PBSPlaza.nl

Recently, I want to sniff a packet stream which was inline with an ASA firewall. Normally I would think on a external sniffer such as ethereal, put it on a mirror port of the firewall port, an sniff the packets. But I found that I can do the same with the capture command in the ASA. Let’s take a quick look how the capture command works and what it is.

In short, these are the steps that I walked through;

1) Create an ACL that will match interesting traffic
2) Define the capture and bind it to an access-list and interface
3) View the capture on the firewall, or copy it off in .pcap format

Here is my situation;

The ACL that you have to make to match traffic, can be made on a interface basis. When you want to use the capture command in a troubleshooting scenario, the best thing you can do is to build a capture for the inside and outside interface, relative to the packet stream. In my situation, I want to sniff a web session of a workstation with IP address 10.1.1.10 to webserver 62.69.184.129. The traffic is PATed to 192.168.10.2 (fictional).

! inside capture ACL
Access-list 100 permit tcp host 10.1.1.10 host 62.69.184.129 eq 80
Access-list 100 permit tcp host 62.69.184.129 eq 80 host 10.1.1.10

! outside capture ACL
Access-list 101 permit tcp host 62.69.184.129 eq 80 host 192.168.10.2
Access-list 101 permit tcp host 192.168.10.2 host 62.69.184.129 eq 80

Now I create the captures for both the inside and outside interface;

capture in access-list 101 interface inside packet-length 1518
capture out access-list 101 interface outside packet-length 1518

Let the client do the session. Then you can copy the results to a tftp server;

copy /pcap capture:out tftp://10.1.1.10/out.pcap
copy /pcap capture:in tftp://10.1.1.10/in.pcap

Finally, you can read the sniffs with wireshark.