topic Re: Replay pcap in General Topics

Replay pcap

hkp — Tue, 07 Jan 2014 13:34:55 GMT

Is there any way that I could feed a pcap into the firewall?

What I would like to do is take a pcap and run it through a monitor port to test out some rules and IDS settings. Right now my plan is to use tcpreplay, but I was curious if there was any way to do this natively in the firewall.

Re: Replay pcap

kprakash — Tue, 07 Jan 2014 13:57:48 GMT

I am afraid if there is a way to import the pcaps into the firewall, and this requires a feature request. Please contact your SE to add this feature.

If you want to test the rules and the IDS settings, configure 2 interfaces on the PANFW as part of a Vwire pair. Connect bothf these interfaces to a replay server ( for traffic coming in both the directions, ie client to server and server to client), and then replay the pcap from the replay server.

Hope that Helps!

BR,

Karthik RP

Re: Replay pcap

Gregoux — Tue, 07 Jan 2014 14:03:11 GMT

did you see that

https://live.paloaltonetworks.com/docs/DOC-5724

pcap replay

Re: Replay pcap

hkp — Tue, 07 Jan 2014 15:07:25 GMT

I don't have access to that.

"Access to this place or content is restricted."

Re: Replay pcap

hkp — Tue, 07 Jan 2014 15:08:58 GMT

Thanks for the response kprakash. I just thought it would be cool if I was able to do this while I was setting up a replay.