Firepower Threat Defence CLI copy capture: no longer working.

[Garry Cross]

Hi have version 6.6.5.1 running on a 4115 and a 2130.

The copy capture: command is no longer working.

Here is the capture in memory.

> show capture
capture testpc type raw-data interface inside [Buffer Full - 524225 bytes]
match ip host 10.180.122.12 any

This command is not able to get the capture into a file.

copy /pcap capture:
Syntax error: The command is not completed

It does not matter what you type after capture: the command will not complete.

Pressing spacebar at the end of the follow does nothing. 

copy /pcap capture:testpc

On an ASA missing items will be prompted for.

> copy /pcap capture: disk0:

Source capture name []?
?Bad filename
%Error parsing filename (No such device)

On the FTD the prompt does not wait for input, spits out the error messages and back to the prompt.

[Rob Ingram · Accepted solution]

@Garry Cross what about if you login to the diagnostics CLI - "system support diagnostic-cli" and perform the same command?

[Garry Cross]

Thank you Rob. I forgot about that access to the cli.

> system support diagnostic-cli

hostname> enable

Password:
hostname#

hostname# copy /pcap capture:testpc ?

cluster: Copy to cluster: file system
disk0: Copy to disk0: file system
flash: Copy to flash: file system
ftp: Copy to ftp: file system
scp: Copy to scp: file system
smb: Copy to smb: file system
tftp: Copy to tftp: file system
hostname# copy /pcap capture:testpc flash:testpc.pcap

Source capture name [testpc]?

Destination filename [testpc.pcap]?
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1249 packets copied in 0.40 secs