• 凡是流经ASA接口的数据包都将被capture命令记录在案,而不论该数据包是否被安全策略拒绝或允许。

    When traffic arrives at an interface, the capture command records the data before any ASA security policies analyze the traffic. For example, an access-list denies all incoming traffic on an interface. The capture command till records the traffic. The ASA security policy then analyzes the traffic.

    实验过程如下:

    • 禁止10.199.33.31访问10.199.55.1:80

      no access-list dmz:others-dmz&inside extended permit tcp 10.199.0.0 255.255.0.0 host 10.199.55.1 eq www
    • 在dmz:others口开启capture

      access-list dmzothers_dmz_capextended permit tcp host 10.199.33.31 host 10.199.55.1 eq www
      capture dmzothers_dmz_intaccess-list dmzothers_dmz_capinterface dmz:others
    • 在33.31上访问55.1的80服务

      结果:失败!

    • 显示capture

      WG-XXCS-PIX525-1(config)# show capture dmzothers_dmz_int
      3 packets captured
      1: 11:20:03.644619 10.199.33.31.2628 > 10.199.55.1.80: S 1575234818:1575234818(0) win 65535 <mss 1380,nop,nop,sackOK>
      2: 11:20:06.678187 10.199.33.31.2628 > 10.199.55.1.80: S 1575234818:1575234818(0) win 65535 <mss 1380,nop,nop,sackOK>
      3: 11:20:12.693720 10.199.33.31.2628 > 10.199.55.1.80: S 1575234818:1575234818(0) win 65535 <mss 1380,nop,nop,sackOK>
      3 packets shown
即使没有开放80的acl,依然可以看到有数据包流到防火墙,说明pix的capture功能是在安全策略处理数据包之前就开始捕获数据包了。
  • capture的acl要写双向(两条)才能捕获“去”和“回”的数据包

    实验过程如下:

    • 允许10.199.33.31访问10.199.55.1:80(单程)

      access-list dmz:others-dmz&inside extended permit tcp 10.199.0.0 255.255.0.0 host 10.199.55.1 eq www
    • 在10.199.33.31上面访问10.199.55.1的80服务

      结果:成功!

