How to decode palo alto netflow app-id from hex value

ssovee — Wed, 08 Nov 2023 04:45:38 GMT

Hi,
I am sending Palo alto netflow to a Linux server. While I capture NetFlow from the server and open it on Wireshark I cannot see appid in plain text format. I only see the hex code. I have attached some screenshot below here.

Is there any way to decode this hex code to a plain text app-id?

Re: How to decode palo alto netflow app-id from hex value

aleksandar.astardzhiev — Thu, 21 Dec 2023 13:51:43 GMT

Hi @ssovee ,

As mentioned here https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/netflow-monitoring/configure-netflow-exports PAN firewall will refresh NetFlow template based on the time interval you specified in the NetFlow server profile.

From your screenshare it looks like PAN firewall is already configured to send PAN-OS specific fields, which include App-ID. However wireshark is unable to recognize this field, and suspect the reason for that is your capture didn't capture NetFlow Template packet sent from the firewall.

You can see example here, how WireShark is able to identify all fields when template is being captured - https://helpdesk.kaseya.com/hc/en-gb/articles/115003522631-How-to-view-NetFlow-in-WireShark

topic How to decode palo alto netflow app-id from hex value in Next-Generation Firewall Discussions

How to decode palo alto netflow app-id from hex value

Re: How to decode palo alto netflow app-id from hex value