07-12-2017 01:54 AM - edited 03-12-2019 02:41 AM
We've been trying to run a packet capture on our FWSM via the ASDM and the capture is not capturing any packets via any of the interfaces.
Have also tried this via the CLI and no luck,
Can anyone help?
PDC-FWSM-01# sh version
FWSM Firewall Version 4.1(15)
Device Manager Version 6.2(3)F
Compiled on Thu 17-Oct-13 08:11 by
PDC-FWSM-01 up 2 years 337 days
failover cluster up 6 years 210 days
Hardware: WS-SVC-FWM-1, 1024 MB RAM, CPU Pentium III 1000 MHz
Flash SMART ATA FLASH DISK @ 0xc321, 20MB
0: Int: GigabitEthernet0 : address is 000b.5f0d.2c00,
1: Int: GigabitEthernet1 : address is 000b.5f0d.2c00,
2: Int: EOBC0 : address is 0000.1400.0000,
The Running Activation Key is not set, using default settings:
07-12-2017 02:03 AM
1. Are you sure the traffic is coming into
2. Can you please share the commands you are using from CLI?
If the packets are not coming in then it is expected that we will not get anything in captures.
You can also run the capture "capture
Here is a document for your reference:-
https://supportforums.cisco.com/document/67346/packet-capture-firewalls-asapixfwsm
Regards
Dinesh Moudgil
P.S. Please rate helpful posts.
07-12-2017 02:27 AM
Hi Dinesh,
1. This is our internal firewall and all the traffic traverses through it. So we definitely know there is traffic.
2. I followed the following guide:
http://www.cisco.com/c/en/us/td/docs/security/fwsm/fwsm32/configuration/guide/fwsm_cfg/troubl_f.html#wp1067860
The guide you have linked looks slightly different, I was hoping to do it via the FSWM ASDM but using the wizard it did not work.
Does the Command "capture asp type asp-drop all" cause a spike in CPU? otherwise, i'll have to run it out of hours
07-12-2017 02:30 AM
It may or may not depending on
Sure, please run it after hours and run "show cap asp" to see if you observe packet drops.
Regards
Dinesh Moudgil
P.S. Please rate helpful posts.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide