Note: Along with these packets, the pcap files contain non-IP traffic like CDP, spanning-tree, and so on. The tx file contains the ARP reply sent from the firewall interface, which is the response to the ARP request for the MAC address of the firewall interface. The rx file with ARP request received from other hosts: The rx file with the ARP reply for an ARP request initiated by interface: The Palo Alto Networks firewall (10.66.24.87) does not have ARP entry for 10.66.24.86 Check on the next hop device to get information on ARP requests initiated from the Palo Alto Networks firewall.

Note: The process described above will not capture ARP requests initiated from firewall. The tx file contains ARP reply sent from the firewall interface. The ARP reply for the ARP request sent by interface ethernet1/1 is Unicast. The rx file contains ARP request initiated by an external host which is broadcast. > debug dataplane packet-diag set capture on.> debug dataplane packet-diag set capture stage firewall file fx.> debug dataplane packet-diag set capture stage receive file rx.> debug dataplane packet-diag set capture stage transmit file tx.> debug dataplane packet-diag set capture stage drop file dx.> debug dataplane packet-diag set filter on.> debug dataplane packet-diag set filter match non-ip only ingress-interface ethernet1/1.Run the following CLI commands to capture ARP packets. Download the packet capture file by clicking on the respective link. Refresh the page and the packet capture files will appear.Click OK when the Packet Capture Warning appears. Enter a file name for each configured stage. Configure the stages for packet captures.Select an interface for Ingress Interface.Click Manage Filters and create a filter.This document describes how to capture ARP packets on an interface on a Palo Alto Networks firewall.

Wireshark filter arp