PIX Traffic Capture

[jameswestley]

Is it possible to capture and log all traffic going in and out of our PIX 515E firewall

[Patrick Laidlaw]

Well you could setup a sniffer on the outside and the inside of your network. Use the monitor mode of a cisco switch to copy all traffic to the port your sniffer is plugged into, or use a dumb hub.

Patrick

[dominic.caron]

Yes...

Create an ACL for both the inside and outside interfaces if doing NAT. The inside interface ACL should use the untranslated sourceIP and destination IP. The outside, the translated.

Create capture on both inside and outside interfaces.

capture filename access-list ### interface outside(or inside) packet-lenght 1500.

Copy the file to your pc via TFTP

copy /pcap capture:filename tftp://x.x.x.x/filename.pcap

Open with ethereal

[flopez]

It is possible, but I haven't tried doing the whole network, but I don't see why it would not be possible. here is what the syntax would look like:

access-list capture permit tcp

In english:

access-list capture permit tcp 192.168.100.0 any 192.168.1.0 any

[srue]

any of the above answers are good. it just depends on what you want exactly. real-time monitoring? if so, go with a sniffer, eg ethereal, sniffer pro, etc... and use SPAN on a switch. If u want to capture traffic to look at later, you can use the capture command described previously here (which you can also do with a sniffer). If you just want to log all connections/sessions into and out of the firewall, syslog will do this with the appropriate logging level. you wont be able to 'look inside' the packet with this option though.

[nleachman]

Hi James,

If you only need to continuosly capture the traffic there is a nice method of creating a "rolling" trace with tethereal and tcpdump. It's outlined in the doc for each of the apps; but I've pretty well worked out the cmd line switches. So if you want to save a little time reply to this post or mail me directly and I'll get you what I have.

Regards, Nick