TCPDUMP execution

iscott — Mon, 09 Mar 2020 21:19:33 GMT

Hello,

I have to do a TCPDUMP to test the communication of my Active Directory because a have a problem with the User-ID service.

I have read the documentation and I don't understand when says that the TCPDUMP captures the traffic that traverses the MGT interface. So what happens with the traffic that traverses the data plane and not the management plane? For example, the authentication communication starts on a computer and goes to the AD server. I think that this is traffic that traverses the data interfaces.

The link that I've used is:

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/take-packet-captures/take-a-packet-capture-on-the-management-interface

Can someone help me to understand?

Regards,

Re: TCPDUMP execution

BPry — Tue, 10 Mar 2020 02:21:26 GMT

@iscott,

The process that you are looking at is very specific to the management interface; if the data is going across a dataplane interface you would simply follow the usual PCAP process.

topic TCPDUMP execution in General Topics

TCPDUMP execution

Re: TCPDUMP execution