Knowledge Center Search


 

[SRX] How to create a PCAP packet capture on a J-Series or SRX branch device (includes KBTV video)

  [KB11709] Show KB Properties

  [KB11709] Hide KB Properties

Categories:
Knowledge Base ID: KB11709
Last Updated: 03 Jan 2014
Version: 18.0

Summary:

This article provides video and text instructions on how to create a PCAP packet capture, on a J-Series or SRX Branch device, that can be read via Wireshark or Ethereal.


Problem or Goal:

When troubleshooting, a packet capture is very useful. This is best accomplished by performing a packet capture outside of the J-series or SRX device. However, under certain instances, having a PC or server inline for Ethereal/Wireshark or tcpdump captures may not be possible. So, the J-Series and SRX Branch devices (SRX100, SRX110,SRX210, SRX220, SRX240, SRX550, and SRX650) can directly perform a packet capture. The steps to do this are documented in the solution below.

Note: The PCAP packet-capture can only capture IPv4 protocol traffic. 


Cause:

Solution:

Go to the video or text instructions below:

Video format:



Text format:

To obtain the packet capture on branch SRX devices, perform the following steps:

Note:
 For information on obtaining packet-captures on high-end SRX devices, refer to KB21563 - How to capture packets on High-End SRX devices.


Step 1:  Configure forwarding options:

To do this, navigate to forwarding-options and then to packet-capture hierarchy as below:
[edit]
user@host# edit forwarding-options packet-capture

[edit forwarding-options packet-capture]
user@host#

 Specify a file name for the packet capture and set the maximum-capture-size to 1500 as below:

[edit forwarding-options packet-capture]
user@host# set file filename testpacketcapture

[edit forwarding-options packet-capture]
user@host# set maximum-capture-size 1500

[edit forwarding-options packet-capture]
user@host# show
file filename testpacketcapture;
maximum-capture-size 1500;

[edit forwarding-options packet-capture]
user@host#top


Step 2:  Configure firewall filter for packet capture.

This is strongly recommended because with the firewall filter, the amount of traffic to be capture can be restricted, and it is less CPU intensive, as compared without filters.

To do this, set the filter, term name, define the match condition, and its action.

For example, the firewall filter below will collect traffic that arrives on the interface with a source address of 10.209.242.138 AND destination-address of 10.204.115.166 AND vice versa. The term allow-all-else is used to make sure that the SRX does not drop any other traffic, but do not sample it either.

user@host# set firewall filter PCAP term 1 from source-address 10.209.144.32
user@host# set firewall filter PCAP term 1 from destination-address 10.204.115.166
user@host# set firewall filter PCAP term 1 then sample
user@host# set firewall filter PCAP term 1 then accept
user@host# set firewall filter PCAP term 2 from source-address 10.204.115.166
user@host# set firewall filter PCAP term 2 from destination-address 10.209.144.32
user@host# set firewall filter PCAP term 2 then sample
user@host# set firewall filter PCAP term 2 then accept
user@host# set firewall filter PCAP term allow-all-else then accept


Step 3:  Apply firewall fIlter to desired interface.

Decide which interface you want to capture the packets on. This must be an Ethernet interface. For this example, interface ge-0/0/0 is used.

Apply the firewall filter on the desired interface for the input and output direction:

user@host# set interfaces ge-0/0/0 unit 0 family inet filter output PCAP
user@host# set interfaces ge-0/0/0 unit 0 family inet filter input PCAP


Step 4:  Commit to activate the packet capture.

user@host# commit

Once you commit, then run your test to pass the traffic that needs to be captured.

Once the test is complete, deactivate the packet capture to stop the collection of packets. To do this, remove the packet-capture and sampling configuration that was just added above and commit. A quick way to do this is using rollback:

user@host# rollback 1
user@host# commit



Step 5:  Copy packet capture file from the SRX or J-Series device, and view it with your PCAP utility.

The captured file is located inthe /var/tmp directory and is formatted in the PCAP format. You can find the file with the file list command. 

user@host> file list /var/tmp/ | match testpacketcapture*  
testpacketcapture1.ge-0.0

Copy this file to your PC.

The packet capture file created can be viewed with Wireshark, Ethereal, or other PCAP packet capture utility.

Purpose:
Troubleshooting

Related Links:

 

 

ASK THE KB

Question or KB ID:


 


 

 
Copyright© 1999-2012 Juniper Networks, Inc. All rights reserved.