This article explains a way for taking a packet-capture (tcpdump) on a SRX firewall for traffic destined to or sourced from the routing-engine of the device. Note that with this method you cannot capture transit traffic, only self traffic.

For packet-captures of transit traffic see the following articles:

• KB11709 - How to create a PCAP packet capture on a SRX branch device [juniper.net]
• KB21563 - Creating a PCAP packet capture on high-end SRX devices [juniper.net]

The monitor traffic tool can be leveraged for this packet-capture purposes by using the write-file statement. An example of the command is the following:

root@srx> monitor traffic interface ge-0/0/0.0 write-file CAPTURE.pcap  <--  write-file is a hidden command so it will not auto-complete and must be typed out

With the above command all traffic to or from the Routing Engine that is forwarded over interface ge-0/0/0.0 will be saved to a file named CAPTURE with a file extension type of pcap. After this, you can download the file from the SRX and open it in a traffic analyzer tool such as Wireshark.