topic Hi White.Yeah... For the in Network Security

Packet capture on outside help

Andy White — Tue, 12 Mar 2019 04:20:51 GMT

Hello,

I have a webserver on the DMZ and I want to capture all source traffic going to it's public IP. I have used the ASDM packet capture before, but can't seem to get this traffic to show up.

My webserver is on (example) 80.170.156.86 (Outside) and translates to 172.32.1.3 (DMZ1)

I did this, but the output is empty.

! outside

! Apply ingress capture on the outside interface.
capture asdm_cap_ingress match udp 0.0.0.0 0.0.0.0 80.170.156.86 255.255.255.255
capture asdm_cap_ingress packet-length 1522 buffer 524288
capture asdm_cap_ingress interface outside

! DMZ1

! Apply egress capture on the DMZ1 interface.
capture asdm_cap_egress match udp 172.32.1.3 255.255.255.255 0.0.0.0 0.0.0.0
capture asdm_cap_egress packet-length 1522 buffer 524288
capture asdm_cap_egress interface DMZ

Any ideas?

Hi, Can you try like this?

nkarthikeyan — Thu, 19 Jun 2014 09:19:21 GMT

Hi,

Can you try like this??

access-list dmz_to_out permit udp host 172.32.1.3 any

capture dmztoout interface dmz1 access-list dmz_to_out buffer 524288 packet-length 1522

You can do vice versa for the inbound towards server

access-list out_to_dmz permit udp any host <80.x.x.x>

capture dmztoout interface outside access-list out_to_dmz buffer 524288 packet-length 1522

Regards

Karthik

I am particularly interested

Andy White — Thu, 19 Jun 2014 09:49:08 GMT

I am particularly interested in what is coming it from the outside interface to this server, is this ingress to the outside interface?.

What public IPs are connecting to this server?

Thanks

Hi White.Yeah... For the

nkarthikeyan — Thu, 19 Jun 2014 10:00:40 GMT

Hi White.

Yeah... For the traffic initiated from outside.... You can try the below one and see.... If this doesn't give the desired result.... we can try with other options....

access-list out_to_dmz permit udp any host <80.x.x.x>

capture dmztoout interface outside access-list out_to_dmz buffer 524288 packet-length 1522

But for this some traffic needs to be going thru for that server.

HTH

Regards

Karthik

Thanks, all working plus I've

Andy White — Thu, 19 Jun 2014 10:18:55 GMT

Thanks, all working plus I've imported into wireshark.

Other than a packet capture to "see what is happeing" do you use "sh conn"?

Hi White, Sh conn will give

nkarthikeyan — Thu, 19 Jun 2014 10:27:34 GMT

Hi White,

Sh conn will give you the connection details along with flags and flow.

Sh local-host to display the network states of the local host....

HTH

Regards

Karthik

Thanks,Do you add any filters

Andy White — Thu, 19 Jun 2014 10:35:37 GMT

Thanks,

Do you add any filters to those commands as there is loads of data showing?