Cisco Firewall :: ASA 5505 Using Logging & Packet-capture To Locate Virus Infected PC

Aug 2, 2011

ATT notified my company we have a virus infected pc on one our networks which sits behind a Cisco ASA 5505 running 7.2(4). The set up is a basic inside/outside NAT configuration. They gave us the destination ip address and port which the our pc is contacting.  I have been tasked to track down the infected pc.  I created the following access-list and applied to the inside interface:
 
access-list VIRUS extended permit TCP ANY host x.x.x.x EQ YYYYY log debugging interval 600 access-group VIRUS in interface inside
 
I enable logging to the console whose output did not list the IP address of the infected pc, only the ip address of the DNS servers we were using. I then used the following capture commands to try locate the internal ip address of the infected pc:
 
capture in-cap interface inside access-list VIRUS-CAP buffer 1000000 packet 1522 capture in-cap access-list VIRUS-CAP interface inside
 
Neither step worked and the resulting console output overwhelmed the firewall in a very short period of time. Before attempting this task again, I would like to know if I am going about this the right way or if there is a better methodology?

View 24 Replies


ADVERTISEMENT

Cisco Firewall :: ASA 5505 - Capture AOL Instant Messenger Traffic?

Feb 11, 2013

I have an ASA 5505 and I setup a port with a PC connected to monitor the LAN interface. I see all the traffic from the LAN  going out and traffic coming back in no problem. What I do not see the the AOL Instant Messenger traffic at all. I have WireShark on the PC and I filter for AIM traffic and I see nothing.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 - How To Store Show Capture Word Output

Apr 16, 2011

I have a cisco ASA 5505 . I need to store " show capture 'word' ( where is a variable) output  to syslog server for analyzing packet and port  .

View 2 Replies View Related

Packet Capture In FWSM?

Oct 1, 2012

when performing packet capture in a FWSM
[code]...

View 2 Replies View Related

Cisco Firewall :: ASA 5505 / Failed To Locate Egress Interface For TCP From DMZ

Apr 9, 2013

I have ASA 5505, in routed mode, basic license.I run a web server in DMZ. I can reach Internet from DMZ. Also, the trafic from outside can reach the web server. However, if the web site is requested from within the DMZ, the request will fail, and the firewall log contains the following message:
 
Failed to locate egress interface for TCP from DMZ50: 30.30.30.10/49213 to 170.70.30.114/80 

I don't have DNS, so the request must go to Internet, even the web site is hosted on the server in DMZ.

Here is sample of my config file:

interface Vlan1
nameif inside
security-level 100
ip address 162.160.1.3 255.255.255.0
!
interface Vlan2

[code]....

What can be the reason for requests, originated in DMZ, to fail, and how could it be fixed?

View 1 Replies View Related

Cisco WAN :: Embedded Packet Capture On ASR1000

Oct 30, 2012

I'm trying to use EPC on ASR1001 running IOS-XE 3.4, and it won't work. Configuration commands are accepted by the router, but there are no packets in the capture buffer.In release notes for IOS-XE, in the 2.5 section, there is a statement that EPC is not supported on ASR1k. Is it true also for newer versions of IOS-XR?

View 1 Replies View Related

Cisco WAN :: Embedded Packet Capture On ASR 1001

Feb 5, 2012

I have a need to capture traffic on an ASR 1001 subinterface, but what I have found is that the Embedded Packet Capture feature is not supported on this platform.  Are there any simple alternatives to capture egress traffic on a subinterface or am I SOL?  This is a walk in the park on normal IOS routers...

View 1 Replies View Related

Security / Firewalls :: Which Packet Capture Program To Use

Oct 24, 2011

I have a piece of software that I suspect is sending unwanted data over the internet to some IP address. I'm not an expert in anything related to computer networks, but I figure I could use such software after playing around a little with it.What application could I use that would so the following:

a) capture all the bytes the application is trying to send out so that it seems to the application it is doing it and see the place it was trying to send it

b) after inspecting the data, if it was ok, send the packages to wherever it was supposed to go so that it seems the original application sent.

View 6 Replies View Related

Cisco WAN :: 3945 MPLS L2VPN Packet Capture

Nov 27, 2012

I want to capture packet on gi0/0 of PE1 in  order to show customer that all his traffic is encapsulated and  transmitted by L2VPN (ldp signaling) in his lab.
 
