The packet capture wizard in ASDM is a great feature of the ASA platform. It allows a network administrator to easily debug an issue and export the capture right to Wireshark from the wizard.
However, as you use this you may notice something. Where are the arp packets? Any time Wireshark is ran from a layer-2 network, arp packets will inevitably be captured. Something I didn’t know is that the ASDM wizard does not capture broadcast packets (at least at the time this was written ASA version 9.4(2) and ASDM 7.6).
Unfortunately Cisco doesn’t really describe this in any of their capture documentation, so if you don’t typically capture through the command line, you’ll never see broadcasts and may wonder what’s wrong.
How can I capture arp broadcasts on my ASA for troubleshooting layer-2 issues?
You have to do this through the ASA command line.
- Log in to the ASA you want to capture/see ARP packets.
- Use the ‘capture’ command with the ethernet-type arp
An example would be:
ASA# capture arp-cap ethernet-type arp interface inside
Where arp-cap is the name of your capture, the ethernet-type filters the capture to only arp packets and the interface picks the interface where you want to see the broadcasts.
You can define a ‘buffer‘ flag if you want, but don’t worry about overloading your ASA, the default is 512kb. The above command is typically what you want.
Now we can execute a show command to see the capture buffer:
ASA# sh cap arp 81 packets captured 1: 13:21:17.283554 arp who-has 192.168.10.1 (cc:3:ca:f8:34:50) tell 192.168.10.21 2: 13:21:17.283630 arp reply 192.168.10.1 is-at cc:3:ca:f8:34:50 3: 13:21:18.600005 arp who-has 10.4.49.190 tell 192.168.10.1 4: 13:21:20.053692 arp who-has 192.168.10.1 (cc:3:ca:f8:34:50) tell 192.168.10.167 5: 13:21:20.053784 arp reply 192.168.10.1 is-at cc:3:ca:f8:34:50 6: 13:21:21.069271 arp who-has 10.4.49.182 tell 10.4.48.25 7: 13:21:21.998391 arp who-has 10.4.49.182 tell 10.4.48.25
We now see who is broadcasting for what, and which hardware address they reside on. Use the detail flag to see more information.
We’ve got what we need, so its time to clean up. It’s very simple:
ASA# no cap arp-cap