packet capture for unknown-tcp

cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
We are conducting regularly scheduled maintenance over the weekend, which could cause some downtime on LIVEcommunity. We apologize for any inconvenience.

packet capture for unknown-tcp

L2 Linker

Hi,

I'm getting a lot of unknown-tcp on the internal network and would like to capture some packets to get an idea what this is.

I tried:

debug dataplane packet-diag set capture trigger application from unknown-tcp to unknown-tcp

but I don't get any packets so far.

I also tried from none to unknown-tcp, same result, nothing captured.

Any idea what I'm doing wrong or a better idea how to capture that unknown traffic?

Regards,

Andreas

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

Hi Andreas

you can enable this command to packetcapture unknown application packets:

> set application dump-unknown yes

the pcaps will appear in the traffic log as a little green arrow or from the CLI in "view-pcap application-pcap <date>/"

Tom Piens
PANgurus

View solution in original post

4 REPLIES 4

L5 Sessionator

Hello Andreas,

I would suggest updating and the Application database to the latest version.

Also try  trigger condition from application "unknown " to "unknown-tcp".

These document might be helpful:

https://live.paloaltonetworks.com/docs/DOC-2007

https://live.paloaltonetworks.com/docs/DOC-2542

-Ameya

Hello Ameya,

thanks for the links. I knew most of it but not all.

The Application DB is the latest version.

In this case I'm observing mainframe traffic, there are not many mainframe apps in the application DB.  😞

Regards, 

  Andreas

Did you get a chance to change the  trigger condition from application "unknown " to "unknown-tcp".

>debug dataplane packet-diag set capture trigger application from unknown to unknown-tcp

If this doesn't work you could try configuring packet filters based on destination-port.

If this is a multi-dataplane platform eg 5k there are few other settings needed to capture exact packets.

-Ameya

Cyber Elite
Cyber Elite

Hi Andreas

you can enable this command to packetcapture unknown application packets:

> set application dump-unknown yes

the pcaps will appear in the traffic log as a little green arrow or from the CLI in "view-pcap application-pcap <date>/"

Tom Piens
PANgurus
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!