Packet Capture Terms

interface sampling

Packet sampling method used by packet capture, in which entire IPv4 packets flowing in the input or output direction, or both directions, are captured for analysis.

libpcap

An implementation of the pcap application programming interface. libpcap may be used by a program to capture packets traveling over a network.

packet capture

1. Packet sampling method in which entire IPv4 packets flowing through a router are captured for analysis. Packets are captured in the Routing Engine and stored as libpcap-formatted files in the /var/tmp directory on the router. Packet capture files can be opened and analyzed offline with packet analyzers such as tcpdump or Ethereal. To avoid performance degradation on the router, implement packet capture with firewall filters that capture only selected packets. See also traffic sampling.
2. Packet sampling method available from the J-Web interface, for capturing the headers of packets destined for or originating from the Routing Engine. (See Capturing and Viewing Packets with the J-Web Interface).

packet loss priority (PLP) bit

Bit used to identify packets that have experienced congestion or are from a transmission that exceeded a service provider's customer service license agreement. This bit can be used as part of a router's congestion control mechanism and can be set by the interface or by a filter.

port mirroring

The process of sending a copy of a packet from the router to an external host address.

For more information about port mirroring, see the JUNOS Policy Framework Configuration Guide.

tcpdump

A command line utility for debugging computer network problems. tcpdump allows the user to display the contents of TCP/IP and other packets captured on a network interface. On UNIX and most other operating systems, a user must have superuser privileges to use tcpdump due to its use of promiscuous mode.

traffic sampling

Packet sampling method in which the sampling key based on the IPv4 header is sent to the Routing Engine. There, the key is placed in a file, or cflowd packets based on the key and are sent to a cflowd server for analysis. See also packet capture.