Command Prompt Packet Tracer

by



Cisco ASA includes a very nice feature since the 7.2(1)-release; packet-tracer.

Command Prompt Packet Tracer

In short, you can inject and trace a packet as it progresses through the security features of the Cisco ASA appliance and quickly determine wether or not the packet will pass.

Packet tracer command prompt commands

I often use it to verify traffic passing through firewall rules, NAT-rules and VPN, but its uses is not limited to these three common troubleshooting steps.

This command changes to the overriding mode. (config) ip dhcp exluded-address xy This command blocks the range between the IP addresses x and y for the DHCP assignment, ie all addresses which are located in this interval are no longer assigned to terminals as an IP configuration.


Command structure
packet-tracer input <source interface> <protocol> <source IP> <source port> <destination IP> <destination port> [detailed]

  • Tracert, Traceroute or Trace Route, is a command-line tool that allows you to use a set of computer network diagnostic commands to troubleshoot TCP/IP problems. Tracert CMD can trace the path that an Internet Protocol (IP) packet takes to its destination.
  • Configuring FTP Server explained using CISCO Packet Tracer.

Useful commands to be used in conjunction with the packet-tracer is “clear conn” and “clear xlate” to clear connection table and NAT-table.

  • NOTE: You will obviously kill all IP-sessions running through the appliance using the clear-commands. So use it at your own risk and don’t blame me if your users comes running after you wielding pitch forks and torches. ,)

Example
Following is an example of a packet-trace to a web-server through a VPN-tunnel, without the “detailed”-option.
My comments in red.

CiscoASA# packet-tracer input inside tcp 10.20.30.40 54444 10.50.60.70 http

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 outside

Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group ACL-inside-in in interface inside
access-list ACL001f-inside-in extended permit ip any any
Additional Information:

Memory Dec 18, 2019 Available Physical Memory; The reporting in the following diagnostic tool has not changed: The Performance tab in Task Manager; When the physical RAM that is installed on a computer equals the address space that is supported by the chipset, the total system memory that is available to the operating system is always less than the physical RAM. Got a new computer and my Installed Physical Memory (RAM) is 8.00GB whereas my Avaiable Physical Memory is 370MB. I game on my PC and I am getting very low FPS with many lag spikes in all of the game I play, I'm assuming this is the problem, but if anyone notices anything in my specs that could be effecting my pc performance, id appreciate some.

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect http
service-policy global_policy global
Additional Information:

Phase: 7
Type: NAT-EXEMPT
Subtype:
Result: ALLOW
Config:
nat-control
match ip inside 10.20.30.0 255.255.255.0 outside 10.40.50.0 255.255.255.0
NAT exempt
translate_hits = 51480, untranslate_hits = 854212
Additional Information:
THE TRAFFIC IS NOT NATED, EVEN THOUGH PHASE 8/9 RESULTS YIELDS RESULT “ALLOW”.

Phase: 8
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 access-list inside_nat_outbound
nat-control
match ip inside 10.20.30.0 255.255.255.0 outside host 10.2.2.10
dynamic translation to pool 1 (200.200.200.200 [Interface PAT])
translate_hits = 0, untranslate_hits = 0
Additional Information: Insanity max 30 utorrent.

Phase: 9
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 10.20.30.0 255.255.255.0
nat-control
match ip inside 10.20.30.0 255.255.255.0 outside any
dynamic translation to pool 1 (200.200.200.200 [Interface PAT])
translate_hits = 3205631, untranslate_hits = 383007
Additional Information:

Phase: 10
Type: VPN
Subtype: encrypt
Result: ALLOW
Config:
Additional Information: TRAFFIC MATCHES VPN AND WILL BE ENCRYPTED

Clear Command Prompt In Cisco Packet Tracer

Phase: 11
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 13
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 10948889, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow FINAL ACTION IS ALLOW WHICH MEANS THE PACKET IS NOT STOPPED IN CONFIGURATION AND WILL BE PASSED ON.

If I try to run the same command again, we will see it matches an existing flow in phase 2 and promptly passed on.

Router

CiscoASA# packet-tracer input inside tcp 10.20.30.40 54444 10.50.60.70 http

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found flow with id 10953078, using existing flow

Result:
input-interface: inside
input-status: up
input-line-status: up
Action: allow

Packet tracer via ASDM / GUI
You can also find the packet-tracer is ASDM via “Tools > Packet Tracer”:

Summary :

Tracert (Trace Route) is a command-line utility and this post introduces how to use tracert cmd to troubleshoot computer network problems. FYI, MiniTool software provides professional data recovery software, disk partition manager, system backup and restore software, and more.

Tracert, Traceroute or Trace Route, is a command-line tool that allows you to use a set of computer network diagnostic commands to troubleshoot TCP/IP problems. Tracert CMD can trace the path that an Internet Protocol (IP) packet takes to its destination.

Below you can check how to use Tracert utility commands to troubleshoot Windows network problems.

Tracert command is available in Command Prompt in Windows 10/8/7 and older Windows versions.

Packet Tracer Command Prompt List

Tracert Command Options

You can use different Trace Route command switches after tracert to conduct different network diagnostics on Windows 10.

To use Tracert command in CMD, you need to firstly enter into Command Prompt in Windows 10. You can press Windows + R, type CMD, and press Ctrl + Shift + Enter to open elevated Command Prompt on your Windows 10 computer.

Flashxp

The Tracert command syntax is as follows: tracert -d -h maximum_hops -j host-list -w timeout target_host.

Below are popular traceroute command options.

Packet Tracer Commands List

  • tracert /? – the help switch of Tracert command. You can type this command in CMD to list Tracert command options with detailed help explanation.
  • - d – this option prevents Tracert utility to resolve IP address to hostnames. This can result in much faster results.
  • -h maximum_hops – specify the maximum number of hops in the search for the target.
  • -j host-list – specify loose source route along the host-list.
  • -w timeout – specify the time in milliseconds to allow each reply before timeout.
  • target_host – specify the name or IP address of the target host.
  • -4 – force Tracert CMD utility to use IPv4 only.
  • -6 - force Tracert CMD utility to use IPv6 only.

For example, you can type tracert www.google.com in Command Prompt and press Enter to show the path from the local computer to the network device with the hostname www.google.com.

For more information and usage example of Tracert CMD utitlity, you can visit: How to Use TRACERT to Troubleshoot TCP/IP Problems in Windows.

There are several other network diagnostic CMD tools you can use to troubleshoot network problems on Windows 10.

For instance, you can use Winsock reset command to reset Winsock catalog and reset compter network adapter software to default settings.

Sometimes you may want to reset TCP/IP in Windows 10 with Netsh commands to fix internet connection problems.

MiniTool Free Software You Might Be Interested

MiniTool Power Data Recovery – this software allows you to easily recover lost/deleted data from Windows computer local drive, external hard drive, SSD, USB, SD card, memory card, and more in a few clicks.

Command Prompt Packet Tracer

MiniTool Partition Manager – manage disk partitions. You can use this free tool to create/delete/extend/resize/format partition, etc. It lets you manage hard disk in all aspects.

MiniTool ShadowMaker - professional free PC backup software allows you select files, folders, partitions or entire disk to back up to external hard drive, USB, network drive, etc. It lets you create a system image backup for your Windows computer. When needed, you can easily restore Windows computer with it.

MiniTool MovieMaker – free video maker & editor allows you to edit video and make personalized video.

MiniTool Video Converter – lets you convert between 1000+ video and audio formats for free at fast speed.

MiniTool uTube Downloader – allows you download YouTube videos, audios, subtitles to computer for offline playback.