capture packets on pix

[lashboy]

hey guys,

I have a remote location with pix 501 and when I do show packets i see lot of traffic hitting inside interface through VPN tunnel and my cpu usage is more than 50% which is bad! how do i see on pix that which machine is generating lot of traffic? who is the top talker? i dont have any switch so that i can spam port or some thing!

do i need access list? and capture? how?

 

[aisdale]

access-list 101 permit ip any any

capture "WORD" access-list 101 interface inside

show capture "WORD"

That’s how you do a capture - that will basically show you everything hitting the pix denied or allowed. Obviously if you know what traffic is going through you can lock it down a bit with the ACL.

safe.

 

[lashboy]

Thanks Man! It worked great!