- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
03-07-2018 01:38 PM
Is there anyway to get bi-directional data in a single packet capture on the PA ? Some of mine seem like it splits the traffic into tranmissions on one, drop on another and recieve on yet another. Can those all be combined?
03-07-2018 01:58 PM
You can merge the PCAPs once you've finished collectiong them, however the stage is what the firewall is actually capturing so it isn't able to take a full capture of everything.
* Drops: Records packets that are dropped due to an error.
* Firewall: Captures when the device is processing packets.
* Receive: Packets that are recieved by the device.
* Transmit: Packets sent from the source.
If you utilize WireShark you can actually merge all of these chronologically to essentially get what you are looking for in one large file. To do so simply open one of the PCAPs and select File > Merge select the other PCAP and then select whether you want to Prepend, Append, or Merge Chronologically.
03-07-2018 02:48 PM
If you enter the same filename for all four stages, I thought you will have everything in one file directly on the firewall...
03-07-2018 01:58 PM
You can merge the PCAPs once you've finished collectiong them, however the stage is what the firewall is actually capturing so it isn't able to take a full capture of everything.
* Drops: Records packets that are dropped due to an error.
* Firewall: Captures when the device is processing packets.
* Receive: Packets that are recieved by the device.
* Transmit: Packets sent from the source.
If you utilize WireShark you can actually merge all of these chronologically to essentially get what you are looking for in one large file. To do so simply open one of the PCAPs and select File > Merge select the other PCAP and then select whether you want to Prepend, Append, or Merge Chronologically.
03-07-2018 02:48 PM
If you enter the same filename for all four stages, I thought you will have everything in one file directly on the firewall...
03-07-2018 06:11 PM - edited 03-07-2018 06:16 PM
03-08-2018 01:35 AM
a word of caution on @Remo's trick
The advantage is that you get everything in one file, but you may lose some visibility on which packets are missing from a stage and, if your capture is large: the pcaps roll over at 200mb, if you put 4 streams into one file, it will roll over much quicker
we do create a pcap.1, so your total size limit is 400mb of capture, but beware that if you put tx + rx + fw into a single file, you'll only be able to get +- 133mb of total traffic beforee you start losing the start of your capture
other than that: awesome trick!
03-08-2018 06:40 AM
good news! you can select multiple 😜
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!