Real-time packet capture on Junos

Packet capture in real time on an interface is performed with the monitor command:

lab@vSRX> monitor traffic interface fxp0 ?
Possible completions:
  <[Enter]>            Execute this command
  absolute-sequence    Display absolute TCP sequence numbers
  brief                Display brief output
  count                Number of packets to receive (0..1000000 packets)
  detail               Display detailed output
  extensive            Display extensive output
  layer2-headers       Display link-level header on each dump line
  matching             Expression for headers of receive packets to match
  no-domain-names      Don't display domain portion of hostnames
  no-promiscuous       Don't put interface into promiscuous mode
  no-resolve           Don't attempt to print addresses symbolically
  no-timestamp         Don't print timestamp on each dump line
  print-ascii          Display packets in ASCII when displaying in hexadecimal format
  print-hex            Display packets in hexadecimal format
  read-file            Read packets from a given file
  resolve-timeout      Period of time to wait for each name resolution (seconds)
  size                 Amount of each packet to receive (bytes)
  write-file           Write packets to specified file
  |                    Pipe through a command
lab@vSRX> monitor traffic interface fxp0 write-file capture01.pcap 
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes

^C
297 packets received by filter
0 packets dropped by kernel

lab@vSRX>

lab@vSRX> file list 

/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /

lab@vSRX> 

Then I open the freeBSD CLI and open the pcap file using tcpdump:

BIOS vs UEFI

Both BISO and UEFI constitute an interface between the Operating System and the firmware of the hardware platform. They are pieces of software that is embedded on some chip or controller on the hardware, i.e. the motherboard of a server. Both BIOS and UEFI look for instructions on the disks that help locate the respective bootloader. BIOS Looks for the MBR (Master Boot Record) in the first sector of the disk. UEFI looks for the .efi files that are located in the EFI Special Partition (ESP) under /boot/efi/EFI/. Once the bootloader is located, the interface (BIOS or UEFI) loads it in memory and give it control for the rest of the OS boot operations.

List all block devices and look for a block device with type of ‘rom’:

user1@rhel10-vm2:~$ lsblk
NAME          MAJ:MIN RM   SIZE RO TYPE MOUNTPOINTS
sr0            11:0    1 816.4M  0 rom  
vda           252:0    0    25G  0 disk 
├─vda1        252:1    0     1M  0 part 
├─vda2        252:2    0     1G  0 part /boot
└─vda3        252:3    0    24G  0 part 
  ├─rhel-root 253:0    0    22G  0 lvm  /
  └─rhel-swap 253:1    0     2G  0 lvm  [SWAP]
user1@rhel10-vm2:~$ 
user1@rhel10-vm2:~$ 

‘sr0’ is the block device of type ‘rom’. There is no mount point associated with it at the moment. In the /dev directory, grep the ‘sr0’ block device:

Basic vs extended regex in grep

With basic regex expressions (short BRE), special characters must be preceeded with a backslash if they are to be interpreted as special. Otherwise, they are interpreted as regular characters. The exception to this rule is the carrot character (^). BRE mode is activated with the -e option.

Let us consider a sample file /tmp/test.log":

Wassim@linux:/tmp$ cat test.log
a+b
a plus b
aaaaaaaab
Wassim@linux:/tmp$ 

Example 1: grep -e and passing the special characters without a backslash:

Notes from a Juniper Junos troubleshooting course

Packets reaching the irb interface trigger a routing lookup.

When using vMX, typically in a lab, then there should be two VMs: one for the control plane and one for the forwarding plane, named something like vmx1-vcp and vmx1-vfp respectively.

When pinging the IP address of an aggregate Ethernet interface, the ICMP Echo Reply packets are duplicated:

lab@vEX> ping 172.16.200.2 count 3    
PING 172.16.200.2 (172.16.200.2): 56 data bytes
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.034 ms
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.209 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.251 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.295 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.346 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.387 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.418 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=0 ttl=63 time=3.448 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.641 ms
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.688 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.711 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.717 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.871 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.883 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.919 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=1 ttl=63 time=3.923 ms (DUP!)
64 bytes from 172.16.200.2: icmp_seq=2 ttl=63 time=2.626 ms

--- 172.16.200.2 ping statistics ---
3 packets transmitted, 3 packets received, +14 duplicates, 0% packet loss
round-trip min/avg/max/stddev = 2.626/3.492/3.923/0.343 ms

lab@vEX> 

The ‘hot swappable’ and ‘hot pluggable’ are chassis capabilities and are not the same.

