topic Queries on Packet Captures. in Next-Generation Firewall Discussions

Queries on Packet Captures.

Satyak — Fri, 28 Mar 2025 13:11:07 GMT

Hi Friends,

I have few queries on the Packet captures and traffic logs

1. If we are pinging from the management ip to the gateway ip i am able to ping but how can i see those logs on the GUI of the firewall.

According to my understanding the Traffic logs which we see completely rely on the data plane and the test which i am doing is on the management so my question is that if i need to see those logs i need to take TCP dump... apart from that is there any way.

2. In Packet capture i set the filter source and destination of user and sever internal ip's in bi-directional way.

My question is that the packet capture should capture only the traffic of the filter's which i have set.... if there is no communication happening no packets should be captured.

This is how packet capture works or even though the communication is not happening packet will get captured...

Any inputs on these queries.

Thanks and Regards

Satya Kalyan

Re: Queries on Packet Captures.

ozheng — Wed, 02 Apr 2025 04:12:04 GMT

Hello @Satyak

My question is that the packet capture should capture only the traffic of the filter's which i have set.... if there is no communication happening no packets should be captured.

Not sure to understand your question, but yes if you set a filter, only the packets matching the filter will be captured.

Olivier

Re: Queries on Packet Captures.

reaper — Wed, 02 Apr 2025 09:30:31 GMT

the packetcapture tool onlyt captures packets hitting the dataplane. anything sent out from the management interface that doesnt touch the dataplane will not be visible in packetcapture tool

you can use tcpdump from the CLI to capture anything happening on the management interface