topic How to capture packets to one host that are being dropped using type asp-drop in Network Security

How to capture packets to one host that are being dropped using type asp-drop

jwnetworker — Tue, 20 Aug 2019 02:57:38 GMT

How can I capture all drops to one host that are being dropped using the type asp-drop. I know I can use the keyword all. But this gives an overwhelming capture of packets...

Re: How to capture packets to one host that are being dropped using type asp-drop

#Mat — Tue, 20 Aug 2019 02:55:46 GMT

Hi jwnetworker, try with capture cap1 type asp-drop all match ip host [IP] any

Regards.-

Re: How to capture packets to one host that are being dropped using type asp-drop

jwnetworker — Tue, 20 Aug 2019 02:59:08 GMT

Ah ok gonna try that one out...tomorrow..

Re: How to capture packets to one host that are being dropped using type asp-drop

jwnetworker — Tue, 20 Aug 2019 13:00:53 GMT

Interesting....I'm getting the following when I use that command:

2926: 06:06:03.470480 10.10.30.58.64691 > 172.16.2.5.9000: R 3855413837:3855413837(0) ack 2423687647 win 0
2927: 06:06:03.471807 10.10.30.58.64688 > 172.16.2.5.9000: R 1493989444:1493989444(0) ack 2810197420 win 0
2928: 06:06:03.512455 10.10.30.58.64693 > 172.16.2.5.9000: . ack 1985360394 win 260
2929: 06:06:03.512836 10.10.30.58.64693 > 172.16.2.5.9000: R 1223030952:1223030952(0) ack 1985360394 win 0
2930: 06:06:03.522876 10.10.30.58.64694 > 172.16.2.5.9000: . ack 4177667639 win 260
2931: 06:06:03.522937 10.10.30.58.64694 > 172.16.2.5.9000: R 2607393033:2607393033(0) ack 4177667639 win 0