CE1-----------(g0/1)PE1(g0/0)------------PE2-----------CE2
 
PE1 and PE2 are Cisco3945 and L2VPN is working well. I  tried cisco RITE(Router IP Traffic Export Packet Capture) feature, but  the output was not what I expected. I tried both export mode and capture  mode. Only LDP hello message I got, looks like RITE is only interested  in IP packet. Monitor session wasn't effective as well because it is not  a switch.
 
Is there any other way/workaround to capture customer's traffic encapsulated in L2VPN?

What I did on PE1 when I was trying RITE export mode:
ip traffic-export profile test
bidirectional

[Code].....

View 3 Replies View Related

Cisco VPN :: ASA-5520 / Packet Capture At VPN Entry (and Exit)

Oct 20, 2011

I would like to capture packets which are going through an IPSEC tunnel. The packets originate in the appliance (syslog) and are sent to the remote via a VPN. I can see the encapsulated packets going out to the peer and I can see the ISAKMP packets to and from the peer. Because the packets originate within the appliance, they do not appear on any interface to be captured.
 
Is there some way to capture these packets before they are encapsulated?I attempted to capture packets on the asa-dataplane, but they are in a format that I cannot decode, and I cannot put a filter on the capture.
 
Hardware is ASA-5520
Software is version 8.3(2)

View 2 Replies View Related

Cisco Switching/Routing :: C6509-E / What Is Mean That Is Packet Capture?

Apr 1, 2013

I operate between c6509-E, what did you flooding? its just packet capture gi1/3 but  i dont know it and is it attack?also same seq no switch gots it?what is problem?

View 2 Replies View Related

Cisco Application :: How To Capture Packet In Load Balancer CSS11501

Jan 15, 2012

how to capture the incoming and outgoing packets on the balancer?The load balancer is connected in between the customer DCN and cisco switches 2960.The reason of capturing both incoming and outgoing packets on the balancer is to prove to our customer that there is no packet loss issue on the balancer, and it could be some issue on their DCN network.Since it is a production server, I will need to ensure that there is no impact to the incoming and outgoing traffic on the balancer and other networking equipments as well.

View 1 Replies View Related

Protocols / Routing :: How To Capture QOS (Quality Of Service) Filed From IP Packet

Aug 8, 2012

I want to make packet sniffer which capture the IP packet and then extracting QOS filed from it's header

View 1 Replies View Related

Cisco Firewall :: How To Enable DHCPD Logging In ASA 5505

Aug 11, 2011

I have configured dhcpd in an ASA 5505 and every thing is working. I am testing it to give me a warning when the address pool is about to be finished or it is empty. But don't konw how to do it. if I run the "debug dhcpd packet", i get that the address pool is empty.

View 3 Replies View Related

Cisco Switching/Routing :: Port Monitoring On A 2901 For Purpose Of Packet Capture?

Jul 26, 2012

I have always done my port monitoring (SPAN) on Cisco layer 3 switches with no issues. This time I am trying to do this on a Cisco 2901 router:

Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.1(4)M2, RELEASE SOFTWARE (fc1)
System image file is "flash0:c2900-universalk9-mz.SPA.151-4.M2.bin
 
I need to have the source port gig0/0 and destination port gig0/1. There is something about the gig port enumeration (slot/port#) that makes the command rejected. It is self explanatory:
 
#sh ip int brie
Interface                  IP-Address      OK? Method Status                Protocol
Embedded-Service-Engine0/0 unassigned      YES NVRAM  administratively down down   
GigabitEthernet0/0         xxx.xxx.xxx.xxx      YES NVRAM  up                    up     
GigabitEthernet0/1         unassigned      YES NVRAM  up                    up     
Serial0/0/0:0              unassigned      YES unset  up                    up     

[code]....
 
It doesn't matter what slot or port number I use, it is always rejected. The command is rejected for Both destination and source gig interfaces. I tried a wide variety of slot/port numbers. To my best understanding the complete port names are: GigabitEthernet0/0 and GigabitEthernet0/1, so why does it think there has to be another digit after 0/0 or 0/1? Does it have anything to do with the Embedded-Service-Engine0/0 being administratively down?

