How to Interpret Traffic Monitor Output

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to Interpret Traffic Monitor Output

Not applicable

I have traffic going over a VPN tunnel. There is a rule alllowing the traffic and routing isn't a problem.

A source host isn't connecting to a host across the tunnel. In monitor I'm seeing entries that say the packet is allowed but in the application column the entry says "insufficient data". What does that mean?  Where can I find a list of expected entries for that column and what they mean?

Thanks for any help.

2 REPLIES 2

L4 Transporter

Hello Wesse,

Insufficient data in the application field

Insufficient data means that there was not enough data to identify the application. So for example, if the 3-way TCP handshake completed and there was one data packet after the handshake but that one data packet was not enough to match any of our signatures, you would see insufficient data in the application field of the traffic log.

https://live.paloaltonetworks.com/docs/DOC-1549

Please verify on the tunnel you have created you have proxy id setup for the subnet traffic that needs to go through the tunnel. However if you have both sides as palo alto then you do not need to set proxy id.

Here is a doc which explains why proxy ids are needed.

https://live.paloaltonetworks.com/docs/DOC-3073

Also if you still see the issue after verifying this you can use the following steps to troubleshoot

1. Need to setup the filters for the traffic we are interested in. To do this, execute the following steps:

Navigate to Monitor--Packet Capture

Click 'Manage Filters'

Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank )

Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field)

2. Setup up the captures

Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop)

3. Enable filters and captures

debug dataplane packet-diag set filter on

debug dataplane packet-diag set capture on

4. open 2 CLI windows

on 1 run the following command to look at the counter ( make sure it run this command once before running the traffic)

show counter global filter packet-filter yes delta yes

on the 2nd window run the following command to look at he sessions

show session all filter source <ip address> destination <ip address>

After your test has been done stop all the captures and filters and see if global counter show you anything why it is dropping the traffic or if you have getting pcap with drop stage.

This will help you narrow down the issue.

Let us know if this helps you resolve the issue.

Thanks

Numan

  • 2075 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!