Because numerous small packets traverse the same VXLAN tunnel with same source and destination tunnel IP addresses, customers need to count whether VXLAN‑encapsulated large ping packets are transmitted or received on underlay interfaces.
This requirement arises due to communication failures between VXLAN endpoints when large ping packets are sent with the DF (Do Not Fragment) bit set.
xe-0/0/2:0.1456 is underlay interface which send out and receive the packet.
We use firewall filter flt_vxlan_ping_in and flt_vxlan_ping_out as example here.
1) Apply firewall filter below to underlay interface xe-0/0/2:0.1456
2) Then initiate ping with specified patterns "aa" from local or remote peers.
cli-> ping pattern aa <>
Checking counter incrementing with CLI below:
cli-> show firewall filter regex flt_vxlan_ping*
Or try cmd below if parameter "regex" is not available:
cli-> show firewall | match flt_vxlan_ping
<- Example configuration which has been verified on Juniper MX304 with codes 23.4R2-S5.6 and 25.2R1.9.
set firewall flexible-match ping_pattern_aa match-start layer-4
set firewall flexible-match ping_pattern_aa byte-offset 66
set firewall flexible-match ping_pattern_aa bit-offset 0
set firewall flexible-match ping_pattern_aa bit-length 32
set firewall family inet filter flt_vxlan_ping_in interface-specific
set firewall family inet filter flt_vxlan_ping_in term t1 from flexible-match-mask mask-in-hex 0xffffffff
set firewall family inet filter flt_vxlan_ping_in term t1 from flexible-match-mask prefix 0Xaaaaaaaa
set firewall family inet filter flt_vxlan_ping_in term t1 from flexible-match-mask flexible-mask-name ping_pattern_aa
set firewall family inet filter flt_vxlan_ping_in term t1 then count cnt_vxlan_ping_in
set firewall family inet filter flt_vxlan_ping_in term t1 then log
set firewall family inet filter flt_vxlan_ping_in term t1 then accept
set firewall family inet filter flt_vxlan_ping_in term t2 then accept
set firewall family inet filter flt_vxlan_ping_out interface-specific
set firewall family inet filter flt_vxlan_ping_out term t1 from flexible-match-mask mask-in-hex 0xffffffff
set firewall family inet filter flt_vxlan_ping_out term t1 from flexible-match-mask prefix 0Xaaaaaaaa
set firewall family inet filter flt_vxlan_ping_out term t1 from flexible-match-mask flexible-mask-name ping_pattern_aa
set firewall family inet filter flt_vxlan_ping_out term t1 then count cnt_vxlan_ping_out
set firewall family inet filter flt_vxlan_ping_out term t1 then log
set firewall family inet filter flt_vxlan_ping_out term t1 then accept
set firewall family inet filter flt_vxlan_ping_out term t2 then accept
set interfaces xe-0/0/2:0 unit 1456 family inet filter input flt_vxlan_ping_in
set interfaces xe-0/0/2:0 unit 1456 family inet filter output flt_vxlan_ping_out
commit
<- Structure of example packet (ASCII mode):
Frame 1: Packet, 1396 bytes on wire (11168 bits), 1396 bytes captured (11168 bits)
Ethernet II, Src: 00:00:5E:00:53:02 (00:00:5E:00:53:02), Dst: 00:00:5E:00:53:01 (00:00:5E:00:53:01)
Destination: 00:00:5E:00:53:01 (00:00:5E:00:53:01)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Source: 00:00:5E:00:53:02 (00:00:5E:00:53:02)
Type: 802.1Q Virtual LAN (0x8100)
[Stream index: 0]
802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 1451
000. .... .... .... = Priority: Best Effort (default) (0)
...0 .... .... .... = DEI: Ineligible
.... 0101 1010 1011 = ID: 1451
Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.255.20, Dst: 172.16.253.71
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
0000 00.. = Differentiated Services Codepoint: Default (0)
.... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
Total Length: 1378
Identification: 0x2ba7 (11175)
000. .... = Flags: 0x0
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
...0 0000 0000 0000 = Fragment Offset: 0
Time to Live: 255
Protocol: UDP (17)
Header Checksum: 0x21c4 [validation disabled]
[Header checksum status: Unverified]
Source Address: 192.168.255.20
Destination Address: 172.16.253.71
User Datagram Protocol, Src Port: 64817, Dst Port: 4789 <<< started from layer 4
Source Port: 64817
Destination Port: 4789
Length: 1358
Checksum: 0x0000 [zero-value ignored]
[Checksum Status: Not present]
[Stream index: 10]
[Stream Packet Number: 1]
[Timestamps]
[Time since first frame: 0.000000000 seconds]
[Time since previous frame: 0.000000000 seconds]
UDP payload (1350 bytes)
Virtual eXtensible Local Area Network
Flags: 0x0800, VXLAN Network ID (VNI)
0... .... .... .... = GBP Extension: Not defined
.... 1... .... .... = VXLAN Network ID (VNI): True
.... .... .0.. .... = Don't Learn: False
.... .... .... 0... = Policy Applied: False
.000 .000 0.00 .000 = Reserved(R): 0x0000
Group Policy ID: 0
VXLAN Network Identifier (VNI): 200020
Reserved: 0
Ethernet II, Src: 00:00:5E:00:52:01(00:00:5e:00:52:01), Dst: 00:00:5E:00:52:00 (00:00:5e:00:52:00)
Destination: 00:00:5E:00:52:00 (00:00:5e:00:52:00)
Source: 00:00:5E:00:52:01(00:00:5e:00:52:01)
[Stream index: 1]
Internet Protocol Version 4, Src: 192.168.110.2, Dst: 192.168.110.1
Total Length: 1328
Identification: 0xe37a (58234)
Time to Live: 64
Protocol: ICMP (1)
Header Checksum: 0x34fe [validation disabled]
Source Address: 192.168.110.2
Destination Address: 192.168.110.1
Internet Control Message Protocol
Type: Echo (ping) request (8)
Code: 0
Checksum: 0x43d5 [correct]
[Checksum Status: Good]
Identifier (BE): 52868 (0xce84)
Identifier (LE): 33998 (0x84ce)
Sequence Number (BE): 0 (0x0000)
