This document explains how to monitor and capture ospf traffic on an interface.

During troubleshooting of ospf, many times it is required to capture ospf packet to understand what packets are exchanged in ospf neighbors.

This is especially useful when ospf neighborship is down and log messages are inconclusive.

• When multiple protocols are running on a link and we require to capture only ospf packets exchanged on that link, below command can be used:

 monitor traffic interface ge-0/0/0 no-resolve matching "ip proto 89" extensive

• If you want to capture the packets as pcap file, use below command:

Lab-re0> monitor traffic interface ge-0/0/0 no-resolve matching "ip proto 89" extensive write-file /var/tmp/ospf.pcap            

Address resolution is OFF.

Listening on ge-0/0/0, capture size 1514 bytes

^C

169 packets received by filter

0 packets dropped by kernel

Note: .pcap file will be saved in /var/tmp folder in above case with filename ospf.pcap. User can specify any location of choice.
 

Lab-re0> file list /var/tmp detail |match ospf 
-rw-r--r--  1 labroot wheel        24 May 2  20:09 ospf.pcap

User can copy the file to desktop and open this pcap in wireshark application.