Packet Capture from Hell

[Kevin Melton]

Forum

I am working at a client site today where we are using some packet captures on the clients ASA to perform some problem resolution.

When I perform a "sho capture" on the ASA, I have this output:

ODEC-ASA# sho capture
capture X type raw-data interface inside interface WAN [Buffer Full - 524245 bytes]
ODEC-ASA#

I need to clear the capture out (best practice) before we configure any new ones.  So i issue this command:

ODEC-ASA# no capture x
ERROR: Capture <x> does not exist.
ODEC-ASA#

But when I do a sho capture again, it is still there.  I have also tried the following:

ODEC-ASA# no capture x type raw-data interface inside interface WAN
                                                      ^
ERROR: % Invalid input detected at '^' marker.
ODEC-ASA#

No matter what I try, I still see the capture when I do a sho capture.

***This capture may have been setup in ASDM I am guessing since it had applied it to two interfaces. But I cannot find where in ASDM to shut it down if there is an option to do so.***

Thanks for any recommendations. This is a pain...

Kevin

[varrao · Accepted solution]

Kevin,

Capture names are case sensitive, try the following command

no capture X

what you might be trying is

no capture x

We need to use upper case X.

Let me know if it works,

Varun

[Kevin Melton]

Varon

That was it.  I cant beleive I had to post out for that.  I am obviously not firing on all cylinders today.

Thanks for your prompt and accurate response!

Kevin

[varrao]

Kevin,

Glad it resolved the issue, and nice work, you pasted the exact things that you did, so it helped me nail it down. Don't worry everyone does, happens with me all the time

Thanks,

Varun