App Gateway packet capture

Question

I'd like to get a packet capture of all traffic on the interface corresponding to the public IP on an App Gateway instance. I can find resources on how to do a packet capture on a VM, and how to do a packet capture on a "Virtual Network Gateway", but as far as I can tell, an App Gateway is not a "Virtual Network Gateway". I'd like a pcap(ng) file, like I'd capture with Wireshark. Is this possible?

Answer 1

Greetings,

As of now packet capture support is only available for virtual network gateway. In Application gateway you can enable diagnostic logs for retrieving,

1. Access log: This includes the caller's IP, requested URL, response latency, return code, and bytes in and out.

2. Performance log: This log captures performance information for each instance, including total requests served, throughput in bytes, total requests served, failed request count, and healthy and unhealthy back-end instance count.

3.Firewall Log: You can use this log to view the requests that are logged through either detection or prevention mode of an application gateway that is configured with the web application firewall.

But, AFAIK generating PCAP file for parsing in Wireshark to see the DNS cache or a log correlating incoming requests with outgoing requests by hostnames and IP addresses at APPGW level is not yet supported.

I would recommend you post your feature request here in this feedback section or upvote the similar kind of feature request here for its future availability.

---

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.

Answer 2

I'm not able to log in at either of those links, but I appreciate the informative response.

Error:
Selected user account does not exist in tenant 'UserVoice, Inc.' and cannot access the application '91a42e81-999b-4cf1-aa36-bb33f25ff53b' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.