一、Screen OS抓包

debug：跟踪防火墙对数据包的处理过程

1. Set ffilter src-ip x.x.x.x dst-ip x.x.x.x dst-port xx

设置过滤列表,定义捕获包的范围

2、clear dbuf

清除防火墙内存中缓存的分析包

3、debug flow basic

开启debug数据流跟踪功能

4、发送测试数据包或让小部分流量穿越防火墙

5、undebug all

关闭所有debug功能

6、get dbuf stream

检查防火墙对符合过滤条件数据包的分析结果

7、unset ffilter

清除防火墙debug过滤列表

8、clear dbuf

清除防火墙缓存的debug信息

9、get debug

查看当前debug设置

 

 

Snoop：捕获进出防火墙的数据包，与Sniffer嗅包软件功能类似

1. Snoop filter ip src-ip x.x.x.x dst-ip x.x.x.x dst-port xx

设置过滤列表,定义捕获包的范围

2、clear dbuf

清除防火墙内存中缓存的分析包

3、snoop

开启snoop功能捕获数据包

4、发送测试数据包或让小部分流量穿越防火墙

5、snoop off

停止snoop

6、get db stream

检查防火墙对符合过滤条件数据包的分析结果

7、snoop filter delete

清除防火墙snoop过滤列表

8、clear dbuf

清除防火墙缓存的debug信息

9、snoop info

查看snoop设置

 

 

 

 

 

 

 

 

 

 

 

 

二、SRX 抓包

debug：跟踪防火墙对数据包的处理过程

SRX对应ScreenOS debug flow basic跟踪报文处理路径的命令：

set security flow traceoptions flag basic-datapath 开启SRX基本报文处理Debug

set security flow traceoptions file filename.log   将输出信息记录到指定文件中

set security flow traceoptions file filename.log  size 设置该文件大小，缺省128k

set security flow traceoptions packet-filter filter1 destination-prefix 5.5.5.2 设置报文跟踪过滤器

run file show filename.log 查看该Log输出信息

 

 

 

 

捕获进出防火墙的数据包

开启抓包功能参数设置

edit forwarding-options

set packet-capture maximum-capture-size 500  //Specify in bytes the maximum size of each packet to capture in each file—for example, 500. The range is between 68 and 1500, and the default is 68 bytes.

set packet-capture file filename pcap-file   //Specify the target filename for the packet capture file—for example, pcap-file. For each physical interface, the interface name is automatically suffixed to the filename—for example, pcap-file.fe-0.0.1.

set packet-capture file files 100   // Specify the maximum number of files to capture—for example, 100. The range is between 2 and 10,000, and the default is 10 files. In the Files box, type 100

 

set packet-capture file size 1024  // Specify the maximum size of each file in bytes—for example, 1024. The range is between 1,024 and 104,857,600, and the default is 512,000 bytes. In the Size box, type 1024.

 

set packet-capture file world-readable  // Specify if all users have permission to read the packet capture files.

Configuring Packet Capture on an Interface

edit interfaces fe-0/0/1

set unit 0 family inet sampling input output

Configuring a Firewall Filter for Packet Capture

edit firewall

set firewall filter dest-all term dest-term from destination-address 192.168.1.1/32

set firewall filter dest-all term dest-term then sample accept

set interfaces fe-0/0/1 unit 0 family inet filter output dest-all

Disabling Packet Capture

edit forwarding-options

set packet-capture disable