0

I have .pcap file that already includes thousands of packets. I want to analyze these packets via CISCO ASA5515-X to observe how much of them are possible to be an attack packet (malicious). However, I could not succeed to read the .pcap file. I am using IcedTea - Cisco ASDM 6.6 for ASA. Wizard -> Packet capture wizards do not have an option to load and read the pcap file and I could not find an alternative way.

Does anyone have a suggestion?

Thank you for your helps in advance.

Regards Eray

3
  • You should be able to open the file in Wirshark and view it, or you can upload it here and view it: appliance.cloudshark.org/upload
    – joeqwerty
    May 6, 2014 at 14:29
  • if you want to just open it, Wireshark is one option. However you might have only downloaded the textual version of the file. see supportforums.cisco.com/discussion/10717591/… May 6, 2014 at 14:31
  • Yea, Wireshark opens it. But how can I use CISCO ASA5515-X router in wireshark to analyze which packets are malicious? Is there any way for that? Thank you for the links by the way. May 6, 2014 at 14:54

1 Answer 1

0

As I understand it, the router only analyzes live traffic. However, you can turn a pcap file into live traffic via tcprewrite and tcpreplay. Those tools let you change the endpoints, recalculate checksums, and send the traffic back through your router for analysis. I would pick two test hosts for your new endpoints such that replaying from one will result in the replayed traffic being routed through the device in question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .