TCPDUMP is one of the hugh reasons for buying one of Palo Alto's competitors. The ability to gain instant visibility into the traffic flow is priceless. Depending on the way an organization writes its change control policy, the way ASA, Palo Alto, Fortigate and a few others do packet capture could be prevented due a configuration change being involved. But since the other big competittor includes tcpdump, and it's not a piece of configuration, it can be executed anytime, without special permission. I'd like to see a tcpdump command in Palo Alto that is a single line command, and dumps to the screen/tty/console etc. without having to execute a second, third, fourth, or fifth command. Leaving behind no residual configuration. It would be best if it based on 'tcpdump'. Having worked with dozens of firewalls, I'm fatigued at having to remember each vendor's unique view on packet capturing command syntax. Even if this feature is not tcpdump under the hood, having it fake being tcpdump would be extremely beneficial. Same command, 'tcpdump', same attributes, '-nn -i eth1/1 -s0 -vv -e -p -A -X -w filename.pcap' etc., and same filter syntax, 'host 1.1.1.1 and port 22 and ! udp' etc.
... View more
