Solved

How to use Wireshark to monitor the inside interface of a cisco ASA or PIX?

Posted on 2011-03-23
6
1,555 Views
Last Modified: 2012-05-11
I've used wireshark to capture network data from a computer/server, but I've never used it to capture traffic on a firewall or router.  Is it possible to use wireshark to capture network traffic on the inside interface of my firewall or router?  Thanks.
0
Comment
Question by:denver218
  • 3
  • 2
6 Comments
 
LVL 3

Expert Comment

by:laughelemental
ID: 35200662
Hello

If you have managed switch you may try to make port mirroring on it. Try to mirror your CISCO port and grab traffic from there. By the way, what model do you have? What switch they are connected to?
0
 
LVL 4

Author Comment

by:denver218
ID: 35201358
I actually have two separate networks on would like to gather stats on.  One has a cisco ASA5510, the outside interface of the ASA Connects to a cisco 3640 Router, and the inside interface of the ASA connects to a cisco 3550 switch.  The second network has a Pix 506E, the outside interface goes to a cisco 2621 Router, and the inside interface goes to a cisco 2950 switch.  Can you show me an example of port mirroring?  Thanks.
0
 
LVL 4

Expert Comment

by:Jerry Mills
ID: 35201598
This will tell you all your options:

http://wiki.wireshark.org/CaptureSetup/Ethernet

0
Superior storage. Superior surveillance.

WD Purple drives are built for 24/7, always-on, high-definition security systems. With support for up to 8 hard drives and 32 cameras, WD Purple drives are optimized for surveillance.

 
LVL 3

Accepted Solution

by:
laughelemental earned 500 total points
ID: 35204605
As for your inside PIX506E-have a look at http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic5
And you'll have to connect a computer with wireshark to SPANned port

Also you may try to get extednded cisco statistics via SYSLOG (install kiwi syslogd on your  windows PC) and enable DEBUG level of detalization on your device.
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ap04_:_syslog_Configuration_and_Cisco_Devices
0
 
LVL 4

Author Comment

by:denver218
ID: 35206250
Thanks.  Ok, so let me get this straight.  This inside interface of the Pix connects to a cisco 3550 switch.  All ports on this switch are in VLAN 1.  So would I be correct in adding the below configurations to my switch:  Would doing to capture traffic from all of VLAN1?  Thanks.

c3550(config)#monitor session 1 source vlan1
c3550(config)#monitor session 1 destination interface fastethernet 0/48 (I would connect my laptop with wireshark to this port.)



0
 
LVL 4

Author Closing Comment

by:denver218
ID: 35257130
Thanks
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

914 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now