> For the complete documentation index, see [llms.txt](https://jncia-workbook.gitbook.io/workbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jncia-workbook.gitbook.io/workbook/junos-firewall-filters/3-viewing-filter-hits.md).
# 3) Viewing Filter Hits
### Pre-Work
Load the config called **filter.configured.cfg** using the **load\_config\_on\_nodes.py** script.
```
python3 load_config_on_nodes.py --lab_dir three-routers --config_filename filter.configured.cfg
```
### Lab
The filter from the previous lab is already configured on R2. The term that permitted ICMP has been removed.
We now want more visibility into traffic that is hitting the `block_local_address` term.
* Configure the v4 filter so that we see the number of packets and bytes hitting the `block_local_address` term
* Configure the v6 filter so that we see the details of the src/dst IPs of the packets hitting the `block_local_address` term
### Answer
Expand to reveal
```
set firewall family inet filter ge-0/0/0_filter_in_v4 term block_local_address then count HIT_COUNTER
set firewall family inet6 filter ge-0/0/0_filter_in_v6 term block_local_address then log
```
### Explanation
Expand to reveal
In the *Basic Firewall Filters* lab, it was mentioned that the three *terminating* actions for a then statement are: `discard`, `reject`, and `accept`. There are many different *non-terminating* actions as well, and that includes the `count` and `log` option. *Non-terminating* means that processing will continue on. You can use these in combination with other *non-terminating* actions, as well as *terminating* actions (`discard`, `reject`, and `accept`).
\
The `count` action will simply count the number of packets and bytes that hit a term. We must give the counter a name. The name is user-defined and can be anything.
```
set firewall family inet filter ge-0/0/0_filter_in_v4 term block_local_address then count HIT_COUNTER
```
\
Initiate pings from R1 to R2's local IPs. You can then view the hits using the `show firewall counter filter ` command:
```
admin@R2> show firewall counter HIT_COUNTER filter ge-0/0/0_filter_in_v4
Filter: ge-0/0/0_filter_in_v4
Counters:
Name Bytes Packets
HIT_COUNTER 168 2
```
\
The `log` action will log details of the packets that hit the term, such as the packet length, src/dst IP, etc.
```
set firewall family inet6 filter ge-0/0/0_filter_in_v6 term block_local_address then log
```
\
We view the logs using `show firewall log`. The log is kept in RAM, not on a log file in persistent memory. (If you want this, you can use `then syslog` as well, although the behavior is slightly different - only the first packet of a flow is logged in detail).
```
admin@R2> show firewall log
Log :
Time Filter Action Interface Protocol Src Addr Dest Addr
16:01:48 pfe D ge-0/0/0.0 ICMPv6 2001:db8:1:2::1 2001:db8:1:2::2
16:01:47 pfe D ge-0/0/0.0 ICMPv6 2001:db8:1:2::1 2001:db8:1:2::2
16:01:46 pfe D ge-0/0/0.0 ICMPv6 2001:db8:1:2::1 2001:db8:1:2::2
16:01:43 pfe D ge-0/0/0.0 ICMPv6 2001:db8:1:2::1 2001:db8:1:2::2
16:01:42 pfe D ge-0/0/0.0 ICMPv6 2001:db8:1:2::1 2001:db8:1:2::2
```
\
Using the `detail` keyword gives us even more information:
```
admin@R2> show firewall log detail
Time of Log: 2026-07-27 16:01:48 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0
Name of protocol: ICMPv6, Packet Length: 32, Source address: 2001:db8:1:2::1, Destination address: 2001:db8:1:2::2 Type 135 Code 0
Time of Log: 2026-07-27 16:01:47 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0
Name of protocol: ICMPv6, Packet Length: 32, Source address: 2001:db8:1:2::1, Destination address: 2001:db8:1:2::2 Type 135 Code 0
Time of Log: 2026-07-27 16:01:46 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0
Name of protocol: ICMPv6, Packet Length: 32, Source address: 2001:db8:1:2::1, Destination address: 2001:db8:1:2::2 Type 135 Code 0
Time of Log: 2026-07-27 16:01:43 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0
Name of protocol: ICMPv6, Packet Length: 16, Source address: 2001:db8:1:2::1, Destination address: 2001:db8:1:2::2 Type 128 Code 0
Time of Log: 2026-07-27 16:01:42 UTC, Filter: pfe, Filter action: discard, Name of interface: ge-0/0/0.0
Name of protocol: ICMPv6, Packet Length: 16, Source address: 2001:db8:1:2::1, Destination address: 2001:db8:1:2::2 Type 128 Code 0
```
\
Notice that the `discard` action is still present on these terms. The new *non-terminating* actions we added have been added alongside the existing `discard` action. It also appears that Junos automatically places the non-terminating actions above the terminating action:
```
admin@R2> show configuration firewall family inet filter ge-0/0/0_filter_in_v4 term block_local_address
from {
destination-address {
10.1.2.2/32;
}
}
then {
count HIT_COUNTER;
discard;
}
```
### Further Reading