Overview

The capture command allows you to troubleshoot the asa by tracking where traffic is going, and capturing that traffic. 

Create ACL

Capture command needs an ACL to filter on.  To capture traffic in both directions, you would need to enter two lines in the acl.  For example, if you wanted to capture all traffic between hosts 10.50.81.22 and 172.25.0.254 you would create an ACL like such:

if you want to remove all the lines of the ACL and start over, simply use the clear configure command.  "no" only works for a specific line.

Run Capture

Create the capture file with the following command.  note that the first "cap" is the capture name, and the second "cap" is the ACL name, "raw-data" captures all of the packet, and the capture looks only at the "inside" interface of the firewall.



You can confirm that the capture is working or not with the show capture command:  (in this example, either no traffic is being sent, or a filter is blocking it. 


If you want more details, you can look at what is hitting the ACL's:

View Capture

Once the capture is configured, you can view what traffic has been filtered through it. 

Disable Capture:

You can simply "no" out a capture command.  First review the current captures with the show command, and then no out the commands you want shut off.