Junos monitor traffic: Packet Capture Examples

Junos offers two complementary ways to capture packets. The quick one is monitor traffic interface, a tcpdump-style operational command that prints packets to the screen or saves them to a file with no configuration change. The persistent one is the forwarding-options packet-capture mechanism: you define a firewall filter with a sample action, apply it to the interface, and Junos writes matching traffic to a pcap file you can pull off the box and open in Wireshark. This guide shows both approaches with real command examples on SRX and EX/QFX platforms.

Quick Capture with monitor traffic

Run from operational mode; Ctrl-C stops the capture. Add a quoted tcpdump-style expression to narrow the traffic:

user@host> monitor traffic interface ge-0/0/0
user@host> monitor traffic interface ge-0/0/0 size 1500 count 20
user@host> monitor traffic interface ge-0/0/0 "icmp"
user@host> monitor traffic interface ge-0/0/0 "host 172.16.1.1 and tcp port 443"

Be aware of two Junos limitations: the monitor traffic command cannot apply match conditions to inbound traffic, and on the interface form, Layer 3 and Layer 4 match conditions (the | match pipe) are not supported.

Persistent Capture with forwarding-options packet-capture

Configure the capture file, define a firewall filter that samples only the traffic you care about, and apply it to the interface. The following SRX example captures ICMP between 172.16.1.1 and 172.16.2.1 only:

[edit forwarding-options packet-capture]
user@host# set file filename CAPTURE1

[edit firewall]
user@host# set filter CAPTURE_FILTER term 1 from source-address 172.16.1.1/32
user@host# set filter CAPTURE_FILTER term 1 from destination-address 172.16.2.1/32
user@host# set filter CAPTURE_FILTER term 1 from protocol icmp
user@host# set filter CAPTURE_FILTER term 1 then count COUNT1
user@host# set filter CAPTURE_FILTER term 1 then sample
user@host# set filter CAPTURE_FILTER term 2 then accept

[edit interfaces ge-0/0/0 unit 0 family inet]
user@host# set filter input CAPTURE_FILTER

Commit, generate the traffic you want to catch, then check the packet counter and locate the capture file. Junos appends the interface name to the filename:

user@host> show firewall
Filter: CAPTURE_FILTER
Counters:
Name      Bytes    Packets
COUNT1    420      5

user@host> file list /var/tmp
/var/tmp/CAPTURE1.ge-0/0/0

Pulling the Capture File and Analyzing It

Copy the file to a workstation over scp and open it in Wireshark:

user@host> file copy /var/tmp/CAPTURE1.ge-0/0/0 scp://user@192.168.200.10/tmp/

Remember to disable the capture when you are done - leaving packet capture running on a busy interface costs CPU:

[edit forwarding-options]
user@host# set packet-capture disable

Related Articles

Pair packet capture with our tcpdump filters guide, Wireshark capture vs display filters, and Junos monitor interface for real-time traffic.

原文链接：https://rayka-co.com/lesson/junos-packet-capture-configuration-example