override traffic packet capture

[hbshin]

Hi, all

I have questions about Application Override traffic packet capture.

Q1. when i enable App override, Overridden traffic is offloaded without reaching Dataplane. is it correct?

Q2. Overridden Initial packet such as UDP when session setup is offloaded?

Q3. I think any traffic that is offloaded can't do packet capture without disable hardware offload off but i don't know how i could capture overridden packet

https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/disable-hardware-offload#

admin guide says.

For example, encrypted traffic (SSL/SSH), network protocols (OSPF, BGP, RIP), application overrides, and terminating applications can be offloaded to the FPGA and therefore are excluded from packet captures by default

Thanks.

[BPry · Accepted solution]

@hbshin,

1) Depends on if your device has a network processor, but regardless it goes through the "fast path" yes. 

2) I don't believe the first packet is ever offloaded on a session, could be wrong though. 

3) Offloaded traffic won't reach the dataplane, which is required by the packet capture process. You'll need to actually temporarily disable offloading to capture this traffic.