topic Re: Packet Capture from Hell in Network Security

Packet Capture from Hell

Kevin Melton — Mon, 11 Mar 2019 20:32:06 GMT

Forum

I am working at a client site today where we are using some packet captures on the clients ASA to perform some problem resolution.

When I perform a "sho capture" on the ASA, I have this output:

ODEC-ASA# sho capture
capture X type raw-data interface inside interface WAN [Buffer Full - 524245 bytes]
ODEC-ASA#

I need to clear the capture out (best practice) before we configure any new ones. So i issue this command:

ODEC-ASA# no capture x
ERROR: Capture <x> does not exist.
ODEC-ASA#

But when I do a sho capture again, it is still there. I have also tried the following:

ODEC-ASA# no capture x type raw-data interface inside interface WAN
^
ERROR: % Invalid input detected at '^' marker.
ODEC-ASA#

No matter what I try, I still see the capture when I do a sho capture.

***This capture may have been setup in ASDM I am guessing since it had applied it to two interfaces. But I cannot find where in ASDM to shut it down if there is an option to do so.***

Thanks for any recommendations. This is a pain...

Kevin

Re: Packet Capture from Hell

varrao — Wed, 11 May 2011 16:59:33 GMT

Kevin,

Capture names are case sensitive, try the following command

no capture X

what you might be trying is

no capture x

We need to use upper case X.

Let me know if it works,

Varun

Re: Packet Capture from Hell

Kevin Melton — Wed, 11 May 2011 17:37:34 GMT

Varon

That was it. I cant beleive I had to post out for that. I am obviously not firing on all cylinders today.

Thanks for your prompt and accurate response!

Kevin

Re: Packet Capture from Hell

varrao — Wed, 11 May 2011 17:40:48 GMT

Kevin,

Glad it resolved the issue, and nice work, you pasted the exact things that you did, so it helped me nail it down. Don't worry everyone does, happens with me all the time

Thanks,

Varun