If you can't run a sniffer, just do the next best thing and capture on the pix itself:

I don't have the exact syntax in front of me, but it should run something like this:

access-list acl-capture permit ip host blah1 host blah2
access-list acl-capture permit ip host blah2 host blah1

capture mycapture acl-capture

copy /pcap capture:mycapture tftphost:mycapture.pcap

And you just got yourself a nice pcap file to analyse...


Ammo