Switching

last person joined: 21 hours ago 

Ask questions and share experiences about EX and QFX portfolios and all switching solutions across your data center, campus, and branch locations.
Back to discussions
Expand all | Collapse all

Is there anyway to save a monitor traffic interface locally stored and ftp / scp it off?

  • 1.  Is there anyway to save a monitor traffic interface locally stored and ftp / scp it off?

    Posted 02-16-2010 12:07

    I tried this and got no lines wrote to my file,  this is an ex4200 on 9.5S1.2

     

    mk2856@VC4200ISGAALPGAIXC01M0# run monitor traffic interface ae2.0 extensive count 10 | save test.pcap
    Address resolution is ON. Use <no-resolve> to avoid any reverse lookup delay.
    Address resolution timeout is 4s.
    Listening on ae2.0, capture size 1514 bytes

    19:51:15.003243 Out
            Juniper PCAP Flags [Ext], PCAP Extension(s) total length 16
              Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
              Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
              Device Interface Index Extension TLV #1, length 2, value: 6401
              Logical Interface Index Extension TLV #4, length 4, value: 67
            -----original packet-----
    Reverse lookup for 172.16.137.7 failed (check DNS reachability).
    Other reverse lookup failures will not be reported.
    Use <no-resolve> to avoid reverse lookups on IP addresses.

            0:26:88:73:7b:80 > 0:14:1b:cf:40:0, ethertype 802.1Q (0x8100), length 149: vlan 3086, p 0, ethertype IPv4, (tos 0x10, ttl  64, id 21010, offset 0, flags [DF], proto: TCP (6), length: 131) 172.16.137.7.telnet > 135.89.93.78.45741: P 568740455:568740534(79) ack 3372704331 win 32832 <nop,nop,timestamp 1820799158 3583295427>
    19:51:15.019438  In
            Juniper PCAP Flags [Ext, In], PCAP Extension(s) total length 16
              Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
              Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
              Device Interface Index Extension TLV #1, length 2, value: 6401
              Logical Interface Index Extension TLV #4, length 4, value: 67
            -----original packet-----
            0:14:1b:cf:40:0 > 0:26:88:73:7b:80, ethertype 802.1Q (0x8100), length 70: vlan 3086, p 0, ethertype IPv4, (tos 0x10, ttl  56, id 13679, offset 0, flags [DF], proto: TCP (6), length: 52) 135.89.93.78.45741 > 172.16.137.7.telnet: . 1:1(0) ack 79 win 9709 <nop,nop,timestamp 3583295507 1820799158>
    19:51:15.019571 Out
            Juniper PCAP Flags [Ext], PCAP Extension(s) total length 16
              Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
              Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
              Device Interface Index Extension TLV #1, length 2, value: 6401
              Logical Interface Index Extension TLV #4, length 4, value: 67
            -----original packet-----
            0:26:88:73:7b:80 > 0:14:1b:cf:40:0, ethertype 802.1Q (0x8100), length 152: vlan 3086, p 0, ethertype IPv4, (tos 0x10, ttl  64, id 21011, offset 0, flags [DF], proto: TCP (6), length: 134) 172.16.137.7.telnet > 135.89.93.78.45741: P 79:161(82) ack 1 win 32832 <nop,nop,timestamp 1820799174 3583295507>
    19:51:15.035825  In
            Juniper PCAP Flags [Ext, In], PCAP Extension(s) total length 16
              Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
              Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
              Device Interface Index Extension TLV #1, length 2, value: 6401
              Logical Interface Index Extension TLV #4, length 4, value: 67
            -----original packet-----
            0:14:1b:cf:40:0 > 0:26:88:73:7b:80, ethertype 802.1Q (0x8100), length 70: vlan 3086, p 0, ethertype IPv4, (tos 0x10, ttl  56, id 13681, offset 0, flags [DF], proto: TCP (6), length: 52) 135.89.93.78.457

    19:51:16.029791  In
            Juniper PCAP Flags [Ext, In], PCAP Extension(s) total length 16
              Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
              Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
              Device Interface Index Extension TLV #1, length 2, value: 6401
              Logical Interface Index Extension TLV #4, length 4, value: 67
            -----original packet-----
            0:14:1b:cf:40:0 > 0:26:88:73:7b:80, ethertype 802.1Q (0x8100), length 70: vlan 3086, p 0, ethertype IPv4, (tos 0x10, ttl  56, id 13685, offset 0, flags [DF], proto: TCP (6), length: 52) 135.89.93.78.45741 > 172.16.137.7.telnet: . 1:1(0) ack 1929 win 9709 <nop,nop,timestamp 3583296517 1820800167>

     

    Wrote 0 lines of output to 'test.pcap'  < =========================

     

     

     

     

    I was not able to get it to save anything to this file? I suppose I can just cut and paste it if necessary but it would be nice to be able to save a small file and ftp it off the device.

     

     

     

     

     

     



  • 2.  RE: Is there anyway to save a monitor traffic interface locally stored and ftp / scp it off?

     
    Posted 02-16-2010 12:22

    Hi Mike

     

    You can use this command:

     

    "run monitor traffic interface ae2.0  write-file test.pcap"

     

    You will have a file on your switch that you will be able to download.

    This file is in the Pcap format and can be read under ethereal or wireshark.

     

    Be carefull the "write-file" option is not supported as it can lead to a lot of access to the fash system.

     

    Hope this will help you