IPS - set up packet logging

[Samir.Belkessam]

Dears,

I would like to know if there is a possibility to collect some packets before and after the packet that trigged the attack signature

it will be helpful in case of troubleshooting and confirm if this attack is a false positive or real attack( knowing that this option is available from other vendors )

Thanks and regards

Samir.

[mikand]

When you setup a profile for the IPS in Objects -> Security Profiles -> Vulnerability Protection you can define if packet capture should be performed or not (either globally like a group of threatid's or specific threatid's).

I cant find any info in the manual if packets from before the packet that triggered the attack signature will be part of this pcap.

[Samir.Belkessam]

Thanks Mikand for you reply, is there someone who can clarify us on this ?