    • 显示capture

      WG-XXCS-PIX525-1(config)# show capture dmzothers_dmz_int
      58 packets captured
      1: 11:24:40.216938 10.199.33.31.2681 > 10.199.55.1.80: S 2123439995:2123439995(0) win 65535 <mss 1380,nop,nop,sackOK>
      2: 11:24:40.218006 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632615261 win 65535
      3: 11:24:40.218570 10.199.33.31.2681 > 10.199.55.1.80: P 2123439996:2123440415(419) ack 1632615261 win 65535
      4: 11:24:40.266938 10.199.33.31.2681 > 10.199.55.1.80: P 2123440415:2123440835(420) ack 1632615575 win 65221
      5: 11:24:40.281403 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632618335 win 65535
      6: 11:24:40.283554 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632619715 win 65535
      7: 11:24:40.300124 10.199.33.31.2681 > 10.199.55.1.80: P 2123440835:2123441150(315) ack 1632621075 win 64175
      8: 11:24:40.303054 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632623835 win 65535
      9: 11:24:40.303145 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632625215 win 65535
      10: 11:24:40.305465 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632627975 win 65535
      11: 11:24:40.305663 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632629355 win 65535
      12: 11:24:40.305739 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632632115 win 65535
      13: 11:24:40.308059 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632633495 win 65535
      14: 11:24:40.308181 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632636255 win 65535
      15: 11:24:40.308211 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632637635 win 65535
      16: 11:24:40.308257 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632639194 win 63976
      17: 11:24:40.316298 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632639194 win 65535
      18: 11:24:40.381450 10.199.33.31.2681 > 10.199.55.1.80: P 2123441150:2123441467(317) ack 1632639194 win 65535
      19: 11:24:40.382319 10.199.33.31.2682 > 10.199.55.1.80: S 123671388:123671388(0) win 65535 <mss 1380,nop,nop,sackOK>
      20: 11:24:40.384410 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632641811 win 65535
      21: 11:24:40.384455 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446529518 win 65535
      22: 11:24:40.385981 10.199.33.31.2682 > 10.199.55.1.80: P 123671389:123671706(317) ack 2446529518 win 65535
      23: 11:24:40.390116 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446532278 win 65535
      24: 11:24:40.392405 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446533658 win 65535
      25: 11:24:40.392481 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446536418 win 65535
      26: 11:24:40.405481 10.199.33.31.2681 > 10.199.55.1.80: P 2123441467:2123441783(316) ack 1632641811 win 65535
      27: 11:24:40.408502 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632644571 win 65535
      28: 11:24:40.408685 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632645951 win 65535
      29: 11:24:40.409097 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632648711 win 65535
      30: 11:24:40.409143 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632650091 win 65535
      31: 11:24:40.409189 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632652833 win 62793
      32: 11:24:40.416329 10.199.33.31.2682 > 10.199.55.1.80: P 123671706:123672022(316) ack 2446537010 win 64943
      33: 11:24:40.417275 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632652833 win 65535
      34: 11:24:40.419457 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446539770 win 65535
      35: 11:24:40.419503 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446541150 win 65535
      36: 11:24:40.421853 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446543910 win 65535
      37: 11:24:40.421883 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446545290 win 65535
      38: 11:24:40.421944 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446548050 win 65535
      39: 11:24:40.424813 10.199.33.31.2682 > 10.199.55.1.80: P 123672022:123672338(316) ack 2446548946 win 64639
      40: 11:24:40.425347 10.199.33.31.2681 > 10.199.55.1.80: P 2123441783:2123442098(315) ack 1632652833 win 65535
      41: 11:24:40.428444 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446551706 win 65535
      42: 11:24:40.428475 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446553086 win 65535
      43: 11:24:40.428520 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446555846 win 65535
      44: 11:24:40.428536 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446557226 win 65535
      45: 11:24:40.430870 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446559986 win 62775
      46: 11:24:40.430901 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446562746 win 60015
      47: 11:24:40.430946 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446564532 win 58229
      48: 11:24:40.452765 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446564532 win 61989
      49: 11:24:40.454627 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446564532 win 65535
      50: 11:24:40.467032 10.199.33.31.2681 > 10.199.55.1.80: P 2123442098:2123442415(317) ack 1632653646 win 64722
      51: 11:24:40.492848 10.199.33.31.2682 > 10.199.55.1.80: P 123672338:123672654(316) ack 2446564532 win 65535
      52: 11:24:40.493077 10.199.33.31.2681 > 10.199.55.1.80: P 2123442415:2123442730(315) ack 1632654028 win 64340
      53: 11:24:40.497731 10.199.33.31.2681 > 10.199.55.1.80: P 2123442730:2123443045(315) ack 1632655072 win 65535
      54: 11:24:40.543230 10.199.33.31.2682 > 10.199.55.1.80: P 123672654:123672963(309) ack 2446565760 win 64307
      55: 11:24:40.549028 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446567229 win 65535
      56: 11:24:40.554857 10.199.33.31.2682 > 10.199.55.1.80: P 123672963:123673282(319) ack 2446567234 win 65530
      57: 11:24:40.557634 10.199.33.31.2682 > 10.199.55.1.80: . ack 2446569341 win 65535
      58: 11:24:40.653469 10.199.33.31.2681 > 10.199.55.1.80: . ack 1632656160 win 64447
      58 packets shown

    从这个例子可以看到,没有捕获到从55.1:80返回来的数据包。

    • 允许10.199.55.1访问10.199.33.31

      access-list dmzothers_dmz_capextended permit tcp host 10.199.55.1 eq www host 10.199.33.31
    • 清除capture

      clear capture dmzothers_dmz_int
    • 在33.31上面访问55.1:80

      结果:成功

    • 显示capture和在55.1上面使用ethereal抓包

      WG-XXCS-PIX525-1(config)# show capture dmzothers_dmz_int
      133 packets captured
      1: 15:29:00.426278 10.199.33.31.4758 > 10.199.55.1.80: S 611345466:611345466(0) win 65535 <mss 1380,nop,nop,sackOK>
      2: 15:29:00.426659 10.199.55.1.80 > 10.199.33.31.4758: S 135175201:135175201(0) ack 611345467 win 5840 <mss 1380,nop,nop,sackOK>
      3: 15:29:00.427361 10.199.33.31.4758 > 10.199.55.1.80: . ack 135175202 win 65535
      4: 15:29:00.427925 10.199.33.31.4758 > 10.199.55.1.80: P 611345467:611345886(419) ack 135175202 win 65535
      5: 15:29:00.428215 10.199.55.1.80 > 10.199.33.31.4758: . ack 611345886 win 6432
      6: 15:29:00.476003 10.199.55.1.80 > 10.199.33.31.4758: P 135175202:135175516(314) ack 611345886 win 6432
      7: 15:29:00.478338 10.199.33.31.4758 > 10.199.55.1.80: P 611345886:611346306(420) ack 135175516 win 65221
      8: 15:29:00.478567 10.199.55.1.80 > 10.199.33.31.4758: . ack 611346306 win 7504
      9: 15:29:00.494618 10.199.55.1.80 > 10.199.33.31.4758: . 135175516:135176896(1380) ack 611346306 win 7504
      10: 15:29:00.494725 10.199.55.1.80 > 10.199.33.31.4758: . 135176896:135178276(1380) ack 611346306 win 7504
      11: 15:29:00.496678 10.199.33.31.4758 > 10.199.55.1.80: . ack 135178276 win 65535
      12: 15:29:00.497075 10.199.55.1.80 > 10.199.33.31.4758: . 135178276:135179656(1380) ack 611346306 win 7504
      13: 15:29:00.497151 10.199.55.1.80 > 10.199.33.31.4758: P 135179656:135181016(1360) ack 611346306 win 7504
      14: 15:29:00.498906 10.199.33.31.4758 > 10.199.55.1.80: . ack 135179656 win 65535
      15: 15:29:00.510639 10.199.33.31.4758 > 10.199.55.1.80: P 611346306:611346621(315) ack 135181016 win 64175
      16: 15:29:00.511875 10.199.55.1.80 > 10.199.33.31.4758: . 135181016:135182396(1380) ack 611346621 win 8576
      17: 15:29:00.512012 10.199.55.1.80 > 10.199.33.31.4758: . 135182396:135183776(1380) ack 611346621 win 8576
      18: 15:29:00.512104 10.199.55.1.80 > 10.199.33.31.4758: . 135183776:135185156(1380) ack 611346621 win 8576
      19: 15:29:00.513843 10.199.33.31.4758 > 10.199.55.1.80: . ack 135183776 win 65535
      20: 15:29:00.513889 10.199.33.31.4758 > 10.199.55.1.80: . ack 135185156 win 65535
      21: 15:29:00.514209 10.199.55.1.80 > 10.199.33.31.4758: . 135185156:135186536(1380) ack 611346621 win 8576
      22: 15:29:00.514331 10.199.55.1.80 > 10.199.33.31.4758: . 135186536:135187916(1380) ack 611346621 win 8576
      23: 15:29:00.514453 10.199.55.1.80 > 10.199.33.31.4758: . 135187916:135189296(1380) ack 611346621 win 8576
      24: 15:29:00.514560 10.199.55.1.80 > 10.199.33.31.4758: . 135189296:135190676(1380) ack 611346621 win 8576
      25: 15:29:00.514667 10.199.55.1.80 > 10.199.33.31.4758: . 135190676:135192056(1380) ack 611346621 win 8576
