PAN CLI - Packet Capture

Palo Alto CLI Packet Capture

paloalto cli command pcap

Step-by-step guide for running packet captures from the PAN-OS CLI.

---

Overview

PAN-OS captures at four stages in the dataplane pipeline:

Stage	What it captures
receive	Packets as they arrive on the ingress interface (pre-firewall)
firewall	Packets inside the firewall engine (post-decrypt, post-NAT)
transmit	Packets leaving on the egress interface
drop	Packets dropped by the firewall

Capturing all four stages lets you pinpoint exactly where traffic is lost.

---

Step-by-Step Capture

1 - Clear Any Previous Filters

debug dataplane packet-diag clear all

2 - Define the Filter

debug dataplane packet-diag set filter match source <src-ip> destination <dst-ip>

Common filter options:

Option	Example
source	10.1.1.100
destination	10.2.2.50
source-port	12345
destination-port	443
protocol	6 (TCP) / 17 (UDP) / 1 (ICMP)
ingress-interface	ethernet1/1
non-ip	yes (capture ARP, etc.)

You can set multiple filters (up to 4 match rules):

debug dataplane packet-diag set filter match source 10.1.1.100 destination 10.2.2.50 destination-port 443 protocol 6

3 - Set Capture Stages

debug dataplane packet-diag set capture stage receive file rx.pcap
debug dataplane packet-diag set capture stage transmit file tx.pcap
debug dataplane packet-diag set capture stage drop file drop.pcap
debug dataplane packet-diag set capture stage firewall file fw.pcap

Optional — set a byte count (slice) or packet count:

debug dataplane packet-diag set capture stage receive byte-count 1500 file rx.pcap

4 - Enable the Filter and Capture

debug dataplane packet-diag set filter on
debug dataplane packet-diag set capture on

5 - Reproduce the Traffic

Generate or wait for the traffic you want to capture.

6 - Stop the Capture

debug dataplane packet-diag set capture off
debug dataplane packet-diag set filter off

7 - Verify Capture Files

debug dataplane packet-diag show capture stage receive
debug dataplane packet-diag show capture stage transmit
debug dataplane packet-diag show capture stage drop
debug dataplane packet-diag show capture stage firewall

8 - Aggregate and Export

debug dataplane packet-diag aggregate-logs

Export via SCP:

scp export filter-pcap from rx.pcap to user@host:/path/
scp export filter-pcap from drop.pcap to user@host:/path/

Or download from the GUI: Monitor > Packet Capture > Captured Files.

9 - Clean Up

debug dataplane packet-diag clear all

---

Quick One-Liner Examples

Capture HTTPS from a single host

debug dataplane packet-diag clear all
debug dataplane packet-diag set filter match source 10.1.1.100 destination-port 443 protocol 6
debug dataplane packet-diag set capture stage receive file rx.pcap
debug dataplane packet-diag set capture stage drop file drop.pcap
debug dataplane packet-diag set capture stage firewall file fw.pcap
debug dataplane packet-diag set capture stage transmit file tx.pcap
debug dataplane packet-diag set filter on
debug dataplane packet-diag set capture on

Capture ICMP between two hosts

debug dataplane packet-diag clear all
debug dataplane packet-diag set filter match source 10.1.1.100 destination 10.2.2.50 protocol 1
debug dataplane packet-diag set capture stage receive file rx.pcap
debug dataplane packet-diag set capture stage drop file drop.pcap
debug dataplane packet-diag set filter on
debug dataplane packet-diag set capture on

---

Management Plane Capture

To capture on the management interface instead of the dataplane:

tcpdump -i eth0 host 10.1.1.100 -w /var/tmp/mgmt.pcap

Export:

scp export mgmt-pcap from mgmt.pcap to user@host:/path/

---

Tips

• Captures are stored in /var/tmp/ on the dataplane
• Keep captures short — long captures can impact performance on busy boxes
• The drop stage is often the most useful for troubleshooting
• If you don’t see packets at the receive stage, the traffic isn’t arriving at the firewall
• If packets appear at receive but not transmit, check the firewall and drop stages
• Use show counter global filter severity drop alongside captures to correlate drop reasons