topic Re: GlobalProtect initiating network trace capturing using the Netsh tool in Windows . in GlobalProtect Discussions

GlobalProtect initiating network trace capturing using the Netsh tool in Windows .

Candance — Fri, 28 Jul 2023 09:31:24 GMT

Good day

I'm experiencing an issue where I'm receiving influx of alerts related to this netsh tool.

I got this arlticle and I was wondering if you can assist me in finding the cause of this behaviour.

https://www.reddit.com/r/paloaltonetworks/comments/144z38e/globalprotect_initiating_network_trace_capturing/

Re: GlobalProtect initiating network trace capturing using the Netsh tool in Windows .

lyuk26 — Thu, 12 Oct 2023 15:11:41 GMT

Noticed this as well, and would like to hear an explanation on why its running Netshell. Thanks!

Re: GlobalProtect initiating network trace capturing using the Netsh tool in Windows .

TANielsenBest — Tue, 24 Oct 2023 15:56:40 GMT

I've noticed this too.

Re: GlobalProtect initiating network trace capturing using the Netsh tool in Windows .

KenGutierrez — Tue, 23 Apr 2024 15:38:19 GMT

Has anyone found why this action takes place?

Re: GlobalProtect initiating network trace capturing using the Netsh tool in Windows .

KenGutierrez — Tue, 23 Apr 2024 16:13:56 GMT

I opened a support ticket.

Per support this IS expected behavior.

Re: GlobalProtect initiating network trace capturing using the Netsh tool in Windows .

JayGolf — Wed, 24 Apr 2024 01:46:10 GMT

Thanks for sharing @KenGutierrez , did they include any other details?

Re: GlobalProtect initiating network trace capturing using the Netsh tool in Windows .

KenGutierrez — Wed, 24 Apr 2024 17:01:05 GMT

The explanation given was that netsh is a tool for troubleshooting built-in to MS. Said but not said was that if GP encountered an issue it triggers the usage of netsh in assisting the troubleshooting of the GP connection. In my case when the trace was triggered coincided with my rebooting of a firewall that I was GP connected to (remote firewall location). I was upgrading/patching my firewall and needed to reboot, this dropped my GP connection (as expected). Since GP saw that as an abnormal behavior (or error of some type) that triggered the netsh trace process. That is the best I can deduce as to why the trace action was taken - as I said all I received from support was that netsh usage is "expected" behavior. The rest was my deduction what was taking place at the time. Hope that helps someone else.