packet capture on Junos operational mode#

Packet capture in real time on an interface is performed with the monitor command:

lab@vSRX> monitor traffic interface fxp0 ?
Possible completions:
  <[Enter]>            Execute this command
  absolute-sequence    Display absolute TCP sequence numbers
  brief                Display brief output
  count                Number of packets to receive (0..1000000 packets)
  detail               Display detailed output
  extensive            Display extensive output
  layer2-headers       Display link-level header on each dump line
  matching             Expression for headers of receive packets to match
  no-domain-names      Don't display domain portion of hostnames
  no-promiscuous       Don't put interface into promiscuous mode
  no-resolve           Don't attempt to print addresses symbolically
  no-timestamp         Don't print timestamp on each dump line
  print-ascii          Display packets in ASCII when displaying in hexadecimal format
  print-hex            Display packets in hexadecimal format
  read-file            Read packets from a given file
  resolve-timeout      Period of time to wait for each name resolution (seconds)
  size                 Amount of each packet to receive (bytes)
  write-file           Write packets to specified file
  |                    Pipe through a command
lab@vSRX> monitor traffic interface fxp0 write-file capture01.pcap 
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes

^C
297 packets received by filter
0 packets dropped by kernel

lab@vSRX>

lab@vSRX> file list 

/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /

lab@vSRX>

Then I open the freeBSD CLI and open the pcap file using tcpdump:

lab@vSRX> start shell 
% pwd
/var/home/lab
% tcpdump -r capture01.pcap
Reverse lookup for 172.25.11.3 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use <no-resolve> to avoid reverse lookups on IP addresses.

15:17:55.757581 Out IP truncated-ip - 204 bytes missing! 172.25.11.3.ssh > 172.25.11.
254.53158: P 1236833713:1236833925(212) ack 3494423964 win 33304 <nop,nop,timestamp 2
182379091 2938365265>
15:17:55.758037  In IP 172.25.11.254.53158 > 172.25.11.3.ssh: . ack 212 win 609 <nop,
nop,timestamp 2938365271 2182379086>
15:17:55.772072  In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 1:53(52) ack 212 win 609 <nop,nop,timestamp 2938365285 2182379086>
15:17:55.772108 Out IP truncated-ip - 44 bytes missing! 172.25.11.3.ssh > 172.25.11.2
54.53158: P 212:264(52) ack 53 win 33304 <nop,nop,timestamp 2182379105 2938365285>
15:17:55.790823  In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 53:105(52) ack 264 win 609 <nop,nop,timestamp 2938365304 2182379105>

<---- output omitted ---->

I can grep for specific data, for example looking for a communication with a remote syslog server:

% tcpdump -r capture01.pcap | grep 514
Reverse lookup for 172.25.11.3 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use <no-resolve> to avoid reverse lookups on IP addresses.

15:17:56.180737 Out IP truncated-ip - 44 bytes missing! 172.25.11.3.ssh > 172.25.11.2
54.53158: P 1304:1356(52) ack 1145 win 33304 <nop,nop,timestamp 2182379514 2938365693
>
15:17:56.199324  In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 1145:1197(52) ack 1356 win 609 <nop,nop,timestamp 2938365712 2182379514>
15:17:57.673481  In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 5097:5149(52) ack 5308 win 609 <nop,nop,timestamp 2938367186 2182380987>
15:17:57.673567 Out IP truncated-ip - 44 bytes missing! 172.25.11.3.ssh > 172.25.11.2
54.53158: P 5308:5360(52) ack 5149 win 33304 <nop,nop,timestamp 2182381007 2938367186
>
15:17:57.692605  In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 5149:5201(52) ack 5360 win 609 <nop,nop,timestamp 2938367205 2182381007>
%

Ideally, download the file from the device and inspect it locally. Delete the capture file in Junos:

lab@vSRX> file list 

/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /

lab@vSRX> 

lab@vSRX> file delete capture01.pcap 

lab@vSRX> file list 

/var/home/lab/:
.lesshst
.ssh/
jt /

lab@vSRX>

packet capture on Junos in the shell mode#

tcpdump should be supported in FreeBSD. But the shell mode with the current user showed me that I need to escalate privileges:

jcluser@spine2> start shell 
% tcpdump 
(no devices found) /dev/bpf0: Permission denied
% pwd
/var/home/jcluser

In this version of FreeBSD, sudo is not available:

% 
% sudo
sudo: Command not found.
% man sudo
man: Command not found.
% uname -a
FreeBSD spine2 JNPR-12.1-20241031.89001bf_buil FreeBSD JNPR-12.1-20241031.89001bf_builder_stable_12_234 #0 r356482+89001bf4fdfc(stable/12_234): Mon Dec  9 11:33:14 PST 2024     builder@qnc-jre-fbsd01:/volume/build/junos/occam/llvm-13.0/sandbox-234-20241031-89001bf/freebsd/stable_12_234/20241031.174156_builder_stable_12_234.89001bf/obj/amd64/juniper/kernels/JNPR-AMD64-PRD/kernel  amd64
%

So I switched user to root.

% su - root
Password:
root@spine2:~ # 

root@spine2:~ # tcpdump --help
Version 4.0-PRE-CVS
libpcap version 0.9.4
Usage: tcpdump [-abdeflnNOpqStUvxX] [-c count] [ -F file ]
                [ -i interface ] [ -r file ] [ -s snaplen ]
                [ -T type ] [ -w file ] [ expression ]
                [ -Jt resolve_tmo ]
root@spine2:~ #

root@spine2:~ # tcpdump -i ge-0/0/0 -w /tmp/tshbgp.pcap 
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on ge-0/0/0, capture size 96 bytes

^C
17 packets received by filter
0 packets dropped by kernel
root@spine2:~ # ls /tmp/tshbgp.pcap 
/tmp/tshbgp.pcap
root@spine2:~ #