topic Re: Packet Capture filters not correct in General Topics

Packet Capture filters not correct

Steve27596 — Fri, 19 May 2017 19:40:40 GMT

I have a problem once in a while where packet capture filters are not working. I set up the filters at one point and if I delete the filters and set up a new filter. Turn packet capture back on and it still gives me captures of the old filter. I can not figure out how to either clear out the filters or clear out the packet capture files.

Anybody see this before?

Thanks,

Steve

Re: Packet Capture filters not correct

Raido_Rattameister — Fri, 19 May 2017 19:53:49 GMT

Packet filters will tag sessions to capture.

If you change filters then active sessions keep the tag and are still captured although filter is different.

> debug dataplane packet-diag clear filter-marked-session all

https://live.paloaltonetworks.com/t5/Management-Articles/Packet-Capture-Contains-Traffic-not-Defined-in-Filter/ta-p/55055

Re: Packet Capture filters not correct

TranceforLife — Fri, 19 May 2017 19:54:44 GMT

Nice. Never had this before but good to know