override traffic packet capture

Reply
Highlighted
L2 Linker

override traffic packet capture

Hi, all

 

I have questions about Application Override traffic packet capture.

 

Q1. when i enable App override, Overridden traffic is offloaded without reaching Dataplane. is it correct?

 

Q2. Overridden Initial packet such as UDP when session setup is offloaded?

 

Q3. I think any traffic that is offloaded can't do packet capture without disable hardware offload off but i don't know how i could capture overridden packet

 

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/disable-hardware-offload#

admin guide says.

For example, encrypted traffic (SSL/SSH), network protocols (OSPF, BGP, RIP), application overrides, and terminating applications can be offloaded to the FPGA and therefore are excluded from packet captures by default

 

Thanks.


Accepted Solutions
Highlighted
L7 Applicator

Re: override traffic packet capture

@hbshin,

1) Depends on if your device has a network processor, but regardless it goes through the "fast path" yes. 

2) I don't believe the first packet is ever offloaded on a session, could be wrong though. 

3) Offloaded traffic won't reach the dataplane, which is required by the packet capture process. You'll need to actually temporarily disable offloading to capture this traffic. 

 

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: override traffic packet capture

@hbshin,

1) Depends on if your device has a network processor, but regardless it goes through the "fast path" yes. 

2) I don't believe the first packet is ever offloaded on a session, could be wrong though. 

3) Offloaded traffic won't reach the dataplane, which is required by the packet capture process. You'll need to actually temporarily disable offloading to capture this traffic. 

 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!