Troubleshooting
Packet Capture Runbook for Cisco, FortiGate, and Juniper Troubleshooting
A practical packet capture planning guide for Cisco, FortiGate, and Juniper troubleshooting with filters, evidence handling, and escalation notes.
Short answer
A packet capture should define source, destination, protocol, interface, count, timing, and evidence owner before commands are run on production routers or firewalls.
Key Takeaways
- Packet capture is evidence, not a fishing expedition.
- Filters should be narrow enough to reduce noise and protect sensitive data.
- Every capture should have a stop condition and a secure handoff path.
Start With the Exact Question
Do not begin with a broad capture. State the symptom first: DNS timeout, TLS reset, asymmetric path, VPN tunnel drop, blocked API call, packet loss, or intermittent session failure. The capture should answer that one question.
Choose the Interface and Direction Carefully
On routers and firewalls, the wrong interface can make a real problem invisible. Capture as close to the decision point as possible: ingress firewall interface, VPN tunnel, WAN edge, server VLAN, or cloud edge path.
- Use source and destination host filters where possible.
- Limit packet count and capture duration.
- Avoid payload capture unless it is explicitly required and approved.
- Store PCAP files as sensitive evidence.
Make Vendor Commands Repeatable
Cisco, FortiGate, and Juniper all support packet inspection workflows, but syntax and limitations differ. A generated task script helps the operator record interface, filter, count, safety notes, and verification commands before touching production.
Practical Checklist
Define symptom, source, destination, port, protocol, and expected behavior.
Select interface and direction based on packet path.
Use a narrow filter and short packet count.
Record start time, device time, and timezone.
Stop capture immediately after evidence is collected.
Store files securely and summarize findings in plain language.
Questions Teams Ask
Should packet captures be broad during an outage?
Usually no. Broad captures create noise, expose sensitive data, and increase device load. Start narrow, then expand only if needed.
Can packet capture affect production devices?
Yes. Capture scope, packet count, interface choice, and device load matter. Use safe limits and approved windows.
What should be included in a capture handoff?
Include device, interface, filter, timeframe, symptom, observed result, and a secure link to the capture file if a PCAP is needed.