Packet capture
Table of Contents
Real-time packet capture on Junos#
Packet capture in real time on an interface is performed with the monitor command:
lab@vSRX> monitor traffic interface fxp0 ?
Possible completions:
<[Enter]> Execute this command
absolute-sequence Display absolute TCP sequence numbers
brief Display brief output
count Number of packets to receive (0..1000000 packets)
detail Display detailed output
extensive Display extensive output
layer2-headers Display link-level header on each dump line
matching Expression for headers of receive packets to match
no-domain-names Don't display domain portion of hostnames
no-promiscuous Don't put interface into promiscuous mode
no-resolve Don't attempt to print addresses symbolically
no-timestamp Don't print timestamp on each dump line
print-ascii Display packets in ASCII when displaying in hexadecimal format
print-hex Display packets in hexadecimal format
read-file Read packets from a given file
resolve-timeout Period of time to wait for each name resolution (seconds)
size Amount of each packet to receive (bytes)
write-file Write packets to specified file
| Pipe through a command
lab@vSRX> monitor traffic interface fxp0 write-file capture01.pcap
Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on fxp0, capture size 96 bytes
^C
297 packets received by filter
0 packets dropped by kernel
lab@vSRX>
lab@vSRX> file list
/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /
lab@vSRX>
Then I open the freeBSD CLI and open the pcap file using tcpdump:
lab@vSRX> start shell
% pwd
/var/home/lab
% tcpdump -r capture01.pcap
Reverse lookup for 172.25.11.3 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use <no-resolve> to avoid reverse lookups on IP addresses.
15:17:55.757581 Out IP truncated-ip - 204 bytes missing! 172.25.11.3.ssh > 172.25.11.
254.53158: P 1236833713:1236833925(212) ack 3494423964 win 33304 <nop,nop,timestamp 2
182379091 2938365265>
15:17:55.758037 In IP 172.25.11.254.53158 > 172.25.11.3.ssh: . ack 212 win 609 <nop,
nop,timestamp 2938365271 2182379086>
15:17:55.772072 In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 1:53(52) ack 212 win 609 <nop,nop,timestamp 2938365285 2182379086>
15:17:55.772108 Out IP truncated-ip - 44 bytes missing! 172.25.11.3.ssh > 172.25.11.2
54.53158: P 212:264(52) ack 53 win 33304 <nop,nop,timestamp 2182379105 2938365285>
15:17:55.790823 In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 53:105(52) ack 264 win 609 <nop,nop,timestamp 2938365304 2182379105>
<---- output omitted ---->
I can grep for specific data, for example looking for a communication with a remote syslog server:
% tcpdump -r capture01.pcap | grep 514
Reverse lookup for 172.25.11.3 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use <no-resolve> to avoid reverse lookups on IP addresses.
15:17:56.180737 Out IP truncated-ip - 44 bytes missing! 172.25.11.3.ssh > 172.25.11.2
54.53158: P 1304:1356(52) ack 1145 win 33304 <nop,nop,timestamp 2182379514 2938365693
>
15:17:56.199324 In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 1145:1197(52) ack 1356 win 609 <nop,nop,timestamp 2938365712 2182379514>
15:17:57.673481 In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 5097:5149(52) ack 5308 win 609 <nop,nop,timestamp 2938367186 2182380987>
15:17:57.673567 Out IP truncated-ip - 44 bytes missing! 172.25.11.3.ssh > 172.25.11.2
54.53158: P 5308:5360(52) ack 5149 win 33304 <nop,nop,timestamp 2182381007 2938367186
>
15:17:57.692605 In IP truncated-ip - 44 bytes missing! 172.25.11.254.53158 > 172.25.
11.3.ssh: P 5149:5201(52) ack 5360 win 609 <nop,nop,timestamp 2938367205 2182381007>
%
Ideally, download the file from the device and inspect it locally. Delete the capture file in Junos:
lab@vSRX> file list
/var/home/lab/:
.lesshst
.ssh/
capture01.pcap
jt /
lab@vSRX>
lab@vSRX> file delete capture01.pcap
lab@vSRX> file list
/var/home/lab/:
.lesshst
.ssh/
jt /
lab@vSRX>