Unknown Application Packet Capture

[smaekawa]

Hi

I want know about Unknown packet capture.

Q1. Where is unknown pcap stored?

[Device] > [Setup] > [Management] > [ Logging and Reporting Settings]

App Pkt Capture ?

Q2. I want know Unknown Pcap Usage.

Q3. When is capture unknown packet in PA packet flow?

Regards,

[UhMayYeah]

Q1. Where is unknown pcap stored?[Device] > [Setup] > [Management] > [ Logging and Reporting Settings]App Pkt Capture ?

Application PCAPs are stored  at the following path /opt/panlogs/session/pan/application/ .

These  PCAPs will appear in the traffic log as a little green arrow .

You can use the  CLI command view-pcap application-pcap <date>/"   to view the Application pcaps

[Device] > [Setup] > [Management] > [ Logging and Reporting Settings] is where you can alter the Storage Quota for various logs and PCAPs

Q2. I want know Unknown Pcap Usage.

Can be viewed using CLI command :

> show system logdb-quota

Quotas:

             traffic: 32.00%, 38.060 GB

              threat: 16.00%, 19.030 GB

              system: 4.00%, 4.758 GB

              config: 4.00%, 4.758 GB

               alarm: 3.00%, 3.568 GB

               trsum: 7.00%, 8.326 GB

         hourlytrsum: 3.00%, 3.568 GB

          dailytrsum: 1.00%, 1.189 GB

         weeklytrsum: 1.00%, 1.189 GB

               thsum: 2.00%, 2.379 GB

         hourlythsum: 1.00%, 1.189 GB

          dailythsum: 1.00%, 1.189 GB

         weeklythsum: 1.00%, 1.189 GB

             appstat: 6.00%, 7.136 GB

              userid: 1.00%, 1.189 GB

            hipmatch: 3.00%, 3.568 GB

   application-pcaps: 1.00%, 1.189 GB

        threat-pcaps: 1.00%, 1.189 GB

  debug-filter-pcaps: 1.00%, 1.189 GB

         hip-reports: 1.00%, 1.189 GB

            dlp-logs: 1.00%, 1.189 GB

Disk usage:

traffic: Logs: 59M, Index: 14M

threat: Logs: 42M, Index: 12M

system: Logs: 5.6M, Index: 904K

config: Logs: 17M, Index: 184K

alarm: Logs: 20K, Index: 20K

trsum: Logs: 86M, Index: 4.1M

hourlytrsum: Logs: 2.7M, Index: 1.5M

dailytrsum: Logs: 944K, Index: 1.4M

weeklytrsum: Logs: 468K, Index: 224K

thsum: Logs: 192K, Index: 192K

hourlythsum: Logs: 176K, Index: 176K

dailythsum: Logs: 168K, Index: 168K

weeklythsum: Logs: 32K, Index: 32K

appstatdb: Logs: 1.1M, Index: 852K

userid: Logs: 100K, Index: 52K

hipmatch: Logs: 20K, Index: 20K

application-pcaps: 1.4M <<====App PCAP usage

threat-pcaps: 4.0K

debug-filter-pcaps: 12K

dlp-logs: 4.0K

hip-reports: 1.1M

wildfire: 16K

Q3. When is capture unknown packet in PA packet flow?

When PA firewall is unable to identify the application using APP-ID ,the application will be termed as unknown (unknown/-tcp,unknown-udp,non-sysn-tcp).

Following Tech note will give you detailed Information about unknown apps and how to report them to Palto Alto.

[mbutt]

The following doc explains about unknow apps

https://live.paloaltonetworks.com/docs/DOC-2007

Also following document explains how to request an new application

https://live.paloaltonetworks.com/docs/DOC-1879

you can also create an app override for an application that is internal to your network and you know the port numbers

https://live.paloaltonetworks.com/docs/DOC-1071

Following doc explains what application override does

https://live.paloaltonetworks.com/docs/DOC-1343

Hope this helps.

Thanks