topic Re: Packet Capture instance within Details of Traffic Log in General Topics

Packet Capture instance within Details of Traffic Log

MGoodnow — Mon, 15 Nov 2010 20:07:40 GMT

Hello,

What is the significance of the "green down arrow" packet capture within the "Details" field of the Traffic Log? We have no packet capture defined and it only shows up randomly for certain connections. Is this an automatic output if there are issues within the session? Thanks!

Cheers,

Mike

Re: Packet Capture instance within Details of Traffic Log

pkruse — Tue, 16 Nov 2010 15:16:33 GMT

The segmented down arrow represents a packet capture, this would be something that you or somebody who might have access to your PAN setup. It can be done via policy or from within the CLI. When you do see these they represent a specific packet type often unique to a given application. Look at your app filter as this is the most common usage.

~Phil

Re: Packet Capture instance within Details of Traffic Log

MGoodnow — Wed, 17 Nov 2010 16:04:12 GMT

In this case - it's not a defined application in the rule. It's a defined port. Also I never setup packet capture on this device - neither cli or policy. And the down arrow is random - only shows up once in a while. That's why I thought perhaps it was auto creating a capture based on an event happening.