topic Re: ASA Logging Traffic Outbound in Network Security https://community.cisco.com/t5/network-security/asa-logging-traffic-outbound/m-p/1375984#M730587 <HTML><HEAD></HEAD><BODY><P>Create an ACL that will go on the inside interface.</P><P></P><P>access-list extended find_pc permit tcp any any eq 3389 log</P><P>access-list extended find_pc permit ip any any</P><P>access-group find_pc in interface inside</P><P></P><P>This will generate a log message when an RDP packet is sent to the outside. You can view the log with</P><P></P><P>show logging</P><P></P><P>Is this what you're looking for?</P></BODY></HTML> Thu, 11 Feb 2010 19:44:43 GMT Collin Clark 2010-02-11T19:44:43Z ASA Logging Traffic Outbound https://community.cisco.com/t5/network-security/asa-logging-traffic-outbound/m-p/1375983#M730582 <P>Hello,</P><P></P><P>I need to be able to find an errant PC on an internal network that is sending RDP traffic outbound.</P><P>Has anyone any pointers on this ?</P><P></P><P>I need to log port 3389 from inside to outside.</P><P></P><P>Thank you.</P><P>S.</P> Mon, 11 Mar 2019 17:08:05 GMT https://community.cisco.com/t5/network-security/asa-logging-traffic-outbound/m-p/1375983#M730582 stephenwilletts 2019-03-11T17:08:05Z Re: ASA Logging Traffic Outbound https://community.cisco.com/t5/network-security/asa-logging-traffic-outbound/m-p/1375984#M730587 <HTML><HEAD></HEAD><BODY><P>Create an ACL that will go on the inside interface.</P><P></P><P>access-list extended find_pc permit tcp any any eq 3389 log</P><P>access-list extended find_pc permit ip any any</P><P>access-group find_pc in interface inside</P><P></P><P>This will generate a log message when an RDP packet is sent to the outside. You can view the log with</P><P></P><P>show logging</P><P></P><P>Is this what you're looking for?</P></BODY></HTML> Thu, 11 Feb 2010 19:44:43 GMT https://community.cisco.com/t5/network-security/asa-logging-traffic-outbound/m-p/1375984#M730587 Collin Clark 2010-02-11T19:44:43Z Re: ASA Logging Traffic Outbound https://community.cisco.com/t5/network-security/asa-logging-traffic-outbound/m-p/1375985#M730600 <HTML><HEAD></HEAD><BODY><P>SOmething easier</P><P></P><P></P><P>Access-list CAPIN permit tcp host PC-IPADDRESS any eq 3389</P><P>Access-list CAPIN permit tcp any eq 3389 host PC-IPADDRESS</P><P></P><P>Capture CAP access-list CAPIN interface INSIDE</P><P></P><P>Then wait until the PC uses port 3389. and whenever you can do a SHOW CAPTURE CAP</P><P></P><P>Hope it helps</P></BODY></HTML> Thu, 11 Feb 2010 20:39:17 GMT https://community.cisco.com/t5/network-security/asa-logging-traffic-outbound/m-p/1375985#M730600 Diego Armando Cambronero Arias 2010-02-11T20:39:17Z