Policy Framework Configuration Guide - Juniper Networks

Chapter 15: Traffic Forwarding and Monitoring Configuration
You can capture only specific types of packets by using a firewall filter in conjunction
with packet capture. To configure packet capture for specific packets using firewall filters,
include the following statements at the [edit firewall] hierarchy level:
[edit firewall]
filter filter-name {
term term-name {
from {
match-conditions;
}
then {
sample;
accept;
}
}
}
NOTE: Configure packet capture with appropriate firewall filters to control
the number of packets captured. Performance of the router may be impacted
if packet capture is used without configuring any firewall filters.
NOTE: Packet capture does not support multilink encapsulations (such as
MLPPP).
You must disable packet capture to modify encapsulation. To modify the encapsulation
on a packet capture-enabled interface, perform the following tasks:
1. Disable packet capture by including the disable statement at the [edit
forwarding-options packet-capture] hierarchy level.
2. Remove the packet capture file for the interface from the /var/tmp/ directory.
3. Change the encapsulation.
4. Enable packet capture.
For packets captured on T1, T3, E1, E3, SE, and ISDN interfaces in the egress direction,
the size of packets captured can be one byte less than the configured value of
maximum-capture-size because of the PLP byte.
To capture packets on an ISDN interface, configure packet capture on the dialer interface.
To capture packets on the PPPoE interface, configure packet capture on the PPPoE
interface.
Packet capture is not supported with MLPPP encapsulation. However, the CLI does not
prevent you from enabling packet capture on an interface with MLPPP encapsulation. If
packet capture is enabled in the input direction on an interface with MLPPP encapsulation,
input packets on that interface are captured on the output interfaces.
By default, there is no tracing operation support for packet capture.
Copyright © 2010, Juniper Networks, Inc.
381