- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-16-2019 04:41 PM - edited 01-16-2019 06:18 PM
Hi, all
I have questions about Application Override traffic packet capture.
Q1. when i enable App override, Overridden traffic is offloaded without reaching Dataplane. is it correct?
Q2. Overridden Initial packet such as UDP when session setup is offloaded?
Q3. I think any traffic that is offloaded can't do packet capture without disable hardware offload off but i don't know how i could capture overridden packet
https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/monitoring/disable-hardware-offload#
admin guide says.
For example, encrypted traffic (SSL/SSH), network protocols (OSPF, BGP, RIP), application overrides, and terminating applications can be offloaded to the FPGA and therefore are excluded from packet captures by default
Thanks.
01-18-2019 02:09 PM
1) Depends on if your device has a network processor, but regardless it goes through the "fast path" yes.
2) I don't believe the first packet is ever offloaded on a session, could be wrong though.
3) Offloaded traffic won't reach the dataplane, which is required by the packet capture process. You'll need to actually temporarily disable offloading to capture this traffic.
01-18-2019 02:09 PM
1) Depends on if your device has a network processor, but regardless it goes through the "fast path" yes.
2) I don't believe the first packet is ever offloaded on a session, could be wrong though.
3) Offloaded traffic won't reach the dataplane, which is required by the packet capture process. You'll need to actually temporarily disable offloading to capture this traffic.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!