packet captures in pcap format

Answered Question
May 13th, 2008
User Badges:

Running a packet capture on an ASA 5520 and I'd like to transfer the capture bucket in pcap format to my computer for analysis. I can get an ASCII record of the packets copied over using the "copy" command, however, I'd like to transfer the pcap dump using the "copy" command instead. Does anyone know how to do that transfer?


The documentation states (8.x cmd reference, pg 4-11) that I should be able to get the pcap dump using a browser and the unit's web interface via https, but I think the unit gets confused with WebVPN when I make the transfer attempt.


Thanks,


Tariq

Correct Answer by anthony.king about 8 years 10 months ago

Use the /pcap switch after the copy command. I've had some problems with copying out the outside interface for some reason but if you do a copy /pcap to flash and then copy the file from flash to your pc it should work just fine.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
anthony.king Tue, 05/13/2008 - 06:25
User Badges:

Use the /pcap switch after the copy command. I've had some problems with copying out the outside interface for some reason but if you do a copy /pcap to flash and then copy the file from flash to your pc it should work just fine.


rahmant Tue, 05/13/2008 - 06:29
User Badges:

That did the trick - thanks :)


Wish they'd mentioned that in the docs ...


Tariq

Actions

This Discussion