topic Replacement for "debug packet <int> src | dst .... in Pix ver7.x? in Network Security

Replacement for "debug packet src | dst .... in Pix ver7.x?

m.surtees — Fri, 21 Feb 2020 09:02:37 GMT

I loved the debug packet cmd in ver 6.3 and used it *every* time there was an issue or a question of whether it was the FW's 'fault' - generally wasn't and I could show traffic hitting the pix on one side, leaving it on another with required NATing or not and often thereby prove by lack of return traffic that the issue was downstream.

Ver 7.x does not have this debug packet cmd ... what can I use in it's place. So far ASA is looking like a backwards step, but only for this reason.

Thanks for any help,

Mike

Re: Replacement for "debug packet src | dst .... in Pix ve

andrew.burns — Thu, 13 Jul 2006 08:12:31 GMT

Hi,

See the capture command in the docs - and as of 7.2 see also the packet-tracer command - should give you all the tools you need.

HTH

Andrew.

Re: Replacement for "debug packet src | dst .... in Pix ve

grant.maynard — Thu, 13 Jul 2006 12:08:17 GMT

Cisco have dropped the debug packet command for PIX from v7, however instead you can use the capture command to set up packet sniffing on the PIX itself. It is best used with an ACL to specify traffic. The basic syntax is:

capture access-list interface

show capture

Re: Replacement for "debug packet src | dst .... in Pix ve

m.surtees — Tue, 18 Jul 2006 14:21:01 GMT

thanks for the info .... I shall go forth and capture (doesn't sound as cool as debug)

Regards,

Mike

Re: Replacement for "debug packet src | dst .... in Pix ve

m.surtees — Tue, 18 Jul 2006 14:21:46 GMT

thanks also for the info

Regards,

Mike