A network team sees intermittent blocks on an internal application and needs to know, for individual packets, whether Snort allowed or dropped each one while the traffic is reproduced. The firewall is in production, so tracing must run only during a short test window, and the check has to happen on the Threat Defense device itself. Which troubleshooting command gives per-packet Snort verdicts under those constraints?

System support trace is the right choice because it reports Snort’s allow-or-drop verdicts for individual packets as reproduced traffic is processed. Running it on the Threat Defense device meets the device-local requirement, and limiting it to the short test window avoids leaving a diagnostic trace active on a production firewall. Matching verdict lines to connection events helps associate packet decisions with the suspected application flow. Capturing the reproduced flow can reveal headers, timing, and observable drops, but a capture does not itself provide Snort’s per-packet verdict; inferring disposition from traffic is not equivalent to seeing the inspection decision. Running show snort alerts is an on-device, time-bounded way to review Snort detections, but alerts are event-oriented and generally do not record an allow verdict for every ordinary packet, so they cannot establish the required packet-by-packet result. Packet-tracer can simulate how a representative flow tuple would be handled, but it evaluates a constructed test rather than reporting verdicts for actual packets during traffic reproduction. Exam caveat: distinguish live inspection diagnostics from captures, alerts, and path simulations, which answer related but different questions. Practical check: verify the trace is active only for the approved window, reproduce a known flow, and confirm its packet verdict lines correlate with the expected connection events before stopping the trace.