FTD - ASP-DROP - Inspection failure (inspect-fail)

[a12288]

I have increased number of  Inspection failure (inspect-fail) from show asp drop, and would like to capture them for further investigation, and wonder what option should I use after capture my-capture type asp-drop ? Thanks.

Leo

[MHM Cisco World]

show capture usually use after capture, 
and note disable capture after troubleshooting.

can you share show interface of ASA ??

[Peter Koltl]

> capture ASP1-insp type asp-drop inspect-fail
Syntax error: Illegal command line

"ASP Inspection failure" (inspect-fail) category: this particular drop grouping is reported as a summary value in the output of the "show asp drop" command. It aggregates several drop events associated with the inspection phase, and there isn’t a dedicated or direct capture filter (such as "inspect-fail") available for use with the capture command.

[Sheraz.Salim]

capture packets dropped due to inspection failures for further investigation, use the command

> system support diagnostic-cli
capture ASP-DROP type asp-drop inspect-fail

This command creates a capture named "ASP-DROP" that specifically targets packets dropped by the Accelerated Security Path (ASP) due to inspection failures. Once the capture is set up, you can view the collected packets with

show ASP-DROP