Wireshark packet capture on ASA 5510

[shivudu1984]

Hi Guys

I would like to analyze the traffic flow on my ASA5510. can i actually monitor the interface on the ASA 5510 (be it inside or outside) using Wireshark without having to create capture access-lists. i use wireshark to monitor my local machine by configuring wireshark to monitor my local interface. can i do that to the firewall (i.e pointing wireshark to monitor ASA's interface directly)

thanks

[cadet alain · Accepted solution]

Hi,

No it's impossible. The only way to do is to capture packet on the ASA and then export the capture as pcap file which you can analyse with

wireshark on your pc

Regards.

Alain.

[shzaman · Accepted solution]

Hi,

Wanted to add something, I am not sure what is real purpose but if the issue is only about capture ACL then starting 7.2(1) you may use 'match' option with 'capture' command to avoid ACL writing. If avoiding ACL is not the real question then you may also use SPAN on switch port at which ASA is connected and see the packets on SPAN destination PC (using wireshark). Pointing PC to directly start showing captures without starting capture on ASA or without capturing traffic from connected device is not possible as mentioned by user 'Alain (cadetalain)'. ASDM also has option for captures.

-Shahid

[jubetz · Accepted solution]

You should consider SPAN or RSPAN on the switch(es) that the ASA connect to.  You could use SPAN to send a copy of all traffic to/from the ASA to your PC and capture it in wireshark.

[shivudu1984]

Thanks guys for your suggestions..