Cisco Asa Capture for troubleshooting

The following example shows the use of the 'match' argument with packet captures:

ciscoasa# capture in interface inside buffer 1000000

ciscoasa# capture in match ip any host 192.168.1.25

ciscoasa#

ciscoasa# capture out interface outside buffer 1000000

ciscoasa# capture out match ip any host

ciscoasa#

ciscoasa# show capture capture in type raw-data buffer 1000000

interface inside buffer 1000000 interface inside [Capturing - 586 bytes]

match ip any host 192.85.1.3

capture out type raw-data buffer 1000000 interface GAT_outside [Capturing - 300 bytes]

match ip any host 192.85.1.3

ciscoasa/FW#

ciscoasa/FW# show cap in

3 packets captured

1: 12:04:06.482625 192.85.1.3 > 192.168.1.25: icmp: echo request

2: 12:04:06.482915 192.168.1.25 > 192.85.1.3: icmp: echo reply

3: 12:04:07.478216 192.85.1.3 > 192.168.1.25: icmp: echo request

ciscoasa/FW#