08-20-2009 10:30 AM - edited 03-11-2019 09:08 AM
I took some capture files this morning on our ASA appliance. I actually view the packets being captured with the real time command. Once I had what I needed, I ended the capture. I then FTP the trace files to my workstation, opened Wireshark to then point to the files. I keep getting this message when I try to open the files::The file "C:\FTProot\lori_ip" isn't a capture file in a format Wireshark understands. I have tried using both a .pcap and a .cap extension. I am still getting the same error message.
Wireshark is opening other files just fine.
Solved! Go to Solution.
08-21-2009 10:00 AM
Hi Kevin,
Using the capture command, the syntax would look like this:
copy /pcap capture:[context/]
Here is a link to the command reference also:
http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/c4.html#wp2123161
Hope that helps.
-Mike
08-20-2009 01:39 PM
When transferring the capture files, you must be sure to leverage the '/pcap' parameter to copy the file as a valid *.pcap file. You probably downloaded the file as the textual version. You may still be able to glean some information from the file if you open it within a text viewer.
You can also download the files leveraging the following URL:
https://
Here's a helpful link for the packet capture feature:
08-20-2009 01:53 PM
I am still having difficulty "leveraging" with the "/pcap" parameter. Where exactly in the copy command does it belong. I have tried it everywher and the ASA is just not liking it...
08-21-2009 10:00 AM
Hi Kevin,
Using the capture command, the syntax would look like this:
copy /pcap capture:[context/]
Here is a link to the command reference also:
http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/c4.html#wp2123161
Hope that helps.
-Mike
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide