How can I capture application layer packages using `monitor traffic`?

Question

In my Juniper MX480 , when I use monitor traffic ae16.327 no-resolve, I only get arp packages:

10:19:51.819444 Out arp who-has 109.25.6.5 tell 109.25.6.6
10:19:52.531849 Out arp who-has 109.25.6.4 tell 109.25.6.6
10:19:52.736633 Out arp who-has 109.25.6.5 tell 109.25.6.6
10:19:53.496214 Out arp who-has 109.25.81.249 tell 109.25.81.254
10:19:53.950304 Out arp who-has 109.25.6.5 tell 109.25.6.6
10:19:54.025389 Out arp who-has 109.25.81.253 tell 109.25.81.254
10:19:54.164206 Out arp who-has 109.25.81.249 tell 109.25.81.254
10:19:54.573082 Out arp who-has 109.25.6.5 tell 109.25.6.6
10:19:54.880021 Out arp who-has 109.25.81.249 tell 109.25.81.254
10:19:54.982068 Out arp who-has 109.25.81.253 tell 109.25.81.254
10:19:55.487762 Out arp who-has 109.25.81.249 tell 109.25.81.254
10:19:56.305907 Out arp who-has 109.25.81.249 tell 109.25.81.254
10:19:56.714072 Out arp who-has 109.25.81.252 tell 109.25.81.254
10:19:57.432325 Out arp who-has 109.25.81.252 tell 109.25.81.254
10:20:10.926591 Out arp who-has 109.25.6.1 tell 109.25.6.6
10:20:10.979725 Out arp who-has 109.25.6.2 tell 109.25.6.6
10:20:11.720756 Out arp who-has 109.25.6.4 tell 109.25.6.6
10:20:11.757662 Out arp who-has 109.25.6.1 tell 109.25.6.6
10:20:11.860067 Out arp who-has 109.25.6.2 tell 109.25.6.6
10:20:12.472939 Out arp who-has 109.25.6.4 tell 109.25.6.6
10:20:13.392493 Out arp who-has 109.25.6.4 tell 109.25.6.6
10:20:14.618627 Out arp who-has 109.25.6.5 tell 109.25.6.6
10:20:15.439043 Out arp who-has 109.25.6.5 tell 109.25.6.6

how can I capture ICMP packages and other application layer packages?

---

EDIT-01

I tried :

monitor traffic ae16.327 no-resolve matching "icmp"

and ping 109.25.81.254 in my host.

but there display nothing, seems capture nothing.

Answer 1

Juniper splits traffic into two categories, exception and transit.

Exception Traffic: These are packets that have a source or destination IP address that lives on that device (i.e. an interface address). Basically, it’s traffic that the device must handle itself (this happens on the routing engine), such as control plane traffic or ICMP packets.

Transit Traffic: This is the traffic that goes through the router, that is received by one interface and forwarded out another without involvement from the RE.

The monitor traffic command can only see exception traffic. In your case, those ARP packets are being generated by your router. As for the ICMP, the address you’re pinging is not on that router, so it would be considered transit traffic. This limitation is intentional, think about a 100G interface operating at line rate, it would overwhelm the CPU when trying to capture those packets or fill available storage if you chose to save the capture to a file.

You can accomplish what you want by configuring Port Mirroring.

Answer 2

if you are pinging an ip in the router, only then monitor traffic will list, you can also do monitor interface lo0, it will list traffic through all interface destined to the router, like bgp, ospf, arp, icmp.

as stated by Jordan, Monitor traffic lists only traffic destined to the router which passes through that interface, this traffic is known as control traffic.

Monitor interface doesnt list all the traffic passing though that interface/transit traffic.

if you want to capture transit traffic, then use sampling.

Packet capture on All SRX, MX (including 1xx, 2xx, 5xx, 6xx SRX and M, MX and T series routes series)

1.Define capture file and settings

set forwarding-options packet-capture file filename test_capture

set forwarding-options packet-capture maximum-capture-size 1500

2. Method1 - Recommended by Juniper and very useful for a granular capture. However the downside is that applying a filter on a production interface increases cpu usage on some devices.

2.1. Create a firewall filter specifying capture criteria:

set firewall filter TEST_CAPTURE term 1-in from source-address 192.168.100.0/24

set firewall filter TEST_CAPTURE term 1-in then sample

set firewall filter TEST_CAPTURE term 1-in then accept

set firewall filter TEST_CAPTURE term 2-out from destination-address

192.168.100.0/24

set firewall filter TEST_CAPTURE term 2-out then sample

set firewall filter TEST_CAPTURE term 2-out then accept

set firewall filter TEST_CAPTURE term 3-catch-all then accept

2.2. Apply filter to an interface, inbound and/or outbound:

set interfaces ge-0/0/1 unit 0 family inet filter input TEST_CAPTURE

set interfaces ge-0/0/1 unit 0 family inet filter output TEST_CAPTURE

file list /var/tmp/ will list the file, ftp to the device on port 22 with ssh credentials to get the file