topic Re: What are these mysterious pcaps? in General Topics

What are these mysterious pcaps?

rvandegrift — Tue, 16 Dec 2014 22:01:43 GMT

Hello,

I've noticed a boatload of application-pcaps - between 5-15k, on days where they are captured. There are captures from most days, but not every day.

As far as I know, I don't have any traffic captures enabled. All of the following show that captures are disabled:

1. debug dataplane packet-diag show setting (capture and logs disabled on all dataplanes)

2. show running application setting (unknown capture and application capture are disabled)

3. debug ike pcap show (no ipsec config anyhow)

What else could be triggering these captures? Maybe they are used as a part of some firewall feature?

This is on PA-5060 running 6.0.5.

Ross

Re: What are these mysterious pcaps?

bat — Tue, 16 Dec 2014 22:04:03 GMT

Hi rvandegrift

Where are you seeing these captures ? I think these might be getting captured due to one of the security profiles like for some of the threat pcap/extended pcap takes place.

Thanks

Re: What are these mysterious pcaps?

rvandegrift — Tue, 16 Dec 2014 22:12:05 GMT

That's it - it looks like we have an AV profile that has a capture set for some hits. Thanks!

Ross

Re: What are these mysterious pcaps?

HULK — Wed, 17 Dec 2014 06:18:57 GMT

Hello Ross,

You may check the configured AV profile, in casepcapenabled on it.

Example:

Hope this helps.

Thanks

Re: What are these mysterious pcaps?

rvandegrift — Wed, 17 Dec 2014 22:27:28 GMT

I thought this was it, but nope - I disabled the AV profile packet capture yesterday, but there are thousands of new pcaps today:

admin@firewall(active-primary)> view-pcap application-pcap 20141217/

Display all 16625 possibilities? (y or n)

I've exported the device config and the Panorama config to grep through. All capture options are disabled in both places.

Are there conditions under which a device might capture packets anyhow?

Ross