Sequence Number (LE): 0 (0x0000)
[Response frame: 18]
ICMP Data […]: 6a0b3b6e0002957faaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Timestamp from icmp data: May 18, 2026 16:16:46.169343000 UTC
[Timestamp from icmp data (relative): -6.648835000 seconds]
Data (1292 bytes)
Data […]: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
[Length: 1292]
<- Following is hex mode of the example packet
(Highlight 66 offset bytes started from layer 4):
0000 00 00 00 5e 53 01 00 00 00 5e 53 02 81 00 05 ab
0010 08 00 45 00 05 62 2b a7 00 00 ff 11 21 c4 c0 a8
0020 ff 14 ac 0a fd 47 fd 31 12 b5 05 4e 00 00 08 00
0030 00 00 03 0d 54 00 00 00 5e 00 52 00 00 00 5e 00
0040 52 01 08 00 45 00 05 30 e3 7a 00 00 40 01 34 fe
0050 c0 a8 6e 02 c0 a8 6e 01 08 00 43 d5 ce 84 00 00
0060 6a 0b 3b 6e 00 02 95 7f aa aa aa aa aa aa aa aa
0070 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0080 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0090 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
00a0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
00b0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
00c0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
00d0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
00e0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
00f0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0100 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0110 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0120 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0130 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0140 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0150 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0160 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0170 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0180 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0190 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
01a0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
01b0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
01c0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
01d0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
01e0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
01f0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0200 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0210 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0220 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0230 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0240 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0250 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0260 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0270 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0280 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0290 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
02a0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
02b0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
02c0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
02d0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
02e0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
02f0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0300 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0310 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0320 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0330 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0340 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0350 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0360 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0370 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0380 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0390 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
03a0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
03b0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
03c0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
03d0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
03e0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
03f0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0400 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0410 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0420 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0430 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0440 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0450 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0460 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0470 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0480 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0490 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
04a0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
04b0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
04c0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
04d0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
04e0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
04f0 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0500 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0510 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0520 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0530 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0540 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0550 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0560 aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
0570 aa aa aa aa