Starting ASG 6.7.2.x, Proxy and Content Analysis communication is through Internal TCP, the traffic can be captured by enabling Internal PCAP on Advanced Secure Gateway (ASG).
Start Internal PCAP:
1. Go To https://ASG-IP:8082/PCAP-INTERNAL/statistics
2. Click Start
3. Reproduce the issue till it happens
4. Click Stop
5. Click Download
How to read the PCAP:
Content Analysis (COE) uses IP address/source port = 254.0.0.1/1344,
Proxy uses IP address/source port 254.0.0.2/any valid source port