01-16-2025 06:02 PM
I noticed something odd with packet captures taken involving traffic originating from a tunnel interface (used for GP VPN clients) where the Ethernet Type header was byte swapped. Meaning instead of 0x0800 it was 0x0008.
The screen snips illustrate the raw exported packets from a NGFW running 11.1.4-h1. Wireshark 4.4.3 with no packet dissector/decode rules.
But using Hxd to byte swap the length field then allows Wireshark to make full sense of the packet. Seems to me that PANOS is writing out that field as little-endian rather than the network-byte order of big endian.
Why does this happen? Not sure if I need to raise a support ticket or a defect/enhancement request ticket for this. Happens reproducibly across multiple packet captures.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
