This screen capture was done on Cisco's dCloud Firepower v1.7 lab, this afternoon. It's a NGFWv v6.7.

Any idea where else I could look? From the expert mode, I can't get a list of the directory with the ls cmd.

Any help would be appreciated.

Thanks.

Re: Capture files on FTD itself

balaji.bandi — Sat, 24 Apr 2021 07:52:43 GMT

if the file was not in this folder, I get on to sudo su (root)

Search for the files using the below command :

find / -name Test4* -print

Re: Capture files on FTD itself

cpaquet — Sat, 24 Apr 2021 20:30:28 GMT

Hi BB,

Thank you so much for you help and patience.

I have attached the result - very long - of the sudo find command. I can't pinpoint to one directory where I could find the capture file would be: besides the numerous process directories, health monitor, etc.

Thanks for your help. Much appreciated.

PS: as I mentioned in my first entyr, if you wish to see for yourself, this example is straigth out of the newest dCloud Firepower lab, v1.7.

Regards,

Re: Capture files on FTD itself

balaji.bandi — Sat, 24 Apr 2021 22:28:31 GMT

you do not have enough rights to fnd the files in the folders,. most of the denied to get access to view what in the folder

you need to get # prompt to run that command not $

Re: Capture files on FTD itself

cpaquet — Tue, 27 Apr 2021 23:16:31 GMT

Thanks BB. Much appreciated.