topic Re: Port analyse by TCPDUMP in General Topics

Port analyse by TCPDUMP

BLAISEMONT — Thu, 02 Nov 2017 17:38:40 GMT

Hello All,

I would like to capture packet by tcpdump on other interface than management interface.

How can do it ? (please explain more detailled as possible).

Thanks for your help.

GB.

Re: Port analyse by TCPDUMP

Mick_Ball — Thu, 02 Nov 2017 17:55:15 GMT

i dont think you can so I just use /monitor/packet capture

Re: Port analyse by TCPDUMP

Mick_Ball — Thu, 02 Nov 2017 18:03:56 GMT

or from CLI

https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Run-a-Packet-Capture/ta-p/62390

Re: Port analyse by TCPDUMP

BLAISEMONT — Thu, 02 Nov 2017 19:37:57 GMT

Yes, thanks. But i precise that i would like to see the trafic streaming in real time like tcpdump under Linux, because i manipulate the rules in production, and i don't cut for more than a few second. I don't have a sandbox to test.

Re: Port analyse by TCPDUMP

Mick_Ball — Thu, 02 Nov 2017 20:58:25 GMT

Ok this is not possible, you could mirror the port on the switch or install a hub between the PA and your switch.

Re: Port analyse by TCPDUMP

gwesson — Thu, 02 Nov 2017 21:38:27 GMT

Technically it can be done using the "follow yes" option in CLI:

> view-pcap follow yes verbose++ filter-pcap tx-test

It will not help @BLAISEMONT much though, because once you change rules you have to commit the changes and then all the traffic is affected. It's also a burdon to the management plane if the capture filter is not narrow enough. The mirror/span port option is by far the best, as long as the switch can handle it.

In case that's missed, you should avoid doing this in production just in case.

Generally without a lab/sandbox though, I'd recommend creating a test rule change that would only apply to the test user above the rule being changed. That allows you to test things out without affecting production.