Packet Capture in ASA

Answered Question
Mar 20th, 2009
User Badges:

Hi Everybody,


I am trying to configure packet capture in ASA 5520 for troubleshooting. I am in the impression that


1. The captured data is stored in the RAM of the Firewall. Is this correct?


2. If that the case won't the firewall run out of memory for normal traffic if I run the capture of sometime?


3. How to reserve the memory space for packet capture?


Can anybody help me on this?


R.B.Kumar

Correct Answer by JamesLuther about 8 years 4 months ago

Hi,


Check here


http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/c1.html#wp2108895


By default ASA only reserves 512k for capture and stops when it is filled, but you can increase this using the buffer option ie


capture CAP-NAME access-list CAP-ACL interface outside buffer 20000


Or you can use a circular buffer to keep capture running ie


capture CAP-NAME access-list CAP-ACL interface outside buffer 20000 circular-buffer




Regards


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
JamesLuther Fri, 03/20/2009 - 12:11
User Badges:
  • Silver, 250 points or more

Hi,


Check here


http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/c1.html#wp2108895


By default ASA only reserves 512k for capture and stops when it is filled, but you can increase this using the buffer option ie


capture CAP-NAME access-list CAP-ACL interface outside buffer 20000


Or you can use a circular buffer to keep capture running ie


capture CAP-NAME access-list CAP-ACL interface outside buffer 20000 circular-buffer




Regards


Actions

This Discussion