Capture on CLI with 'match' keyword not working

[patoberli]

Hi All

I'm running a Cisco ASA with 9.4(3)4 code and have a problem with NFS disconnects with our new NetApp storage. I don't know yet if it's the Linux Server, NetApp or the Firewall in between.

In any case, I see drops caused by the ASA with the ASP reason tcp-not-syn, although I don't see those duplicate packets in a capture (so far).

Anyway, while troubleshooting this, I have tried to capture all asp-drop events, but only between the two affected hosts.

I tried this command:

[code]capture themdrops type asp-drop all match ip host 1.1.36.31 host 2.2.89.27 [/code]

This does capture all asp-drop events, but it completely ignores my match argument. I'm pretty sure I had this problem with a 8.2 release years ago already, but didn't find the time to mention this here. I would need this, as this is our internet firewall which has a LOT of asp-drops (mostly acl-drop) and thus the capture is useless.

Do you also have this issue?

Thanks

Patrick

[Kanwaljeet Singh · Accepted solution]

Hi Patrick,

Looks like you are running into the below issue:

CSCts55011: ASA match parameter in capture type asp-drop doesn't filter.

There has been no fix yet.

CSCsf31461    Capture type asp-drop needs to be filterable by ACL

You can use without match and just  do show capname | inc <ip address> and that should show you the reason.

Hope this helps!

Regards,

Kanwal

Note:Please mark answers if they are helpful.

[Oliver Kaiser · Accepted solution]

You cannot use the all statement in your capture in version 9.4(3). By using all, it will ignore your match statements due to some limitation in the asa code.

A  resolved bug CSCts55011 exists for this issue. You will need 9.6(2) for this to work, but from my tests I have found that match statements did not work correctly so I used an acl to limit the scope, which did the trick

Let me know if this answers your question and mark as helpful. I have seen many forum posts on this issue throughout the years and it is finally fixed ;)

[patoberli]

Ah damn, thanks for finding this bug (and yeah, for me it's a bug because the ?-function clearly states that I can add a match statement).