Hi This KB provides Junos configuration to count packets of DNS traffic.

The firewall filter configuration is handy when a Juniper device is transit for DNS traffic as monitor traffic interface will not capture any transit traffic on that device.

Below FF configuration will count the DNS packets ingressing and egressing a device from one source destination pair.

Please note some QFX switches does not support log action in output direction. Please verify this config in lab before configuring on a production device

set firewall family inet filter DNS_JTAC-out interface-specific

set firewall family inet filter DNS_JTAC-out term 1 from source-address X.X.X.X

set firewall family inet filter DNS_JTAC-out term 1 from destination-address Y.Y.Y.Y

set firewall family inet filter DNS_JTAC-out term 1 from protocol udp

set firewall family inet filter DNS_JTAC-out term 1 from port domain

set firewall family inet filter DNS_JTAC-out term 1 then count DNS-out

set firewall family inet filter DNS_JTAC-out term 1 then accept

set firewall family inet filter DNS_JTAC-out term 2 then accept

set firewall family inet filter DNS_JTAC-in interface-specific

set firewall family inet filter DNS_JTAC-in term 1 from source-address Y.Y.Y.Y

set firewall family inet filter DNS_JTAC-in term 1 from destination-address X.X.X.X

set firewall family inet filter DNS_JTAC-in term 1 from protocol udp

set firewall family inet filter DNS_JTAC-in term 1 from port domain

set firewall family inet filter DNS_JTAC-in term 1 then count DNS-in

set firewall family inet filter DNS_JTAC-in term 1 then log

set firewall family inet filter DNS_JTAC-in term 1 then accept

set firewall family inet filter DNS_JTAC-in term 2 then accept

set interfaces <> unit <> family inet filter input DNS_JTAC-in

set interfaces <> unit <> family inet filter output DNS_JTAC-out