{"id":1828,"date":"2013-09-26T14:54:58","date_gmt":"2013-09-26T13:54:58","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=1828"},"modified":"2013-12-17T09:30:51","modified_gmt":"2013-12-17T09:30:51","slug":"running-snoop-on-netscreen-firewall","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=1828","title":{"rendered":"Running Snoop on Netscreen Firewall"},"content":{"rendered":"

An aide-memoir:<\/p>\n

ScreenOS-> undebug all
\nScreenOS-> clear db
\nScreenOS-> snoop info
\nSnoop: OFF
\nFilters Defined: 0, Active Filters 0
\nDetail: OFF, Detail Display length: 96
\nSnoop tunnel traffic: ON
\nScreenOS-> snoop filter ip src-ip 129.0.52.74
\nsnoop filter added
\nScreenOS-> snoop info
\nSnoop: OFF
\nFilters Defined: 1, Active Filters 1
\nDetail: OFF, Detail Display length: 96
\nSnoop tunnel traffic: ON
\nSnoop filter based on:
\nid 1(on): IP src-ip 129.0.52.74 dir(B)
\nScreenOS-> snoop detail len 1514
\nScreenOS-> snoop info
\nSnoop: OFF
\nFilters Defined: 1, Active Filters 1
\nDetail: OFF, Detail Display length: 1514
\nSnoop tunnel traffic: ON
\nSnoop filter based on:
\nid 1(on): IP src-ip 129.0.52.74 dir(B)
\nScreenOS-> snoop
\nStart Snoop, type ESC or ‘snoop off’ to stop, continue? [y]\/n y
\nScreenOS->
\nScreenOS-> snoop off
\nSnoop off
\nScreenOS-> get db st
\n4488957.0: ethernet3\/4(i) len=54:006440352fc8->0010dbff2200\/0800
\n129.0.52.74 -> 172.23.64.94\/6
\nvhl=45, tos=00, id=29961, frag=4000, ttl=126 tlen=40
\ntcp:ports 44183->22, seq=1443227022, ack=1957543016, flag=5010\/ACK<\/p>\n

4488962.0: ethernet3\/4(i) len=134:006440352fc8->0010dbff2200\/0800
\n129.0.52.74 -> 172.23.64.94\/6
\nvhl=45, tos=00, id=29975, frag=4000, ttl=126 tlen=120
\ntcp:ports 44183->22, seq=1443227022, ack=1957543016, flag=5018\/ACK<\/p>\n

4488962.0: ethernet3\/4(i) len=54:006440352fc8->0010dbff2200\/0800
\n129.0.52.74 -> 172.23.64.94\/6
\nvhl=45, tos=00, id=29976, frag=4000, ttl=126 tlen=40
\ntcp:ports 44183->22, seq=1443227102, ack=1957543084, flag=5010\/ACK<\/p>\n

4488968.0: ethernet3\/4(i) len=134:006440352fc8->0010dbff2200\/0800
\n129.0.52.74 -> 172.23.64.94\/6
\nvhl=45, tos=00, id=30273, frag=4000, ttl=126 tlen=120
\ntcp:ports 44183->22, seq=1443227102, ack=1957543084, flag=5018\/ACK<\/p>\n

4488968.0: ethernet3\/4(i) len=134:006440352fc8->0010dbff2200\/0800
\n129.0.52.74 -> 172.23.64.94\/6
\nScreenOS->
\nScreenOS-><\/p>\n

 <\/p>\n

The snoop options available for your release are viewable via the CLI command :<\/p>\n

\u00a0\u00a0 snoop ?<\/code><\/p>\n

This will produce a list similar to the following:<\/p>\n\n\n\n\n\n\n\n\n\n\n
Parameter<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n
snoop<\/code><\/td>\nStarts the snoop capture<\/td>\n<\/tr>\n
snoop\u00a0?<\/code><\/td>\nProvides a list of top level options:<\/p>\n

detail\u00a0\u00a0 snoop detail configuration<\/p>\n

filter\u00a0\u00a0 snoop filter configuration
\ninfo\u00a0\u00a0\u00a0\u00a0 show snoop information
\noff\u00a0\u00a0\u00a0\u00a0\u00a0 turn off snoop
\n<\/code><\/td>\n<\/tr>\n

snoop\u00a0detail\u00a0?<\/code><\/td>\nTo set the packet length to display, use the len option<\/p>\n

len\u00a0\u00a0\u00a0\u00a0\u00a0 snoop detail length
\noff\u00a0\u00a0\u00a0\u00a0\u00a0 turn off snoop detail<\/p>\n

<number> packet length to display (range: 1 - 1514) <\/code><\/td>\n<\/tr>\n

snoop\u00a0filter\u00a0? <\/code><\/td>\nFilter options allow the setting of the IP source, destination, and\/or port; setting the filter direction, interface, etc.<\/p>\n

cisco-hdlc\u00a0\u00a0 snoop cisco hdlc protocol packet
\ndelete\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 delete snoop filter
\nethernet\u00a0\u00a0\u00a0\u00a0 snoop specified ethernet
\nframe-relay\u00a0 snoop frame relay protocol and multilink fragment packet
\nid\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop filter id
\nip\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop ip packet
\noff\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 turn off snoop filter
\non\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 turn on snoop filter
\nppp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop ppp protocol and multilink fragment packet
\ntcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop tcp packet
\nudp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop udp packet
\n<\/code><\/td>\n<\/tr>\n

snoop\u00a0filter\u00a0ip\u00a0?<\/code><\/td>\nIP Filter options:<\/p>\n

direction\u00a0\u00a0\u00a0\u00a0\u00a0 snoop direction
\ndst-ip\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop filter dst ip
\ndst-port\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop filter dst port
\ninterface\u00a0\u00a0\u00a0\u00a0\u00a0 interface name
\nip-proto\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop filter ip proto
\nport\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 src or dst port
\nsrc-ip\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop filter src ip
\nsrc-port\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop filter src port
\n<IPv4 Address> IPv4 Address
\noffset\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ip offset
\n<\/code><\/td>\n<\/tr>\n

snoop\u00a0filter\u00a0ethernet\u00a0?<\/code><\/td>\nEthernet Filter options:<\/p>\n

arp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop arp packet
\ndirection\u00a0\u00a0\u00a0\u00a0\u00a0 snoop direction
\ninterface\u00a0\u00a0\u00a0\u00a0\u00a0 interface name
\nnsrp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop nsrp packet
\nvlan\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop vlan packet
\n<number >\u00a0\u00a0\u00a0 \u00a0 snoop specified ethernet type
\nexcept\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 snoop all but the specified ethernet type
\noffset\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ethernet offset<\/code><\/td>\n<\/tr>\n

snoop\u00a0info<\/code><\/td>\nProvides details about the snoop settings that have been configured.<\/p>\n

Snoop: OFF
\nFilters Defined: 0, Active Filters 0
\nDetail: OFF, Detail Display length: 96
\n<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

An aide-memoir: ScreenOS-> undebug all ScreenOS-> clear db<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[63,84,13],"tags":[4,37],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1828"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1828"}],"version-history":[{"count":4,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1828\/revisions"}],"predecessor-version":[{"id":1937,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1828\/revisions\/1937"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1828"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1828"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1828"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}