Monitoring Interface Traffic

Problem

You want to look at the headers of packets transiting an interface to debug protocol operation.

Solution

Use the monitor traffic command:

	aviva@RouterG> monitor traffic interface fe-1/0/1 size  1492  detail 

 

Discussion

The monitor traffic command is equivalent to the Unix tcpdump command and is useful for watching protocol traffic on an interface when attempting to debug a problem. This recipe watches all traffic on interface fe-1/0/1, which is an interface in an OSPF backbone area (area 0.0.0.0). The default packet size for the monitor traffic command is 68 bytes, which captures the beginning of packet headers, but not much more. We specify a packet size of 1,492 bytes, which is the maximum OSPF packet size. Here's what the output looks like:

	Listening on fe-1/0/1, capture size 1492 bytes
	05:14:46.915999 In IP (tos 0xc0, ttl 1, id 2843, offset 0, flags [none], prot
	o: OSPF (89), length: 68) 10.0.0.2 > OSPF-ALL.MCAST.NET: OSPFv2, Hello (1), leng
	th: 48
	 Router-ID: 192.168.17.1, Backbone Area, Authentication Type: none (0)
	 Options: [External]
	 Hello Timer: 10s, Dead Timer 40s, Mask: 255.255.255.0, Priority: 128
	 Designated Router 10.0.0.2, Backup Designated Router 10.0.0.1
	 Neighbor List:
	 192.168.19.1
	05:14:50.715849 Out IP (tos 0xc0, ttl 1, id 63978, offset 0, flags [none], pro
	to: OSPF (89), length: 68) 10.0.0.1 > OSPF-ALL.MCAST.NET: OSPFv2, Hello (1), len
	gth: 48
	 Router-ID: 192.168.19.1, Backbone Area, Authentication Type: none (0)
	 Options: [External]
	 Hello Timer: 10s, Dead Timer 40s, Mask: 255.255.255.0, Priority: 128
	 Designated Router 10.0.0.2, Backup Designated Router 10.0.0.1
	 Neighbor List:
	 192.168.17.1
	…
	^C
	6 packets received by filter
	0 packets dropped by kernel

Type Ctrl-c to end the monitoring.

One disadvantage of monitoring interface traffic is that it uses a lot of the Routing Engine's CPU and can degrade performance on the router.