topic Re: Complete session captures in General Topics

Complete session captures

KatanaNZ — Tue, 01 Jun 2010 20:33:41 GMT

Hi All,

In an attempt to displace a SNORT environment, with a PAN implementation for monitoring ( at this stage only ),

we need to be able to replicate complete session captures for forensic's ( internal security, police etc ).

Although its possible to capture packets for false positive reasons, how would I go about storing ( most likly off the appliance )

packet captures so they can be reviewed as sessions?

Cheers,

SteveRPCAP

Re: Complete session captures

swhyte — Tue, 01 Jun 2010 22:21:41 GMT

Hello Katana,

while you are able to do packet captures on specific applications and threats on the Paloalto device, those packet captures are limited to just the first couple of packets. I assume that is not what you are looking for.

We can do packet filters, but once again the size would be limited. These captures are primarily for troubleshooting. From what you have described it seems you would like a full dump of all packets for all sessions that come accross the Paloalto device. Currently do not do this. But that is why we have the traffic logs which are very detailed with session info. You can in turn have the traffic logs sent to a syslog server if you desire.

thanks,

Stephen

Re: Complete session captures

KatanaNZ — Thu, 03 Jun 2010 02:43:39 GMT

Will the traffic logs contain packet information though? Thats the key decider, as its needed for potential legal forensics.

Re: Complete session captures

swhyte — Thu, 03 Jun 2010 22:33:49 GMT

If you are refering to the actual data in packets, then no.

Stephen

Re: Complete session captures

mjacobsen — Fri, 04 Jun 2010 00:38:19 GMT

If this was for a specific instance, the device can do session captures but it is not something you would leave on for all traffic going through the device. It would be targeted at tracking specific, suspect flows in the network for a brief period of time. For full network recording, a dedicated capture product would be necessary.

Re: Complete session captures

alexs — Tue, 10 Aug 2010 16:13:33 GMT

What about session packet capture for specific regular expressions / templates in the data patterns filters. can I perform only this action?