Skip to main content
typo
Source Link

When you do a packet capture on an SRX you specify the filename you want to save the PCAPs as and then the SRX will append the name of the interface it caught them on.

[edit forwarding-options packet-capture]
 user@host# set file filename testpacketcapture

See here - https://kb.juniper.net/InfoCenter/index?page=content&id=KB11709

The captured file is located in the /var/tmp directory and is formatted in the PCAP format. You can find the file with the file list command.

user@host> file list /var/tmp/ | match testpacketcapture*  
testpacketcapture1.ge-0.0

In the above example they used the interface ge-0/0/0.

It will work for a reth interface also but as far as I can remember it'll tag them with the physical interface.

You can run the packet capture on multiple interfaces. You just need to tag each interface with your firewall filter eg if your filefilter was called PCAP then

user@host# set interfaces ge-0/0/0 unit 0 family inet filter output PCAP
user@host# set interfaces ge-0/0/0 unit 0 family inet filter input PCAP

and make sure your firewall filter has the right terms to capture the required traffic.

When you do a packet capture on an SRX you specify the filename you want to save the PCAPs as and then the SRX will append the name of the interface it caught them on.

[edit forwarding-options packet-capture]
 user@host# set file filename testpacketcapture

See here - https://kb.juniper.net/InfoCenter/index?page=content&id=KB11709

The captured file is located in the /var/tmp directory and is formatted in the PCAP format. You can find the file with the file list command.

user@host> file list /var/tmp/ | match testpacketcapture*  
testpacketcapture1.ge-0.0

In the above example they used the interface ge-0/0/0.

It will work for a reth interface also but as far as I can remember it'll tag them with the physical interface.

You can run the packet capture on multiple interfaces. You just need to tag each interface with your firewall filter eg if your file was called PCAP then

user@host# set interfaces ge-0/0/0 unit 0 family inet filter output PCAP
user@host# set interfaces ge-0/0/0 unit 0 family inet filter input PCAP

and make sure your firewall filter has the right terms to capture the required traffic.

When you do a packet capture on an SRX you specify the filename you want to save the PCAPs as and then the SRX will append the name of the interface it caught them on.

[edit forwarding-options packet-capture]
 user@host# set file filename testpacketcapture

See here - https://kb.juniper.net/InfoCenter/index?page=content&id=KB11709

The captured file is located in the /var/tmp directory and is formatted in the PCAP format. You can find the file with the file list command.

user@host> file list /var/tmp/ | match testpacketcapture*  
testpacketcapture1.ge-0.0

In the above example they used the interface ge-0/0/0.

It will work for a reth interface also but as far as I can remember it'll tag them with the physical interface.

You can run the packet capture on multiple interfaces. You just need to tag each interface with your firewall filter eg if your filter was called PCAP then

user@host# set interfaces ge-0/0/0 unit 0 family inet filter output PCAP
user@host# set interfaces ge-0/0/0 unit 0 family inet filter input PCAP

and make sure your firewall filter has the right terms to capture the required traffic.

Source Link

When you do a packet capture on an SRX you specify the filename you want to save the PCAPs as and then the SRX will append the name of the interface it caught them on.

[edit forwarding-options packet-capture]
 user@host# set file filename testpacketcapture

See here - https://kb.juniper.net/InfoCenter/index?page=content&id=KB11709

The captured file is located in the /var/tmp directory and is formatted in the PCAP format. You can find the file with the file list command.

user@host> file list /var/tmp/ | match testpacketcapture*  
testpacketcapture1.ge-0.0

In the above example they used the interface ge-0/0/0.

It will work for a reth interface also but as far as I can remember it'll tag them with the physical interface.

You can run the packet capture on multiple interfaces. You just need to tag each interface with your firewall filter eg if your file was called PCAP then

user@host# set interfaces ge-0/0/0 unit 0 family inet filter output PCAP
user@host# set interfaces ge-0/0/0 unit 0 family inet filter input PCAP

and make sure your firewall filter has the right terms to capture the required traffic.