tcpdump like packet capture on PA

Reply
L4 Transporter

tcpdump like packet capture on PA

how can check  dhcp packet on PA , for example using tcpdump -i Internal port 67 we see on unix/linux boxes.

how can we check same dhcp request and response packet on PA .

Highlighted
L2 Linker

Re: tcpdump like packet capture on PA

If OS version 6.0 and above then,

tail follow yes mp-log pan_dhcpd.log

or

tail follow yes mp-log dhcpd.log

L4 Transporter

Re: tcpdump like packet capture on PA

getting error

2015-01-13 03:20:39.392 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-01-14 07:05:26.362 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:521): Error reading dhcp client persistent rt obj xml file

2015-01-14 07:05:26.362 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-01-23 03:27:59.331 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:521): Error reading dhcp client persistent rt obj xml file

2015-01-23 03:27:59.332 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-01-29 10:07:10.330 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:521): Error reading dhcp client persistent rt obj xml file

2015-01-29 10:07:10.330 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-01-29 10:09:52.329 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:521): Error reading dhcp client persistent rt obj xml file

2015-01-29 10:09:52.329 +0000 Error:  pan_dhcp_read_rtobject_from_disk(pan_dhcp_client_obj.c:562): Error reading dhcp client objects from disk

2015-02-02 19:03:09.437 +0000 Error:  pan_dhcpd_opcmd_show_state

L7 Applicator

Re: tcpdump like packet capture on PA

Hello Mandar,

You may enable packet capture for those DHCP initial messages, as mentioned below.

Configure the first dataplane packet-diag filter to capture DHCP Discover, DHCP Request, and DHCP Inform packets. This filter will capture UDP traffic on source port 68 (bootpc) and destination port 67 (bootps).

> debug dataplane packet-diag set filter match protocol 17 source-port 68 destination-port 67

Configure a second dataplane packet-diag filter to capture DHCP ACK, DHCP NACK, and DHCP Offer packets. This filter will capture UDP traffic on source port 67 (bootps) and destination port 68 (bootpc).

> debug dataplane packet-diag set filter match protocol 17 source-port 67 destination-port 68

Enable pre-parse match.  This is necessary to collect DHCP packets destined for the DHCP Client interface.

> debug dataplane packet-diag set filter pre-parse-match yes

Enable the packet filter.

> debug dataplane packet-diag set filter on

Configure Packet Captures on the transmit, receive, and drop stages to collect DHCP packets.

> debug dataplane packet-diag set capture stage drop file dhcp-drop

> debug dataplane packet-diag set capture stage transmit file dhcp-tx

> debug dataplane packet-diag set capture stage receive file dhcp-rx

Packet capture is enabled

You are set to capture DHCP Client traffic once traffic is generated generated.  Upon completion, be sure to disable (in the following order) packet captures and packet filters.

Run the following commands:

> debug dataplane packet-diag set capture off

Packet capture is disabled

> debug dataplane packet-diag set filter off

debug packet filter: off

OR, do the same from PAN GUI.

DHCP-1.JPG

DHCP-2.JPG

** Please mark my answer as correct/helpful if appropriate.**

Hope this helps.

Thanks

L7 Applicator

Re: tcpdump like packet capture on PA

Which PAN OS is running into this Firewall.?

Thanks

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!