You can configure a Palo Alto Networks firewall
to take a packet capture based on an application name and filters
that you define. You can then use the packet capture to troubleshoot
issues with controlling an application. When configuring an application
packet capture, you must use the application name defined in the
App-ID database. You can view a list of all App-ID applications
using Applipedia or from the web interface
on the firewall in
Using a terminal emulation application, such as
PuTTY, launch an SSH session to the firewall.
Turn on the application packet capture and define filters.
set application dump on application
example, to capture packets for the linkedin-base application that
matches the security rule named Social Networking Apps, run the
following CLI command:
set application dump on application linkedin-base rule "Social Networking Apps"
You can also apply other filters, such as source
IP address and destination IP address.
View the packet capture output to ensure that the correct
filters are applied. The output displays after you enable the packet
The following output confirms that application capture
filtering is now based on the linkedin-base application for traffic
that matches the Social Networking Apps rule.
Access linkedin.com from a web browser and perform some
LinkedIn tasks to generate LinkedIn traffic, and then run the following
CLI command to turn off application packet capture:
set application dump off
View/export the packet capture.
Log in to the web interface on the firewall
In the log entry that you are interested in, click
the green packet capture icon
View the packet capture directly or
to your computer. The following screen capture shows the linkedin-base