Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

LOG DETAIL IN PIX

how to trace a particluar ip which is hitting the pix nating ip quite frequently,how to use the log in formation,with date,

  • VPN
15 REPLIES
Silver

Re: LOG DETAIL IN PIX

The best way to trace a particular IP is throught the use of the capture statement... First, you define an ACL to look for the specific traffic you are interested in. Then, you assign your ACL to a cap and applyt he capture to the interface you want. Here is an example:

access-list cap extended permit ip host 1.1.1.1 host 2.2.2.2

capture cap access-list cap interface outside

New Member

Re: LOG DETAIL IN PIX

Thanks for the reply.

my nat ip is 41.x.x.x assigned to the internal 172.x.x.x.now i need to capture the 172.x.x.x series traffic.now give the config for the acl and config of the interface.what's the command to see the output

Silver

Re: LOG DETAIL IN PIX

What is the destination of the traffic? Are you interested in inbound or outbound traffic or both?

New Member

Re: LOG DETAIL IN PIX

hi walker,

The destination of the traffic is to the internal router.

interested in both.we are using this pix only for nating,asa5510.

Silver

Re: LOG DETAIL IN PIX

Here you go...

access-list cap1 extended permit ip any host 41.1.1.1(router's public IP)

access-list cap1 extended permit ip host 41.1.1.1 any

access-list cap2 extended permit ip any host 172.16.1.1 (router's internal IP)

access-list cap2 extended permit ip host 172.16.1.1 any

capture cap1 access-list cap1 interface outside

capture cap2 access-list cap2 interface inside

To see captures..

show capture cap1

show capture cap2

********* PLEASE RATE***************

Cheers

Jay

New Member

Re: LOG DETAIL IN PIX

thanks, i am able to capture the outside traffic whereas inside,it says no packets captured....

Silver

Re: LOG DETAIL IN PIX

Then either your traffic is not getting through the firewall.... Or you didn't make the access list correctly. Or you didn't apply the access list to the inside with the capture command.

Check those 3 things.

New Member

Re: LOG DETAIL IN PIX

thanks ,i am able to capture on both.i need to capture the complete traffic both inside &outside interfaces and store in to an ftp directory,how to do it??

now its getting only 958 packets,if i need to capture for a day continous.how to go about that????

Silver

Re: LOG DETAIL IN PIX

You can download the captures in a format viewable with Ethereal. Here is how you do it..

1. Open Internet Explorer

2. Browse to https:///capture/cin/pcap

3. Save file

4. Open using Ethereal.

You can capture as much as you want..

As always.. Please rate!!

Thanks

Jay

119
Views
2
Helpful
15
Replies
This widget could not be displayed.