Watching Data Pass Through a Firewall
Sometimes you might want to know what sort of traffic has passed through a firewall to reach a certain host. At other times, you might need to troubleshoot why traffic is not being forwarded through the firewall. In this case, you would want to verify that packets arrived on one firewall interface but did not go out another interface.
You can use two methods to watch or verify that packets have passed through a firewall:
• Capture session— Packets passing through an interface and matching given conditions are captured in a buffer and can be displayed later.
• Debug packet— Packets matching conditions defined in a debug command are reported as they pass through the firewall.
Note
Beginning with ASA 7.0(1), the debug packet method is no longer supported.
These methods require different configuration steps, and each affects the firewall resources in different ways. Table 11-11 compares the capture and debug packet methods.
|
Table 11-11. Verifying That Packets Have Passed Through a Firewall: Capture Session Versus Debug Packet |
|
|
Capture Session |
Debug Packet |
|
Packets (or portions of packets) are captured and stored in a memory buffer. |
Packets are reported but not captured. Reports are sent to the active debug trace channel (Telnet, SSH, or console). |
|
Captured packets are displayed later. |
Packet reports are displayed in real time. |
|
Packets are identified for capture by an interface, an EtherType, or an access list. |
Packets are identified for debugging by parameters in the debug packet command. |
|
Many capture sessions can be configured and enabled. |
Only one debug packet session can be configured at a time. |
|
Capture Session |
Debug Packet |
|
A capture session is bound to a firewall interface. Only packets passing through that interface can be captured. |
A debug packet session reports on matching packets as they are inspected and moved through a firewall interface. |
|
Capture sessions do not adversely affect firewall CPU resources. |
A debug packet session can be very taxing on the firewall CPU and packet throughput. |
|
By default, each capture session uses a 512KB buffer in the firewall memory. |
A debug packet session does not require a block of firewall memory. |
Post a comment