Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 331)

9-29

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Capturing Packets

Step 4 To copy the contents of the packet capture buffer to a TFTP server, enter the following command:

copy capture:capture-name tftp://location/path [pcap]

Replace capture-name with the name of the packet capture you want to view. Replace location and path

with the host name, path name, and file name of the file where you want to store the captured packets.

Some TFTP servers may require that the file already exists with write permission assigned to “world.”

The pcap option causes the file to be created in libpcap format, which can be viewed with tcpdump or

other applications.

Step 5 To clear the packet capture buffer, enter the following command:

clear capture capture-name

Step 6 To clear the packet capture definition and release the resources allocated for it, enter the following

command:

no capture capture-name

Replace capture-name with the name of the packet capture you want to clear.

Step 7 To stop the packet capture and save the current contents of the packet capture buffer, enter the following

command:

no capture capture-name [interface name]

Replace capture-name with the name of the packet capture you want to stop. When you use the interface

option to identify a specific interface, replace name with the name assigned to the interface.

Step 8 To remove the access list from a running packet capture, enter the following command:

no capture capture-name access-list acl_id

Replace capture-name with the name of the packet capture and replace acl_id with the name of the

access list.

Packet Capture Output Formats

Table 9-4 shows the output formats for packet captures of different protocol types. The decoded output

of the packets is dependent on the protocol of the packet. The output in square brackets is displayed when

you use the capture command with the detail option.

Ta b l e 9-4 Packet Capture Formats

Capture Type Syntax

ICMP packet HH:MM:SS.ms [ether-hdr] ip-source ip-destination: icmp: icmp-type icmp-code

[checksum-failure]

UDP packet HH:MM:SS.ms [ether-hdr] src-addr.src-port dest-addr.dst-port:[checksum-info] udp

payload-len

TCP packet HH:MM:SS.ms [ether-hdr] src-addr.src-port dest-addr.dst-port: tcp-flags

[header-check] [checksum-info] sequence-number ack-number tcp-window

urgent-info tcp-options

1 2 ... 326 327 328 329 330 331 332 333 334 335 336 ... 465 466

Brak uwag

Cisco PIX 525 Dokumentacja Strona 331