Packet Capture Overview

Packet capture is used by network administrators and security engineers for the following purposes:

• Monitor network traffic and analyze traffic patterns.
• Identify and troubleshoot network problems.
• Detect security breaches in the network, such as unauthorized intrusions, spyware activity, or ping scans.

Packet capture operates like traffic sampling on the Services Router, except that it captures entire packets including the Layer 2 header rather than packet headers and saves the contents to a file in the libpcap format. Packet capture also captures IP fragments. Unlike traffic sampling, there are no tracing operations for packet capture.

Note: You can enable packet capture and port mirroring simultaneously on a Services Router.

For more information about traffic sampling, see the JUNOS Policy Framework Configuration Guide.

This overview contains the following topics:

• Packet Capture on Router Interfaces
• Firewall Filters for Packet Capture
• Packet Capture Files
• Analysis of Packet Capture Files