Byte swapping needed on packet captures taken from tunnel interfaces

Luke_Godwin — Fri, 17 Jan 2025 02:02:28 GMT

I noticed something odd with packet captures taken involving traffic originating from a tunnel interface (used for GP VPN clients) where the Ethernet Type header was byte swapped. Meaning instead of 0x0800 it was 0x0008.

The screen snips illustrate the raw exported packets from a NGFW running 11.1.4-h1. Wireshark 4.4.3 with no packet dissector/decode rules.

But using Hxd to byte swap the length field then allows Wireshark to make full sense of the packet. Seems to me that PANOS is writing out that field as little-endian rather than the network-byte order of big endian.

Why does this happen? Not sure if I need to raise a support ticket or a defect/enhancement request ticket for this. Happens reproducibly across multiple packet captures.

topic Byte swapping needed on packet captures taken from tunnel interfaces in Next-Generation Firewall Discussions

Byte swapping needed on packet captures taken from tunnel interfaces