Troubleshooting Security Implementations - Internetworking Troubleshooting - page 773

•

debug packet if_name —Used to debug a packet. The following example lists the information as it
appears in a packet.
router# debug packet inside
--------PACKET ---------
-- IP --
4.3.2.1 ==> 255.3.2.1
ver = 0x4 hlen = 0x5 tos = 0x0 tlen = 0x60
id = 0x3902 flags = 0x0 frag off=0x0
ttl = 0x20 proto=0x11 chksum = 0x5885
-—UDP --
source port = 0x89 dest port = 0x89
len = 0x4c checksum = 0xa6a0
-—DATA --
00000014: 00 01 00 00|
....
00000024: 00 00 00 01 20 45 49 45 50 45 47 45 47 45 46 46| ..
.. EIEPEGEGEFF
00000034: 43 43 4e 46 41 45 44 43 41 43 41 43 41 43 41 43| CC
NFAEDCACACACAC
00000044: 41 43 41 41 41 00 00 20 00 01 c0 0c 00 20 00 01| AC
AAA.. ..... ..
00000054: 00 04 93 e0 00 06 60 00 01 02 03 04 00| ..
....\Q......
--------END OF PACKET ---------

• debug packet if_name [src source_ip [netmask mask]] [dst dest_ip [netmask mask]] [[proto
icmp] | [proto tcp [sport src_port] [dport dest_port]] | [proto udp [sport src_port] [dport
dest_port]] [rx|tx|both] —Used to see the contents of packets as it travels between two destinations.
Syntax description:
- if_name —Interface name from which the packets are arriving; for example, to monitor packets
coming into the PIX Firewall from the outside, set if_name to outside.
- src source —Source IP address.
- netmask mask —Network mask.
- dst dest_ip —Destination IP address.
- proto icmp —Display ICMP packets only.
- proto tcp —Display TCP packets only.
- sport src_ port —Source port. See the “Ports” section in “Introduction” for a list of valid port
literal names.
- dport dest_ port —Destination port.
- proto udp —Display UDP packets only.
- rx —Display only packets received at the PIX Firewall.
- tx —Display only packets that were transmitted from the PIX Firewall.
- both —Display both received and transmitted packets.
In the following example, the contents of the tcp packets on port 25 with the source address of
200.200.200.20 and the destination address of 100.100.100.10 are displayed.

debug packet outside src 200.200.200.20 dst 100.100.100.10 proto tcp dport 25 both