Starting on 20.1 release, on Branch/1500 platforms, there is a useful debugging command on the PFE side. “tcpdump” at PFE (which has a similar format to the standard tcpdump) can dump the forwarding traffic at ingress/egress.

This "tcpdump" capture is done even before the normal PCAP capture which is done at the logical interfaces level.

Because of this, it helps in scenarios like L2 channel errors in KB24550 [juniper.net]. L2 channel errors occur when an ingress packet cannot be assigned to a logical interface, so normal PCAP will not be able to capture these packets, while "tcpdump" at PFE does.

To access flowd/PFE you need to run the following:

>start shell

%vty [fwdd if branch, fpc0 if SRX1500, if you are in a cluster then prempt it with the node that is handling the traffic, example node0.fpc0]

tcpdump at PFE contains the following options:

FLOWD(vty)# tcpdump

  <carriage return>   Completes command

  <number>       stop after captured count packets [-c *count]

  clear         clear buffer and reset all the filter parameters

  ether         set packet filter based on ethernet or L2 header

  format        set the packet dump format

  ip          set packet filter based on IP or L3 header

  mbuf         set packet filter based on mbuffer or driver info

  show         show only changed filter parameters

  tcp          set packet filter based on TCP or L4 header

  write         write the raw packets to file [-w *file]

You can add filters to capture with "ip" "ether" "tcp" or "mbuf", you can check current filters with "tcpdump show".

To start the capture specify the packet count, example running "tcpdump 40" will start the capture and it will stop after 40 captured packets.

To see the current captured packets run "tcpdump" plain.

To clear the currently captured packets and to clear the added filters run "tcpdump clear".