      26: 15:29:00.516269 10.199.33.31.4758 > 10.199.55.1.80: . ack 135187916 win 65535
      27: 15:29:00.516361 10.199.33.31.4758 > 10.199.55.1.80: . ack 135189296 win 65535
      28: 15:29:00.516422 10.199.33.31.4758 > 10.199.55.1.80: . ack 135192056 win 62775
      29: 15:29:00.516635 10.199.55.1.80 > 10.199.33.31.4758: P 135192056:135193436(1380) ack 611346621 win 8576
      30: 15:29:00.516742 10.199.55.1.80 > 10.199.33.31.4758: . 135193436:135194816(1380) ack 611346621 win 8576
      31: 15:29:00.516864 10.199.55.1.80 > 10.199.33.31.4758: . 135194816:135196196(1380) ack 611346621 win 8576
      32: 15:29:00.517002 10.199.55.1.80 > 10.199.33.31.4758: . 135196196:135197576(1380) ack 611346621 win 8576
      33: 15:29:00.517108 10.199.55.1.80 > 10.199.33.31.4758: . 135197576:135198956(1380) ack 611346621 win 8576
      34: 15:29:00.517154 10.199.55.1.80 > 10.199.33.31.4758: P 135198956:135199135(179) ack 611346621 win 8576
      35: 15:29:00.518512 10.199.33.31.4758 > 10.199.55.1.80: . ack 135194816 win 60015
      36: 15:29:00.518772 10.199.33.31.4758 > 10.199.55.1.80: . ack 135197576 win 57255
      37: 15:29:00.518848 10.199.33.31.4758 > 10.199.55.1.80: . ack 135199135 win 55696
      38: 15:29:00.520206 10.199.33.31.4758 > 10.199.55.1.80: . ack 135199135 win 59456
      39: 15:29:00.521548 10.199.33.31.4758 > 10.199.55.1.80: . ack 135199135 win 65535
      40: 15:29:00.543749 10.199.33.31.4758 > 10.199.55.1.80: P 611346621:611346938(317) ack 135199135 win 65535
      41: 15:29:00.544832 10.199.33.31.4759 > 10.199.55.1.80: S 3994942590:3994942590(0) win 65535 <mss 1380,nop,nop,sackOK>
      42: 15:29:00.545244 10.199.55.1.80 > 10.199.33.31.4758: . 135199135:135200515(1380) ack 611346938 win 8576
      43: 15:29:00.545336 10.199.55.1.80 > 10.199.33.31.4758: P 135200515:135201752(1237) ack 611346938 win 8576
      44: 15:29:00.545381 10.199.55.1.80 > 10.199.33.31.4759: S 4216227405:4216227405(0) ack 3994942591 win 5840 <mss 1380,nop,nop,sackOK>
      45: 15:29:00.547319 10.199.33.31.4758 > 10.199.55.1.80: . ack 135201752 win 65535
      46: 15:29:00.547365 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216227406 win 65535
      47: 15:29:00.558397 10.199.33.31.4759 > 10.199.55.1.80: P 3994942591:3994942908(317) ack 4216227406 win 65535
      48: 15:29:00.558625 10.199.55.1.80 > 10.199.33.31.4759: . ack 3994942908 win 6432
      49: 15:29:00.562150 10.199.55.1.80 > 10.199.33.31.4759: . 4216227406:4216228786(1380) ack 3994942908 win 6432
      50: 15:29:00.562272 10.199.55.1.80 > 10.199.33.31.4759: . 4216228786:4216230166(1380) ack 3994942908 win 6432
      51: 15:29:00.564011 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216230166 win 65535
      52: 15:29:00.564378 10.199.55.1.80 > 10.199.33.31.4759: . 4216230166:4216231546(1380) ack 3994942908 win 6432
      53: 15:29:00.564484 10.199.55.1.80 > 10.199.33.31.4759: . 4216231546:4216232926(1380) ack 3994942908 win 6432
      54: 15:29:00.564607 10.199.55.1.80 > 10.199.33.31.4759: . 4216232926:4216234306(1380) ack 3994942908 win 6432
