What is the reason for packet capture?

[bgranholm]

Hello all,

We recently flattened our lab firewall and configured it as a tap firewall. It currently has only one security policy which is an allow all policy. The firewall currently has one zone and the only other non-standard default config is a handful of custom applications and application overrides.

What I did was set a filter in the traffic logs of "flags has pcap" and surprisingly to me, there were actual packet captures. The traffic consisted of unknown-tcp and udp, incomplete data and a couple of traceroutes. However, it doesn't capture packets for all of any one of those categories, which begs the question:

Why is the firewall capturing data from seemingly random traffic from the categories of unknown-tcp, unknown-udp, incomplete data and traceroute?

Thanks,

Ben

[mikand]

There is a setting somewhere if unknown traffic should be captured or not by default.

The reason is to have a sample to send for analysis if needed (or investage on your own) - for example in order to create a custom appid (either on your own or by support from PaloAlto).

The packetcapture can also be setup for various IPS and (I think) AV signatures - same here to have a sample in case false positive occurs or such.

[bgranholm]

I have combed the firewall for that setting and I am not finding it. I have default settings for the security profiles and I don't have them applied anywhere. Anyone else want to take a shot?

[sraghunandan · Accepted solution]

Please refer the following docs:-