Cisco ASA Series CLI Configuration Guide, 9.0

Enables packet capture capabilities for packet sniffing and network fault isolation.

The access-list access_list_name keyword argument pair captures traffic that matches an access list. In multiple context mode, this is only available within a context. The any keyword specifies any IP address instead of a single IP address and mask. The all keyword captures all the packets that the ASA drops. The asp-drop [ drop-code ] keyword argument pair captures packets dropped by the accelerated security path. The drop-code specifies the type of traffic that is dropped by the accelerated security path. See the show asp drop frame command for a list of drop codes. If you do not enter the drop-code argument, then all dropped packets are captured. You can enter this keyword with the packet-length , circular-buffer , and buffer keywords, but not with the interface or ethernet-type keyword. In a cluster, dropped forwarded data packets from one unit to another are also captured. In multiple context mode, when this option is issued in system context, all dropped data packets are captured; when this option is issued in a user context, only dropped data packets that enter from interfaces belonging to the user context are captured. The buffer buf_size keyword argument pair defines the buffer size used to store the packet in bytes. When the byte buffer is full, packet capture stops. When used in a cluster, this is the per-unit size, not the sum of all units. The capture_name argument specifies the name of the packet capture. Use the same name on multiple capture statements to capture multiple types of traffic. When you view the capture configuration using the show capture command, all options are combined on one line. The circular-buffer keyword overwrites the buffer, starting from the beginning, when the buffer is full. The cluster exec keyword is used only in a clustering deployment as a wrapper CLI prefix, can be used with the capture and show capture commands, and enables you to issue the capture command in one unit and run the command in all the other units at the same time. The decrypted keyword enables decrypted TCP data to be encapsulated with L2-L4 headers, then captured by the capture engine. The ethernet-type type keyword argument pair selects an Ethernet type to capture. Supported Ethernet types include 8021Q, ARP, IP, IP6, IPX, LACP, PPPOED, PPPOES, RARP, and VLAN. An exception occurs with the 802.1Q or VLAN type. The 802.1Q tag is automatically skipped and the inner Ethernet type is used for matching. The host ip keyword argument pair specifies the single IP address of the host to which the packet is being sent. The interface interface_name keyword argument pair sets the name of the interface on which to use packet capture. You must configure an interface for any packets to be captured. You can configure multiple interfaces using multiple capture commands with the same name. To capture packets on the dataplane of an ASA, you can use the interface keyword with “asa_dataplane” as the interface name.You can specify “cluster” as the interface name to capture the traffic on the cluster control link interface. The interface names "cluster" and "asa-dataplane" are fixed and not configurable. If the type lacp capture is configured, the interface name is the physical name. The isakmp keyword captures ISAKMP traffic. This is not available in multiple context mode. The ISAKMP subsystem does not have access to the upper layer protocols. The capture is a pseudo capture, with the physical, IP, and UDP layers combined together to satisfy a PCAP parser. The peer addresses are obtained from the SA exchange and are stored in the IP layer. Use the ikev1 or ikev2 keywords to capture only IKEv1 or IKEv2 protocol information. The lacp keyword captures LACP traffic. If configured, the interface name is the physical interface name. The trace , match , and access-list keywords cannot be used together with the lacp keyword.

The mask argument specifes the subnet mask for the IP address. When you specify a network mask, the method is different from the Cisco IOS software access-list command. The ASA uses a network mask (for example, 255.255.255.0 for a Class C mask). The Cisco IOS mask uses wildcard bits (for example, 0.0.0.255). The match prot keyword argument pair specifies the packets that match the five-tuple to allow filtering of those packets to be captured. You can use this keyword up to three times on one line. The operator argument matches the port numbers used by the source or destination. The permitted operators are as follows:

• lt—less than
• gt—greater than
• eq—equal to

The packet-length bytes keyword argument pair sets the maximum number of bytes of each packet to store in the capture buffer. If you set the protocol to tcp or udp, the port keyword specifies the integer or name of a TCP or UDP port. The raw-data keyword captures inbound and outbound packets on one or more interfaces. This setting is the default. The real-time keyword displays the captured packets continuously in real-time. To terminate real-time packet capture, enter Ctrl + c. To permanently remove the capture, use the no form of this command. This option applies only to raw-data and asp-drop captures. This option is not supported when you use the cluster exec capture command. The reinject-hide keyword specifies that no reinjected packets will be captured and applies only in a clustering environment. The tls-proxy keyword captures decrypted inbound and outbound data from TLS proxy on one or more interfaces. The trace trace_count keyword argument pair captures packet trace information, and the number of packets to capture. This option is used with an access list to insert trace packets into the data path to determine whether or not the packet has been processed as expected. The type keyword specifies the type of data captured. The url url keyword argument pair specifies a URL prefix to match for data capture. Use the URL format http:// server / path to capture HTTP traffic to the server. Use https:// server / path to capture HTTPS traffic to the server. The user webvpn-user keyword argument pair specifies a username for a WebVPN capture. The webvpn keyword captures WebVPN data for a specific WebVPN connection.

Note If ACL optimization is configured, you cannot use the access-list command in capture. You can only use the access-group command. An error appears if you try to use the access-list command in this case.