How can I tweak packet captures on my ASA5510??
Posted on 2009-02-10
I have recently installed an ASA 5510 (outside interface on a 10mb leased line) which will host a number of services. At the moment, it is only handling web requests from inside our company.
I have been monitoring the traffic flow on this 10mb line to ascertain how much bandwidth our internet traffic uses and noticed every hour, on the hour there is a sudden rush of inbound and outbound traffic (this happens 24 hours a day at 50 minutes past each hour). Interface monitoring shows the source of the traffic is our Inside network.
To find out what is sending/receiving this data, I set a packet capture up this morning at 7:30 am. This was done by creating the access list (theory: it should capture everything as everything will match that list):
#access-list INSIDE_ACCESS_IN permit ip any any
#access-group INSIDE_ACCESS_IN in interface inside
#capture inside_interface access-list INSIDE_ACCESS_IN interface Inside
At 8am I perofrmed the...
#show capture inside_interface
...command. A sample of the the output is below:
2: 18:15:23.719811 126.96.36.199.80 > 192.168.0.71.4705: P 2675336381:2675336825(444) ack 4112385865 win 64583
3: 18:15:23.719979 188.8.131.52.80 > 192.168.0.71.4705: P 2675336825:2675337006(181) ack 4112385865 win 64583
4: 18:15:33.995218 184.108.40.206.80 > 192.168.0.71.4705: . ack 4112386817 win 65535
5: 18:15:33.998483 220.127.116.11.80 > 192.168.0.71.4705: P 2675337006:2675337450(444) ack 4112386817 win 65535
6: 18:15:33.998666 18.104.22.168.80 > 192.168.0.71.4705: P 2675337450:2675337631(181) ack 4112386817 win 65535
7: 18:15:43.253664 192.168.3.217 > 22.214.171.124: icmp: echo request
All of the capture seemed to span from 18:15 to 18:49. I am bamboozled by this as I only created the access list at 7:30 this morning and applied it at this time. The capture was set to start a couple of minutes later. The time on the ASA is set to the correct time.
So... a couple of questions:
>Am I reading the capture right? This does say "this packet was captured at 18:15"?
>If I am reading the capture right, why does the capture show packets from 18:15 when the capture was only set at 07:30? Does it log everything and show you packets that matched the access lists when you tell it to do so at a later date?
>How can I get a capture to run from 22:00 tonight until 07:00 tomorrow and grab all these mystery flows of data that happen on the hour (I would rather do this on the ASA as opposed to other methods if possible).
>A slightly different line of question: I have set the time on the ASA through the ASDM GUI. I don't really trust the GUI as much as the cmd line. How can I set the time from the cmd line. Searched Cisco.com and couldn't find out (hence I used the ASDM).
Any comments gratefully accepted