Impact of run tcpdump on every interface.

[Nipon-Deb-Sify]

Hi,

We need to execute tcpdump in PA-VM for a specific reason. We need to TCPdump data from firewalls for 15 minutes at various intervals; there is no specified source or destination. When we run tcpdump from every interface, we want to know if it has any effect? The current utilization

Management CPU 15%
Data Plane CPU 65%
Session Count 2484 / 819200

And details of Firewall is bellow:

VM License VM-300
VM Capacity Tier 9.0 GB
VM Mode Microsoft Azure
Software Version 11.0.2
GlobalProtect Agent 6.1.0

Regards

Nipon

[reaper]

do you have an indication of your bandwidth usage?

the built-in packetcapture will only allow you to capture up to 200mb, roll over to a new file and then another 200mb, but then the rollover is rolled over (i.e. you can have a maximum of 400mb captured per capture type rx/tx/fw/drp)

unless you apply filters, 15 minutes does not seem feasible

I'd worry less about CPU usage at this point