Hi,
A basic packet capture configuration for ASA could look something like this
access-list TRAFFIC-CAPTURE permit ip 10.10.10.0 255.255.255.0 any
access-list TRAFFIC-CAPTURE permit ip any 10.10.10.0 255.255.255.0
capture TRAFFIC-CAPTURE type raw-data access-list TRAFFIC-CAPTURE interface inside buffer 33500000 circular-buffer
Where
- TRAFFIC-CAPTURE = Is the ACL that defines the traffic to be captured. The above ACL captures both directions of the traffic when the source is 10.10.10.0/24 and destination is "any" (and vice versa naturally)
- 10.10.10.0/24 = Is an example LAN network located behind "inside" interface (or is the interface network)
- inside = Is the interface from which the capture is taken from
- 33500000 = Is pretty close to the max buffer memory you can have on any ASA firewall for a single capture
- You can make separate capture for each direction and later attach the capture files using wireshark
- circular-buffer = Is the setting that will permit the ASA to overwrite the old captured data when the buffer is full. Capture will keep on working but old data will be overwritten as new data is being captured.
Naturally the above ACL is VERY broad. You can change the capture to only capture one "host" traffic. Or only capture TCP or UDP traffic only. You can limit to some certain destination IP addresses. Just control as you like with the ACL.
To show if traffic is hitting the capture
show capture
To show a specific capture and its contents
show capture
To copy a capture to external TFTP server
- To be later opened with Wireshark for example
copy /pcap capture: tftp://x.x.x.x/.pcap
To remove a capture from ASA
- Also removes the collected data
no capture
Hopefully the above information has been helpfull. Please do rate if it has been and naturally ask more if needed.
- Jouni
