Packet Capture Overview

Packet capture is used by network administrators and security engineers for the following purposes:

• Monitor network traffic and analyze traffic patterns.
• Identify and troubleshoot network problems.
• Detect security breaches in the network, such as unauthorized intrusions, spyware activity, or ping scans.

Packet capture operates like traffic sampling on the Services Router, except that it captures entire packets including the Layer 2 header rather than packet headers and saves the contents to a file in the libpcap format. Packet capture also captures IP fragments. You cannot enable packet capture and traffic sampling on the router at the same time. Unlike traffic sampling, there are no tracing operations for packet capture.

Enabling packet capture on the router deletes the traffic sampling configuration. Similarly, enabling traffic sampling on the router deletes the packet capture configuration.

For more information about traffic sampling, see the JUNOS Policy Framework Configuration Guide.

This overview contains the following topics:

• Packet Capture on Router Interfaces
• Firewall Filters for Packet Capture
• Packet Capture Files
• Analysis of Packet Capture Files