Take a Custom Application Packet Capture

You can configure a Palo Alto Networks firewall to take a packet capture based on an application name and filters that you define. You can then use the packet capture to troubleshoot issues with controlling an application. When configuring an application packet capture, you must use the application name defined in the App-ID database. You can view a list of all App-ID applications using Applipedia or from the web interface on the firewall in
Objects
Applications
.
  1. Using a terminal emulation application, such as PuTTY, launch an SSH session to the firewall.
  2. Turn on the application packet capture and define filters.
    admin@PA-200>
    set application dump on application <
    application-name
    > rule <
    rule-name
    >
    For example, to capture packets for the facebook-base application that matches the security rule named rule1, run the following CLI command:
    admin@PA-200>
    set application dump on application facebook-base rule rule1
    You can also apply other filters, such as source IP address and destination IP address.
  3. View the output of the packet capture settings to ensure that the correct filters are applied. The output appears after enabling the packet capture.
    In the following output, you see that application filtering is now on based on the facebook-base application for traffic that matches rule1.
    A
    pplication setting:
    Application cache : yes
    Supernode : yes
    Heuristics : yes
    Cache Threshold : 16
    Bypass when exceeds queue limit: no
    Traceroute appid : yes
    Traceroute TTL threshold : 30
    Use cache for appid : no
    Unknown capture : on
    Max. unknown sessions : 5000
    Current unknown sessions : 0
    Application capture : on
    Max. application sessions : 5000
    Current application sessions : 0
    Application filter setting:
    Rule : rule1
    From : any
    To : any
    Source : any
    Destination : any
    Protocol : any
    Source Port : any
    Dest. Port : any
    Application : facebook-base
    Current APPID Signature
    Signature Usage : 21 MB (Max. 32 MB)
    TCP 1 C2S : 15503 states
    TCP 1 S2C : 5070 states
    TCP 2 C2S : 2426 states
    TCP 2 S2C : 702 states
    UDP 1 C2S : 11379 states
    UDP 1 S2C : 2967 states
    UDP 2 C2S : 755 states
    UDP 2 S2C : 224 states
  4. Access Facebook.com from a web browser to generate Facebook traffic and then turn off application packet capture by running the following CLI command:
    admin@PA-200>
    set application dump off
  5. View/export the packet capture.
    1. Log in to the web interface on the firewall and select
      Monitor
      Logs
      Traffic
      .
    2. In the log entry that you are interested in, click the green packet capture icon packet_capture_icon.png in the second column.
    3. View the packet capture directly or
      Export
      it to your computer. The following screen capture shows the facebook-base packet capture.
    packet_capture-application-facebook.png

Recommended For You