topic Re: PAN OS Packet Capture in General Topics

PAN OS Packet Capture

snormoyle — Wed, 04 Jan 2012 16:43:06 GMT

I know where and how to start a packet capture on the device. I would like to know if the capture can be configured to capture only specific parameters (ie src ip, dst ip, src port, dst port). I don't see those options on the web GUI.

Re: PAN OS Packet Capture

Retired Member — Thu, 05 Jan 2012 06:34:45 GMT

Yes it is possible to apply filters on packet captures. In fact it is highly recommended as PAN packet-capture is meant as a debugging tool for specific traffic only and not for whole subnet capturing. From within Monitor tab > Packet Capture, there is a Filtering section. Click on Manage Filters. From there you can add up to 4 filters based on source/destination IP, source/destination port, interface or protocol. Be sure to also enable the 'Filtering' switch to ON.

-Richard

Re: PAN OS Packet Capture

snormoyle — Thu, 05 Jan 2012 16:53:19 GMT

That manage filter did not look like a link or button so did not give it any thought to hover the mouse pointer over it.

Thanks that is what I was looking for.