Take PCAP from the mgmt interface using the UI

[myky]

Hi All,

Is there a particular reason why this option is only available from the CLI?

Thanks,

Myky

[BatD · Accepted solution]

@myky I comes to the Palo Alto architecture - the Mgmt interface is attached to the management plane, which is linux based and you can run tcpdump. All data interfaces are part of the firewall Data Plane which does its own separate packet processing.

[myky]

@BatD  sounds like a reasonable explanation. Would be nice to have this feature integrated with UI. 

[craigomatic]

I usually have to keep a cheat list like this:

tcpdump filter "dst 10.10.20.6 or src 10.10.20.6"

view-pcap mgmt-pcap mgmt.pcap

view-pcap no-dns-lookup yes no-port-lookup yes mgmt-pcap mgmt.pcap 

[myky]

@craigomatic I prefer to upload the file using SCP option. It is better to view it in the .pcap file

[craigomatic]

Definitely more readable in WireShark for sure. If you have that option of accessing an scp server ... sometimes that's not available in my experience!

[myky]

@craigomatic  that is one of the reasons why l started this topic. Another thing with tcpdump, it is good for the basic connectivity check but for instance, if you would like to see RADIUS Access-Accept reply, in particular check for the attributes, tcpdump won't help((

[craigomatic]

If it's sent in clear text, with verbose commands and x offsets you should be able to see the packets. I've been able to grab ldap credentials on 389 like that. Not sure about radius. You have a whole other set of troubleshooting commands with auth, like below:

test authentication authentication-profile "CorpLDAP" username user password

Then you have to follow the authd.log:

tail follow yes mp-log authd.log

[myky]

Thanks @craigomatic, very useful info