Can't view all captured packets.

[Mariusz Bochen]

Hello,

Is there any command which allows to change number of displayed captured packets?

I have a following capture setup:

capture SFTP_TEST type raw-data access-list SFTP_TEST buffer 200000 interface inside circular-buffer [Capturing - 199102 bytes]

when I issue command show capture SFTP_TEST I get:

1676543 packets captured

1...

2...

and so on

157 packets shown.

So far I have tried:

show capture SFTP_TEST count 10000

same result (only 157 are shown)

same when I try

show capture SFTP_TEST count 10

(always displays magic number 157)

I have a very similar capture setup on another firewall and I can view all packets without any problems.

Any help will be much appreciated.

Regards

Mariusz

[Jouni Forss]

Hi,

I would suggest copying the whole capture to your local computer and open it with Wireshark

copy /pcap capture:SFTP_TEST tftp://x.x.x.x/SFTP_TEST.pcap

Hope this helps

- Jouni

[Jouni Forss · Accepted solution]

Hi,

And also,

I think your capture buffer is too small. Its 200KB and its filled already and the ASA is overwriting the old content because of "circular-buffer". This is why NOT every capture packet is in the capture as the buffer has been configured too small. I generally use the max size thats close to 33,5MB

- Jouni

[Mariusz Bochen]

Hi Jouni,

Thanks for replying.

I though the same, but the confusing bit was different number of packets captured and number of packets displayed.

Looks like the “packet captured” shows total number of packets processed by the defined capture rather than packets in the buffer so it makes sense what you said.

I have reconfigured this with the maximum 33554432 buffer and I’ll post the outcome in few days.

Regards

Mariusz

[Mariusz Bochen]

That worked.

Many thanks!