01-21-2011 01:06 PM - edited 03-11-2019 12:38 PM
Hi Guys
I would like to analyze the traffic flow on my ASA5510. can i actually monitor the interface on the ASA 5510 (be it inside or outside) using Wireshark without having to create capture access-lists. i use wireshark to monitor my local machine by configuring wireshark to monitor my local interface. can i do that to the firewall (i.e pointing wireshark to monitor ASA's interface directly)
thanks
Solved! Go to Solution.
01-21-2011 02:44 PM
Hi,
No it's impossible. The only way to do is to capture packet on the ASA and then export the capture as pcap file which you can analyse with
wireshark on your pc
Regards.
Alain.
01-21-2011 11:03 PM
Hi,
Wanted to add something, I am not sure what is real purpose but if the issue is only about capture ACL then starting 7.2(1) you may use 'match' option with 'capture' command to avoid ACL writing. If avoiding ACL is not the real question then you may also use SPAN on switch port at which ASA is connected and see the packets on SPAN destination PC (using wireshark). Pointing PC to directly start showing captures without starting capture on ASA or without capturing traffic from connected device is not possible as mentioned by user 'Alain (cadetalain)'. ASDM also has option for captures.
-Shahid
01-22-2011 11:29 AM
You should consider SPAN or RSPAN on the switch(es) that the ASA connect to. You could use SPAN to send a copy of all traffic to/from the ASA to your PC and capture it in wireshark.
01-21-2011 02:44 PM
Hi,
No it's impossible. The only way to do is to capture packet on the ASA and then export the capture as pcap file which you can analyse with
wireshark on your pc
Regards.
Alain.
01-21-2011 11:03 PM
Hi,
Wanted to add something, I am not sure what is real purpose but if the issue is only about capture ACL then starting 7.2(1) you may use 'match' option with 'capture' command to avoid ACL writing. If avoiding ACL is not the real question then you may also use SPAN on switch port at which ASA is connected and see the packets on SPAN destination PC (using wireshark). Pointing PC to directly start showing captures without starting capture on ASA or without capturing traffic from connected device is not possible as mentioned by user 'Alain (cadetalain)'. ASDM also has option for captures.
-Shahid
01-22-2011 11:29 AM
You should consider SPAN or RSPAN on the switch(es) that the ASA connect to. You could use SPAN to send a copy of all traffic to/from the ASA to your PC and capture it in wireshark.
01-22-2011 06:46 PM
Thanks guys for your suggestions..
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide