>
    Strata Copilot
    Enable Packet Capture Collection
    Focus
    Download PDF
    Focus
    1. Home
    2. Device Security
    3. Device Security Administration Guide
    4. Monitor Device Security Health
    5. Enable Packet Capture Collection
    Download PDF
    Device Security

    Enable Packet Capture Collection

    Table of Contents

    Enable Packet Capture Collection

    Authorize packet capture on firewalls for use by the Device Security Research Team.
    Where Can I Use This?What Do I Need?
    • Device Security (Managed by Strata Cloud Manager)
    • (Legacy) IoT Security (Standalone portal)
    One of the following subscriptions:
    • Device Security subscription
    • Precision AI bundle subscription
    • Device Security X subscription
    Enable on-demand packet capture (pcap) to help Palo Alto Networks significantly improve the accuracy and completeness of device identification and application recognition (App-ID) within your environment. When active, pcap collection allows our Device Security Research Team to remotely perform secure, targeted, temporary packet captures on your NGFW. Analyzing pcaps helps us develop more precise device and App-ID identification models, providing enhanced security protections for you.
    When you first onboard Device Security, the final step of the onboarding workflow lets you review and confirm whether remote pcap collection is enabled in your tenant. By default, remote pcap collection is enabled as part of onboarding to improve device visibility.
    After onboarding Device Security, you can always change your remote pcap collection preferences under AdministrationData Privacy SheetPCAP Collection.

    How Packet Capture Works & Security Controls

    Our Device Security Research Team initiates packet captures using the same secure, remote channel established for firewall support and debugging. Packet captures don't impact firewall performance and don't grant any ability to modify your Security policy rules or controls. Packet capture collection can’t be enabled in FedRAMP (moderate and high) environments or tenants based in the China region.
    We prioritize your data security and privacy. All pcap files are encrypted both in transit and at rest. Furthermore, advanced cloud tools are used to scan pcap files for sensitive data, such as personally identifiable information or patient health information, to mitigate risk of sensitive data leaving your cloud region or inadvertently being accessed by our research team. All packet capture files are automatically deleted after 120 days. You can request the deletion of your data at any time by opening a support ticket.
    For more information about the types of Personal Data that Device Security might collect, see the Device Security Privacy Datasheet.

    Enable On-Demand Packet Capture

    For the Device Security Research Team to use remote pcap collection to collect network traffic metadata, you must first enable telemetry on your firewalls, install the OpenConfig plugin on your firewalls, and then authorize pcap collection for your tenant from Device Security. Depending on the version of PAN-OS that your firewalls are running, they might already have the OpenConfig plugin installed.
    To support packet capture on firewalls, they must be running PAN-OS 10.2.10 or later.
    1. Log in to PAN-OS and follow the steps to Enable Device Telemetry on your firewalls.
      For devices running PAN-OS 11.2.8 or later, telemetry is enabled by default in PAN-OS.
    2. Follow the steps to install the OpenConfig plugin.
      If you already have the OpenConfig plugin installed, ensure that you are using a supported OpenConfig plugin version, based on your PAN-OS version. See the table below for supported OpenConfig plugin versions.
      1. Select DevicePlugins and search for OpenConfig.
      2. Download an appropriate plugin version, based on what version of PAN-OS you are running, and then Install it.
        PAN-OS versionOpenConfig version
        12.1.5 and later2.1.5
        11.2 and earlier2.1.3hf and later 2.1.3 versions
    3. Log in to Device Security with a user account with a tenant superuser role to enable pcap collection.
      Tenants who onboarded to Device Security between August 7, 2025 and October 21, 2026 have pcap collection enabled by default, except for FedRAMP and Device Security China tenants. The first user with superuser privileges who accesses Device Security after October 21, 2026 will be asked to reconfirm their pcap collection enablement status.
    4. Navigate to PCAP Collection at AdministrationData Privacy SheetPCAP Collection.
    5. Select the check box to Enable PCAP collection for your tenant.
      If you want to deauthorize pcap collection, deselect the check box.

    © 2026 Palo Alto Networks, Inc. All rights reserved.