Juniper J2300 User Manual page 263

Table 90: CLI monitor traffic Match Conditions
Match Condition
Entity Type
host [ address | hostname ]
network address
network address mask mask
port [ port-number | port-name ]
Directional
destination
source
source and destination
source or destination
Packet Length
less bytes
greater bytes
Protocol
arp
ether
ether [broadcast | multicast]
ether protocol [ address | (\arp | \ip
| \rarp)
icmp
ip
ip [broadcast | multicast]
Replace with any protocol in Table 90. Replace
protocol
offset, from the beginning of the packet header, to use for the comparison.
The optional parameter represents the number of bytes examined in
size
the packet header—1, 2, or 4 bytes.
For example, the following command displays all multicast traffic:
user@host> monitor traffic matching "ether[0] & 1 !=0"
Description
Matches packet headers that contain the specified address or hostname. You can
preprend any of the following protocol match conditions, followed by a space, to host:
arp, ip, rarp, or any of the Directional match conditions.
Matches packet headers with source or destination addresses containing the specified
network address.
Matches packet headers containing the specified network address and subnet mask.
Matches packet headers containing the specified source or destination TCP or UDP
port number or port name.
Directional match conditions can be prepended to any Entity Type match conditions,
followed by a space.
Matches packet headers containing the specified destination.
Matches packet headers containing the specified source.
Matches packet headers containing the specified source and destination.
Matches packet headers containing the specified source or destination.
Matches packets with lengths less than or equal to the specified value, in bytes.
Matches packets with lengths greater than or equal to the specified value, in bytes.
Matches all ARP packets.
Matches all Ethernet frames.
Matches broadcast or multicast Ethernet frames. This match condition can be
prepended with source or destination.
Matches Ethernet frames with the specified address or protocol type. The arguments
arp, ip, and rarp are also independent match conditions, so they must be preceded
with a backslash (\) when used in the ether protocol match condition.
Matches all ICMP packets.
Matches all IP packets.
Matches broadcast or multicast IP packets.
Monitoring and Diagnosing a Services Router
with the byte
byte-offset
Using CLI Diagnostic Commands
233