Palo Alto Useful Commands

Management Interface Packet Capture
GUI packet capture can be used for packet capture of inline data interfaces.
To capture traffic on the management interface use cli tcpdump

tcpdump snpalen 0 filter "host a.b.c.d"
view-pcap mgmt-pcap mgmt.pcap
tftp export mgmt-pcap from mgmt.pcap to  {a.b.c.d}

less mp-log authd.log


 

Debug dataplane packet-diag clear all
debug dataplane packet-diag clear filter-marked-session all

Debug dataplane packet-diag set filter match destination 8.8.8.8

Debug dataplane packet-diag set filter on

Debug datapplane packet-diag show setting

Show counter  global filter packet-filter yes delta yes

 30 mins mod 3b

show session all filter source 192.168.17.50
show session all filter state
show session id {number}   even for aged out sessions