      55: 15:29:00.566331 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216231546 win 65535
      56: 15:29:00.566392 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216234306 win 65535
      57: 15:29:00.566560 10.199.55.1.80 > 10.199.33.31.4759: P 4216234306:4216234898(592) ack 3994942908 win 6432
      58: 15:29:00.588684 10.199.33.31.4758 > 10.199.55.1.80: P 611346938:611347254(316) ack 135201752 win 65535
      59: 15:29:00.590042 10.199.55.1.80 > 10.199.33.31.4758: . 135201752:135203132(1380) ack 611347254 win 8576
      60: 15:29:00.590148 10.199.55.1.80 > 10.199.33.31.4758: . 135203132:135204512(1380) ack 611347254 win 8576
      61: 15:29:00.590270 10.199.55.1.80 > 10.199.33.31.4758: . 135204512:135205892(1380) ack 611347254 win 8576
      62: 15:29:00.590377 10.199.55.1.80 > 10.199.33.31.4758: . 135205892:135207272(1380) ack 611347254 win 8576
      63: 15:29:00.590499 10.199.55.1.80 > 10.199.33.31.4758: . 135207272:135208652(1380) ack 611347254 win 8576
      64: 15:29:00.590637 10.199.55.1.80 > 10.199.33.31.4758: . 135208652:135210032(1380) ack 611347254 win 8576
      65: 15:29:00.590728 10.199.55.1.80 > 10.199.33.31.4758: . 135210032:135211412(1380) ack 611347254 win 8576
      66: 15:29:00.590866 10.199.55.1.80 > 10.199.33.31.4758: P 135211412:135212774(1362) ack 611347254 win 8576
      67: 15:29:00.592086 10.199.33.31.4758 > 10.199.55.1.80: . ack 135204512 win 65535
      68: 15:29:00.592605 10.199.33.31.4758 > 10.199.55.1.80: . ack 135205892 win 65535
      69: 15:29:00.592758 10.199.33.31.4758 > 10.199.55.1.80: . ack 135208652 win 65535
      70: 15:29:00.592803 10.199.33.31.4758 > 10.199.55.1.80: . ack 135210032 win 65535
      71: 15:29:00.592819 10.199.33.31.4758 > 10.199.55.1.80: . ack 135212774 win 62793
      72: 15:29:00.593429 10.199.33.31.4759 > 10.199.55.1.80: P 3994942908:3994943224(316) ack 4216234898 win 64943
      73: 15:29:00.593475 10.199.33.31.4758 > 10.199.55.1.80: . ack 135212774 win 65535
      74: 15:29:00.594833 10.199.55.1.80 > 10.199.33.31.4759: . 4216234898:4216236278(1380) ack 3994943224 win 7504
      75: 15:29:00.594955 10.199.55.1.80 > 10.199.33.31.4759: . 4216236278:4216237658(1380) ack 3994943224 win 7504
      76: 15:29:00.595077 10.199.55.1.80 > 10.199.33.31.4759: . 4216237658:4216239038(1380) ack 3994943224 win 7504
      77: 15:29:00.595184 10.199.55.1.80 > 10.199.33.31.4759: . 4216239038:4216240418(1380) ack 3994943224 win 7504
      78: 15:29:00.596862 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216237658 win 65535
      79: 15:29:00.596923 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216239038 win 65535
      80: 15:29:00.597228 10.199.55.1.80 > 10.199.33.31.4759: . 4216240418:4216241798(1380) ack 3994943224 win 7504
      81: 15:29:00.597350 10.199.55.1.80 > 10.199.33.31.4759: . 4216241798:4216243178(1380) ack 3994943224 win 7504
      82: 15:29:00.597457 10.199.55.1.80 > 10.199.33.31.4759: . 4216243178:4216244558(1380) ack 3994943224 win 7504
      83: 15:29:00.597579 10.199.55.1.80 > 10.199.33.31.4759: . 4216244558:4216245938(1380) ack 3994943224 win 7504
      84: 15:29:00.597655 10.199.55.1.80 > 10.199.33.31.4759: P 4216245938:4216246834(896) ack 3994943224 win 7504
      85: 15:29:00.599303 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216241798 win 65535
      86: 15:29:00.599334 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216243178 win 65535
      87: 15:29:00.599395 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216245938 win 62775
      88: 15:29:00.613096 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216246834 win 65535
      89: 15:29:00.625761 10.199.33.31.4758 > 10.199.55.1.80: P 611347254:611347570(316) ack 135212774 win 65535
      90: 15:29:00.626035 10.199.33.31.4759 > 10.199.55.1.80: P 3994943224:3994943541(317) ack 4216246834 win 65535
      91: 15:29:00.627347 10.199.55.1.80 > 10.199.33.31.4758: . 135212774:135214154(1380) ack 611347570 win 8576
      92: 15:29:00.627485 10.199.55.1.80 > 10.199.33.31.4758: . 135214154:135215534(1380) ack 611347570 win 8576
      93: 15:29:00.627592 10.199.55.1.80 > 10.199.33.31.4758: . 135215534:135216914(1380) ack 611347570 win 8576
      94: 15:29:00.627714 10.199.55.1.80 > 10.199.33.31.4758: . 135216914:135218294(1380) ack 611347570 win 8576
      95: 15:29:00.627836 10.199.55.1.80 > 10.199.33.31.4758: . 135218294:135219674(1380) ack 611347570 win 8576
      96: 15:29:00.627942 10.199.55.1.80 > 10.199.33.31.4758: . 135219674:135221054(1380) ack 611347570 win 8576
      97: 15:29:00.628065 10.199.55.1.80 > 10.199.33.31.4758: . 135221054:135222434(1380) ack 611347570 win 8576
      98: 15:29:00.628187 10.199.55.1.80 > 10.199.33.31.4758: . 135222434:135223814(1380) ack 611347570 win 8576
      99: 15:29:00.628293 10.199.55.1.80 > 10.199.33.31.4758: . 135223814:135225194(1380) ack 611347570 win 8576
      100: 15:29:00.628339 10.199.55.1.80 > 10.199.33.31.4759: P 4216246834:4216247216(382) ack 3994943541 win 8576
      101: 15:29:00.629346 10.199.33.31.4758 > 10.199.55.1.80: . ack 135215534 win 65535
      102: 15:29:00.629590 10.199.33.31.4758 > 10.199.55.1.80: . ack 135216914 win 65535
      103: 15:29:00.629712 10.199.55.1.80 > 10.199.33.31.4758: . 135225194:135226574(1380) ack 611347570 win 8576
      104: 15:29:00.629819 10.199.55.1.80 > 10.199.33.31.4758: . 135226574:135227954(1380) ack 611347570 win 8576
      105: 15:29:00.629865 10.199.55.1.80 > 10.199.33.31.4758: P 135227954:135228360(406) ack 611347570 win 8576
      106: 15:29:00.630170 10.199.33.31.4758 > 10.199.55.1.80: . ack 135223814 win 62775
      107: 15:29:00.631467 10.199.33.31.4758 > 10.199.55.1.80: . ack 135226574 win 60015
      108: 15:29:00.649777 10.199.33.31.4758 > 10.199.55.1.80: . ack 135226574 win 63775
      109: 15:29:00.652340 10.199.33.31.4758 > 10.199.55.1.80: . ack 135226574 win 65535
      110: 15:29:00.665584 10.199.33.31.4759 > 10.199.55.1.80: P 3994943541:3994943857(316) ack 4216247216 win 65153
      111: 15:29:00.666881 10.199.55.1.80 > 10.199.33.31.4759: P 4216247216:4216248444(1228) ack 3994943857 win 8576
      112: 15:29:00.673243 10.199.33.31.4759 > 10.199.55.1.80: P 3994943857:3994944172(315) ack 4216248444 win 65535
      113: 15:29:00.674312 10.199.55.1.80 > 10.199.33.31.4759: P 4216248444:4216249488(1044) ack 3994944172 win 8576
      114: 15:29:00.681071 10.199.33.31.4759 > 10.199.55.1.80: P 3994944172:3994944487(315) ack 4216249488 win 64491
      115: 15:29:00.682276 10.199.55.1.80 > 10.199.33.31.4759: P 4216249488:4216250576(1088) ack 3994944487 win 8576
      116: 15:29:00.687952 10.199.33.31.4759 > 10.199.55.1.80: P 3994944487:3994944796(309) ack 4216250576 win 65535
      117: 15:29:00.693659 10.199.55.1.80 > 10.199.33.31.4759: . 4216250576:4216251956(1380) ack 3994944796 win 8576
      118: 15:29:00.693689 10.199.55.1.80 > 10.199.33.31.4759: P 4216251956:4216252148(192) ack 3994944796 win 8576
      119: 15:29:00.695444 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216252148 win 65535
      120: 15:29:00.733497 10.199.55.1.80 > 10.199.33.31.4759: P 4216252148:4216252153(5) ack 3994944796 win 8576
      121: 15:29:00.737159 10.199.33.31.4759 > 10.199.55.1.80: P 3994944796:3994945111(315) ack 4216252153 win 65530
      122: 15:29:00.738334 10.199.55.1.80 > 10.199.33.31.4759: P 4216252153:4216252966(813) ack 3994945111 win 8576
      123: 15:29:00.756278 10.199.33.31.4759 > 10.199.55.1.80: P 3994945111:3994945430(319) ack 4216252966 win 64717
      124: 15:29:00.757620 10.199.55.1.80 > 10.199.33.31.4759: . 4216252966:4216254346(1380) ack 3994945430 win 8576
      125: 15:29:00.757681 10.199.55.1.80 > 10.199.33.31.4759: P 4216254346:4216255073(727) ack 3994945430 win 8576
      126: 15:29:00.759451 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216255073 win 65535
      127: 15:29:00.834688 10.199.55.1.80 > 10.199.33.31.4758: . 135226574:135227954(1380) ack 611347570 win 8576
      128: 15:29:01.012313 10.199.33.31.4758 > 10.199.55.1.80: . ack 135227954 win 65535
      129: 15:29:01.012542 10.199.55.1.80 > 10.199.33.31.4758: P 135227954:135228360(406) ack 611347570 win 8576
      130: 15:29:01.058865 10.199.33.31.4759 > 10.199.55.1.80: P 3994945430:3994945665(235) ack 4216255073 win 65535
      131: 15:29:01.059353 10.199.55.1.80 > 10.199.33.31.4759: P 4216255073:4216255596(523) ack 3994945665 win 8576
      132: 15:29:01.213489 10.199.33.31.4759 > 10.199.55.1.80: . ack 4216255596 win 65012
      133: 15:29:01.213535 10.199.33.31.4758 > 10.199.55.1.80: . ack 135228360 win 65129
      133 packets shown

      对比ethereal抓的包,一模一样,这证明了pix的capture可以相当于ethereal的抓包功能了。另外PIX还可以将抓的包导出到一个文件中,由ethereal进行分析。

ACL的处理顺序

acl的处理顺序为acl的排列顺序,而acl的排列顺序是根据用户输入的顺序。 例如前先已经有了两条允许规则:

access-list dmz-inside extended permit tcp any any eq 21
access-list dmz-inside extended permit tcp any any eq 20

那么,用户后续再输入:

access-list dmz-inside extended deny tcp host 10.199.55.5 host 10.199.56.6 eq 21
access-list dmz-inside extended deny tcp host 10.199.55.5 host 10.199.56.6 eq 20

仍然无法阻止用户从10.199.55.5使用ftp协议登陆到10.199.56.6