packet capturing

elite2010 — Tue, 12 Mar 2019 07:31:09 GMT

Hi,

I have an issue like everyday for a particular period of time my internet bandwidth getting full. Can i get an insight If i capture the packet from asa and analyze ?.

During packet capturing asa performance will degrade ?

I tried to capture but it stops after around 600 packets .

if i want capture all internet traffic how the command look like ?

Please help

Thanks

Here is the doc that will

Dinesh Moudgil — Mon, 21 Mar 2016 04:24:23 GMT

Here is the doc that will give you insight for how to take packet captures:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html

If you wish to capture packets on ASA for internet traffic for any specific source, the capture will look like
captures capi interface inside match ip host x.x.x.x any

If you wish to see if the internet traffic is getting dropped for any particular host, then you can get the following captures:

cap asp type asp-drop all

show cap asp | in x.x.x.x

where x.x.x.x is the particular source IP.

NOTE:If you are capturing the traffic for many users destined to all the IPs on internet, it may degrade the performance of the ASA. You can use circular buffer option as well to captures the packets.

Moreover, if the issue is pertaining to bandwidth getting full.
Check the output of the following commands to see the status of the resources:

show resource usage
show mem
show cpu
show processes cpu-usage non-zero sorted

Look out for interface errors as well as this issue might be pertaining to bursty traffic as well.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

topic Here is the doc that will in Network Security

packet capturing

Here is the doc that will