Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Dynamic and Manual Packet Captures

Dynamic and manual packet captures help you investigate communication failures on WAN Edge devices and Intrusion Detection and Prevention (IDP) attacks detected by SRX Series Firewalls.

Dynamic and manual packet captures help you investigate communication failures on WAN Edge devices. They should be used as part of your troubleshooting process.

Note:

Mist does not collect or store any payload data from packets capture. Only transmission and connection data are used.

Dynamic Packet Captures

Which Events Trigger Dynamic Packet Captures?

Whenever a connection failure occurs between WAN Edge devices or an Intrusion Detection And Prevention (IDP) attack on an SRX Series Firewalls, it automatically triggers a short-term dynamic packet capture (PCAP). Each dynamic PCAP captures up to five packets before and five packets after the attack signature match, providing context around the security event for faster root-cause analysis.

These events include:

  • ARP failure to next-hop—The WAN Edge device fails to resolve the MAC address of the next hop or destination on WAN links.

  • DHCP resolution failure—The WAN Edge device fails to obtain an IP address from the DHCP server on a WAN link.

  • BGP peering failure—A BGP session on the WAN Edge device transitions from an established state, and fails to maintain the peer session.

  • Overlay path failure—An overlay path between two WAN Edge devices is impacted.

Finding the Packet Captures

Dynamic packet captures are saved to the cloud. You can download these files from the Insights page of the Juniper Mist portal.

Video Demo

Anyone who's ever looked at WAN PCAPs know how maddening that can be. Literally everyone at the branch accessing the internet is sending traffic on the WAN. Looking at any particular message sequence will most likely involve combining several PCAPs.

This can be time-consuming and frustrating. However, with Juniper Dynamic Packet Capture, now extended to the WAN, MIST automatically captures all the messages when an incident occurs. You no longer need to grab a bunch of PCAPs to combine them and hope you caught what you were looking for, and there's no need to recreate the issue.

Juniper MIST captures the packets while the issue is occurring, so you have the raw data right away. This drastically reduces MTTR as you no longer need to sort through a mountain of messages to find the ones related to your incident. That's WAN Assurance Dynamic PCAP in 60 seconds.

Example

This example shows how easily you can find dynamic packet captures on the Insights page on the Mist portal.

  1. From the left menu, select Monitor > Service Levels.

  2. Click the Insights button to view the Insights page.

  3. Scroll down to the Events section and click the applicable tab.

    Paperclip icons indicate the events with dynamic packet captures.

  4. Click an event to see more details on the right side of the screen.

  5. Below the details, click Download Packet Capture.

To download the PCAP for SRX Series:

  1. From the left menu, select Site > WAN | Security Events.

  2. Click the download icon (a paperclip image) in the Dynamic PCAP (SRX only) column to download the PCAP file associated with the IDP event.

    Note: Dynamic PCAP for IDP events is supported on SRX WAN Edge devices running Junos version 23.1R1 or later.

    After downloading the dynamic packet capture to your computer, use packet capture analyzer like Wireshark to view the data.

Manual Packet Captures

For manual packet captures, go to Site > WAN Edge Packet Captures, where you can:

  • Choose the network type (WAN) to capture packets.

  • Restrict the packet capture to a particular WAN Edge device.

  • Configure the number of packets captured, packet size in bytes, and the duration of the capture session.

  • Configure other capture parameters such as header inclusion and capture filters. See Enable Packet Capture on a WAN Edge Device Manually for details.

Enable Packet Capture on a WAN Edge Device Manually

By default, Juniper Mist streams the packet capture session data, including beacon frames, to the Mist portal. Mist also provides various options to manually create packet capture sessions on a WAN Edge device.

To enable PCAP on a WAN Edge device:

  1. Select Site > WAN > WAN Edge Packet Captures.
  2. Select a site from the Site drop-down list.
  3. Click the + icon next to the Add WAN Edge field, and select the device on which you want to enable packet capture.
    You can select multiple devices for a single packet capture operation.
  4. Specify the number of packets captured per device, packet size in bytes, and the duration of the capture session in seconds.

    Packet capture works by buffering packets locally on the device, which has limited space available. By default, Mist truncates header data from the captured packets to reduce the size of capture files, while still providing the most relevant information.

    Note: If you specify 0 in the No. of packets/Edge field, unlimited number of packets will be captured.
  5. Configure a port filter for packet capture. To do that follow the steps below:
    1. Click Add Port Filter.
    2. From the Port Name drop-down list, select a port on which you want to enable packet capture.
    3. In the TCPDUMP Expression field, specify filters using a tcpdump expression if required.
    4. If you want to use the expression builder, select the Use expression builder check box and configure the filters.
    5. Click Save.

      Mist supports packet capture for IPv4 traffic on SSR and SRX devices, and for IPv6 traffic on SSR devices.

  6. Click Start Capture to enable packet capture on the selected port.

After the packet capture is complete, you can download the file for inspection. To do that, click Captured File on the upper right of the screen.

After downloading the packet capture to your computer, use Wireshark view the data.