I see this article:

user@host> monitor traffic matching “port 22” no-resolve

there can matching a port

and I can matching arp too:

user@host> monitor traffic matching “arp” no-resolve

but, how can I matching a IP address?

if I matching

user@host> monitor traffic matching “” no-resolve 

there will get syntax error.


Add the host keyword. As in:

user@host> monitor traffic matching "host” no-resolve 
  • @aircraft. While using the monitor command in Juniper , please remember that only packets /traffic destined to Router itself or Routing Engine will be shown on cli. You cannot capture the transit traffic by using this command. Only packets that are hit on Control plan can be captured using this command. Dec 22 '19 at 14:05
  • @aircraft. Furthermore if you want to save the output of monitor command in pcap (wireshark format) you can add the hidden knob to the monitor command like this:- monitor traffic interface ge-1/1/0 matching "port tcp 179" no-resolve write-file test.pcap Dec 22 '19 at 14:09
  • @aircraft. The file test.pcap will stored in /var/home/Username directory. Dec 22 '19 at 14:13

It's completely depends upon devices your are working with .

By Configuring filter with soucce and destination ip address traffic can be monitored

Traffic can either monity with "souce Ip address ". & *Destination ip address". Or even with service port traffic can be monitored

Example of filters Configured in juniper firewall to monitor traffic is

Show security flow session "source -prefix" 12.14.X.X destionation destionation destionation -prefix 14.76.X.X


user@host> monitor traffic matching "net"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.