This article provides guidance on generating packet captures from Junos devices to the Junos Space / Security Director server and outlines steps to resolve issues when packet capture data does not appear in the UI.

Packet capture data is not visible over SD UI

A corrupted packet_db.packets table in Junos Space can prevent packet capture data from being displayed in the SD UI.

Reference for Packet Capture Configuration

For an overview of packet capture in Security Director, refer to:
https://www.juniper.net/documentation/us/en/software/nm-apps23.1/junos-space-security-director/topics/concept/junos-space-packet-capture-overview.html

To configure packet capture on SRX:

[SRX-IDP] How to configure security packet capture on SRX 

A) Identify if the Packet Table Is Corrupted

Run the following command to check packet table status:

[root@space-005056a9e965 ~]# mysql -ujboss -p$(grep mysql.jboss /etc/sysconfig/JunosSpace/pwd | awk -F= '{print $2}')  -e 'select count(*) from packet_db.packets' 

If the table is corrupted, you will see an error similar to:
ERROR 1194 (HY000): Table 'packets' is marked as crashed and should be repaired

B) Truncate the Packet Table to Correct the Issue

Execute the following command to clear the corrupted table:

# mysql -ujboss -p$(grep mysql.jboss /etc/sysconfig/JunosSpace/pwd | awk -F= '{print $2}')  -e 'truncate table packet_db.packets' 

You can verify the table now responds normally:
[root@space-005056a9e965 ~]# mysql -ujboss -p$(grep mysql.jboss /etc/sysconfig/JunosSpace/pwd | awk -F= '{print $2}')  -e 'select count(*) from packet_db.packets' 
mysql: [Warning] Using a password on the command line interface can be insecure.
+----------+
| count(*) |
+----------+
|      280 |
+----------+

C) Validate Packet Capture Traffic on Junos Space

Use tcpdump to confirm packet capture traffic is reaching the Space server:

[root@space-005056a9e965 ~]# tcpdump -nn -vv -i any port 2050
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes 08:40:06.415730 IP (tos 0x0, ttl 254, id 137, offset 0, flags [none], proto UDP (17), length 94)
    10.x.x.x.2050 > 10.y.y.y.2050: [udp sum ok] UDP, length 66
08:40:06.415791 IP (tos 0x0, ttl 254, id 138, offset 0, flags [none], proto UDP (17), length 268)
    10.x.x.x..2050 > 10.y.y.y.2050: [udp sum ok] UDP, length 240

If packets are displayed, data is reaching the server successfully.

Once the corrupted table is corrected and packet capture traffic is verified, packet capture data should become visible in the SD UI. Below snapshot can be used as reference. 

Note : If you face any further issues, please contact JUNIPER JTAC Support for assistance.