override traffic packet capture

hbshin — Thu, 17 Jan 2019 02:18:07 GMT

Hi, all

I have questions about Application Override traffic packet capture.

Q1. when i enable App override, Overridden traffic is offloaded without reaching Dataplane. is it correct?

Q2. Overridden Initial packet such as UDP when session setup is offloaded?

Q3. I think any traffic that is offloaded can't do packet capture without disable hardware offload off but i don't know how i could capture overridden packet

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/disable-hardware-offload#

admin guide says.

For example, encrypted traffic (SSL/SSH), network protocols (OSPF, BGP, RIP), application overrides, and terminating applications can be offloaded to the FPGA and therefore are excluded from packet captures by default

Thanks.

Re: override traffic packet capture

BPry — Fri, 18 Jan 2019 22:09:30 GMT

@hbshin,

1) Depends on if your device has a network processor, but regardless it goes through the "fast path" yes.

2) I don't believe the first packet is ever offloaded on a session, could be wrong though.

3) Offloaded traffic won't reach the dataplane, which is required by the packet capture process. You'll need to actually temporarily disable offloading to capture this traffic.

topic Re: override traffic packet capture in General Topics

override traffic packet capture

Re: override traffic packet capture