Cisco Cisco ASA 5510 Adaptive Security Appliance Technisches Handbuch

Refer to Cisco Technical Tips Conventions for more information on document conventions.

In this section, you are presented with the information to configure the features described in this document.

Note: Use the Command Lookup Tool (registered customers only) to obtain more information on the
commands used in this section.

When the WebVPN capture tool is enabled, the capture tool stores the data from the first URL visited in these
files:

original.000Contains the data exchanged between the security appliance and the web server.

• 

mangled.000Contains the data exchanged between the security appliance and the browser.

• 

For each subsequent capture, the capture tool generates additional matching original.<nnn> and
mangled.<nnn> files and increments the file extensions. In this example, the output of the dir command
displays three sets of files from three URL captures:

hostname#dir

Directory of disk0:/

2952        −rw−        10931           10:38:32 Jan 19 2005 config

6           −rw−        5124096         19:43:32 Jan 01 2003 cdisk.bin

3397        −rw−        5157            08:30:56 Feb 14 2005 ORIGINAL.000

3398        −rw−        6396            08:30:56 Feb 14 2005 MANGLED.000

3399        −rw−        4928            08:32:51 Feb 14 2005 ORIGINAL.001

3400        −rw−        6167            08:32:51 Feb 14 2005 MANGLED.001

3401        −rw−        5264            08:35:23 Feb 14 2005 ORIGINAL.002

3402        −rw−        6503            08:35:23 Feb 14 2005 MANGLED.002

hostname#

Note: The Flash File System has limitations when multiple files are opened for writing. The WebVPN capture
tool can possibly cause file system corruption when multiple capture files are updated concurrently. If this
failure should occur with the capture tool, contact the Cisco Technical Assistance Center (TAC).

In order to activate the WebVPN capture tool, use the debug menu webvpn 67 command from privileged
EXEC mode:

Where:

cmd is 0 or 1. 0 disables capture. 1 enables capture.

• 

user is the username to match for data capture.

• 

url is the URL prefix to match for data capture. Use one of these URL formats:

Use /http to capture all data.

♦ 

Use /http/0/<server/path> to capture HTTP traffic to the server identified by <server/path>.

♦ 

Use /https/0/<server/path> to capture HTTPS traffic to the server identified by <server/path>.

♦ 

•