ASP-DROP Packet Capture

Mike Keenan — Tue, 12 Mar 2019 05:07:59 GMT

I ran the following asp-drop packet capture on my ASA 5520 Firewall:

capture asp type asp-drop acl-drop headers-only circular-buffer

I then performed the following show command. I replaced the real IP addresses with different ones so as not to reveal my internal IP addressing scheme:

show capture asp | i 172.18.2

I then got the following returns. I replaced the real IP addresses with different ones so as not to reveal my internal IP addressing scheme:

4: 21:40:47.504459 172.18.5.5.52152 > 172.18.2.65.161: udp 79
9: 21:40:58.174459 172.18.5.5.52152 > 172.18.2.65.161: udp 79
14: 21:41:08.314879 172.18.5.17.52152 > 172.18.2.65.161: udp 79

Why does the destination IP address that ends with .161 (assuming that it is a destination port) also show :udp 79 (also assuming that it is a destination port?

What is the port that it is communicating to? Is it 161 or udp 79?

Hi,The destination ip is 172

Aref Alsouqi — Wed, 26 Nov 2014 00:56:44 GMT

Hi,

The destination ip is 172.18.2.65 and the destination port is 161, the udp 79 is the udp payload lenght. Please check out this link.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/s2.html#wp1391007

Regards,

Aref

topic ASP-DROP Packet Capture in Network Security

ASP-DROP Packet Capture

Hi,The destination ip is 172