PA Packet capture

[jdprovine]

Is there anyway to get bi-directional data in a single packet capture on the PA ?  Some of mine seem like it splits the traffic into tranmissions on one, drop on another and recieve on yet another. Can those all be combined?

[BPry · Accepted solution]

@jdprovine,

You can merge the PCAPs once you've finished collectiong them, however the stage is what the firewall is actually capturing so it isn't able to take a full capture of everything. 

* Drops: Records packets that are dropped due to an error. 

* Firewall: Captures when the device is processing packets.

* Receive: Packets that are recieved by the device. 

* Transmit: Packets sent from the source. 

If you utilize WireShark you can actually merge all of these chronologically to essentially get what you are looking for in one large file. To do so simply open one of the PCAPs and select File > Merge select the other PCAP and then select whether you want to Prepend, Append, or Merge Chronologically. 

[Remo · Accepted solution]

If you enter the same filename for all four stages, I thought you will have everything in one file directly on the firewall...

[BPry]

@Remo,

Does...does that actually work? 

Wow that actually works. I've always just assumed that the file needs to be different for the different stages. This will save quite a bit of time throughout the week, thanks @Remo! 

[reaper]

a word of caution on @Remo's trick

The advantage is that you get everything in one file, but you may lose some visibility on which packets are missing from a stage and, if your capture is large: the pcaps roll over at 200mb, if you put 4 streams into one file, it will roll over much quicker

we do create a pcap.1, so your total size limit is 400mb of capture, but beware that if you put tx + rx + fw into a single file, you'll only be able to get +- 133mb of total traffic beforee you start losing the start of your capture

other than that: awesome trick!

[jdprovine]

@reaper @BPry @Remo

As always you have made it hard for me to pick the accepted solution because you all offer such great idea. Thanks!!

[reaper]

good news! you can select multiple 😜