Monitor > Packet Capture
All Palo Alto Networks firewalls have a built-in packet capture (pcap) feature you can use to capture packets that traverse the network interfaces on the firewall. You can then use the captured data for troubleshooting purposes or to create custom application signatures.
The packet capture feature is CPU-intensive and can degrade firewall performance. Only use this feature when necessary and make sure to turn it off after you collect the required packets.
What do you want to know?
What are the different methods the firewall can use to capture packets?
How do I generate a custom packet capture?
How do I generate packet captures when the firewall detects a threat?
Where do I download a packet capture?
Looking for more?
See Custom Signatures.
See Take Packet Captures.
Take Packet Captures
Take Packet Captures All Palo Alto Networks firewalls allow you to take packet captures (pcaps) of traffic that traverses the management interface and network interfaces ...
Types of Packet Captures
Types of Packet Captures There are different types of packet captures you can enable, depending on what you need to do: Custom Packet Capture —The ...
Packet Capture Overview
Packet Capture Overview You can configure a Palo Alto Networks firewall to perform a custom packet capture or a threat packet capture. Custom Packet Capture ...
Take a Custom Application Packet Capture
Take a Custom Application Packet Capture You can configure a Palo Alto Networks firewall to take a packet capture based on an application name and ...
Building Blocks for a Custom Packet Capture
Building Blocks for a Custom Packet Capture The following table describes the components of the Monitor Packet Capture page that you use to configure packet ...
Take a Packet Capture for Unknown Applications
Take a Packet Capture for Unknown Applications Palo Alto Networks firewalls automatically generate a packet capture for sessions that contain an application that it cannot ...
Take an Application Packet Capture
Take an Application Packet Capture The following topics describe two ways that you can configure the firewall to take application packet captures: Take a Packet ...
Take a Custom Packet Capture
Take a Custom Packet Capture Custom packet captures allow you to define the traffic that the firewall will capture. To ensure that you capture all ...
Take a Threat Packet Capture
Take a Threat Packet Capture To configure the firewall to take a packet capture (pcap) when it detects a threat, enable packet capture on Antivirus, ...