topic PA random packet captures in General Topics

PA random packet captures

jambulo — Tue, 26 Mar 2013 15:14:29 GMT

I've noticed that our 5020 is taking (what seems like)random packet captures. I searched this forum about this, and have read that the PA does do packet captures if the traffic is identified as "unknown-tcp" and "insufficient-data". The traffic I see that is generating pcaps seems random. For example, there are pcaps for "ciscovpn", "apple-push-notifications", "kontiki", etc. If I look into the "Log Details", these sessions are not hitting any Threat rules that might have caused a packet capture. Also, CLI packet capturing(set application dump) is off, as well as the packet capture option in the GUI. Anyone else experience this?

Thanks

Re: PA random packet captures

sraghunandan — Tue, 26 Mar 2013 18:32:06 GMT

So does it capture random packets with the expected ones or only random packets.

Re: PA random packet captures

jambulo — Tue, 26 Mar 2013 21:04:45 GMT

When I tell it to capture packets, it'll capture the specified packets just fine. But with packet capturing turned off, it's still capturing packets, and randomly it seems.

Re: PA random packet captures

sraghunandan — Tue, 26 Mar 2013 21:24:50 GMT

Weird. Please open a case with support so that we can investigate the issue.