Cisco PIX 525 Spécifications télécharger pdf (Page 330)

9-28

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Capturing Packets

Replace acl_id with the name of any existing access list, which can limit the capture based on one or

more of the following selection criteria:

• IP protocol type

• Source or destination addresses

• TCP or UDP port

• ICMP type

For information about configuring an access control list, refer to “Controlling Outbound Connectivity”

in Chapter 3, “Controlling Network Access and Use.”

To use the buffer option, replace bytes with the number of bytes you want to assign to the packet capture

buffer, subject to the memory available on the PIX

Firewall. The default buffer size is 512 K. You can

run multiple packet captures on different interfaces concurrently if the PIX

Firewall has sufficient

memory.

To use the ethernet option, replace type with one of the following packet types: ip, arp, rarp, vlan,

802.1Q, ipx, ip6, pppoed, pppoes, or any number in the range from 1 to 65536 (corresponding to the

protocol type specified in the Ethernet packet). When using 802.1Q (VLAN), the 802.1Q tag is

automatically skipped and the inner ethernet-type is used for matching. If you enter ethernet-type 0, all

packet types are captured.

To use the packet-length option, replace bytes with the maximum number of bytes from each packet that

you want copied to the capture buffer. By default, the limit is 68 bytes.

Step 2 To view the contents of the packet capture buffer, enter the following command:

show capture [capture-name][access-list acl_id][count count][detail] [dump]

Replace capture-name with the identifier you assigned to the packet capture. Replace acl_id with the

name of an access control list to restrict the display of the captured packets. Replace count with the

number of packets to display.

The fields included when you use the detail option are listed within square brackets ([]) in Table 9-4.

The dump option displays a hexadecimal display of the packet transported over the data link transport.

Note that Media Access Control (MAC) information is not shown. A dump is also displayed if no

protocol is available.

Use the show capture command without any parameters to display the current runtime configuration for

packet captures.

Step 3 To view a packet capture using a web browser, enter the following command:

https://pix-host/capture/capture-name[/pcap]

Replace pix-host with the IP address or host name of the PIX Firewall where the packet capture

occurred. Replace capture-name with the name of the packet capture you want to view.

The pcap option causes the packet capture to be downloaded to the web browser in libpcap format. After

you save the packet capture from the browser, you can view a libpcap file with tcpdump or other

applications.

1 2 ... 325 326 327 328 329 330 331 332 333 334 335 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 330

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525