https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240937#M69013 <P>pcap is encrypted even if traffic is decrypted by Palo but Wireshark allows you to decrypt it if you have correct cert...</P> Thu, 22 Nov 2018 21:58:22 GMT Raido_Rattameister 2018-11-22T21:58:22Z https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240930#M69011 <P>&nbsp;</P><P>Need to know can we see or scan user Data if we do PCAP on the SSL decrypted traffic?</P> Thu, 22 Nov 2018 21:25:15 GMT https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240930#M69011 MP18 2018-11-22T21:25:15Z https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240937#M69013 <P>pcap is encrypted even if traffic is decrypted by Palo but Wireshark allows you to decrypt it if you have correct cert...</P> Thu, 22 Nov 2018 21:58:22 GMT https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240937#M69013 Raido_Rattameister 2018-11-22T21:58:22Z https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240940#M69014 The SSL decryption which occurs on the firewall doesn't allow you to create pcaps that you would be able to see unencrypted. You can however SSL "mirror" the decrypted SSL traffic which would then allow you to create the unencrypted pcaps<BR /> Thu, 22 Nov 2018 22:10:45 GMT https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240940#M69014 Brandon_Wertz 2018-11-22T22:10:45Z https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240957#M69029 <P>which cert we need to see the contents of traffic which is ssl decrypted via pcap?</P> Fri, 23 Nov 2018 05:02:20 GMT https://live.paloaltonetworks.com/t5/general-topics/seeing-user-data-by-pcap-and-ssl-decryption/m-p/240957#M69029 MP18 2018-11-23T05:02:20Z