This article provides CLI command with sample output to check the packets dropped by policers applied on firewall filters
Since the packets dropped by filters/policers would not access flow module, you will not be able to find the drops from flow trace. When packet loss occurs and is confirmed to be caused by policers applied on firewall filters, there is a CLI command to further verify the same
The following command could be used to check the packet counters and bytes processed by the actions configured in policer actions
> show firewall filter <filter name>
sample output:
> show firewall filter test
Filter: test Policers: Name Bytes Packets Policer-1 2770 70 <<------------------
Note: the outputs here listed under policers are not the statistics policers, but only the statics processed by the action configured under the policers.
policer Policer-1 {
if-exceeding {
bandwidth-limit 10m;
burst-size-limit 1m;
}
then discard; <<-----------------
https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/command/show-firewall-filter.html