For details on cookie usage on our site, read our Privacy Policy
tcpdump filters
- LIVEcommunity
- Discussions
- General Topics
- tcpdump filters
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
03-10-2016 02:24 AM
Does anyone know what filters are supported for the tcpdump command on PAN-OS (7.0) ?
For troubelshooting of a Syslog (server) issue, due to large amounts of traffic, I need to capture only packets with syn- or fin/rst-flag set.
Something like this : # tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0
Documentation found 'How To Packet Capture (tcpdump) On Management Interface' are sparse, as the filter options very well might be.
- Mark as New
- Subscribe to RSS Feed
- Permalink
03-18-2016 12:35 AM - edited 05-26-2016 02:15 AM
Thanks a lot Gereardo.
Seems like I got confused about the use of ' versus "
In my initial example the closing ' was also missing, This was a copy/paste glitch. Honest
(there might be a closing ")" in your link that prevents it from being clickable)
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-04-2018 07:59 AM
How to run TCPDUMP on other interface except mgmt. Anybody has nay idea....
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-04-2018 08:28 AM
Hi @aloke1.p,
TCPDUMP is specifically for the mgmt interface.
For dataplane interfaces you can use PCAP:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgUCAS
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVoCAK
Hope this helps.
Cheers !
-Kiwi.
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!
- POC - To validate everything associated with Machine-Learning/Deep Learning PAN-OS - Features of URL Filtering, Wildfire, Threat Prevention Test in General Topics
- how to apply and remove the tags to multiple endpoints in cortex xdr without using any filters in Cortex XDR Discussions
- How can I block VPN users connected to Server to access to a specific application via url filtering in Next-Generation Firewall Discussions
- Create a correlation between xdr agent and palo alto url filtering in Cortex XDR Discussions
- PAN-OS XML API filtering question in Next-Generation Firewall Discussions
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