View 4 Replies View Related

Cisco Firewall :: ASA 5520 - ASDM Logging - Disable Rules Logging

Nov 16, 2011

I'm encountering what I think is an issue on logging system on FW ASA 5520 - Asa Version 8.4(2), ASDM version 6.4(5). When I disabled the logging inside a rule from ASDM, or from console with the "log disable" option inside ACL, If I check in ASDM logging real time window I continue to see all the entry related to disabled rules. This is a correct behaviour about ASA logging ? How I can "hide" the entry related to disabled rules (this is what I need for troubleshooting purposes) ?

View 1 Replies View Related

Cisco VPN :: ASA 5505 - Remote Firewall Does Not Receive Single Packet From Source IP

Jun 3, 2012

I have setup an asa 5505 with multiple sub nets (plus license) and a vpn tunnel (ipsec) between this and an other asa on a second branch office (multiple vlans) . Now I need to route only two vlans from the first site to reach some of the second branch networks
 
let's call them: 1 branch
A-172.16.4.0/24
B-172.16.2.0/24
 
2 branch 
C- 10.10.10.0/24
D- 10.20.10.0/24
E- 10.66.10.0/24
 
the tunnelis ok From A to CDE . but from B to CDE won't come up. pinging is unsuccessful as well as all other traffic. the connection profile is setup to have both A and B as local networks and A and B by the moment share the same access rules configuration.
 
logs show firewall 1 let pass and build connections, without denies, but remote firewall does not receive a single packet from the source ip from network B.

View 2 Replies View Related

Cisco Firewall :: ASA 5505 Not Giving Out DHCP To Clients / Only Discovery Packet?

May 3, 2012

My ASA 5505 has stopped giving out DHCP address to my machines.Everything was working fine and nothing has changed in the network. I've reloaded the firewall and clear all DHCP on the firewall I've even re-entered the cmd on the ASA.
 
I'm able to staticlly assigned address to the clients and all is way. When I do a DHCP debug on the ASA I don't see any events relating to the DHCP service apart from checking for lease expiry.
 
I've also tried to plug a machine straight into the ASA and no result. I finally did a packet capture and I am seeing the client machine sending out a DHCP discover packet and nothing else is responding.
 
My ASA config is:
 
dhcpd address 192.168.3.10-192.168.3.33 inside
dhcpd dns 8.8.4.4 interface inside
dhcpd option 3 ip 192.168.3.1 interface inside
dhcpd enable inside

View 7 Replies View Related

Cisco VPN :: 5505 - Routing Failed To Locate Next Hop For TCP From Internet

Jul 2, 2012

We need to connect from an external computer connected by cisco-vpn-client to one internal server that is behind an ASA 5505 config with Easy VPN. The VPN connection with the client to our 5520 firewall is fine, but when I try to connect to the server on the LAN, FW log says:

Routing failed to locate next hop for TCP from Internet:172.17.1.215/1108 to Lan_Interna:172.33.0.50/3389 
Attached image.

View 22 Replies View Related

Cisco Firewall :: ASA 5520 With 9.0.1 IOS - Capture To Inside Interface Not Supported

Dec 9, 2012

I recently upgraded my 5520 to 9.0.1 IOS.  Today I tried to apply a capture to my inside interface referencing a simple ACL and I get this error.
 
ERROR: Capture doesn't support access-list <capin> containing mixed policies
 
I also created a capture for the outside interface with a similar ACL and it worked just fine.  I can't seem to find anything on the web that gives me a clue to resolving the error above. 

View 7 Replies View Related

Cisco Firewall :: ASA 5510 / 8.0 - Capture Type ASP Drop Entries With No Reason?

Dec 4, 2011

I have a capture set up of type "asp-drop all", and I am capturing certain packets with no indicated ASP drop reason.  See output below (ASA 5510 with 8.0(5)23 code):asa5510-8.0#  show capture, capture ASP type asp-drop all buffer 15000 circular-buffer [Capturing - 14912 bytes]

View 2 Replies View Related

Cisco Firewall :: Routing Failed To Locate Next Hop For UDP 500

Jun 13, 2013

we have a asa that block some ip dresse with this reason ( Drop-reason:(no-adjacency ) No valid  adjacency ) and  when i check the log i found this message for the same blocked ip adresse  when they try to make dmvpn tunnel wyh the hub . Routing failed to locate next hop for UDP from MPLS:10.0.104.53/500 to MPLS:10.5.250.251/500 i inform you that the ip adresse of the hub (10.5.250.251 ) is connected in DMVPN Interface not MPLS ,and tha ASA is configured with na nat-cotrol command .nat is not configured.

