topic FWSM and capture. in Network Security https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551456#M605390 <P>Another question about FWSM with software 4.1(1).</P><P>Using capture, we are able to view the captured packets after a minute, or more, that they hit the interface.</P><P>Why?</P><P></P><P>Regards.</P><P>Andrea</P> Mon, 11 Mar 2019 19:17:08 GMT andrea.meconi 2019-03-11T19:17:08Z FWSM and capture. https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551456#M605390 <P>Another question about FWSM with software 4.1(1).</P><P>Using capture, we are able to view the captured packets after a minute, or more, that they hit the interface.</P><P>Why?</P><P></P><P>Regards.</P><P>Andrea</P> Mon, 11 Mar 2019 19:17:08 GMT https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551456#M605390 andrea.meconi 2019-03-11T19:17:08Z Re: FWSM and capture. https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551457#M605391 <HTML><HEAD></HEAD><BODY><P>Hi Andrea,</P><P></P><P>Do you mean that it takes a minute or so before you see any packets show up in the capture you configured? If so, this is expected when you configure a new ACL to be used with a capture. The capture will not start showing packets until the ACL used to match the traffic is finished compiling.Therefore, the longer it takes for the ACLs to compile, the longer it will be before you start seeing any data in your capture.</P><P></P><P>Hope that helps.</P><P></P><P>-Mike</P></BODY></HTML> Wed, 01 Dec 2010 14:29:52 GMT https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551457#M605391 mirober2 2010-12-01T14:29:52Z Re: FWSM and capture. https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551458#M605392 <HTML><HEAD></HEAD><BODY><P>You are right Mike.<BR />But this happens with an ACL with two entries also?</P><P>Regards.</P><P>Andrea</P></BODY></HTML> Wed, 01 Dec 2010 14:36:41 GMT https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551458#M605392 andrea.meconi 2010-12-01T14:36:41Z Re: FWSM and capture. https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551459#M605393 <HTML><HEAD></HEAD><BODY><P>Hi Andrea,</P><P></P><P>Yes, unfortunately all of the rules need to be recompiled whenever an ACL change is made. Therefore, this is expected behavior if you have a large set of ACLs.</P><P></P><P>-Mike</P></BODY></HTML> Wed, 01 Dec 2010 14:42:12 GMT https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551459#M605393 mirober2 2010-12-01T14:42:12Z Re: FWSM and capture. https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551460#M605394 <HTML><HEAD></HEAD><BODY><P>Many thanks for your help Mike.</P><P>Regards.</P><P>Andrea</P></BODY></HTML> Wed, 01 Dec 2010 14:47:14 GMT https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551460#M605394 andrea.meconi 2010-12-01T14:47:14Z Re: FWSM and capture. https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551461#M605395 <HTML><HEAD></HEAD><BODY><P>Sorry Mike. To be clear, FWSM captures all packets but shows these after some minutes, when session is already closed.</P></BODY></HTML> Wed, 01 Dec 2010 14:56:14 GMT https://community.cisco.com/t5/network-security/fwsm-and-capture/m-p/1551461#M605395 andrea.meconi 2010-12-01T14:56:14Z