Palo Alto Networks Knowledgebase: Can Data Capture Files Generated on the Firewall be Opened with Wireshark?

Can Data Capture Files Generated on the Firewall be Opened with Wireshark?

2015
Created On 08/05/19 19:21 PM - Last Updated 08/05/19 19:48 PM
Content Release Deployment
Resolution

Overview

No, the the data capture files are not in PCAP format. Therefore, they cannot be opened with Wireshark.

Details

When a data pattern is configured to match a type of traffic and the password for Manage Data Protection (Device > Setup > Content-ID) has been configured, a Data Filtering log captures the data that is triggered by the pattern.

Snip20131004_2.png

DLP.PNG

A file (with a filename in the format similar to "20130911%2F10.32.1.77-61142-192.168.23.205-1080-207547") will be generated and can be downloaded. This file is not in a pcap format and cannot be viewed or opened with Wireshark, since the profile has an option to capture the data and not the packet.

owner: apasupulati



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClfVCAS&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language