Packet Capture on SRX

-

Use firewall Filter to capture the packet to a file.

1. Configure forwarding options:
set forwarding-options packet-capture file filename MyCapture size 1000000
set forwarding-options packet-capture maximum-capture-size 1500

 2. Configure firewall filter for packet capture
set firewall filter PCAP term 1 from source-address 192.168.2.88/32
set firewall filter PCAP term 1 from destination-address 192.168.2.182/32
set firewall filter PCAP term 1 from protocol tcp
set firewall filter PCAP term 1 then sample
set firewall filter PCAP term 1 then accept
set firewall filter PCAP term 2 from source-address 192.168.2.182/32
set firewall filter PCAP term 2 from destination-address 192.168.2.88/32
set firewall filter PCAP term 2 from protocol tcp
set firewall filter PCAP term 2 then sample
set firewall filter PCAP term 2 then accept
set firewall filter PCAP term Allow-ALL-Else then accept

 3. Apply firewall fIlter to desired interface then commit it.
set interfaces fe-0/0/0 unit 0 family inet filter input PCAP
set interfaces fe-0/0/0 unit 0 family inet filter output PCAP

 commit

4. Display Capture
> file list /var/tmp | match Mycapture

  jliu@SRX100> start shell
% cd /var/tmp
% ls
MyCapture.fe-0.0.0              gksdchk.log                     policy_status
cleanup-pkgs.log                gres-tp                         rtsdb
dhcpd.core-tarball.0.tgz        install                         sampled.pkts
eedebug_bin_file                krt_gencfg_filter.txt           spu_kmd_init
event_tags.php                  pics                            vi.recover
%
% tcpdump -r MyCapture.fe-0.0.0
Reverse lookup for 192.168.2.182 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use to avoid reverse lookups on IP addresses.
00:59:54.576551  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: S 704758831:704758831(0) win 8192
00:59:54.576669 Out IP 192.168.2.88.telnet > 192.168.2.182.15871: S 3511893291:3511893291(0) ack 704758832 win 65535
00:59:54.576800  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: . ack 1 win 4380
00:59:54.578019  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: P 1:22(21) ack 1 win 4380
00:59:54.578172 Out IP 192.168.2.88.telnet > 192.168.2.182.15871: P 1:16(15) ack 22 win 32839
00:59:54.578265  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: P 22:25(3) ack 16 win 4376
00:59:54.578349  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: P 25:28(3) ack 16 win 4376
00:59:54.578423 Out IP 192.168.2.88.telnet > 192.168.2.182.15871: P 16:28(12) ack 25 win 32848
00:59:54.578510  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: P 28:37(9) ack 28 win 4373
00:59:54.578603 Out IP 192.168.2.88.telnet > 192.168.2.182.15871: P 28:46(18) ack 37 win 32845
00:59:54.578676  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: P 37:54(17) ack 46 win 4368
00:59:54.578761  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: P 54:60(6) ack 46 win 4368
00:59:54.578844  In IP 192.168.2.182.15871 > 192.168.2.88.telnet: P 60:71(11) ack 46 win 4368
00:59:54.578916 Out IP 192.168.2.88.telnet > 192.168.2.182.15871: . ack 60 win 32847
00:59:54.579002 Out IP 192.168.2.88.telnet > 192.168.2.182.15871: P 46:58(12) ack 71 win 32850

5. Remove the capture
rollback 1
commit

 

Use Monitor Traffic for real time capture for packet targets to SRX

monitor traffic interface reth0.0 matching "port ssh"
monitor traffic interface reth0.0 matching "host 192.168.1.1"

Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more