Document:PAN-OS® Web Interface Reference

Building Blocks for a Custom Packet Capture

Building Blocks for a Custom Packet Capture

The following table describes the components of the

Monitor

Packet Capture

page that you use to configure packet captures, enable packet capture, and to download packet capture files.

Custom Packet Capture Building Blocks	Configured In	Description
Manage Filters	Configure Filtering	When enabling custom packet captures, you should define filters so that only the packets that match the filters are captured. This will make it easier to locate the information you need in the pcaps and will reduce the processing power required by the firewall to perform the packet capture. Click Add to add a new filter and configure the following fields: Id —Enter or select an identifier for the filter. Ingress Interface —Select the ingress interface on which you want to capture traffic. Source —Specify the source IP address of the traffic to capture. Destination —Specify the destination IP address of the traffic to capture. Src Port —Specify the source port of the traffic to capture. Dest Port —Specify the destination port of the traffic to capture. Proto —Specify the protocol number to filter (1-255). For example, ICMP is protocol number 1. Non-IP —Choose how to treat non-IP traffic (exclude all IP traffic, include all IP traffic, include only IP traffic, or do not include an IP filter). Broadcast and AppleTalk are examples of Non-IP traffic. IPv6 —Select this option to include IPv6 packets in the filter.
Filtering	Configure Filtering	After defining filters, set the Filtering to ON . If filtering is OFF , then all traffic is captured.
Pre-Parse Match	Configure Filtering	This option is for advanced troubleshooting purposes. After a packet enters the ingress port, it proceeds through several processing steps before it is parsed for matches against pre‑configured filters. It is possible for a packet, due to a failure, to not reach the filtering stage. This can occur, for example, if a route lookup fails. Set the Pre-Parse Match setting to ON to emulate a positive match for every packet entering the system. This allows the firewall to capture packets that do not reach the filtering process. If a packet is able to reach the filtering stage, it is then processed according to the filter configuration and discarded if it fails to meet filtering criteria.
Packet Capture	Configure Capturing	Click the toggle switch to turn packet capture ON or OFF . You must select at least one capture stage. Click Add and specify the following: Stage —Indicate the point at which to capture packets: drop —When packet processing encounters an error and the packet is dropped. firewall —When the packet has a session match or a first packet with a session is successfully created. receive —When the packet is received on the dataplane processor. transmit —When the packet is transmitted on the dataplane processor. File —Specify the capture file name. The file name should begin with a letter and can include letters, digits, periods, underscores, or hyphens. Packet Count —Specify the maximum number of packets, after which capturing stops. Byte Count —Specify the maximum number of bytes, after which capturing stops.
Captured Files	Captured Files	Contains a list of custom packet captures previously generated by the firewall. Click a file to download it to your computer. To delete a packet capture, select the packet capture and then Delete it. File Name —Lists the packet capture files. The file names are based on the file name you specify for the capture stage Date —Date the file was generated. Size (MB) —The size of the capture file. After you turn on packet capture and then turn it off, you must click Refresh ( ) before any new PCAP files display in this list.
Clear All Settings	Settings	Click Clear All Settings to turn off packet capture and to clear all packet capture settings. This does not turn off packet capture set in a security profile. For information on enabling packet capture on a security profile, see Enable Threat Packet Capture.