topic Re: How to see geneve encapsualted header information in packet capture in VM-Series in the Public Cloud

How to see geneve encapsualted header information in packet capture

Sephora_IT — Mon, 25 Apr 2022 20:47:12 GMT

How to see geneve encapsualted header information in packet capture

Re: How to see geneve encapsualted header information in packet capture

PavelK — Sun, 01 May 2022 12:56:12 GMT

from your post it is not clear how this is related to Palo Alto, however Wireshark is supporting GENEVE ever since version 2.0.0. The dissector is using default port UDP 6081. If you expand packet details, you should see details of encapsulated frame/packet.

Kind Regards

Pavel

Re: How to see geneve encapsualted header information in packet capture

aleksandar.astardzhiev — Thu, 16 Jun 2022 11:45:06 GMT

Hi @PavelK

I am guessing @Sephora_IT question is related to the GENEVE encapsulation between GWLBe (endpoint) in AWS and VM-Series firewall.

Unfortunately I don't believe it is possible to capture GENEVE encapsulation with packet capture on the firewall...Not sure if enabling "pre-parse match" could help, but it should be used only with low volume of traffic

Re: How to see geneve encapsualted header information in packet capture

PavelK — Fri, 17 Jun 2022 09:55:53 GMT

Hello @aleksandar.astardzhiev

I see. Thank you for input.

Kind Regards

Pavel

Re: How to see geneve encapsualted header information in packet capture

bartpmika — Thu, 30 Jun 2022 17:29:36 GMT

you can enable capturing the GENEVE encapsulated traffic by running the following command in CLI:

debug dataplane packet-diag set capture encapsulation yes

Re: How to see geneve encapsualted header information in packet capture

danedeen — Wed, 22 Mar 2023 03:36:22 GMT

Thanks for the debug command, after enabling I can see the udp/6081 encapsulation in my captures.

Dan