Then you can retrieve it using the copy command later.
asa5520-a# copy flash:/capin ?
disk0: Copy to disk0: file system disk1: Copy to disk1: file system flash: Copy to flash: file system ftp: Copy to ftp: file system running-config Update (merge with) current system configuration smb: Copy to smb: file system startup-config Copy to startup configuration system: Copy to system: file system tftp: Copy to tftp: file system asa5520-a# copy flash:/capin
Capture using ASDM
First, access ASA via ASDM and launch "Packet Capture Wizard" from the Wizard menu.
Once it is launched, a brief description of "Packet Capture Wizard" is displayed. Click "Next."
You will then be asked to define what you want to set the ingress interface to.
Follow the instructions to select "inside", which is the inside interface.
In the Packet Match Criteria item, you can narrow down the target traffic using ACL.
In this example, however, nothing is selected and all IP traffic will be covered.
Next, select the egress interface.
Set to "outside."
In the next screen, you can change the maximum size of the capture, and the capture buffer size.
If you are not sure what sort of packets will be received, set the size to the maximum value, 1522 bytes. For buffer size, if it is known that a problem will occur within a relatively limited period of time,
set to a smaller value. If you are not sure when a problem might occur, change the value as needed.
Next, you will be asked whether the configured settings are correct. Press Next to proceed.
Clicking on Start in this screen will run the packet capture on ASA.
To retrieve the packet capture, click Stop and then click "Save captures..."
Set the output format to PCAP and retrieve the capture for both ingress and egress interfaces.
Original Document: Cisco Support Community Japan DOC-12336