Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

How to use Wireshark to monitor the inside interface of a cisco ASA or PIX?

Posted on 2011-03-23
6
Medium Priority
?
1,606 Views
Last Modified: 2012-05-11
I've used wireshark to capture network data from a computer/server, but I've never used it to capture traffic on a firewall or router.  Is it possible to use wireshark to capture network traffic on the inside interface of my firewall or router?  Thanks.
0
Comment
Question by:denver218
  • 3
  • 2
6 Comments
 
LVL 3

Expert Comment

by:laughelemental
ID: 35200662
Hello

If you have managed switch you may try to make port mirroring on it. Try to mirror your CISCO port and grab traffic from there. By the way, what model do you have? What switch they are connected to?
0
 
LVL 4

Author Comment

by:denver218
ID: 35201358
I actually have two separate networks on would like to gather stats on.  One has a cisco ASA5510, the outside interface of the ASA Connects to a cisco 3640 Router, and the inside interface of the ASA connects to a cisco 3550 switch.  The second network has a Pix 506E, the outside interface goes to a cisco 2621 Router, and the inside interface goes to a cisco 2950 switch.  Can you show me an example of port mirroring?  Thanks.
0
 
LVL 4

Expert Comment

by:Jerry Mills
ID: 35201598
This will tell you all your options:

http://wiki.wireshark.org/CaptureSetup/Ethernet

0
Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

 
LVL 3

Accepted Solution

by:
laughelemental earned 2000 total points
ID: 35204605
As for your inside PIX506E-have a look at http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic5
And you'll have to connect a computer with wireshark to SPANned port

Also you may try to get extednded cisco statistics via SYSLOG (install kiwi syslogd on your  windows PC) and enable DEBUG level of detalization on your device.
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ap04_:_syslog_Configuration_and_Cisco_Devices
0
 
LVL 4

Author Comment

by:denver218
ID: 35206250
Thanks.  Ok, so let me get this straight.  This inside interface of the Pix connects to a cisco 3550 switch.  All ports on this switch are in VLAN 1.  So would I be correct in adding the below configurations to my switch:  Would doing to capture traffic from all of VLAN1?  Thanks.

c3550(config)#monitor session 1 source vlan1
c3550(config)#monitor session 1 destination interface fastethernet 0/48 (I would connect my laptop with wireshark to this port.)



0
 
LVL 4

Author Closing Comment

by:denver218
ID: 35257130
Thanks
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

885 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question