topic Re: Take PCAP from the mgmt interface using the UI in General Topics

Take PCAP from the mgmt interface using the UI

myky — Tue, 27 Aug 2019 10:49:19 GMT

Hi All,

Is there a particular reason why this option is only available from the CLI?

Thanks,

Myky

Re: Take PCAP from the mgmt interface using the UI

BatD — Tue, 27 Aug 2019 12:28:56 GMT

@myky I comes to the Palo Alto architecture - the Mgmt interface is attached to the management plane, which is linux based and you can run tcpdump. All data interfaces are part of the firewall Data Plane which does its own separate packet processing.

Re: Take PCAP from the mgmt interface using the UI

myky — Tue, 27 Aug 2019 12:45:21 GMT

@BatD sounds like a reasonable explanation. Would be nice to have this feature integrated with UI.

Re: Take PCAP from the mgmt interface using the UI

craigomatic — Tue, 27 Aug 2019 14:44:21 GMT

I usually have to keep a cheat list like this:

tcpdump filter "dst 10.10.20.6 or src 10.10.20.6"

view-pcap mgmt-pcap mgmt.pcap

view-pcap no-dns-lookup yes no-port-lookup yes mgmt-pcap mgmt.pcap

Re: Take PCAP from the mgmt interface using the UI

myky — Tue, 27 Aug 2019 14:46:46 GMT

@craigomatic I prefer to upload the file using SCP option. It is better to view it in the .pcap file

Re: Take PCAP from the mgmt interface using the UI

craigomatic — Tue, 27 Aug 2019 14:48:17 GMT

Definitely more readable in WireShark for sure. If you have that option of accessing an scp server ... sometimes that's not available in my experience!

Re: Take PCAP from the mgmt interface using the UI

myky — Tue, 27 Aug 2019 14:54:40 GMT

@craigomatic that is one of the reasons why l started this topic. Another thing with tcpdump, it is good for the basic connectivity check but for instance, if you would like to see RADIUS Access-Accept reply, in particular check for the attributes, tcpdump won't help((

Re: Take PCAP from the mgmt interface using the UI

craigomatic — Tue, 27 Aug 2019 14:58:39 GMT

If it's sent in clear text, with verbose commands and x offsets you should be able to see the packets. I've been able to grab ldap credentials on 389 like that. Not sure about radius. You have a whole other set of troubleshooting commands with auth, like below:

test authentication authentication-profile "CorpLDAP" username user password

Then you have to follow the authd.log:

tail follow yes mp-log authd.log

Re: Take PCAP from the mgmt interface using the UI

myky — Tue, 27 Aug 2019 15:07:08 GMT

Thanks @craigomatic, very useful info