2

how is packet capturing on the ASA firewall different or similar to setting up a syslog server for the capture.

I want to capture interesting traffic on the FW and store them for analysis during troubleshooting, currently the buffer size allows me to log only 3 hours of capture, so, we went ahead and set-up a syslog server, it has a lot of noise and more over i can't see any meaningful information like packet drops and 3 way tcp handshakes.

would sending the captures from the ASA to a tftp server, protects the format a as is shows up on the ASA FW and thus can be more useful ?

Improve this question
2
  • This type of analysis is very diffucult, error prone, and in my opinion in most cases a waste of time (a timesink). I'm sure there is a time and place for it but ... It's usually just too much output to mean anything. Have you thought about a 'NGFW' that has alot of this event correlation logic scripted up for you already, e.g., Firepower for ASA?
    – Ronnie Royston
    Aug 25, 2016 at 3:13
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 15, 2017 at 1:08

2 Answers 2

Reset to default
4

The packet capture feature stores data in pcap format, which can be read by Wireshark and other analysis tools. So, yes, that would probably be more useful for packet analysis than syslog messages.

Improve this answer
2

You could set a port in monitor mode (I.E. set it as a span port) then use an external device to capture and analyse traffic.

extract from Cisco Security Appliance Command Reference, Version 8.0

switchport monitor

For models with a built-in switch, such as the ASA 5505 adaptive security appliance, use the switchport monitor command in interface configuration mode to enable SPAN, also known as switch port monitoring. The port for which you enter this command (called the destination port) receives a copy of every packet transmitted or received on the specified source port. The SPAN feature lets you attach a sniffer to the destination port so you can monitor traffic. You can specify multiple source ports by entering this command multiple times. You can only enable SPAN for one destination port. To disable monitoring of a source port, use the no form of this command.

switchport monitor source_port [tx | rx | both]

no switchport monitor source_port [tx | rx | both] Syntax Description

source_port

Specifies the port you want to monitor. You can specify any Ethernet port as well as the Internal-Data0/1 backplane port that passes traffic between VLAN interfaces. Because the Internal-Data0/1 port is a Gigabit Ethernet port, you might overload the Fast Ethernet destination port with traffic. Monitor the port Internal-Data0/1 with caution.

tx

(Optional) Specifies that only transmitted traffic is monitored.

rx

(Optional) Specifies that only received traffic is monitored.

both

(Optional) Specifies that both transmitted and received traffic is monitored. both is the default. Defaults

The default type of traffic to monitor is both.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.