Packet capture from operational mode allows you to capture packets from operational mode without committing the configurations. You can define the packet filter to trace only a certain type of traffic, such as logical interface, protocol, source IP address prefix, source port, destination IP address prefix, and destination port. In addition, you can modify the file name, file type, file size and capture size of the packet capture output.
The following setup is present from Customer, but the pcap-file in /var/tmp is not present.
set forwarding-options packet-capture file filename pcap-file set forwarding-options packet-capture file files 100 set forwarding-options packet-capture file size 1k set forwarding-options packet-capture file world-readable set forwarding-options packet-capture maximum-capture-size 500 set interfaces xe-0/0/38 unit 0 family ethernet-switching filter input PCAP set interfaces xe-0/0/38 unit 0 family ethernet-switching filter output PCAP set firewall family ethernet-switching filter PCAP term 1 from destination-address 10.0.0.1/32 set firewall family ethernet-switching filter PCAP term 1 then accept set firewall family ethernet-switching filter PCAP term allow-all-else then accept
Upon validating proper firewall filter configuration, validated proper packe-capture configuration. However the interface must be family inet instead of ethernet-switching as per Juniper documentation: