Capturing traffic on ASA firewall with CAPTURE command is easy but capturing specific traffic between two host play’s an important role during production hours and if we have too many host on the network. Lets practice one such case.
Study Case : PC [ 10.1.1.1 ] shown above diagram is able to communicate with the server1- 64.1.1.2 but not with Server2 – 64.1.1.3. Ping from PC1 to server 64.1.1.3 fails. Configuration looks correct on ASA for both outside and inside interface.We also dont have access to any device outside interface of ASA to check their end configuration.
PC#ping 64.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 64.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/24/32 ms
PC#ping 64.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 64.1.1.3, timeout is 2 seconds: …..
Success rate is 0 percent (0/5)
PC#sho arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.1.1.1 – c202.071e.0000 ARPA FastEthernet0/0
Internet 10.1.1.50 2 0c9f.4449.6703 ARPA FastEthernet0/0
PC#
Once the above step is done, the next thing you do here to check the connectivity between server2 and ASA outside interface. We can see below layer 3 pings fails and also we can see we dont have arp entry in the ARP table of ASA for 64.1.1.3
ASAv# ping 64.1.1.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 64.1.1.3, timeout is 2 seconds: ?????
Success rate is 0 percent (0/5)
ASAv#
ASAv# sho arp
outside 64.1.1.2 c201.070d.0000 17
man 1.1.1.2 c203.09b2.0000 107
ASAv# sho arp | in 64.1.1.3
ASAv#
The ARP table shown on ASA [ version 9.9 ]above is little bit confusing as we are not quickly sure whether ( On cisco IOS router you will at-least see incomplete which tells we have tried sending ARP request but it is incomplete) ASA outside interface sent any ARP request packet to the server 2 or not. We cannot just run debug command in production to check this and it is also not efficient way to capture all ARP traffic in and out so lets see now how can we filter specific traffic. i am going to capture arp request and arp reply from ASA outside interface [ 64.1.1.50 ] to 64.1.1.3. The syntax is below.
ARP Request
capture < filename > interface < your connected interface > ethernet-type < protocol : arp here > match mac< source_mask> any
in our case :
capture arp1req interface outside ethernet-type arp match mac 0c9f.4449.6702 ffff.ffff.ffff any
FFFF is a hex value to match the exact address.just like 255 in the IP subnet mask address field in the Layer 3 address. This value plays an important role to capture specific layer 2 traffic with the mac address.
ARP reply
capture < filename > interface < your connected interface > ethernet-type < protocol : arp here > match mac< source_wild_card_mask> < destination_wild_card_mask>
In our case :
capture arp1rep interface outside ethernet-type arp match mac c204.084c.0000 ffff.ffff.ffff 0c9f.4449.6702 ffff.ffff.ffff
After executing the above commands now, we can see below now that we are sending ARP request but we are not getting any reply. This tells us that we have issue on other side of outside interface of ASA. We can also can see below, we are just filtering the specific traffic with respect to ARP to specific host 64.1.1.3 only, not all.
There are other way to detect this issue [ shown below] but sometime looking at directly packets will help in understanding what our device is doing and this intern help in faster resolution of the problem. I hope this help.
ASAv# sho arp statistics
Number of ARP entries in ASA: 2
Dropped blocks in ARP: 4
Maximum Queued blocks: 2
Queued blocks: 1
Interface collision ARPs Received: 0
ARP-defense Gratuitous ARPS sent: 0 Total ARP retries: 4 Unresolved hosts: 1
Maximum Unresolved hosts: 1
ASAv#
Recently I passed the Wireshark exam WCNA-102.x link and i am proud to say that now i am officially a WCNA certified. It was a great journey of preparation and in today’s article I am going to share with you all some of these, which might help you’ll if you are considering to appear for the exam.
My Exam preparation materials: You will need two official books to pass this exam. One is study Guide and other one is final prep guide
Mandatory Official Books for the preparation:
Wireshark Network Analysis (Second Edition): The Official Wireshark Certified Network Analyst Study Guide. link
Optional Material : Routergods YouTube Training on WCNA link
Very good training videos but not mandatory one to pass the exam but can be used as a initial preparation for the exam as it will give a good overview of exam topics.
How these books are organized ?
Study Guide : This is the book which is going to make you real WCNA.I must say this book is the bible of wireshark . Laura Chappell intro, the author has not only shared how to play with wireshark but also made sure to give real time case studies at the end of each chapters.
There are 33 chapters in this book.The first 13 chapters are very important and one cannot skip them since the the remaining chapters [ from chapter 14 ] are on protocols (e.g ICMP,TCP,DNS,DHCP) and on wireshark command line tools [ except chapter 21 – on IO graph ] and thus these chapters require the skills you obtained from first initial 13 chapters. For Example : without knowing chapter 8 [which is on time values and interpret summary] you will not be able to confidently calculate RTT time between different set of protocols such as ICMP [ mentioned on chapter 18] using wireshark.
Prep Guide : You can study this book in 6 hours before the exam. It has list of all the preparation questions divided in 3 section [ 1 section has 10 chapters or more ] .It would be considered a good refresher.
How much time it take for the preparation ? It may vary from person to person but i took around 2 month of time [ daily studying for 1 to 3 hours on working day and 8 hours + on off days ] to complete all these three materials. Initially i booked the exam on October 1st but later took 5 more days and finally attempted the exam on October 6th.
What is the passing score for the exam ?
This depends and as per official doc link passing score for each examination is calculated by equating the scoring values associated with each question. Passing rates are estimated to be in the 70% to 80% range. What are the challenges you will face when preparing for the exam ?
As you start reading chapters it is necessary that you play with the wireshark in-between and apply those skills in practice as you read, this is where you might require another desktop or monitor which is going to make your life easier as it made mine since i had another personal computer.
What is the level of difficulty in the exam ?
The exam was easy since it covered all the exam topics from the official book itself. So it is very important you read all the chapters in the book thoroughly.
Final Conclusion and thoughts:
In my opinion WCNA certification is all about official study guide and if you want to consider yourself as a real WCNA, you should be able to complete all the chapters [ unless you are using wireshark daily at work ] of official study guide.Best of Luck.
