Dump traffic on routing-instance with a Juniper SRX firewall

Question

A Juniper firewall can display data with the tcpdump command:

% tcpdump -i ge-0/0/0
% tcpdump -i vlan10

However, if the interface or the VLAN is assigned to a routing instance, the traffic is not captured. Is there a way to do it ?

Answer 1

This works fine on the lower-end SRX models - try using the layer 3 interface bound to your VLAN eg:

tcpdump -i vlan.10

My configuration looks like this:

routing-instances {
    TCPDUMP-TEST {
        instance-type virtual-router;
        interface vlan.10;
    }
}
vlans {
    v10-TEST {
        vlan-id 10;
        l3-interface vlan.10;
    }
}

Bear in mind that you won't be able to see traffic that isn't directed at the RE (eg: destination IP address of vlan.10 interface). You also won't be able to see ICMP traffic, as this is processed via the PFE, rather than the RE.