Make sure you select the ‘zip’ version if you want the portable version (i.e., no installation). I chose to use the latter as it literally takes less than a minute to set up a TFTP server on a Windows machine.ĭownload the mini-portable TFTP server here. The Palo supports exporting via SCP or TFTP. Now it’s time to export the capture so we can view it in Wireshark. When you are happy that you have captured enough traffic, simply press CTRL+C to stop.For example: tcpdump filter 'host 10.70.0.1' snaplen 0 Enter snaplen 0 to capture the entire packet.

You can use the option snaplen to determine how many bytes you want to capture. Note that by default only 68 or 96 bytes of data will be captured per packet depending on which hardware model you have. To or from a specific address (both sides of the conversation) tcpdump filter 'host 10.70.0.1' To a specific address: tcpdump filter 'src 10.70.0.1' It is optional to create filters but I would recommend doing so if you are looking for specific trafficIf you want to capture packets from a specific IP address then you would use something like this: Now we use the tcpdump command to start capturing.Management traffic cannot be captured using the ‘packet capture’ feature on the GUI so we need to do it using the CLI. Some reasons why you may want to capture packets on the management interface is to capture traffic such as RADIUS and Syslog which is processed via the management plane. In this quick how-to I will show you how you can very easily and quickly run a packet capture on a Palo Alto management interface.

Wireshark portable no interfaces