> For the complete documentation index, see [llms.txt](https://jncia-workbook.gitbook.io/workbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jncia-workbook.gitbook.io/workbook/junos-basics/26-troubleshooting-with-packet-captures.md).
# 26) Troubleshooting with Packet Captures
### Pre-Work
Load the config called **broken.ospf.cfg** using the **load\_config\_on\_nodes.py** script.
```
python3 load_config_on_nodes.py --lab_dir three-routers --config_filename broken.ospf.cfg
```
### Lab
OSPF is setup, but the adjacency between R1 and R2 is not coming up. You are not allowed to look at the config of R2 for this lab.
Take a packet capture from within the CLI of R1 to identify the issue. Fix the issue by only configuring R1.
### Answer
Expand to reveal
Use `monitor traffic interface ge-0/0/0 detail` to run a packet capture:
```
admin@R1> monitor traffic interface ge-0/0/0 detail
Address resolution is ON. Use to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on ge-0/0/0, capture size 1578 bytes
Reverse lookup for 10.1.2.2 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use to avoid reverse lookups on IP addresses.
15:36:02.845076 In IP (tos 0xc0, ttl 1, id 18842, offset 0, flags [none], proto: OSPF (89), length: 76) 10.1.2.2 > 224.0.0.5: OSPFv2, Hello, length 56 [len 44]
Router-ID 2.2.2.2, Backbone Area, Authentication Type: none (0)
Options [External, LLS]
Hello Timer 5s, Dead Timer 20s, Mask 255.255.255.0, Priority 128
LLS: checksum: 0xfff6, length: 3
Extended Options (1), length: 4
Options: 0x00000001 [LSDB resync]
15:36:05.018235 Out IP (tos 0xc0, ttl 1, id 23208, offset 0, flags [none], proto: OSPF (89), length: 80) 10.1.2.1 > 224.0.0.5: OSPFv2, Hello, length 60 [len 48]
Router-ID 1.1.1.1, Backbone Area, Authentication Type: none (0)
Options [External, LLS]
Hello Timer 10s, Dead Timer 40s, Mask 255.255.255.0, Priority 128
Designated Router 10.1.2.1
Neighbor List:
2.2.2.2
LLS: checksum: 0xfff6, length: 3
Extended Options (1), length: 4
Options: 0x00000001 [LSDB resync]
```
\
We can see from this that R2 has the hello/dead timers set to 5/20 seconds.
\
We can change R1's timers to these values to bring OSPF up.
```
set protocols ospf area 0 interface ge-0/0/0.0 hello-interval 5
set protocols ospf area 0 interface ge-0/0/0.0 dead-interval 20
```
### Explanation
Expand to reveal
The `monitor traffic` command performs a pcap on traffic sent to/from the RE. So it only captures exception traffic. You cannot capture data plane/transit traffic.
\
Note the difference between this command and `monitor interface traffic` which we saw in the previous lab. (This is `monitor traffic` vs. `monitor interface`).
\
We have several features available to us with the `monitor traffic` command, such as `write-file` to save it to a file, `count` to limit the number of packets, `matching` apply a filter, `layer2-headers` to see src/dst MAC, and more.
\
If we don't use `detail`, we won't get packet contents. We will get one line per packet, as you can see below.
```
admin@R1> monitor traffic interface ge-0/0/0
verbose output suppressed, use or for full protocol decode
Address resolution is ON. Use to avoid any reverse lookup delay.
Address resolution timeout is 4s.
Listening on ge-0/0/0, capture size 96 bytes
Reverse lookup for 10.1.2.2 failed (check DNS reachability).
Other reverse lookup failures will not be reported.
Use to avoid reverse lookups on IP addresses.
15:35:23.163375 In IP 10.1.2.2 > 224.0.0.5: OSPFv2, Hello, length 56
15:35:24.271778 Out IP truncated-ip - 20 bytes missing! 10.1.2.1 > 224.0.0.5: OSPFv2, Hello, length 60
15:35:27.146905 In IP 10.1.2.2 > 224.0.0.5: OSPFv2, Hello, length 56
15:35:31.452734 In IP 10.1.2.2 > 224.0.0.5: OSPFv2, Hello, length 56
15:35:33.207218 Out IP truncated-ip - 20 bytes missing! 10.1.2.1 > 224.0.0.5: OSPFv2, Hello, length 60
```
* The `bytes missing!` message is normal, and is due to where in the packet encapsulation process the packet capture is performed.
\
We can also filter the output to OSPF traffic if desired:
```
monitor traffic interface ge-0/0/0 matching "proto ospf" detail
```
\
The ability to easily start a packet capture with a single command is a huge benefit of Junos. But be aware that some exception traffic (such as ICMP) is actually processed by the line card CPU, not the RE, so you would not see it with this command.
### Further Reading