topic FWSM ASP Drop Captures in Network Security

FWSM ASP Drop Captures

Antonio Knox — Tue, 12 Mar 2019 02:02:10 GMT

Can anyone explain to me why it is that when I run a capture that I don't see any ip addresses in the capture output? Here's what I'm seeing:

FWSM# sh cap dropcap

761 packets seen, 761 packets captured

1: 11:26:45.370601 802.1Q vlan#322 P0 fe80::e5a9:75e9:3da:2187.546 > ff02::1:2.547: udp 111 [hlim 1]

2: 11:26:47.540041 802.1Q vlan#321 P0 fe80::5c3b:a488:b25f:76cf.546 > ff02::1:2.547: udp 112 [hlim 1]

.......

Does the FWSM captures default to IPv6 or something? I expect to see solicitations and such, but I know I'm dropping IPv4 packets as well, but I don't see any here.

FWSM ASP Drop Captures

Antonio Knox — Wed, 26 Jun 2013 17:36:23 GMT

Never mind. Figured it out.

FWSM ASP Drop Captures

Julio Carvajal — Thu, 27 Jun 2013 05:04:04 GMT

Hello Antonio,

Those addresses are from IPv6 (Link-local addresses communicating to a Multicast address)

Can you share to the community what you find out so people with the same query than you can learn from this,

Also mark the question as answered as you already figure it out

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.