OSPF in Junos

lab@vSRX> show configuration interfaces ge-0/0/2 
unit 0 {
    family inet {
        address 192.168.11.2/24;
    }
}

lab@vSRX> show configuration protocols ospf 
area 0.0.0.0 {
    interface ge-0/0/2.0;
}

lab@vSRX> 

lab@vSRX> show ospf interface 
Interface           State   Area            DR ID           BDR ID          Nbrs
ge-0/0/2.0          BDR     0.0.0.0         192.168.1.1     192.168.31.1       1

lab@vSRX> 

lab@vSRX> show ospf neighbor 
Address          Interface              State           ID               Pri  Dead
192.168.11.1     ge-0/0/2.0             Full            192.168.1.1      128    39

lab@vSRX>

lab@vSRX> show route protocol ospf  

inet.0: 24 destinations, 38 routes (24 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

192.168.1.1/32     *[OSPF/10] 01:58:32, metric 1
                    >  to 192.168.11.1 via ge-0/0/2.0
224.0.0.5/32       *[OSPF/10] 01:58:42, metric 1
                       MultiRecv

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

lab@vSRX>

Git vs SVC

An SVC is a type of Software Configuration Management (SCM) git is the most popular distributed software version control (dsvc)

Git vs Github

Git is the DSVC (Distributed Software Version Control). Github is a cloud platform that uses Git as its core technology plus additional features like Discussions and Pull Requests.

Using Git

There are CLI tools like Git Desktop and GUI tools like Microsoft Visual Studio Code to use Git. GUI tools have their own limitations.

First, I have the habit of working in virtual environments. I create one and activate it:

Wassim@linux:~/private/labscripts$ python -m venv venv
Wassim@linux:~/private/labscripts$ ls
venv
Wassim@linux:~/private/labscripts$ source venv/bin/activate
((venv) ) Wassim@linux:~/private/labscripts$

I upgrade the pip package:

((venv) ) Wassim@linux:~/private/labscripts$ pip install --upgrade pip
Requirement already satisfied: pip in ./venv/lib64/python3.12/site-packages (23.3.2)
Collecting pip
  Downloading pip-26.2.1-py3-none-any.whl.metadata (4.6 kB)
Downloading pip-26.2.1-py3-none-any.whl (1.8 MB)
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1.8/1.8 MB 19.3 MB/s eta 0:00:00
Installing collected packages: pip
  Attempting uninstall: pip
    Found existing installation: pip 23.3.2
    Uninstalling pip-23.3.2:
      Successfully uninstalled pip-23.3.2
Successfully installed pip-26.2.1
((venv) ) Wassim@linux:~/private/labscripts$ 

I only have the pip package installed. I need pyEZ, Netmiko.

NTP configuration and verification on Junos

lab@vSRX> show configuration system | find ntp 
ntp {
    server 172.25.11.254;
}

lab@vSRX> show configuration system | find zone 
time-zone Europe/Berlin;
syslog {
    file interactive-commands {
        interactive-commands any;
    }
    file messages {
        any any;
        authorization info;
    }
}
license {
    autoupdate {
        url https://ae1.juniper.net/junos/key_retrieval;
    }
}
ntp {
    server 172.25.11.254;
}

lab@vSRX>

Then I instruct Junos to sync its date and time with the NTP server. Note that the set date ntp is executed at the operational mode:

PIM-SM requires the following components: a Rendez-vous Point, shared trees, source trees.

PIM Register and Register Stop messages 

PIM register messages are sent by a PIM router to the Rendez-vous Point when it [the PIM router] receives multicast traffic from a streaming source. 

PIM RP sends a PIM register stop message to signal to the PIM router that it [the RP] has received the PIM register message.

Incoming Interfaces vs Outgoing Interface List

Incoming Interface

The PIM router’s interface that receives – or is supposed to receive – multicast traffic from the multicast source.