Replay pcap

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Replay pcap

Not applicable

Is there any way that I could feed a pcap into the firewall?

What I would like to do is take a pcap and run it through a monitor port to test out some rules and IDS settings.  Right now my plan is to use tcpreplay, but I was curious if there was any way to do this natively in the firewall.

1 accepted solution

Accepted Solutions

L5 Sessionator

I am afraid if there is a way to import the pcaps into the firewall, and this requires a feature request. Please contact your SE to add this feature.

If you want to test the rules and the IDS settings, configure 2 interfaces on the PANFW as part of a Vwire pair. Connect bothf these interfaces to a replay server ( for traffic coming in both the directions, ie client to server and server to client), and then replay the pcap from the replay server.

Hope that Helps!

BR,

Karthik RP

View solution in original post

4 REPLIES 4

L5 Sessionator

I am afraid if there is a way to import the pcaps into the firewall, and this requires a feature request. Please contact your SE to add this feature.

If you want to test the rules and the IDS settings, configure 2 interfaces on the PANFW as part of a Vwire pair. Connect bothf these interfaces to a replay server ( for traffic coming in both the directions, ie client to server and server to client), and then replay the pcap from the replay server.

Hope that Helps!

BR,

Karthik RP

L4 Transporter

I don't have access to that.

"Access to this place or content is restricted."

Thanks for the response kprakash.  I just thought it would be cool if I was able to do this while I was setting up a replay.

  • 1 accepted solution
  • 4978 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!