Capture Problems on ASA

Unanswered Question
Nov 4th, 2009

Who knows why the capture command on the asa 8.0 release does capture packets but is not able to display (or export to wireshark) all packets.

The command I use (in several variations)

capture cap1 type raw-data buffer 33554432 interface outside circular-buffer headers-only [Capturing - 17124 bytes]

the command sh capture cap1

simply shows several lines (from some thousands)

Wireshark displays "The capture file appears to have been cut short in the middle of a packet"

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Panos Kampanakis Wed, 11/04/2009 - 12:03

Don't use the "headers-only" and then if you save the capture in pcap Wireshark should be able to open it.

I hope it helps.



This Discussion