View 4 Replies View Related

Networking With A Possibly Infected Computer?

Oct 21, 2011

I was wondering if there is a possibility of getting a trojan from my roommate's computer while using a router. My computer will be the one with the router and the roommate's computer will be the one with the network adapter. He had it fixed supposedly,but there is a possibility that it is not gone.

View 3 Replies View Related

Cisco Firewall :: ASA 5510 / Enabling Firewall To Send Logging Information?

Jun 22, 2011

I have a ASA 5510 firewall with CSC module and Security Plus license for CSC module.Will you tell me how to configure my firewall to send emails to particular mail ID when someone login into the firewall or any virus attacks from outside.

View 6 Replies View Related

Cisco Firewall :: ASA5510 Routing Failed To Locate Next Hop

Jun 14, 2012

I have two interfaces connected to two different subnet -  interface 0/1 = 10.100.1.0/24 , interface0/2 = 10.100.113.0/24 as they are direct connected to the ASA i assume i dont need to add an static route but when i try to ping from one interface to the other (ping inside 10.100.113.1) i get "Routing failed to locate next hop". [code]

View 1 Replies View Related

Virtual Machine - Can Guest OS Become Infected Through Host OS

Jan 5, 2013

VIRTUAL MACHINE ~ Can Guest OS become Infected Through Host OS ?If I setup and use a virtual machine running/containing both a Host OS and a guest OS ... do they remain completely separate entities when operating one or the other?My main concern is Virus related ... if for instance I'm Running Windows 7 as the host and XP as the guest and I get the host OS infected, will the guest XP OS also contract it by default because it is operating on the same disk?

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Failed To Locate Egress Interface?

Jul 22, 2012

having a bit of trouble setting up our 5510.  None of us have ever played with a firewall before.  We've got most of the basics covered.  I was able to get to the outside world to do a software update to the box, but my laptop that sits in the inside can't see the outside.  We only have the default access rules in place at the moment.  Our old ISA firewall rules don't really translate all that well to this new box.

View 2 Replies View Related

Cisco Firewall :: ASA 5510 - Failed To Locate Egress Interface

Mar 9, 2011

I have ASA 5510 with 8.3 version and using multi context. I created a new context ABC and tryed to add routes in the context for the ABC networks it would not work.  There was an error in the log stating, “failed to locate egress interface”.  I changed the metric on the static routes from 1 to 2 and it started working.  Is it normal in a multi context?

View 4 Replies View Related

No Connectivity (wired Or Wireless) After Infected Windows Gen2

Dec 30, 2011

From my company for a new line of work I started. Was "deep frozen" when I got it and was useless to me in that state. Got it thawed and it suddenly wanted to do loads of updates, so I let it. Apparently I was not careful enough & got the "XP antivirus 2012" malware.Eventually conquered that beast and installed avira free.almost immediately avira picked up on the "html/infected win.gen2" malware.I quarantined, deleted, scanned comp. w. avira, rkill, & malwarebytes. all scans came up clean but I now have no connectivity. wired conn. continually tries to acquire network address and w.less has limited or no.Not my router or modem as I have 2 home comps actively cnctd as I type this. Also tried multiple other networks w. same neg. results.After loads of searching and t/s'ing I believe I have found the root of the problem: When I look under "services" I found that "netbios helper", "Network Location Awareness" & "dhcp client" are all not started.

Trying to start them results in failure b/c some "dependencies are marked for deletion". the afore-mentioned 3 things are dependent upon the Netbios over tcpip and tcpip protocol driver. Those drivers are in the system32/drivers folder but I cannot find a "non plug and play" section in the device manager.Yes, I looked under "hidden devices" and I looked in every drop down. I successfully cmd: netsh int ip reset c: esetlog.txt but when I tried to reset winsock I got winsock is not recognized as an internal or external command, operable program or batch file.I have no reboot disk or thumb drive and bios is p/w'ed so I can't wipe the slate clean and start fresh. Is there anything I can do short of giving it to the "IT guy" at work? That's a black hole I'd really like to avoid if possible.

