Capture traffic as is on the wire?

mjensen40400 — Mon, 12 Apr 2021 14:25:36 GMT

On a Palo Alto is there a way to take a packet capture on a specified interface and simply see everything as is on the wire?

For example on a Check Point I can do a tcp dump on a specified interface and the interface is basically put into promiscuous mode and I see traffic after firewall, after NAT, etc. On my Palo's it seems I have to pick a stage for a capture and I can't find a way to simply see everything as is on the interface / wire level.

Re: Capture traffic as is on the wire?

kiwi — Tue, 13 Apr 2021 08:42:53 GMT

Hi @mjensen40400 ,

You are current. You can get the PCAP for the different stages and merge them together to get the complete view.

The importance of the stages is to ensure you are able to verify if NAT is applied properly. It also allows you to see if there's a difference between the packets sent out and received from both the client and server perspectives:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0

Don't get me wrong ... I totally understand how a tcpdump can be a very quick and easy way to look at the traffic. You can do a tcpdump on the management interface at the moment:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleECAS

There's also a feature request for this (FR# 947 - tcpdump style command for packet capture) so I would certainly recommend you to reach out to your local SE and have him add your vote to this request. Share the word and have more customers add their vote.

Cheers !

-Kiwi.

topic Re: Capture traffic as is on the wire? in General Topics

Capture traffic as is on the wire?

Re: Capture traffic as is on the wire?