• Latest Version:

  Cisco Packet Tracer 7.3.0 LATEST

• Requirements:

  Mac OS X 10.8 or later

• Author / Product:

  Cisco Systems, Inc. / Cisco Packet Tracer for Mac

• Old Versions:

• Filename:

  PacketTracer730_mac.dmg

• MD5 Checksum:

  d31b82813498f8bf12dd2f6aab9efbd7

• Details:

  Cisco Packet Tracer for Mac 2020 full offline installer setup for Mac

How to Install CrossOver to run Cisco Packet Tracer Student 6.2 Click the Download Free Trial button above and get a 14-day, fully-functional trial of CrossOver. After you've downloaded CrossOver check out our YouTube tutorial video to the left, or visit the CrossOver Chrome OS walkthrough for specific steps. Cisco Packet Tracer free download - Cisco VPN Client, Cisco Packet Tracer Mobile, Cisco VPN Client Fix for Windows 8.1 and 10, and many more programs.

Introduction

This document describes how to work with Firepower Threat Defense (FTD) captures and Packet Tracer utilities.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software versions:

• ASA5515-X that runs FTD software 6.1.0
• FPR4110 that runs FTD software 6.2.2
• FS4000 that runs Firepower Management Center (FMC) software 6.2.2

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Network Diagram

Background Information

FTD Packet Processing

The FTD packet processing can be visualized as follows:

1. A packet enters the ingress interface and it is handled by the LINA engine.
2. If the policy requires the packet is inspected by the Snort engine.
3. The Snort engine returns a verdict for the packet.
4. The LINA engine drops or forwards the packet based on Snort’s verdict.

Based on the architecture, the FTD captures can be taken in these places:

Configure

Work with Snort Engine Captures

Prerequisites

There is an Access Control Policy (ACP) applied on FTD that allows Internet Control Message Protocol (ICMP) traffic to go through. The policy also has an Intrusion Policy applied:

Requirements

1. Enable capture on FTD CLISH mode using no filter.
2. Ping through the FTD and check the capture output.

Solution

Step 1. Log in to the FTD console or SSH to the br1 interface and enable capture on FTD CLISH mode using no filter.

On FTD 6.0.x the command is:

Step 2. Ping through FTD and check the capture output.

Work with Snort Engine Captures

Requirements

1. Enable capture on FTD CLISH mode using a filter for IP 192.168.101.1.
2. Ping through FTD and check the capture output.

Solution

Step 1. Enable capture on FTD CLISH mode using a filter for IP 192.168.101.1.

Step 2. Ping through the FTD and check the capture output:

You can use the -n option to see the hosts and port numbers in numeric format. For example, the previous capture will be shown as:

Tcpdump Filter Examples

Example 1

In order to capture Src IP or Dst IP = 192.168.101.1 and Src port or Dst port = TCP/UDP 23, enter this command:

Example 2

In order to capture Src IP = 192.168.101.1 and Src port = TCP/UDP 23, enter this command:

Example 3

In order to capture Src IP = 192.168.101.1 and Src port = TCP 23, enter this command:

Example 4

In order to capture Src IP = 192.168.101.1 and see the MAC address of the packets add the 'e' option, enter this command:

Example 5

In order to exit after you capture 10 packets, enter this command:

Example 6

In order to write a capture to a file with name capture.pcap and copy it via FTP to a remote server, enter this command:

Work with FTD LINA Engine Captures

Requirements

1. Enable two captures on FTD using these filters:

2. Ping from Host-A (192.168.103.1) to Host-B (192.168.101.1) and check the captures.

Solution

Step 1. Enable the captures:

Step 2. Check the captures in the CLI.

Ping from Host-A to Host-B:

The two captures have different sizes due to the Dot1Q header on the INSIDE interface. This is shown in this output example:

Work with FTD LINA Engine Captures – Export a Capture via HTTP

Requirements

Export the captures taken in the previous scenario with a browser.

Solution

In order to export the captures with a browser, you need to:

1. Enable the HTTPS server.
2. Allow HTTPS access.

By default, the HTTPS server is disabled and no access is allowed:

Step 1. Navigate to Devices > Platform Settings, click New Policy and choose Threat Defense Settings:

Specify the Policy name and Device Target:

Step 2. Enable the HTTPS server and add the network that you want to be allowed to access the FTD device over HTTPS:

Save and Deploy.

During the policy deployment you can enable debug http in order to see the HTTP service starting:

The result on FTD CLI is:

Open a browser on Host-A (192.168.103.1) and use this URL in order to download the first capture:

For reference:

For the second capture:

Work with FTD LINA Engine Captures - Export a Capture via FTP/TFTP/SCP

Requirements

Export the captures taken in the previous scenarios with FTP/TFTP/SCP protocols.

Solution

Export a capture to an FTP server:

Export a capture to a TFTP server:

Export a capture to an SCP server:

Offload captures from FTD:

Currently when needing to offload captures from FTD the easiest method is to perform the following:

1.) From Lina -

copy /pcap capture:<cap_name> disk0:

2.) From FPR root -

mv /ngfw/mnt/disk0/<cap_name> /ngfw/var/common/

3.) From FMC UI - System > Health > Monitor > Device > Advanced Troubleshooting > <cap_name> in field and download

Work with FTD LINA Engine Captures – Trace a Real Traffic Packet

Requirements

Enable a capture on FTD with these filters:

Ping from Host-A (192.168.103.1) the Host-B (192.168.101.1) and check the captures.

Solution

Cisco Packet Tracer 6.2 Download For Mac Os X 64-bit

Tracing a real packet can be very useful to troubleshoot connectivity issues. It allows you to see all the internal checks that a packet goes through. Add the trace detail keywords and specify the amount of packets that you want to be traced. By default, the FTD traces the first 50 ingress packets.

In this case, enable capture with trace detail for the first 100 packets that FTD receives on INSIDE interface:

Ping from Host-A to Host-B and check the result:

The captured packets are:

This output shows a trace of the first packet. The interesting parts are:

• Phase 12 where can be seen the 'forward flow'. This is the LINA engine Dispatch Array (effectively the internal order of operations)
• Phase 13 where FTD sends the packet to Snort instance
• Phase 14 where the Snort Verdict is seen

Capture Tool in Post-6.2 FMC Software Versions

In FMC Version 6.2.x, a new packet capture wizard was introduced. Navigate to Devices > Device Management and click the Troubleshoot icon. Then choose Advanced Troubleshooting and finally Capture w/Trace.

Choose Add Capture to create an FTD capture:

The current FMC UI limitations are:

• Cannot specify Src and Dst ports
• Only basic IP Protocols can be matched
• Cannot enable capture for LINA engine ASP Drops

Workaround – Use the FTD CLI.

As soon as you apply a capture from the FMC UI the capture is running:

The capture on FTD CLI:

Trace a Real Packet on Post-6.2 FMC

On FMC 6.2.x, the Capture w/Trace wizard allows you to capture and trace real packets on FTD:

You can check the traced packet in the FMC UI:

FTD Packet Tracer Utility

Requirements

Cisco Packet Tracer 6.2 Download For Mac Os X Catalina

Use the Packet Tracer utility for this flow and check how the packet will be handled internally:

Solution

Packet Tracer will generate a virtual packet. As shown in this example, the packet is a subject to Snort inspection. A capture taken at the same time at Snort-level (capture-traffic) shows the ICMP echo request:

Cisco Packet Tracer 6.2 Download For Mac Os X Download

The Snort-level capture during the packet-tracer test shows the virtual packet:

Packet Tracer UI Tool in Post-6.2 FMC Software Versions

In FMC Version 6.2.x the Packet Tracer UI tool was introduced. The tool is accessible in the same way as the capture tool and allows you to run Packet Tracer on FTD from the FMC UI:

Cisco Packet Tracer 6.2 Download For Mac Os X Iso

Related Information