Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Navigation
Guide That Contains This Content
[+] Expand All
[-] Collapse All

    Packet Flow Monitoring Overview

    The policy log rule provides a way to monitor a packet flow by capturing a sample of the packets that satisfy the classification of the rule in the system log. See JunosE System Event Logging Reference Guide for information about logging.

    To capture the interface, protocol, source address, destination address, source port, and destination port, set the policyMgrPacketLog event category to log at severity info and at low verbosity. To capture the version, ToS, len ID, flags, time to live (TTL), protocol, and checksum in addition to the information captured at low verbosity, set the verbosity to medium or high.

    When the policy is configured, all packets are examined and the matching packets are placed in the log. No more than 512 packets are logged every 3 seconds. The router maintains a count of the total number of matching packets. This count is incremental even if the packet cannot be stored in the log (for example, because the count exceeds the 512-packet threshold).

    This example shows how you might use classification to specify the ingress packets that are logged in to an interface.

    host1(config)#ip policy-list testPolicy host1(config-policy-list)#classifier-group logA host1(config-policy-list-classifier-group)#log host1(config-policy-list-classifier-group)#exit host1(config-policy-list)#exit host1(config)#interface atm 0/0.0 host1(config-subif)#ip policy input testPolicy statistics enabled host1(config-subif)#exit host1(config)#log destination console severity info host1(config)#log severity info policyMgrPacketLog host1(config)#log verbosity low policyMgrPacketLog host1(config)#log here

     

    This example provides a more detailed procedure that an ISP might use to log information during a ping attack on the network. The procedure includes the creation of the classifier and policy lists to specify the desired packet flow to monitor, the logging of the output of the classification operation, and the output of the show command.

    In this example, a customer has reported to their ISP that an attack is occurring on their internal servers. The attack is a simple ping flood.

    1. The ISP creates a classifier list to define an ICMP echo request packet flow.
      host1:vr2(config)#ip classifier-list icmpEchoReq icmp any any 8 0 host1:vr2(config)#ip policy-list pingAttack host1:vr2(config-policy-list)#classifier-group icmpEchoReq host1:vr2(config-policy-list-classifier-group)#log host1:vr2(config-policy-list-classifier-group)#exit host1:vr2(config-policy-list)#exit
      host1:vr2(config)#interface gigabitEthernet 2/0 host1:vr2(config-if)#ip address 10.10.10.2 255.255.255.0 host1:vr2(config-if)#exit
      host1:vr2(config)#virtual-router vr1 host1:vr1(config)#interface gigabitEthernet 0/0 host1:vr1(config-if)#ip address 10.10.10.1 255.255.255.0 host1:vr1(config-if)#ip policy input pingAttack statistics enabled host1:vr1(config-if)#exit host1:vr1(config)#exit
    2. The ISP configures standard logging on the E Series router.
      host1(config)#log destination console severity info host1(config)#log severity info policyMgrPacketLog host1(config)#log here
      INFO 12/16/2003 12:59:47 policyMgrPacketLog ():icmpEchoReq icmp GigabitEthernet0/0 10.10.10.2 10.10.10.1 forwardedINFO 12/16/2003 12:59:47 policyMgrPacketLog ():icmpEchoReq GigabitEthernet0/0 number of hits = 21551INFO 12/16/2003 12:59:50 policyMgrPacketLog ():icmpEchoReq icmp GigabitEthernet0/0 10.10.10.2 10.10.10.1 forwardedINFO 12/16/2003 12:59:50 policyMgrPacketLog ():icmpEchoReq GigabitEthernet0/0 number of hits = 21851INFO 12/16/2003 12:59:53 policyMgrPacketLog ():icmpEchoReq icmp GigabitEthernet0/0 10.10.10.2 10.10.10.1 forwardedINFO 12/16/2003 12:59:53 policyMgrPacketLog ():icmpEchoReq GigabitEthernet0/0 number of hits = 22151
    3. The ISP displays statistics for the interface.
      host1:vr1#show ip interface gigabitEthernet 0/0
      GigabitEthernet0/0 line protocol Ethernet is up, ip is up
        Network Protocols: IP
        Internet address is 10.10.10.1/255.255.255.0
        Broadcast address is 255.255.255.255
        Operational MTU = 1500  Administrative MTU = 0
        Operational speed = 1000000000  Administrative speed = 0
        Discontinuity Time = 1092358
        Router advertisement = disabled
        Proxy Arp = enabled
        Network Address Translation is disabled
        Administrative debounce-time = disabled
        Operational debounce-time    = disabled
        Access routing = disabled
        Multipath mode = hashed
        Auto Configure = disabled
        Auto Detect = disabled
        Inactivity Timer = disabled
        In Received Packets 488421, Bytes 62517888
          Unicast Packets 488421, Bytes 62517888
          Multicast Packets 0, Bytes 0
        In Policed Packets 0, Bytes 0
        In Error Packets 0
        In Invalid Source Address Packets 0
        In Discarded Packets 0
        Out Forwarded Packets 486152, Bytes 62232048
          Unicast Packets 486152, Bytes 62232048
          Multicast Routed Packets 0, Bytes 0
        Out Scheduler Dropped Packets 0, Bytes 0
        Out Policed Packets 0, Bytes 0
        Out Discarded Packets 2269
        IP policy input pingAttack
          classifier-group icmpEchoReq entry 1
            488421 packets, 69355782 bytes
            log
        queue 0: traffic class best-effort, bound to ip GigabitEthernet0/0
          Queue length 0 bytes
          Forwarded packets 485988, bytes 70954248
          Dropped committed packets 0, bytes 0
          Dropped conformed packets 0, bytes 0
          Dropped exceeded packets 0, bytes 0 

    You can also capture traffic that transits through the router by using the policyMgrPacketLog category. When you set the logging severity level to info, you have the following options

    • interface—filter on an interface
    • interface-type—filter on an interface type
    • policy-list—filter on a policy list

    The policy list must contain the log keyword in the classifier group you want to monitor. You must also enable logging for policyMgrPacketLog and for the specific interface or policy list.

    host1(config)#log severity info policyMgrPacketLog host1(config)#log severity info policyMgrPacketLog policy-list all host(config)#ip policy-list test host(config-policy-list)#classifier-group * host1(config-policy-list-classifier-group)#log
    host1(config)#interface fastEthernet 2/0.100 host1(config-if)#vlan id 100 host1(config-if)#ip address 100.1.1.1 255.255.255.0 host1(config-if)#ip policy input test host1(config-if)#ip policy output test

    The packet capture can also be done for any source and destination defined in the classifier list. If the logging verbosity is set to low, you can obtain the following level of detail from the packet capture:

    INFO 02/20/2008 10:10:23 policyMgrPacketLog:
    test icmp FastEthernet2/2.100 100.1.1.2 100.1.2.2 forwarded
    INFO 02/20/2008 10:10:26 ppolicyMfrPacketLog:
    test icmp FastEthernet2.2.100.100.1.2.2 100.1.1.2 forwarded

    If the logging verbosity is set to medium or high, you can obtain the following level of detail from the packet capture:

    INFO 02/20/2008 10:15:11 policyMgrPacketLog: Classifier: test.1, prot: icmp, 
    intf:  FastEthernet2/2.100, sa: 100.1.1.2, da: 100.1.2.2 version: 0x45, tos: 
    0x0, len: 0x3e8, id: 0x714, flags: 0x0, ttl: 0x20, proto; 0x1, chksum: 0xc4fb, 
    forwarded
    INFO 02/20/2008 10:15:14 ppolicyMfrPacketLog: classifier: test.1, prot: icmp, 
    intf: FastEthernet2/2.100, sa: 100.1.1.2 da: 100.1.2.2 version: 0x45, tos: 
    0x0, len: 0x3e8, id: 0xbe8, flags: 0x0, ttl: 0x7e, proto; 0x1, chksum: 0x6227,
    forwarded

    Published: 2014-08-14