Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1611
  • Last Modified:

How to use Wireshark to monitor the inside interface of a cisco ASA or PIX?

I've used wireshark to capture network data from a computer/server, but I've never used it to capture traffic on a firewall or router.  Is it possible to use wireshark to capture network traffic on the inside interface of my firewall or router?  Thanks.
0
denver218
Asked:
denver218
  • 3
  • 2
1 Solution
 
laughelementalCommented:
Hello

If you have managed switch you may try to make port mirroring on it. Try to mirror your CISCO port and grab traffic from there. By the way, what model do you have? What switch they are connected to?
0
 
denver218Author Commented:
I actually have two separate networks on would like to gather stats on.  One has a cisco ASA5510, the outside interface of the ASA Connects to a cisco 3640 Router, and the inside interface of the ASA connects to a cisco 3550 switch.  The second network has a Pix 506E, the outside interface goes to a cisco 2621 Router, and the inside interface goes to a cisco 2950 switch.  Can you show me an example of port mirroring?  Thanks.
0
 
Jerry MillsCommented:
This will tell you all your options:

http://wiki.wireshark.org/CaptureSetup/Ethernet

0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
laughelementalCommented:
As for your inside PIX506E-have a look at http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic5
And you'll have to connect a computer with wireshark to SPANned port

Also you may try to get extednded cisco statistics via SYSLOG (install kiwi syslogd on your  windows PC) and enable DEBUG level of detalization on your device.
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ap04_:_syslog_Configuration_and_Cisco_Devices
0
 
denver218Author Commented:
Thanks.  Ok, so let me get this straight.  This inside interface of the Pix connects to a cisco 3550 switch.  All ports on this switch are in VLAN 1.  So would I be correct in adding the below configurations to my switch:  Would doing to capture traffic from all of VLAN1?  Thanks.

c3550(config)#monitor session 1 source vlan1
c3550(config)#monitor session 1 destination interface fastethernet 0/48 (I would connect my laptop with wireshark to this port.)



0
 
denver218Author Commented:
Thanks
0

Featured Post

Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now