Solved

How to use Wireshark to monitor the inside interface of a cisco ASA or PIX?

Posted on 2011-03-23
6
1,549 Views
Last Modified: 2012-05-11
I've used wireshark to capture network data from a computer/server, but I've never used it to capture traffic on a firewall or router.  Is it possible to use wireshark to capture network traffic on the inside interface of my firewall or router?  Thanks.
0
Comment
Question by:denver218
  • 3
  • 2
6 Comments
 
LVL 3

Expert Comment

by:laughelemental
Comment Utility
Hello

If you have managed switch you may try to make port mirroring on it. Try to mirror your CISCO port and grab traffic from there. By the way, what model do you have? What switch they are connected to?
0
 
LVL 4

Author Comment

by:denver218
Comment Utility
I actually have two separate networks on would like to gather stats on.  One has a cisco ASA5510, the outside interface of the ASA Connects to a cisco 3640 Router, and the inside interface of the ASA connects to a cisco 3550 switch.  The second network has a Pix 506E, the outside interface goes to a cisco 2621 Router, and the inside interface goes to a cisco 2950 switch.  Can you show me an example of port mirroring?  Thanks.
0
 
LVL 4

Expert Comment

by:Jerry Mills
Comment Utility
This will tell you all your options:

http://wiki.wireshark.org/CaptureSetup/Ethernet

0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 3

Accepted Solution

by:
laughelemental earned 500 total points
Comment Utility
As for your inside PIX506E-have a look at http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#topic5
And you'll have to connect a computer with wireshark to SPANned port

Also you may try to get extednded cisco statistics via SYSLOG (install kiwi syslogd on your  windows PC) and enable DEBUG level of detalization on your device.
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ap04_:_syslog_Configuration_and_Cisco_Devices
0
 
LVL 4

Author Comment

by:denver218
Comment Utility
Thanks.  Ok, so let me get this straight.  This inside interface of the Pix connects to a cisco 3550 switch.  All ports on this switch are in VLAN 1.  So would I be correct in adding the below configurations to my switch:  Would doing to capture traffic from all of VLAN1?  Thanks.

c3550(config)#monitor session 1 source vlan1
c3550(config)#monitor session 1 destination interface fastethernet 0/48 (I would connect my laptop with wireshark to this port.)



0
 
LVL 4

Author Closing Comment

by:denver218
Comment Utility
Thanks
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now