Packet Capture Runbook: Best Practices for Cisco, FortiGate, and Juniper Troubleshooting

Packet capture is a critical technique for network engineers to analyze traffic, detect anomalies, and resolve complex connectivity or performance issues. Effective packet capture depends on defining precise filters and capture parameters to limit the scope and performance impact. This runbook focuses on practical steps for Cisco IOS/EPC, FortiGate FortiOS sniffer, and Juniper Junos OS devices as per official documentation and best practices. [1][2][3]

Cisco's Embedded Packet Capture lets you capture traffic directly on routers or switches running IOS or IOS XE. The process involves several steps:

1. Define a capture buffer (size, max packet size, circular or linear). 2. Create an ACL filter with source/destination IPs and protocols. 3. Define a capture point on an interface (physical, tunnel). 4. Associate the buffer with the capture point. 5. Start and stop the capture. 6. Review the capture summary or dump the capture buffer. 7. Export the capture as a PCAP file via TFTP.

The capture resides in DRAM and does not persist across reloads, so timely export is critical. EPC configuration is temporary and does not save to startup-config ensuring no impact post troubleshooting.

This method supports capturing on physical and sub-interfaces and filtering by access lists. However, L2 info may be lost during export, and IPv6 is limited in some configurations. [1]

FortiGate firewalls use a CLI-based sniffer trace to capture network traffic live on interfaces. To ensure precise capture:

- Define filters to specify source/destination IPs and protocols. - Set a capture duration or packet count to limit impact. - Redirect or save capture output for analysis.

FortiGate CLI commands allow starting and stopping the sniffer, selecting interfaces, and applying filters similar to tcpdump syntax. This live capture method provides real-time insights into traffic flowing through the firewall.

Remember that sniffer traces run on the data plane and can impact performance if not limited by count or time. Assigning an evidence owner ensures responsible use and capturing relevant sessions only. [2]

Juniper devices support packet capture through firewall filters applied to interfaces combined with operational mode commands.

Configuration includes: - Defining firewall filters to match packets by IP address, port, or protocol. - Applying filters as input/output on physical or logical interfaces. - Setting maximum capture file size, number of files, and packet size limits.

Captured packets, including Layer 2 headers, are saved in libpcap format in /var/tmp and can be retrieved via FTP or SCP for offline analysis with tcpdump or Wireshark.

Juniper also provides a CLI operational mode 'request packet-capture start/stop' for on-demand captures, useful for quick troubleshooting without configuration commits. However, operational mode captures are temporary and non-persistent.

Careful filter planning reduces performance impact and collects only relevant packet data. [3]

To avoid service disruption, follow these guidelines before initiating packet capture:

- Define source and destination addresses clearly to limit capture scope. - Specify protocol types (e.g., TCP, UDP, ICMP) to filter unnecessary traffic. - Select the correct interface(s) where the traffic flows. - Determine packet count or capture duration limits to avoid memory exhaustion. - Assign an evidence owner responsible for executing captures and managing data securely. - Avoid capturing on high-speed or critical interfaces during peak traffic. - Use maintenance windows if possible. - Export and analyze captures promptly; buffer memory is limited. - Remove or disable capture configurations immediately after use.

Implement capture filters, audit trails, and documentation for every capture in compliance with organizational policies. [1][2][3]