topic Packet capture in General Topics

Packet capture

Jatin.Singh — Fri, 19 Jul 2019 00:41:25 GMT

We have an issue with SIP sessions randomly hang on the firewall. We are trying to do packet capture on the Palo alto firewall. Since the issue is random, so we need to leave the packet capture on until it happens next time.

It seems the firewall automatically turns off the packet capture after about 10 to 15 minutes. Is that by design? Is there anyway we can leave it on for long period of time?

Also will the capture files keeps deleting the old packets and keep the latest ones?

Re: Packet capture

allee — Fri, 19 Jul 2019 03:56:33 GMT

Looks like there is a hard limit of 209,715,200 bytes = 210 Mb

What file sizes are you seeing once the .pcap turn off?

Also, one thing that may help is locking down the filters to a specific source/dest IP address and source/dest port.

Re: Packet capture

Jatin.Singh — Fri, 19 Jul 2019 04:45:28 GMT

Yes we have filtered to specific source and destination and port. It turns off packet capture by itself about 10 minutes regardless the size of the file, which was under 8M.

I am thinking of using tcpdump in command line to do the packet capture. Will it do the capture continuously? For how long? Can we export the file to a external tftp server?

Re: Packet capture

allee — Fri, 19 Jul 2019 21:50:16 GMT

@Jatin.Singh tcpdump is for taking .pcap on the management interface only.

Have you tried doing an App Override or turning off ALG?

Here's a good troubleshooting doc for troubleshooting VoIP issues:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmUiCAK