Re: Native packet capture using Cisco Gear

Anyone else having issues with capture crashing the firewall. Oddly enough
we only see this when turning the capture off but the pix reboots. Happens
on all models 515E and higher. We have 200 firewalls and I've found no rhyme
or reason for it. We have not tried on 7.0 code



On 9/4/05, Ha, Jason <JHa@verisign.com.au> wrote:
> Sure, you can use the "capture" command.
>
> Issue "capture ?" for Syntax.
>
> The capture is based on an existing ACL that you have configured for a
> particular interface.
>
> So, for example, if I have an ACL grouped to my outside interface called
> "101" and I want to name the capture itself "Outside_Capture", I can
> perform a capture by issuing the command:
>
> capture Outside_Capture access-list 101 outside
>
> You can then view the capture using the command:
>
> show capture Outside_Capture
>
> Alternatively, you can simply use the debug tools (i.e., debug packet
> outside src/dst <ip address> etc).
>
> Not quite as complete as tcpdump, but it's the best you have. >:) Good
> luck.
>
> Peace,
>
> Jason
>
> -----Original Message-----
> From: jim_at_drexel.edu@securityfocus.com
> [mailto:jim_at_drexel.edu@securityfocus.com]
> Sent: Saturday, 3 September 2005 1:18 AM
> To: firewalls@securityfocus.com
> Subject: Native packet capture using Cisco Gear
>
> Is there way to do in-line sniffing / capture using PIX or FWSM, similar
> to how I tcpdump under the Nokia platforms?
> I also have the ability to use IDS blades if required...