How to use Wireshark to monitor the inside interface of a cisco ASA or PIX?

I've used wireshark to capture network data from a computer/server, but I've never used it to capture traffic on a firewall or router.  Is it possible to use wireshark to capture network traffic on the inside interface of my firewall or router?  Thanks.
LVL 4
denver218Asked:
Who is Participating?
 
laughelementalConnect With a Mentor Commented:
As for your inside PIX506E-have a look at http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic5
And you'll have to connect a computer with wireshark to SPANned port

Also you may try to get extednded cisco statistics via SYSLOG (install kiwi syslogd on your  windows PC) and enable DEBUG level of detalization on your device.
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ap04_:_syslog_Configuration_and_Cisco_Devices
0
 
laughelementalCommented:
Hello

If you have managed switch you may try to make port mirroring on it. Try to mirror your CISCO port and grab traffic from there. By the way, what model do you have? What switch they are connected to?
0
 
denver218Author Commented:
I actually have two separate networks on would like to gather stats on.  One has a cisco ASA5510, the outside interface of the ASA Connects to a cisco 3640 Router, and the inside interface of the ASA connects to a cisco 3550 switch.  The second network has a Pix 506E, the outside interface goes to a cisco 2621 Router, and the inside interface goes to a cisco 2950 switch.  Can you show me an example of port mirroring?  Thanks.
0
Become a Leader in Data Analytics

Gain the power to turn raw data into better business decisions and outcomes in your industry. Transform your career future by earning your MS in Data Analytics. WGU’s MSDA program curriculum features IT certifications from Oracle and SAS.  

 
Jerry MillsCommented:
This will tell you all your options:

http://wiki.wireshark.org/CaptureSetup/Ethernet

0
 
denver218Author Commented:
Thanks.  Ok, so let me get this straight.  This inside interface of the Pix connects to a cisco 3550 switch.  All ports on this switch are in VLAN 1.  So would I be correct in adding the below configurations to my switch:  Would doing to capture traffic from all of VLAN1?  Thanks.

c3550(config)#monitor session 1 source vlan1
c3550(config)#monitor session 1 destination interface fastethernet 0/48 (I would connect my laptop with wireshark to this port.)



0
 
denver218Author Commented:
Thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.