Palo Alto - Packet Capture --okay

4 State Capture --> 4 difference files
Receive State ---------->Drop State ---------->FW State -------->Transmit (marked to leave firewall)

to check if the packet actually left the FW , check the device on the other side






Packet Capture on GUI 

"Monitor"  --> " Packet Capture

Pre-Parse Match    --->  Never use it


Put a Limit



CLI Capture 
debug dataplane packet-diag clear all

debug dataplane packet-diag set filter match



debug dataplane packet-diag set capture stage receive (firewall,transmit, drop)  file rx.pcap


debug dataplane packet-diag set capture off





debug dataplane packet-diag set capture off