Juniper Networks J-Series manual Packet Capture on Router Interfaces, Configuring Packet Capture

Chapter 13: Configuring Packet Capture

NOTE: You can enable packet capture and port mirroring simultaneously on a Services Router.

For more information about traffic sampling, see the JUNOS Policy Framework

Configuration Guide.

This overview contains the following topics:

■Packet Capture on Router Interfaces on page 255

■Firewall Filters for Packet Capture on page 255

■Packet Capture Files on page 256

■Analysis of Packet Capture Files on page 256

Packet Capture on Router Interfaces

Packet capture is supported on the T1, T3, E1, E3, serial, Fast Ethernet, ADSL,

G.SHDSL, PPPoE, and ISDN interfaces.

To capture packets on an ISDN interface, configure packet capture on the dialer interface. To capture packets on a PPPoE interface, configure packet capture on the PPPoE logical interface.

Packet capture supports PPP, Cisco HDLC, Frame Relay, and other ATM encapsulations. Packet capture also supports Multilink PPP (MLPPP), Multilink Frame Relay end-to-end (MLFR), and Multilink Frame Relay UNI/NNI (MFR) encapsulations.

You can capture all IPv4 packets flowing on an interface in the inbound (ingress) or outbound (egress) direction or in both directions. Tunnel interfaces can support packet capture in the outbound direction only.

Use the J-Web configuration editor or CLI configuration editor to specify maximum packet size, the filename to be used for storing the captured packets, maximum file size, maximum number of packet capture files, and the file permissions. See “Configuring Packet Capture on an Interface (Required)” on page 259.

NOTE: For packets captured on T1, T3, E1, E3, serial, and ISDN interfaces in the outbound (egress) direction, the size of the packet captured might be 1 byte less than the maximum packet size configured because of the packet loss priority (PLP) bit.

To modify encapsulation on an interface that has packet capture configured, you must first disable packet capture. For more information, see “Changing Encapsulation on Interfaces with Packet Capture Configured” on page 262.

Firewall Filters for Packet Capture

When you enable packet capture on a Services Router, all packets flowing in the direction specified in packet capture configuration (inbound, outbound, or both) are captured and stored. Configuring an interface to capture all packets might degrade

Packet Capture Overview ■ 255