nerdexam
Cisco

300-730 · Question #174

An engineer must investigate a connectivity issue and decides to use the packet capture feature on Cisco FTD. The goal is to see the real packet going through the Cisco FTD device and see Snort…

The correct answer is A. Specify the trace using the -T option after the capture-traffic command. On Cisco FTD, the -T option appended to the capture-traffic command enables trace mode, which includes Snort detection actions in the packet capture output.

Troubleshooting VPNs

Question

An engineer must investigate a connectivity issue and decides to use the packet capture feature on Cisco FTD. The goal is to see the real packet going through the Cisco FTD device and see Snort detection actions as a part of the output. After the capture-traffic command is issued, only the packets are displayed. Which action resolves this issue?

Options

  • ASpecify the trace using the -T option after the capture-traffic command
  • BPerform the trace within the Cisco FMC GUI instead of the Cisco FMC CLI
  • CUse the verbose option as a part of the capture-traffic command
  • DUse the capture command and specify the trace option to get the required information

How the community answered

(52 responses)
  • A
    75% (39)
  • B
    8% (4)
  • C
    15% (8)
  • D
    2% (1)

Why each option

On Cisco FTD, the -T option appended to the capture-traffic command enables trace mode, which includes Snort detection actions in the packet capture output.

ASpecify the trace using the -T option after the capture-traffic commandCorrect

The -T flag added to the capture-traffic command activates trace functionality on Cisco FTD, causing the output to display Snort IPS inspection results and detection actions alongside each captured packet. This is the specific CLI option designed to surface Snort decision data within the FTD packet capture tool and is distinct from basic packet display mode.

BPerform the trace within the Cisco FMC GUI instead of the Cisco FMC CLI

The FMC GUI packet capture feature does not inherently add Snort detection output - the trace functionality must be explicitly enabled at the CLI level and switching interfaces does not change this behavior.

CUse the verbose option as a part of the capture-traffic command

The verbose option increases the detail level of packet header information displayed but does not enable Snort trace mode or expose IPS detection decisions.

DUse the capture command and specify the trace option to get the required information

The capture command with the trace option is an ASA-specific approach and does not integrate Snort detection action output in the same way the -T option does on FTD's capture-traffic command.

Concept tested: Cisco FTD capture-traffic Snort trace option

Source: https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212474-firepower-packet-capture.html

Topics

#Cisco FTD#packet capture#capture-traffic#Snort trace

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice