topic Re: PIX Traffic Capture in Network Security

PIX Traffic Capture

jameswestley — Fri, 21 Feb 2020 08:40:11 GMT

Is it possible to capture and log all traffic going in and out of our PIX 515E firewall

Re: PIX Traffic Capture

Patrick Laidlaw — Wed, 25 Jan 2006 18:00:49 GMT

Well you could setup a sniffer on the outside and the inside of your network. Use the monitor mode of a cisco switch to copy all traffic to the port your sniffer is plugged into, or use a dumb hub.

Patrick

Re: PIX Traffic Capture

dominic.caron — Wed, 25 Jan 2006 19:08:55 GMT

Yes...

Create an ACL for both the inside and outside interfaces if doing NAT. The inside interface ACL should use the untranslated sourceIP and destination IP. The outside, the translated.

Create capture on both inside and outside interfaces.

capture filename access-list ### interface outside(or inside) packet-lenght 1500.

Copy the file to your pc via TFTP

copy /pcap capture:filename tftp://x.x.x.x/filename.pcap

Open with ethereal

Re: PIX Traffic Capture

flopez — Wed, 25 Jan 2006 21:29:17 GMT

It is possible, but I haven't tried doing the whole network, but I don't see why it would not be possible. here is what the syntax would look like:

access-list capture permit tcp

In english:

access-list capture permit tcp 192.168.100.0 any 192.168.1.0 any

Re: PIX Traffic Capture

srue — Thu, 26 Jan 2006 02:03:36 GMT

any of the above answers are good. it just depends on what you want exactly. real-time monitoring? if so, go with a sniffer, eg ethereal, sniffer pro, etc... and use SPAN on a switch. If u want to capture traffic to look at later, you can use the capture command described previously here (which you can also do with a sniffer). If you just want to log all connections/sessions into and out of the firewall, syslog will do this with the appropriate logging level. you wont be able to 'look inside' the packet with this option though.

Re: PIX Traffic Capture

nleachman — Tue, 31 Jan 2006 19:35:55 GMT

Hi James,

If you only need to continuosly capture the traffic there is a nice method of creating a "rolling" trace with tethereal and tcpdump. It's outlined in the doc for each of the apps; but I've pretty well worked out the cmd line switches. So if you want to save a little time reply to this post or mail me directly and I'll get you what I have.

Regards, Nick