Description

This article explains why no output packets may be captured during packets capture in high-end SRX Series devices, and describes what can be done to capture both packets in both ingress and egress directions.

 

Symptoms

Example Topology

Consider traffic as follows:

  
PC1(20.1.1.1)-----(ge-0/0/1.0)SRX(reth1.0)-----(10.1.1.2)PC2
 

To perform packets capture in high-end SRX Series devices, the following configuration is used:

Note: To know about the settings for basic packets capture in high-end SRX Series devices, refer to KB21563 - [SRX] Example - How to create a PCAP packet capture on high-end SRX devices [juniper.net] . 

{primary:node0}[edit security datapath-debug]
root@SRX-1400# show
capture-file datapcap format pcap size 1m files 5;
maximum-capture-size 1500;
action-profile {
    do-capture {
        event np-egress {
            count;
            packet-dump;
        }
        event np-ingress {
            count;
            packet-dump;
        }
    }
}
packet-filter my-filter {
    action-profile do-capture;
    source-prefix 20.1.1.1/32;
    interface reth1.0;
}
packet-filter my-filter_2 {             
    action-profile do-capture;
    destination-prefix 20.1.1.1/32;
    interface reth1.0;
}
 

However, with this configuration, only packets from 10.1.1.2 to 20.1.1.1 are seen in the packets capture result. Packets from 20.1.1.1 to 10.1.1.2 are not captured.

 
alt

 

Solution

This is because SRX devices will perform packets capture only for the ingress direction packets if one specific interface is set under packet-filter , which is the case in the above example.

 

This behavior is expected as per design in high-end SRX Series devices. If packets capture is required in both ingress and egress directions, add a specific interface into packet-filter and set both the egress and ingress interfaces for the specific interface under packet-filter .

Using the same configuration above, to capture packets in both directions, use the following: 

{primary:node0}[edit security datapath-debug]
root@SRX-1400# show
capture-file datapcap format pcap size 1m files 5;
maximum-capture-size 1500;
action-profile {
    do-capture {
        event np-egress {
            count;
            packet-dump;
        }
        event np-ingress {
            count;
            packet-dump;
        }
    }
}
packet-filter my-filter {
    action-profile do-capture;
    source-prefix 20.1.1.1/32;
    destination-prefix 10.1.1.2/32;
    interface ge-0/0/1.0;          <<<<here</span>
}
packet-filter my-filter_2 {            
    action-profile do-capture;
    destination-prefix 20.1.1.1/32;
    interface reth1.0;
}
 

Now packets from 20.1.1.1 to 10.1.1.2 and from 10.1.1.2 to 20.1.1.1 are captured as follows:

alt