Real-time packet capture on Junos
Packet capture in real time on an interface is performed with the monitor command:
lab@vSRX> monitor traffic interface fxp0 ?
Possible completions:
<[Enter]> Execute this command
absolute-sequence Display absolute TCP sequence numbers
brief Display brief output
count Number of packets to receive (0..1000000 packets)
detail Display detailed output
extensive Display extensive output
layer2-headers Display link-level header on each dump line
matching Expression for headers of receive packets to match
no-domain-names Don't display domain portion of hostnames
no-promiscuous Don't put interface into promiscuous mode
no-resolve Don't attempt to print addresses symbolically
no-timestamp Don't print timestamp on each dump line
print-ascii Display packets in ASCII when displaying in hexadecimal format
print-hex Display packets in hexadecimal format
read-file Read packets from a given file
resolve-timeout Period of time to wait for each name resolution (seconds)
size Amount of each packet to receive (bytes)
write-file Write packets to specified file
| Pipe through a command
lab@vSRX> monitor traffic interface fxp0 write-file capture01.pcap
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes
^C
297 packets received by filter
0 packets dropped by kernel
lab@vSRX>
lab@vSRX> file list
/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /
lab@vSRX>
Then I open the freeBSD CLI and open the pcap file using tcpdump: