Pcap exports fail

cancel
Showing results for 
Search instead for 
Did you mean: 

Pcap exports fail

Not applicable

From the cli:

adming@pan2020> scp export threat-pcap from 20110619 to root@linuxhost:/root/pcaps

Password: hunter2

/opt/panlogs/session/pan/threat/20110619: not a regular file

admin@pan2020>

Bug?  Should I feed it bran or yogurt?

Edit:  OS 3.1.8

1 ACCEPTED SOLUTION

Accepted Solutions

scp export filter-pcap from <filename> to <username>@<ip-addr>:<path-to-file>

typically filename will equal the name of your packet-diag packet capture. To export the threat pcaps you would replace filter-pcap with threat-pcap.

if you hit the tab key after entering 'from' the system should show you the files that are available for export.

-Benjamin

View solution in original post

6 REPLIES 6

L6 Presenter

try adding *

e.g. from 20110619*

we do not recommend feeding your firewall anything other than AC power and network packets. Smiley Wink

-Benjamin

No change.  😞

Thanks for the suggestion though.

you should be able to export each file individually if you specify the full filename.

How would I do that?  Pre-pending the path just makes it try to send /opt/panlogs/session/pan/theat//opt/panlogs/session/pan/threat/20110619, which dies with "No such file or directory".

I tried to scp from the Linux host instead, but it just stalls after the password prompt.

Is there some other way to get at any old file with advance knowledge of the path?

scp export filter-pcap from <filename> to <username>@<ip-addr>:<path-to-file>

typically filename will equal the name of your packet-diag packet capture. To export the threat pcaps you would replace filter-pcap with threat-pcap.

if you hit the tab key after entering 'from' the system should show you the files that are available for export.

-Benjamin

OK, it seems I just wasn't done yet.

20110619 isn't the filename, it's a directory that contains almost 60,000 logs from that day.  Swell.  :smileylaugh:

Thanks for prodding me in the right direction.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!