Filter
Top Products
69-20
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 69 Using External Monitoring, Troubleshooting, and Diagnostic Tools
Using the Packet Capture Wizard
–
Network address, including subnet mask, in either the format 10.10.10.0/24 or
10.10.10.0/255.255.255.0.
–
Choose the protocol type to capture from the drop-down list. Available protocol types to capture
are ah, eigrp, esp, gre, icmp, icmp6, igmp, igrp, ip, ipinip, nos, ospf, pcp, pim, snp, tcp, or udp.
If the protocol is ICMP, select the ICMP type from the drop-down list. Available types include
ALL, alternate-address, conversion-error, echo, echo-reply, information-reply,
information-request, mask-reply, mask-request, mobile-redirect, parameter-problem, redirect,
router-advertisement, router-solicitation, source-quench, time-exceeded, timestamp-reply,
timestamp-request, traceroute, or unreachable.
If the protocol is TCP or UDP, specify the source and destination port services. Available
options include the following:
–
To include all services, choose All Services.
–
To indicate specific services, choose an appropriate operator from the drop-down list (=, !=, >,
<, or range) and then select one of the following: aol, bgp, chargen, cifs, citrix-ica, ctiqbe,
daytime, discard, domain, echo, exec, finger, ftp, ftp-data, gopher, h323, hostname, http, https,
ident, imap4, irc, kerberos, klogin, kshell, ldap, ldaps, login, lotusnotes, lpd, netbios-ssn, nfs,
nntp, pcanywhere-data, pim-auto-rp, pop2, pop3, pptp, rsh, rtsp, sip, smtp, sqlnet, ssh, sunrpc,
tacacs, talk, telnet, uucp, whois, or www. The >, <, and range operators function based on the
port number assigned to the selected service.
When using the range operator, a second drop-down list is enabled. Use the two drop-down lists
to select the starting and ending services in the range you want to specify. The service with the
lower corresponding port number should be selected in the first drop-down list, and the service
with higher corresponding port number should be selected in the second drop-down list.
Step 6 Click Next to proceed to the Select egress interface step.
Step 7 Select the egress interface from the drop-down list.
Note You cannot select the same interface as ingress and egress in the same wizard.
Step 8 In the Packet Match Criteria area, do one of the following:
Note The Packet Match Criteria option (Access-list or Packet Parameters) you selected for the ingress
interface will also be used for the egress interface. Also, if you used packet parameters for
matching on the ingress interface, the protocol definition you used will also be used for the
egress interface.
• If you are using an access list to match packets, choose the access list from the drop-down list.
• If you are using packet parameters to match packets, the parameters used for ingress are also used
for egress.
Step 9 Click Next to proceed to the Set buffer parameters step.
Step 10 Specify the buffer parameters by configuring the following fields:
In the Buffer Parameters area, you specify the buffer size and packet size. The buffer size is the
maximum amount of memory that the capture can use to store packets. The packet size is the longest
packet that the capture can hold. We recommend that you use the longest packet size to capture as much
information as possible.