This article explains the steps and procedures to display the Packet Captures in the SD

In SD > Monitor > Packet Capture, users will view all the packets captured by SRX Series devices, and then download the attack packets. For some users, this page will display "No data available" due to the configuration which is required on the device might not be present.

As per the SD-Packet_Capture-Document, the below ports must be open. 

Port 2050 (UDP) - Used to receive attack packets sent by SRX Series Firewalls"?>SRX Series Firewalls.
Port 2051 (TCP) - Used by the Security Director to fetch the attack packets stored in the Junos Space Network Management Platform database.

To confirm, execute the below command and you should see port 2050 should be in the listen state.

# netstat -lnutp | grep :2050
# netstat -lnutp | grep :2051 

Once the ports are confirmed, please make sure the below configurations are present on the device. If not, we need to configure it.

set security idp security-package automatic interval 24
set security idp security-package automatic enable
set security idp sensor-configuration packet-log total-memory 5
set security idp sensor-configuration packet-log max-sessions 15
set security idp sensor-configuration packet-log threshold-logging-interval 2
set security idp sensor-configuration packet-log source-address 10.219.86.34 (Interface of SRX)
set security idp sensor-configuration packet-log host 10.219.86.81 (VIP of Junos Space)
set security idp sensor-configuration packet-log host port 2050 

Also, the below configurations should be present on the device.

set security idp idp-policy LAB_TEST rulebase-ips rule 1 match source-address any
set security idp idp-policy LAB_TEST rulebase-ips rule 1 match destination-address any
set security idp idp-policy LAB_TEST rulebase-ips rule 1 match application default
set security idp idp-policy LAB_TEST rulebase-ips rule 1 match attacks predefined-attacks ICMP:INFO:ECHO-REQUEST
set security idp idp-policy LAB_TEST rulebase-ips rule 1 match attacks predefined-attacks ICMP:INFO:ECHO-REPLY
set security idp idp-policy LAB_TEST rulebase-ips rule 1 then action no-action
set security idp idp-policy LAB_TEST rulebase-ips rule 1 then notification log-attacks
set security idp idp-policy LAB_TEST rulebase-ips rule 1 then notification packet-log pre-attack 5
set security idp idp-policy LAB_TEST rulebase-ips rule 1 then notification packet-log post-attack 10
set security idp idp-policy LAB_TEST rulebase-ips rule 1 then notification packet-log post-attack-timeout 20
set security idp default-policy LAB_TEST
set security policies from-zone lan to-zone junos-host policy default-permit match source-address any
set security policies from-zone lan to-zone junos-host policy default-permit match destination-address any
set security policies from-zone lan to-zone junos-host policy default-permit match application any
set security policies from-zone lan to-zone junos-host policy default-permit then permit application-services idp-policy LAB_TEST
set security policies from-zone junos-host to-zone lan policy Test1 match source-address any
set security policies from-zone junos-host to-zone lan policy Test1 match destination-address any
set security policies from-zone junos-host to-zone lan policy Test1 match application any
set security policies from-zone junos-host to-zone lan policy Test1 then permit application-services idp-policy LAB_TEST
set security policies from-zone junos-host to-zone lan policy Test1 then log session-close
set security policies from-zone junos-host to-zone lan policy Test1 then count 

NOTE: All the above sample configurations are taken from the JTAC lab

Upon following the above steps, execute the tcpdump on the Junso Space CLI to confirm whether the packets are being received from the device.

# tcpdump -nn -vv -i any port 2050
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
08:40:06.415730 IP (tos 0x0, ttl 254, id 137, offset 0, flags [none], proto UDP (17), length 94)
   10.219.86.34.2050 > 10.219.86.81.2050: [udp sum ok] UDP, length 66
08:40:06.415791 IP (tos 0x0, ttl 254, id 138, offset 0, flags [none], proto UDP (17), length 268)
   10.219.86.34.2050 > 10.219.86.81.2050: [udp sum ok] UDP, length 240

If all the above steps are followed correctly, you should be able to see the Packet Captures displayed on the Junos Space Security Director > Monitor > Packet Capture page.