Packet Capture Overview

Packet capture is used by network administrators and security engineers for the following purposes:

• Monitor network traffic and analyze traffic patterns.
• Identify and troubleshoot network problems.
• Detect security breaches in the network, such as unauthorized intrusions, spyware activity, or ping scans.

Packet capture operates like traffic sampling on the device, except that it captures entire packets including the Layer 2 header rather than packet headers and saves the contents to a file in the libpcap format. Packet capture also captures IP fragments. You cannot enable packet capture and traffic sampling on the device at the same time. Unlike traffic sampling, there are no tracing operations for packet capture.

Note: You can enable packet capture and port mirroring simultaneously on a device.

For more information about traffic sampling, see the JUNOS Policy Framework Configuration Guide.

This overview contains the following topics:

• Packet Capture on Device Interfaces
• Firewall Filters for Packet Capture
• Packet Capture Files
• Analysis of Packet Capture Files