Packet Capture (VLAN)

[tecnatomsa]

    How can i capture the packets for only one VLAN? I have a virtual Interface ethernet1/6.40 and if i use a filter for only the interface (ethernet1/6) the PA doesn't capture anything.

[emr_1]

Hi

Do you mean you can't select your ethernet1/6.40 on your filtering configuration?

I could select my sub-interface on my box from either CLI or GUI.

> debug dataplane packet-diag set filter match ingress-interface ?

  ethernet1/1     ethernet1/1

  ethernet1/2     ethernet1/2

  ethernet1/2.1   ethernet1/2.1

  ethernet1/3     ethernet1/3

  ethernet1/4     ethernet1/4

  loopback        loopback

  loopback.1      loopback.1

  tunnel          tunnel

  tunnel.1        tunnel.1

  tunnel.2        tunnel.2

  vlan            vlan

  <value>         Ingress hardware interface name

[tecnatomsa]

I can't see my sub-interfaces from the CLI

(active)> debug dataplane packet-diag set filter match ingress-interface

  ethernet1/1    ethernet1/1

  ethernet1/11   ethernet1/11

  ethernet1/12   ethernet1/12

  ethernet1/13   ethernet1/13

  ethernet1/14   ethernet1/14

  ethernet1/15   ethernet1/15

  ethernet1/16   ethernet1/16

  ethernet1/2    ethernet1/2

  ethernet1/3    ethernet1/3

  ethernet1/4    ethernet1/4

  ethernet1/5    ethernet1/5

  ethernet1/6    ethernet1/6

  loopback       loopback

  tunnel         tunnel

  vlan           vlan

  <value>        Ingress hardware interface name

(active)> show interface

  all              Show all interface information

  ethernet1/1      ethernet1/1

  ethernet1/1.41   ethernet1/1.41

  ethernet1/11     ethernet1/11

  ethernet1/12     ethernet1/12

  ethernet1/13     ethernet1/13

  ethernet1/14     ethernet1/14

  ethernet1/15     ethernet1/15

  ethernet1/16     ethernet1/16

  ethernet1/2      ethernet1/2

  ethernet1/2.43   ethernet1/2.43

  ethernet1/3      ethernet1/3

  ethernet1/3.45   ethernet1/3.45

  ethernet1/4      ethernet1/4

  ethernet1/4.46   ethernet1/4.46

  ethernet1/5      ethernet1/5

  ethernet1/5.22   ethernet1/5.22

  ethernet1/6      ethernet1/6

  ethernet1/6.40   ethernet1/6.40

  hardware         Show all hardware interface information

  logical          Show all logical interface information

  loopback         loopback

  management       Show management interface information

  tunnel           tunnel

  vlan             vlan

  <value>          <name> interface name

[emr_1]

Hmm...I'm using v5.0.4. How about your box?

[tecnatomsa]

4.1.8-h3

[emr_1]

I confirmed with my PA-5020.

Both 4.1.10 and 4.1.12 would not show me sub-interface.

I'm not sure this is bug or not.

You should open a case and ask PAN selecting sub-interface for pcap is new feature from 5.0 or not.

Regards,