Home
Security

Cisco ASA Packet Capture

Kerry Cordero·
Security
··1 min read


1. Configure the capture 

capture CAP interface Outside match ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

2. Start the capture

Continue to the next step! The capture is already running. There is no concept of starting or stopping a capture on the ASA.

3. Stop the capture

Continue to the next step! There is no concept of starting or stopping a capture on the ASA.

4. Verify the capture is collecting packets

show capture

Should see packets captured in the output:

capture CAP type raw-data interface Outside [Capturing - 116466 bytes]
  match ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

5. Collect the dump and decode it in the next step.

show capture CAP

Can be used to see a basic decode of the captured packets:

ASA# show capture CAP

10 packets captured

   1: 04:02:37.128792       802.1Q vlan#400 P0 192.168.1.10.22 > 192.168.2.20.49216: P 1147377325:1147377393(68) ack 55550215 win 32768 
   2: 04:02:37.199208       802.1Q vlan#400 P0 192.168.2.20.49216 > 192.168.1.10.22: . ack 1147377273 win 65535 
   3: 04:02:37.199238       802.1Q vlan#400 P0 192.168.2.20.49216 > 192.168.1.10.22: . ack 1147377325 win 65535 
   4: 04:02:37.200047       802.1Q vlan#400 P0 192.168.2.20.49216 > 192.168.1.10.22: . ack 1147377393 win 65535 
   5: 04:02:37.710366       802.1Q vlan#400 P0 192.168.2.20.49216 > 192.168.1.10.22: P 55550215:55550267(52) ack 1147377393 win 65535 
   6: 04:02:37.710442       802.1Q vlan#400 P0 192.168.1.10.22 > 192.168.2.20.49216: . ack 55550267 win 32768 
   7: 04:02:37.710824       802.1Q vlan#400 P0 192.168.1.10.22 > 192.168.2.20.49216: P 1147377393:1147377445(52) ack 55550267 win 32768 
   8: 04:02:37.783864       802.1Q vlan#400 P0 192.168.2.20.49216 > 192.168.1.10.22: . ack 1147377445 win 65535 
   9: 04:02:37.823245       802.1Q vlan#400 P0 192.168.2.20.49216 > 192.168.1.10.22: P 55550267:55550319(52) ack 1147377445 win 65535 
  10: 04:02:37.823306       802.1Q vlan#400 P0 192.168.1.10.22 > 192.168.2.20.49216: . ack 55550319 win 32768

Or collect the full dump and decode it in the Dump Decoder tab above if more detailed analysis is necessary

terminal pager 0
show capture CAP dump

6. Remove the capture and access list (ACL) if necessary:

no capture CAP

Some Notes:
When looking at captures, you may see S’s and P’s:
S = Syn
P = Push

Copyright © 2022 Kerry Cordero