O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

7.19. Configure a Packet Capture in ScreenOS

Problem

You want to capture and view packets as they traverse the ScreenOS gateway.

Solution

The snoop command enables packet captures on ScreenOS gateways. It captures packets to the debug buffer:

	Internal_fw-> clear dbuf
	Internal_fw-> snoop
	Start Snoop, type ESC or 'snoop off' to stop, continue? [y]/n y
	Internal_fw->
	...<wait for a few seconds to capture the stream>
	Internal_fw-> snoop off
	Snoop off
	Internal_fw->

Discussion

The ScreenOS snoop command is similar to snoop and tcpdump commands in the Unix world. It captures packets as they traverse the firewall, but unlike debug flow basic,it does not show the processing that the ScreenOS gateway performed on them.

Tip

Please note that for high-end, ASIC-based, high-throughput ScreenOS gateways such as the ISG-1000/2000 and the NS5200/5400, the output generated by snoop, just like the debug flow basic output, only displays the initial packets for a given flow until a full session table entry is generated. Once a full session table entry is set up on the high-end platforms, and the subsequent packets for that session flow are pro-cessed directly by the ASIC fast-path, snoop does not capture those pack-ets. On the other hand, the snoop output on the lower-end SSG-5 through SSG-500 Series, and the NS-5GT, NS-25/50, NS-200, and NS-500 Series, shows all of the subsequent packets associated with the session flowing through the ScreenOS gateway.

Once the packets have been captured by running the snoop ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required