Description

This article provides step-by-step instructions to configure packet capture on an NFX250 device. The captured packets can be used for traffic analysis and troubleshooting.

Symptoms

1. Configure forwarding options:
 
set forwarding-options packet-capture file filename JTAC_PCAP
set forwarding-options packet-capture file files 5
set forwarding-options packet-capture file size 10m
set forwarding-options packet-capture file world-readable
set forwarding-options packet-capture maximum-capture-size 1500
 
2. Configure firewall filter for packet capture 
 
set firewall filter PCAP term 1 from source-address <source IP >
set firewall filter PCAP term 1 from destination-address <destination IP >
set firewall filter PCAP term 1 then sample
set firewall filter PCAP term 1 then accept
set firewall filter PCAP term 2 from source-address<destination IP >
set firewall filter PCAP term 2 from destination-address <source IP >
set firewall filter PCAP term 2 then sample
set firewall filter PCAP term 2 then accept
set firewall filter PCAP term all-else then accept
 
3. Apply firewall filter to L3 interface
set interfaces <L3 interface> unit 0 family inet filter input PCAP
set interfaces <L3 interface> unit 0 family inet filter output PCAP
 
4. Commit to activate the packet capture.
# commit

The captured file be present in /var/tmp directory :
> file list /var/tmp/ | match JTAC_PCAP* 
 
Copy this file to your PC.
The packet capture file created can be viewed with Wireshark, Ethereal, or other PCAP packet capture utility.

Solution

1. Configure forwarding options:

 

set forwarding-options packet-capture file filename JTAC_PCAP

set forwarding-options packet-capture file files 5

set forwarding-options packet-capture file size 10m

set forwarding-options packet-capture file world-readable

set forwarding-options packet-capture maximum-capture-size 1500

 

2. Configure firewall filter for packet capture 

 

set firewall filter PCAP term 1 from source-address <source IP >

set firewall filter PCAP term 1 from destination-address <destination IP >

set firewall filter PCAP term 1 then sample

set firewall filter PCAP term 1 then accept

set firewall filter PCAP term 2 from source-address<destination IP >

set firewall filter PCAP term 2 from destination-address <source IP >

set firewall filter PCAP term 2 then sample

set firewall filter PCAP term 2 then accept

set firewall filter PCAP term all-else then accept

 

3. Apply firewall filter to L3 interface

set interfaces <L3 interface> unit 0 family inet filter input PCAP

set interfaces <L3 interface> unit 0 family inet filter output PCAP

 

4. Commit to activate the packet capture.

# commit

 

The captured file be present in /var/tmp directory :

 

> file list /var/tmp/ | match JTAC_PCAP* 

 

Copy this file to your PC.

The packet capture file created can be viewed with Wireshark, Ethereal, or other PCAP packet capture utility.

Modification History

2024-04-09 : Article Created
Changed visibility