How to perform a snoop packet capture

From Tech-Wiki
Revision as of 04:48, 7 March 2012 by Jebr (Talk | contribs)

Jump to: navigation, search


http://kb.juniper.net/KB5411

The debug buffer is a circular buffer, once the buffer has reached the size limit, the oldest data will be overwritten. The buffer size is configurable. To change the size, use the following commands:

set db size 4096
set console dbuf
clear db

To set-up the packet snoop:

snoop info
snoop detail or snoop detail len <snaplen 1-1514>
snoop filter ... (see the CLI-help for filter options)
clear dbuf
snoop

Reproduce the issue.
The timestamp resolution of the output is in tenths of a second.
Stop the capture and then display the output with the following command:

snoop off
get dbuf stream or get dbuf stream > tftp <host> <name-of-file>

To clear down:

snoop filter delete
clear dbuf