Tracert大家都比较熟悉，通过它我们可以了解数据包经过的路径。如果网络出现了故障，我们可以在自己的PC上运行该命令，从而可以帮助我们定位故障点。

在Cisco的防火墙ASA上有一个类似Tracert的命令Packet-tracer， 此命令可以模拟通过防火墙的流量，从而可以检测你配置的ASA上的策略是否生效，帮助你定位数据包在通讯过程中在哪个节点被阻止，是非常有用的排错工具。命令格式如下：

packet-tracer input [src_int] protocol src_addr src_port dest_addr dest_port [detailed] [xml] 

 

asa5510# packet-tracer input inside icmp 192.168.1.1 25 25 192.168.101.6

 

Phase: 1

Type: FLOW-LOOKUP

Subtype: 

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

 

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   0.0.0.0         0.0.0.0         outside

 

Phase: 3

Type: IP-OPTIONS

Subtype: 

Result: ALLOW

Config:

Additional Information:

 

Phase: 4

Type: INSPECT 

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

 

Phase: 5

Type: NAT-EXEMPT

Subtype: 

Result: ALLOW

Config:

nat (inside) 0 access-list nonat

nat-control

match ip inside 192.168.1.0 255.255.255.0 outside 192.168.101.0 255.255.255.0

    NAT exempt

    translate_hits = 1903, untranslate_hits = 1887

Additional Information:

 

Phase: 6

Type: NAT

Subtype: 

Result: ALLOW

Config:

nat (inside) 1 192.168.1.0 255.255.255.0

nat-control   

match ip inside 192.168.1.0 255.255.255.0 outside any

    dynamic translation to pool 1 (58.246.135.204 [Interface PAT])

    translate_hits = 152927, untranslate_hits = 101108

Additional Information:

 

Phase: 7

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

nat (inside) 1 192.168.1.0 255.255.255.0

nat-control

match ip inside 192.168.1.0 255.255.255.0 outside any

    dynamic translation to pool 1 (58.246.135.204 [Interface PAT])

    translate_hits = 152927, untranslate_hits = 101108

Additional Information:

 

Phase: 8

Type: ×××

Subtype: encrypt

Result: DROP

Config:

Additional Information:

              

Result:       

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop 

Drop-reason: (acl-drop) Flow is denied by configured rule