I've a Juniper SRX 340 Cluster (15.1X49-D70.3) on which I have to do some debug. I know how to sample packets on interfaces and my question is: is it possible to sample traffic at the same time on both WAN and LAN interfaces (and save it into separates files)?
My achieve is to track a TCP session when it enters the firewall and when it exits from firewall.
When you do a packet capture on an SRX you specify the filename you want to save the PCAPs as and then the SRX will append the name of the interface it caught them on.
[edit forwarding-options packet-capture]
user@host# set file filename testpacketcapture
See here - https://kb.juniper.net/InfoCenter/index?page=content&id=KB11709
The captured file is located in the /var/tmp directory and is formatted in the PCAP format. You can find the file with the file list command.
user@host> file list /var/tmp/ | match testpacketcapture*
testpacketcapture1.ge-0.0
In the above example they used the interface ge-0/0/0.
It will work for a reth interface also but as far as I can remember it'll tag them with the physical interface.
You can run the packet capture on multiple interfaces. You just need to tag each interface with your firewall filter eg if your filter was called PCAP then
user@host# set interfaces ge-0/0/0 unit 0 family inet filter output PCAP
user@host# set interfaces ge-0/0/0 unit 0 family inet filter input PCAP
and make sure your firewall filter has the right terms to capture the required traffic.
