0

There is a problem with downloading pcap capture from Cisco ASA 5520 from https://<ip_of_asa>/admin/capture/<capture_name>/pcap - an empty file with size 24 bytes is downloaded while https://<ip_of_asa>/admin/capture/<capture_name> (without pcap in url) shows captured packets fine. The problem started when ASA memory usage was at high level. Now it is back to normal but capture download still fails. The capture was removed and a new one created - this didn't help. I've already faced this problem before and in that case it was resolved after ASA restart. In this case ASA reboot is not an option. Is there a way to resolve this issue without reboot?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 9:23
  • This issue was finally resolved after ASA reboot. At the time when the question was asked a reboot was not possible so it not really an answer. But I'll probably have to add that as an answer. – Andrey Grachev Dec 25 '18 at 10:33
  • Please do. We get a lot of questions with no accepted answers popping up all the time. Users complain that we just see the same questions over and over, so I'm trying to clear the backlog of the year. Thanks. – Ron Maupin Dec 25 '18 at 10:35
3

As a workaround, it looks like you can manually copy the capture via CLI to any of the normal destinations: https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/c4.html#wp2144072

This means you should also be able to SCP it off the ASA, if you can't push it to HTTP/FTP/TFTP via the copy command. Here's a good post on using SCP if you haven't before: https://thestupidengineer.wordpress.com/2015/04/01/scp-file-to-asa/

You can download Putty's SCP client if you don't have a 'Nix box to use.

  • Thank you for the answer. While this a valid solution, I can't use it since I don't have console access to ASA. It is possible to ask colleagues to use such method once or twice but capture needs to be downloaded periodically. The only way for me right now is to restore download via https. – Andrey Grachev Sep 2 '18 at 10:00
  • @AndreyGrachev, I don't understand why you think that you must have console access to the ASA. SCP works over the network, and you should be able to telnet or SSH into the ASA. In fact, it is recommended that you actually disable the HTTP and HTTPS servers in your ASA. – Ron Maupin Sep 2 '18 at 15:14
  • @RonMaupin, sorry, under console access I actually meant CLI (telnet or SSH) - don't have any of that. HTTP is currently used because there is some automated processing done by downloading the capture periodically. – Andrey Grachev Sep 2 '18 at 15:29
  • @AndreyGrachev, if you do not have CLI access to the ASA, then I do not understand how you think you can resolve a problem on it. For a question to be on-topic here, you must have direct control. Also, it sounds like your capture/processing is really a kludge. There may be better ways to do what you want. You can set up a logging server, and the ASA can automatically send to it on its own, then you can take data from the server at your leisure. – Ron Maupin Sep 2 '18 at 15:37
  • It sounds like you need to configure NetFlow and have a NetFlow server. You seem to be using the wrong tool for the job. In any case, we would need to see the full (sanitized) ASA configuration. – Ron Maupin Sep 2 '18 at 16:02
0

The issue was resolved after ASA reboot. Not a real answer since the question was about a fix without reboot. Adding it not to leave the question hanging unaccepted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.