CCNP Security FIREWALL 642-618 Official Cert Guide (2012)

Using Packet Capture

To gain visibility into the traffic that is entering or exiting an ASA, you could use an external network protocol analyzer or packet sniffer—provided that it is connected to a network switch that can mirror traffic to it. A more convenient approach is to use the packet capture feature that is integrated into the ASA.

You can use the packet capture feature to collect a copy of packets as they enter and exit ASA interfaces. You can define one or more capture sessions on an ASA, each operating independently. Captured packets are stored in a memory buffer and can be viewed much like a protocol analyzer or sniffer trace. You can also copy the buffer contents onto an external device for viewing and analysis.

Using the Packet Capture Wizard in ASDM

You can also set up a packet capture in ASDM by using the Packet Capture Wizard. The wizard configures capture sessions that are identical to the capture command in the CLI, except that a GUI front end is used instead.

The Packet Capture Wizard sets up two separate capture sessions: one on an ingress interface and one on an egress interface. Each session captures traffic in both directions, collecting packets as they enter and exit the ASA.

To use the ASDM Packet Capture Wizard, choose Wizards > Packet Capture Wizard. A window describing the five steps of the wizard will appear, as shown in Figure 16-3. Click the Next button.

Figure 16-3. Initiating the Packet Capture Wizard in ASDM

Enter the ingress interface traffic information, as shown in Figure 16-4. This includes the ingress interface (inside in the example), source and destination addresses and subnet masks, and the protocol. In the example, all IP traffic will be captured. Click the Next button.

Figure 16-4. Configuring the Ingress Interface Capture Session

Enter the egress interface traffic information, as shown in Figure 16-5. This includes the egress interface (outside in the example) and the source and destination addresses and subnet masks. In the example, all IP traffic will be captured. Click the Next button.

Figure 16-5. Configuring the Egress Interface Capture Session

Enter the capture buffer parameters, as shown in Figure 16-6. The maximum packet size (1522 in the example) and capture buffer size (524,288 bytes in the example) are given here. Check the Use Circular Buffer check box if you want the capture to use a circular buffer. By default, the capture will stop when the buffer is full. By default, you will manually tell the Packet Capture Wizard when to collect the capture buffer contents. Otherwise, you can check the Get Capture Every 10 Seconds check box to automatically fetch the buffers at regular intervals. Click the Nextbutton to continue.

Figure 16-6. Configuring Capture and Buffer Parameters

A summary window will display, as shown in Figure 16-7. The summary shows all the CLI commands that ASDM will add to the ASA configuration to build the two packet capture sessions. Click the Next button to continue.

Figure 16-7. Reviewing the Capture Session Commands

Start the captures by clicking the Start button. If you have configured the capture to fetch the buffer contents every 10 seconds, packet headers will be shown in the Run Captures window automatically. Otherwise, the window will remain mostly empty while the capture is running; to see the capture buffer contents, click the Get Capture Buffer button, as shown in Figure 16-8.

Figure 16-8. Displaying Capture Buffer Contents

The capture buffer for the ingress interface capture session is shown in the topmost box, while the egress interface session is shown in the bottom box.

You can save the capture buffers on your local PC by clicking the Save Captures button. Select ASCII to save the capture in plaintext, or PCAP to save it in a standard format that a network analyzer like Wireshark or OmniPeek can decode. Click Save Ingress Capture or Save Egress Capture to begin saving the capture buffer to a file on your local machine.

You can also load the capture directly into a network analyzer application by clicking the Launch Network Sniffer Application button. You should have a PCAP-compliant network analyzer application installed on your local machine. If you have problems getting ASDM to find the application, go to Tools > Preferences, and choose the location of the application’s startup file in the Network Sniffer Application box.

Capturing Packets from the CLI

While ASDM presents a streamlined approach to configuring a packet capture, you can use the CLI instead for more versatile control.

Begin by defining an access list that will be used to identify the traffic to be captured. You can set up a capture session that doesn’t use an access list at all, but it will capture all traffic passing through. The access list is used to flag packets for capture—not to permit or deny them from passing through the interface. Therefore, only the permit keyword is useful here. An implicit deny statement is at the end of the access list, which causes all other traffic to pass without being captured.

If you need to specify IP addresses or port numbers, you should use values that are relevant to any NAT or PAT configured on the ASA. For example, a capture session can monitor inbound traffic on an interface before NAT is performed, and it can monitor outbound traffic after NAT is performed.

Next, use the following command to define a capture session:

ciscoasa# capture session_name [interface {int_name | asa_dataplane | cplane}
[parameters]

By default, all packets moving through all ASA interfaces are captured. You should try to narrow the scope of the captured packets as much as possible so that only packets of interest are captured. You can specify the ASA interface name where the capture should take place.

If you need to capture packets that are passing internally between the ASA and an integrated security module, you can use the asa_dataplane keyword to capture data packets or the cplane keyword to capture control plane packets, respectively.

You can specify additional parameters, as listed in Table 16-2, to make the capture session more specific.

Table 16-2. Capture Session Parameters for the capture session_name Command

As an example, suppose you want to capture all packets that involve HTTPS connections with inside host 192.168.1.199, as they are seen on the outside ASA interface. Example 16-7 shows the configuration commands that can be used to define the capture access list and to define the capture session. Notice that the access list has two parts: one line permits HTTPS packets destined toward the server, and another line permits HTTPS packets coming from the server. In this way, the ASA will capture bidirectional traffic at the outside interface.

Example 16-7. Commands Used to Configure a Capture Session