View 3 Replies View Related

Cisco ASA 5505 Simple PAT - Packet-tracer Can't Look At Any External Devices While Running

Sep 16, 2012

here, am used to the RouterSwitch CLI but been asked to set up an ASA 5505 8.4.Quite simply I am trying to at least test out a static PAT from an external source to an internal server in a test environment and no matter whether I set it up as an auto-nat or a twice-nat whenever I run a packet tracer I end up with the same error. This is the packet-tracer I am running-packet-trace input outside tcp 80.80.80.80 3389 10.240.0.10 3389
 
Phase: 5
Type: NAT
Subtype: rpf-check
Result: DROP
Config:nat (inside,outside) source static server publicIP service RDP RDP
Additional Information:
 
[code]....
 
Now I have a couple of questions initially. I have made the presumption that packet-tracer does not look at any external devices while running - as in as long as the ports are up it doesn't matter what is on the end of them for testing purposes? Is there anything I am missing?I have this morning wiped the config and have simply set up the adapters, a default route and twice nat and am not sure why I keep getting the error. I am sure it is something very simple and I'm being a massive donut!

[code]...

View 3 Replies View Related

Cisco Firewall :: ASA5510 Logging Within ASDM

Feb 26, 2012

I'm on the ASDM of a 5510 and the logging with in the ASDM is currently set just right, but when I go into the console via SSH and use "term mon" I don't get this logging showing up. [code] As you can see I have set the ASDM and console to the same level.  Currently in the ASDM I can see a user getting denied access to a device, but in the console view I dont get that, which I woudl like.

View 2 Replies View Related

Cisco Routers :: RV180W Firewall Logging

Dec 4, 2012

I can't seem to satisfy with the RV180W. I've set a firewall block rule for certain traffice lan>wan, and I'd like to view the log.
 
Administratration | Firewall | Firewall Logs, I can select any or all items. Where do I view the log?
 
I can go to Logging | Logging Policies and select everything for the 'default' policy.
 
No matter what, I go to Status | View Logs, and select whatever severity level I want but get little to nothing, and definitely no firewall logging.

View 9 Replies View Related

Cisco Firewall :: IOS Router 2851 Logging

Apr 26, 2011

One of our client has a  Cisco IOS router 2851 with Zone Based Firewalls, enabled.
 
We tried to configure the router to receive the logs and we receive it in the following format:
<189>45: *Apr 11 11:22:14.757: %SYS-5-CONFIG_I: Configured from console by vty0 (10.151.xxx.xxx)<190>46: *Apr 11 11:23:13.109: %FW-6-DROP_PKT: Dropping tcp session 10.151.xxx.xxx:1908 212.58.xxx.xxx:80  due to  RST inside current window with ip ident 0<189>47: *Apr 11 11:38:02: %SYS-5-CONFIG_I: Configured from console by vty0 (10.151.xxx.xxx)<190>48: *Apr 11 11:40:57: %FW-6-DROP_PKT: Dropping tcp session 10.151.xxx.xxx:2062 74.115.xxx.xxx:80 on zone-pair Outbound class CMAP_Inspect_Out due to  Stray Segment with ip ident 0
 
However, we support the following format:
 
<190>3711348: 3711346: Jul 23 15:29:xxx.xxx IST: %FW-6-SESS_AUDIT_TRAIL_START: Start https session: initiator (172.16.14.71:2721) -- responder (132.183.xxx.xxx:443)<190>3711349: 3711347: Jul 23 15:29:59.465 IST: %FW-6-DROP_PKT: Dropping Other session 65.209.xxx.xxx:2721 132.183.106.17:443  due to  RST inside current window with ip ident 49293 tcpflags 0x5014 seq.no 1653005683 ack 1796295020<190>3711350: 3711348: Jul 23 15:30:04.377 IST: %FW-6-SESS_AUDIT_TRAIL: Stop https session: initiator (172.16.xxx.xxx:2721) sent 807 bytes -- responder (132.183.xxx.xxx:443) sent 2062 bytes
 
What are the exact steps required to recieve the above format? If the logging needs to be enabled on Access Lists, need exact commands, from the console config mode?

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved