Core issue
This issue is due to the presence of Cisco bug ID CSCeh89701.
Note: The syntax noted in this documentation is for 6.x and earlier codes. The syntax for this option has been changed in 7.x code to copy [/pcap] capture: capture_name tftp://server/path.
Issue the copy capture: capture_name tftp://server/path [pcap] command in order to copy capture information to a remote TFTP server.
Issue the https://securityappliance-ip-address/capture/capture_name[/pcap]
command in order to see the packet capture information with a web browser.
If the pcap optional keyword is specified, a libpcap-format file is
downloaded to the web browser and can be saved with the web browser.
Note: A libcap file can be viewed with TCPDUMP or Ethereal.
Resolution
As a workaround, use the ? option after copy is entered in order to determine the options and syntax. This is an example:
copy ?
/noconfirm Do not prompt for confirmation
/pcap Raw packet capture dump
capture: Copyout capture buffer
flash: Copy from flash: file system
ftp: Copy from ftp: file system
http: Copy from http: file system
https: Copy from https: file system
running-config Copy from current system configuration
startup-config Copy from startup configuration
system: Copy from system: file system
tftp: Copy from tftp: file system
pixfirewall# copy /pcap capture:?
capture:
pixfirewall# copy /pcap capture: ?
WORD Capture buffer name prepended by optional context-name and '/'
This is the correct syntax of the command:
copy [/pcap] capture: capture_name tftp://server/path
Problem Type
Troubleshoot software feature
Product Family
Firewall - PIX 500 series
PIX Software Version
PIX version 7.x
PIX Model
PIX 500 Series Firewall
VPN Tunnel End Points
Any end point
Selected PIX or Router Commands
capture command
Bug ID
Bug ID not listed
