cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
909
Views
0
Helpful
1
Replies

Capture Problems on ASA

kerstin-534
Level 1
Level 1

Who knows why the capture command on the asa 8.0 release does capture packets but is not able to display (or export to wireshark) all packets.

The command I use (in several variations)

capture cap1 type raw-data buffer 33554432 interface outside circular-buffer headers-only [Capturing - 17124 bytes]

the command sh capture cap1

simply shows several lines (from some thousands)

Wireshark displays "The capture file appears to have been cut short in the middle of a packet"

1 Reply 1

Panos Kampanakis
Cisco Employee
Cisco Employee

Don't use the "headers-only" and then if you save the capture in pcap Wireshark should be able to open it.

I hope it helps.

PK

Review Cisco Networking products for a $25 gift card