topic Re: Packet capture of specific Security Rule? in General Topics

Packet capture of specific Security Rule?

ktm530russ — Wed, 19 Jun 2013 23:45:28 GMT

I need to confirm what traffic data (specific DNS Request strings inside the packet) is hitting two specific Security rules, so would like to capture just the traffic that is hitting these rules. Is there any way to do this?

I have run the Packet Capture (in,out,firewall, and drop), filtered to port 53 (DNS), but have no way of knowing WHICH rule the traffic is hitting.

I tried setting one rule to "Block", and was able to see the "Drop" capture traffic for that rule, but my clients started screaming due to legitimate DNS requests failing. Can't do that again.....

Re: Packet capture of specific Security Rule?

emr_1 — Thu, 20 Jun 2013 01:24:11 GMT

I think there is no way to specify security rule for packet capturing.

Can you use 'test security-policy-match ...' command instead?

Re: Packet capture of specific Security Rule?

cchristiansen — Thu, 20 Jun 2013 03:00:19 GMT

It is true that you are not able to simply initiate a packet capture with a security rule as the filter criteria. However, you can do the following:

admin@PA-200> show session all filter rule dns-test

--------------------------------------------------------------------------------

ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])

Vsys Dst[Dport]/Zone (translated IP[Port])

--------------------------------------------------------------------------------

13580 dns ACTIVE FLOW NS 192.168.100.50[52160]/trust/17 (10.19.0.107[39841])

vsys1 10.0.0.246[53]/untrust (10.0.0.246[53])

12502 dns ACTIVE FLOW NS 192.168.100.50[49422]/trust/17 (10.19.0.107[62992])

vsys1 10.0.0.246[53]/untrust (10.0.0.246[53])

13571 dns ACTIVE FLOW NS 192.168.100.50[52502]/trust/17 (10.19.0.107[15692])

vsys1 10.0.0.246[53]/untrust (10.0.0.246[53])

13590 dns ACTIVE FLOW NS 192.168.100.50[62261]/trust/17 (10.19.0.107[32684])

vsys1 10.0.0.246[53]/untrust (10.0.0.246[53])

admin@PA-200> show session id 13580

Session 13580

c2s flow:

source: 192.168.100.50 [trust]

dst: 10.0.0.246

proto: 17

sport: 52160 dport: 53

state: INIT type: FLOW

src user: unknown

dst user: unknown

s2c flow:

source: 10.0.0.246 [untrust]

dst: 10.19.0.107

proto: 17

sport: 53 dport: 39841

state: INIT type: FLOW

src user: unknown

dst user: unknown

start time : Thu Jun 20 03:48:34 2013

timeout : 30 sec

total byte count(c2s) : 95

total byte count(s2c) : 152

layer7 packet count(c2s) : 1

layer7 packet count(s2c) : 1

vsys : vsys1

application : dns

rule : dns-test

session to be logged at end : True

session in session ager : False

session synced from HA peer : False

address/port translation : source + destination

nat-rule : NATOUT(vsys1)

layer7 processing : enabled

URL filtering enabled : True

URL category : any

session via syn-cookies : False

session terminated on host : False

session traverses tunnel : False

captive portal session : False

ingress interface : ethernet1/2

egress interface : ethernet1/1

session QoS rule : N/A (class 4)

admin@PA-200>

"show session all filter rule" will give you the sessions that are currently matching your rule. You can get the session data by doing "show session id <ID>".

Capturing the actual data will require a packet capture, either on the firewall or another machine.

-chadd.

Re: Packet capture of specific Security Rule?

sunright — Thu, 20 Jun 2013 03:56:44 GMT

You can also compared the pcap with traffic log.

Since traffic you look for must be DNS, I would use source port number to identify which packet is corresponding to a specific traffic log.

Traffic log should include rule name as well.

FYI:

This is the way to add column in traffic log in GUI.

https://live.paloaltonetworks.com/docs/DOC-2799

Re: Packet capture of specific Security Rule?

ktm530russ — Thu, 20 Jun 2013 15:21:48 GMT

Thanks for the responses. I DO need to see the acual data inside the packets (looking for which DNS request string is hitting each DNS rule), thus the question regarding packet capture.

I thought of doing the PCAP comparison to the traffic log, but we had over 17,000 DNS capture packets under 2 minutes... even parsing for time-stamps would be a HUGE undertaking...

Re: Packet capture of specific Security Rule?

emr_1 — Thu, 20 Jun 2013 15:59:39 GMT

I found one command that might help you...I hope.

try 'set application dump on rule <rulename> protocol 17 destination-port 53'

you can see green down arrow besides each traffic log after you enter this command

I just mention that if I enter 'set application dump on rule <rulename>', my PAN device somehow collected pcaps for all traffics.

I think only rulename does not work properly.

***Additional Comments***

I confirmed that rulename filter does not work even I specify protocol number and destination number.

This command would not help you.

I apologize for it.

Re: Packet capture of specific Security Rule?

sunright — Mon, 24 Jun 2013 01:54:14 GMT

Hi,

Even though you have 17000 DNS packet, I assume source port is sequence or randomized so it should be possible to match pcap and traffic log?

Were you not able to identify which traffic log was made with which pcap?

You can use filter on GUI like following.

( port.src eq xxx ) and ( port.dst eq 53 ) and ( app eq dns )

There is filter function on CLI as well.

admin@PA-200> show log traffic

+ action action

+ app app

+ csv-output csv-output

+ direction direction

+ dport dport

+ dst dst

+ dstuser dstuser

+ end-time end-time

+ from from

+ query query

+ receive_time receive_time

+ rule rule

+ sport sport

+ src src

+ srcuser srcuser

+ start-time start-time

+ to to

| Pipe through a command

<Enter> Finish input

I hope this helps.

Re: Packet capture of specific Security Rule?

sunright — Mon, 24 Jun 2013 02:21:56 GMT

One correction. the following filter should be sufficient.

( port.src eq xxx ) and ( app eq dns )

Re: Packet capture of specific Security Rule?

sraghunandan — Tue, 25 Jun 2013 03:59:32 GMT

Have you had a chance to review this doc:-

https://live.paloaltonetworks.com/docs/DOC-3601