topic Re: Pcap exports fail in General Topics

Pcap exports fail

nwallette — Mon, 20 Jun 2011 17:59:27 GMT

From the cli:

adming@pan2020> scp export threat-pcap from 20110619 to root@linuxhost:/root/pcaps

Password: hunter2

/opt/panlogs/session/pan/threat/20110619: not a regular file

admin@pan2020>

Bug? Should I feed it bran or yogurt?

Edit: OS 3.1.8

Re: Pcap exports fail

bpappas — Mon, 20 Jun 2011 18:38:26 GMT

try adding *

e.g. from 20110619*

we do not recommend feeding your firewall anything other than AC power and network packets.

-Benjamin

Re: Pcap exports fail

nwallette — Mon, 20 Jun 2011 21:33:08 GMT

No change. 😞

Thanks for the suggestion though.

Re: Pcap exports fail

bpappas — Mon, 20 Jun 2011 21:36:15 GMT

you should be able to export each file individually if you specify the full filename.

Re: Pcap exports fail

nwallette — Mon, 20 Jun 2011 21:45:05 GMT

How would I do that? Pre-pending the path just makes it try to send /opt/panlogs/session/pan/theat//opt/panlogs/session/pan/threat/20110619, which dies with "No such file or directory".

I tried to scp from the Linux host instead, but it just stalls after the password prompt.

Is there some other way to get at any old file with advance knowledge of the path?

Re: Pcap exports fail

bpappas — Mon, 20 Jun 2011 21:56:52 GMT

scp export filter-pcap from <filename> to <username>@<ip-addr>:<path-to-file>

typically filename will equal the name of your packet-diag packet capture. To export the threat pcaps you would replace filter-pcap with threat-pcap.

if you hit the tab key after entering 'from' the system should show you the files that are available for export.

-Benjamin

Re: Pcap exports fail

nwallette — Mon, 20 Jun 2011 22:02:55 GMT

OK, it seems I just wasn't done yet.

20110619 isn't the filename, it's a directory that contains almost 60,000 logs from that day. Swell. :smileylaugh:

Thanks for prodding me in the right direction.