Capture Problems on ASA

Unanswered Question
Nov 4th, 2009
User Badges:

Who knows why the capture command on the asa 8.0 release does capture packets but is not able to display (or export to wireshark) all packets.

The command I use (in several variations)

capture cap1 type raw-data buffer 33554432 interface outside circular-buffer headers-only [Capturing - 17124 bytes]

the command sh capture cap1

simply shows several lines (from some thousands)

Wireshark displays "The capture file appears to have been cut short in the middle of a packet"

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Panos Kampanakis Wed, 11/04/2009 - 12:03
User Badges:
  • Cisco Employee,

Don't use the "headers-only" and then if you save the capture in pcap Wireshark should be able to open it.

I hope it helps.



This Discussion