Packet capture

Fri, 24 Jul 2026 21:31:13 +0200

Real-time packet capture on Junos

Packet capture in real time on an interface is performed with the monitor command:

lab@vSRX> monitor traffic interface fxp0 ?
Possible completions:
  <[Enter]>            Execute this command
  absolute-sequence    Display absolute TCP sequence numbers
  brief                Display brief output
  count                Number of packets to receive (0..1000000 packets)
  detail               Display detailed output
  extensive            Display extensive output
  layer2-headers       Display link-level header on each dump line
  matching             Expression for headers of receive packets to match
  no-domain-names      Don't display domain portion of hostnames
  no-promiscuous       Don't put interface into promiscuous mode
  no-resolve           Don't attempt to print addresses symbolically
  no-timestamp         Don't print timestamp on each dump line
  print-ascii          Display packets in ASCII when displaying in hexadecimal format
  print-hex            Display packets in hexadecimal format
  read-file            Read packets from a given file
  resolve-timeout      Period of time to wait for each name resolution (seconds)
  size                 Amount of each packet to receive (bytes)
  write-file           Write packets to specified file
  |                    Pipe through a command
lab@vSRX> monitor traffic interface fxp0 write-file capture01.pcap 
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes

^C
297 packets received by filter
0 packets dropped by kernel

lab@vSRX>

lab@vSRX> file list 

/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /

lab@vSRX>

Then I open the freeBSD CLI and open the pcap file using tcpdump:

Wireshark on

Packet capture

Real-time packet capture on Junos