Packets retransmission captured in packet capture on firewall but still seems dropping

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Packets retransmission captured in packet capture on firewall but still seems dropping

L1 Bithead

Recently trying to debug a possible packet dropping issue at firewall (screenshot attached for reference). The issue is appearing when I try to make request to my server from my iOS device, some API calls works Ok but often few of those fails with 503 error code and this happens randomly against different APIs.

When I looked at the firewall the failed request packets appear in the packet capture but doesn't appear in the firewall traffic logs. I tried to filter the denied traffic but nothing appeared there.

The question is when packets are coming then how come those are not being served and transferred to the target server?

Can anyone share some more details to look into or any possible problem that is hampering the traffic? I see the retransmission packets for the failed request (see attachment).

 

2 REPLIES 2

Cyber Elite
Cyber Elite

Hello,

Make sure you have logging enabled on all policies and check the unified logs on the Palo Alto.

Regards,

Cyber Elite
Cyber Elite

it's possible somehow your dropped packet is hitting the default rule which doesn't have logging by default

If you set up packet captures i'd recommend running 'show counter global filter delta yes packet-filter yes' in tandem with your tests to see if any weird global counters pop up matching your packet capture filters that can explain why the packet is discarded

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 475 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!