Capturing connections on an interface

Introduction link

Capturing (or dumping) means to capture network packets. In this article, we’ll look at how to capture TCP packets that pass through our Cisco device, particularly through a specific interface. Here’s how to proceed.

Creating the access list link

First, create an access list called dumptcp to allow connections from a host to any of our interfaces. You can specify a particular one if you wish:

  access-list dumptcp permit ip host 192.168.0.104 any
  

Then we do the reverse so that the Cisco can respond:

  access-list dumptcp permit ip any host 192.168.0.104
  

Creating the Dump link

Now that we have the ability to see the traffic, we need to create the dump rule that we’ll call dump104, and that we’ll use on the inside interface:

  capture dump104 access-list dumptcp interface inside
  

Now, we verify that our dump is correctly configured:

  $ show capture
capture dump104 access-list dumptcp interface inside
  

Now that everything is set up, we can view the capture:

  $ show capture dump104
14:25:49.653545 192.168.0.77 > 192.168.0.104: icmp: echo request
14:25:50.650952 192.168.0.77 > 192.168.0.104: icmp: echo request
14:25:51.650967 192.168.0.77 > 192.168.0.104: icmp: echo request