packet capture on cisco ASA firewall with trace

Good capture option here for ASA

You can do a show trace on it and it goes though it like a packet tracer

capture capout2 type raw-data trace detail interface OUTSIDE include-decrypted match ip host 192.168.10.50 host 8.8.4.4

show capture capout2 trace detail packet-number 1

tracing latency with wireshark

Run you capture, run your test

Open the capture, click on a packet.

right click on TCP in the bottom pane
-> protocol preferences -> calculate conversation timestamps

timestamps appears under TCP
right click -> Apply as column

sort highest number on top. Value is in seconds 1.0 is one second
0.02 is 2 ms.

FIN ACKs can be ignored as they are just closing connections

setting up packet captures on the cisco ASA

cap capin interface inside match ip host 192.168.1.50 host 200.100.100.100 circular-buffer

This will capture data in both directions
circular buffer means it will overwrite when buffer is full
Otherwise it will fill up and stop capturing
You can use clear cap capin to clear out the data

Will capture all the drops of any type
capture asp-drop type asp-drop all
sh cap asp-drop

You can also look in sh asp drop to see if they are increasing

The capture file can be saved and copied off the ASA:

https://100.100.100.200/capture/my-cap-name/pcap

To save the capture file
copy /pcap capture: disk0:

Copy the file off with CLI or ASDM file transfer.

There is also a way to connect ASDM directly to wireshark.

packet capture on ASA

access-list CAP_OUT_ACL extended permit tcp host 172.20.178.12 host 172.20.188.12 eq 443
access-list CAP_IN_ACL extended permit tcp host 172.20.188.12 host 172.20.178.12 eq 443
capture CAP_OUT interface WAN access-list CAP_OUT_ACL
capture CAP_IN interface WAN access-list CAP_IN_ACL

clear capture CAP_OUT
clear capture CAP_IN

sh capture
sh capture CAP_OUT