Description

This article provides information on how to perform TCP dump to collect to-host packets.

Symptoms

Performing TCP dump helps users to capture to-host packets (packets ingressing and egressing the Routing-Engine) that are traversing an interface and analyze them.

Solution

The following commands are issued in the shell mode to capture packets on specified interfaces. 

Note : This is related to 'to-host' (Routing-Engine) packets and not 'transit' traffic. 

juniper%tcpdump -i ge-0/0/17 -s 1500 -w /var/tmp/tcp17.pcap -c 10000

In the above TCP dump command:

  • i specifies the physical interface, in which the packet capture has to be taken.

  • s specifies the first 1500 bytes of the packet that needs to be captured.

  • c specifies the count of packets that need to be captured. If this option is not used, then the packets will continue to get captured; until it is stopped by typing ctrl+C.

  • w specifies the location of packet capture file on the device.

So the above command captures the first 1500 bytes of the next 10,000 packets from the ge-0/0/17 interface and places the output in the tcp17.pcap file, which is located in the /var/tmp/ directory.

Note : Ensure that you specify the ' –s' option to set the packet snaplength. The default value captures only 64 bytes and this saves only packet headers in the capture file. To troubleshoot redirected packets or higher level traffic (HTTP, authentication, and so on), a copy of complete packets is required.

Switch@juniper%tcpdump -w /local1/dump.pcap -i ge-0/0/0 -s 1500 -c 10000
This command captures the first 1500 bytes of the next 10,000 packets from the ge-0/0/0 interface and places the the output in the dump.pcap file, which is located in the local1 directory on the Content Engine.

Note : Ensure that you specify 'option –s' to set the packet snaplength. The default value captures only 64 bytes and this saves only packet headers in the capture file. To troubleshoot redirected packets or higher level traffic (HTTP, authentication, and so on), a copy of complete packets is required.

Note : This tcpdump is similar to the "monitor traffic interface" that can be collected from the CLI.

Modification History

2024-4-18: Modified the visibility setting that was causing an error.
2020-02-03: Article reviewed for accuracy. Article is correct and complete.