Cisco ASA Packet Capture

In order to utilize a packet capture you must understand what you're looking at. If you don't know what you're looking at then it does you no good to capture the packets. First things first you must set up a packet capture with your cisco pix or asa as seen here http://analysisandreview.com/cisco/how-to-configure-a-packet-capture-in-the-cisco-asa/

Now once you look at the capture you'll likely be cornfused and wonder whats up. If thats the case then you need to understand the tcp three way hand shake.

To establish a connection, TCP uses a three-way handshake. Before a client attempts to connect with a server, the server must first connect to a port for connection.. this is called a passive open. Once the passive open is made a client may initiate an active open. To establish a connection, the three-way handshake occurs like this

1. SYN = The active open is performed by the client sending a SYN to the server.
2. SYN-ACK =In response, the server replies with a SYN-ACK.
3. ACK = Finally the client sends an ACK back to the server.

At this point, both the client and server have received an acknowledgment of the connection.

So in your packet capture you'll see the ack and syn ack so you'll be able to show the sever admin that there servers are able to communicate via the network and that your end is clear.