Juniper SRX抓包.docxVIP

debug：跟踪防火墙对数据包的处理过程SRX对应ScreenOS debug flow basic跟踪报文处理路径的命令：set security flow traceoptions flag basic-datapath开启SRX基本报文处理Debugset security flow traceoptions file filename.log将输出信息记录到指定文件中set security flow traceoptions file filename.log size file-size设置该文件大小，缺省128kset security flow traceoptions packet-filter filter1 destination-prefix 5.5.5.2设置报文跟踪过滤器run file show filename.log查看该Log输出信息捕获进出防火墙的数据包开启抓包功能参数设置edit forwarding-optionsset packet-capture maximum-capture-size 500 //Specify in bytes the maximum size of each packet to capture in each file—for example, 500. The range is between 68 and 1500, and the default is 68 bytes.set packet-capture file filename pcap-file //Specify the target filename for the packet capture file—for example, pcap-file. For each physical interface, the interface name is automatically suffixed to the filename—for example, pcap-file.fe-0.0.1.set packet-capture file files 100 // Specify the maximum number of files to capture—for example, 100. The range is between 2 and 10,000, and the default is 10 files. In the Files box, type 100set packet-capture file size 1024 // Specify the maximum size of each file in bytes—for example, 1024. The range is between 1,024 and 104,857,600, and the default is 512,000 bytes. In the Size box, type 1024.set packet-capture file world-readable // Specify if all users have permission to read the packet capture files.Configuring Packet Capture on an Interfaceedit interfaces fe-0/0/1set unit 0 family inet sampling input outputConfiguring a Firewall Filter for Packet Captureedit firewallset firewall filter dest-all term dest-term from destination-address 192.168.1.1/32set firewall filter dest-all term dest-term then sample acceptset interfaces fe-0/0/1 unit 0 family inet filter output dest-allDisabling Packet Captureedit forwarding-optionsset packet-capture disable