topic Re: Packet Capture stopped working in General Topics

Packet Capture stopped working

JoergK — Fri, 31 May 2013 15:41:31 GMT

Hi,

the last days I did some captures on a PA-2020. At Yesterday I tried again but it doesn't work anymore. Tried via WebGUI and CLI.
If I start the capture it is shown running but no files are created. PAN-OS is 4.1.12.

Does anybody know this issue? Can it get fixed without restarting dataplane or device?

Thanks

Jörg

Re: Packet Capture stopped working

sdurga — Fri, 31 May 2013 17:13:32 GMT

Try clearing all the Packet capture settings to default and set the filters and the capture files new again.

You can clear all the Packet capture settings using the command "debug dataplane packet-diag clear all "

Tx,

Sandeep

Re: Packet Capture stopped working

sraghunandan — Fri, 31 May 2013 18:18:34 GMT

Can you see packet count incrementing for you capture stages , use this command to verify the same

debug dataplane packet-diag show setting

Re: Packet Capture stopped working

JoergK — Mon, 03 Jun 2013 11:44:19 GMT

Hi sdurga,

already tried this. Didn't fix the problem.

Thx

Jörg

Re: Packet Capture stopped working

JoergK — Mon, 03 Jun 2013 11:48:36 GMT

Hi sraghunandan,

the capture seems to work:

PAGATE> debug dataplane packet-diag show setting

Packet capture

Enabled: yes

Snaplen: 0

Stage firewall : file firew

Captured: packets - 70041 bytes - 41621506

Maximum: packets - 0 bytes - 0

But no files are generated:

FW-PAGATE> view-pcap follow yes filter-pcap

<No files available> Directory is empty

Thx

Jörg

Re: Packet Capture stopped working

kdd — Mon, 03 Jun 2013 12:21:41 GMT

Hi Joergk,

how long is the name of the interface? we use panos 5.0.3 with 5020 and capturing doesn't work because of long if-name. instead of eth1/3.4040 it will be shortened to eth1/3.404

Maybe it is the same problem.

Regards Klaus

Re: Packet Capture stopped working

JoergK — Mon, 03 Jun 2013 12:58:29 GMT

Thx Klaus,

good to know! And really poor if length of IF name causes issues in further releases :smileyconfused:

But in my case it already worked.

Re: Packet Capture stopped working

sraghunandan — Mon, 03 Jun 2013 23:56:58 GMT

can try the following

> debug software restart vardata-receiver

wait for some time and see if it fixes it.

Re: Packet Capture stopped working

cchristiansen — Tue, 04 Jun 2013 04:52:43 GMT

Hello Joergk,

I believe that Klaus may be correct. This sounds very similar to a known issue. You should open a case with support so that they can investigate.

-chadd.

Re: Packet Capture stopped working

JoergK — Tue, 04 Jun 2013 07:31:14 GMT

Hi sraghunandan,

> debug software restart vardata-receiver

fixed the problem

Thx

Jörg