Packet capture option

[sanja]

Hello,

I did some research regarding packet capture option, and couldn't find clear answer so I have to ask here 🙂

Documentation states that this option is enabled by default for some blades, and  I cannot find for which blades it is enabled by default. 

Also, in log entry I can find link to download pcap just for malicious trafffic (for example, IPS prevented traffic). What about Threat Emulation blade?

[_Val_]

Threat Emulation packet capture would mean you capture the whole file as part of the logs. That would be too heavy.

[sanja]

Hi, thanks for the reply. What about other blades? 

[Timothy_Hall]

Pretty sure only the Threat Emulation, IPS, Anti-Virus, and Anti-Bot blades can generate packet captures.  Content Awareness can show a redacted copy of the offending Data Type, but it is not a full packet capture.

[PhoneBoy]

Pretty sure PCAP is only done for IPS and only for the malicious packet.

[Timothy_Hall]

Packet Captures are done for Anti-Virus too:

[sanja]

Thanks!

Is it safe to keep these default settings, cause security gateways are having some performance issues at the moment (memory consumption is too high)?

[Amir_Senn]

AB/AV - have a packet capture but not all the time, depends on the attack type and prevention method.

IPS - defined per attack. For some attacks it's on by default and for some it's off.

Threat Emulation - not a packet capture but a Forensic Report. See Attached.

You can keep default settings, no performance degradation should be caused by normal usage.