topic Re: tcpdump like packet capture on PA in General Topics

tcpdump like packet capture on PA

fatboy1607 — Mon, 02 Feb 2015 18:41:56 GMT

how can check dhcp packet on PA , for example using tcpdump -i Internal port 67 we see on unix/linux boxes.

how can we check same dhcp request and response packet on PA .

Re: tcpdump like packet capture on PA

Mystique — Mon, 02 Feb 2015 18:49:11 GMT

If OS version 6.0 and above then,

tail follow yes mp-log pan_dhcpd.log

tail follow yes mp-log dhcpd.log

Re: tcpdump like packet capture on PA

fatboy1607 — Mon, 02 Feb 2015 19:05:26 GMT

getting error

2015-01-13 03:20:39.392 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-01-14 07:05:26.362 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:521): Error reading dhcp client persistent rt obj xml file

2015-01-14 07:05:26.362 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-01-23 03:27:59.331 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:521): Error reading dhcp client persistent rt obj xml file

2015-01-23 03:27:59.332 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-01-29 10:07:10.330 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:521): Error reading dhcp client persistent rt obj xml file

2015-01-29 10:07:10.330 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-01-29 10:09:52.329 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:521): Error reading dhcp client persistent rt obj xml file

2015-01-29 10:09:52.329 +0000 Error: pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-02-02 19:03:09.437 +0000 Error: pan_dhcpd_opcmd_show_state

Re: tcpdump like packet capture on PA

HULK — Mon, 02 Feb 2015 19:10:09 GMT

Hello Mandar,

You may enable packet capture for those DHCP initial messages, as mentioned below.

Configure the first dataplane packet-diag filter to capture DHCP Discover, DHCP Request, and DHCP Inform packets. This filter will capture UDP traffic on source port 68 (bootpc) and destination port 67 (bootps).

> debug dataplane packet-diag set filter match protocol 17 source-port 68 destination-port 67

Configure a second dataplane packet-diag filter to capture DHCP ACK, DHCP NACK, and DHCP Offer packets. This filter will capture UDP traffic on source port 67 (bootps) and destination port 68 (bootpc).

> debug dataplane packet-diag set filter match protocol 17 source-port 67 destination-port 68

Enable pre-parse match. This is necessary to collect DHCP packets destined for the DHCP Client interface.

> debug dataplane packet-diag set filter pre-parse-match yes

Enable the packet filter.

> debug dataplane packet-diag set filter on

Configure Packet Captures on the transmit, receive, and drop stages to collect DHCP packets.

> debug dataplane packet-diag set capture stage drop file dhcp-drop

> debug dataplane packet-diag set capture stage transmit file dhcp-tx

> debug dataplane packet-diag set capture stage receive file dhcp-rx

Packet capture is enabled

You are set to capture DHCP Client traffic once traffic is generated generated. Upon completion, be sure to disable (in the following order) packet captures and packet filters.

Run the following commands:

> debug dataplane packet-diag set capture off

Packet capture is disabled

> debug dataplane packet-diag set filter off

debug packet filter: off

OR, do the same from PAN GUI.

** Please mark my answer as correct/helpful if appropriate.**

Hope this helps.

Thanks

Re: tcpdump like packet capture on PA

HULK — Mon, 02 Feb 2015 19:19:47 GMT

Which PAN OS is running into this Firewall.?

Thanks