Difference between revisions of "How to perform a snoop packet capture"
From Tech-Wiki
| Line 3: | Line 3: | ||
http://kb.juniper.net/KB5411 | http://kb.juniper.net/KB5411 | ||
| − | The debug buffer is a circular buffer, once the buffer has reached the size limit, the oldest data will be overwritten. | + | The debug buffer is a circular buffer, once the buffer has reached the size limit, the oldest data will be overwritten.<br /> |
| − | The buffer size is configurable. To change the size, use the following commands: | + | The buffer size is configurable.<br /> |
| + | To change the size, use the following commands: | ||
set db size 4096 | set db size 4096 | ||
| Line 20: | Line 21: | ||
''Reproduce the issue.''<br /> | ''Reproduce the issue.''<br /> | ||
The timestamp resolution of the output is in tenths of a second.<br /> | The timestamp resolution of the output is in tenths of a second.<br /> | ||
| − | Stop the capture and then display the output with the following | + | Stop the capture and then display the output with the following commands: |
snoop off | snoop off | ||
Revision as of 04:54, 7 March 2012
The debug buffer is a circular buffer, once the buffer has reached the size limit, the oldest data will be overwritten.
The buffer size is configurable.
To change the size, use the following commands:
set db size 4096 set console dbuf clear db
To set-up the packet snoop:
snoop info snoop detail or snoop detail len <snaplen 1-1514> snoop filter ... (see the CLI-help for filter options) clear dbuf snoop
Reproduce the issue.
The timestamp resolution of the output is in tenths of a second.
Stop the capture and then display the output with the following commands:
snoop off get dbuf stream or get dbuf stream > tftp <host> <name-of-file>
To clear down:
snoop filter delete clear dbuf