Juniper ScreenOS traffic profiling with fprofile

Qlemo"Batchelor", Developer and EE Topic Advisor
CERTIFIED EXPERT
Published:
Updated:
In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is available starting with 6.0.

The profiling is only available in CLI, so you need to know how to get there by a serial attached terminal emulation, or telnet / ssh. This is not covered here.

General CLI tip
At all times, you can type unique starting parts of the commands:
 
get fpro pac stop
                      

Open in new window

and if you can't remember the syntax, just put a question mark after your command to get further help:
 
get fpro pac ?
                      

Open in new window

or press [Tab] for auto-complete and help

How to

1. Preparation of profiling


The preparation can be done at any time, and needs not to be changed once set up.
 
unset fprofile packet wrap
                      set fprofile packet enable
                      set fprofile packet count 16
                      

Open in new window

The count is measured in kilo-packets, allowed are 1-256
 

2. Start and stop profiling

 

clear fprofile
                      set fprofile packet start
                      

Open in new window

If you set up nowrap (like above), profiling ends automatically as soon as the packet count is reached. If you set wrap mode, the buffer used is overwritten until you issue a
 
set fprofile packet stop
                      

Open in new window

I've seen no CPU effect if you leave fprofile enabled (but stopped), however you can disable that to be safe:
 
unset fprofile packet enable
                      

Open in new window

After disabling fprofile, the collected profile data is not available anymore, even after reenabling.
If you want to check the actual state of the profiling enginge:
 
get fprofile
                      

Open in new window

shows state of fprofile: enabled and start or stop.
 

3. Viewing the profile


After profiling, you want to evaluate the collected data, of course.
 
get fprofile packet			shows complete profile with packet type, protocol, src/dst ip, src/dst port, time and percentage
                      get fprofile packet ip dst-ip		shows top 10 destination IPs, summing up disregarding src info and dst ports.
                      get fprofile packet ip dst-ip all	shows all destination IPs, ...
                      get fprofile packet ip dst-ip top 5	shows top 5 ...
                      

Open in new window

Similar aggregation is available for protocols, ports, IPs - see complete syntax below.


Complete syntax variants

clear fprofile
                       
                      get fprofile packet ip proto top <NUMBER>
                      get fprofile packet ip proto all
                      get fprofile packet ip proto
                      get fprofile packet ip src-ip top <NUMBER>
                      get fprofile packet ip src-ip all
                      get fprofile packet ip src-ip
                      get fprofile packet ip dst-ip top <NUMBER>
                      get fprofile packet ip dst-ip all
                      get fprofile packet ip dst-ip
                      get fprofile packet ip sport top <NUMBER>
                      get fprofile packet ip sport all
                      get fprofile packet ip sport
                      get fprofile packet ip dport top <NUMBER>
                      get fprofile packet ip dport all
                      get fprofile packet ip dport
                      get fprofile packet ip top <NUMBER>
                      get fprofile packet ip all
                      get fprofile packet ip
                      get fprofile packet none-ip proto top <NUMBER>
                      get fprofile packet none-ip proto all
                      get fprofile packet none-ip proto
                      get fprofile packet none-ip src-mac top <NUMBER>
                      get fprofile packet none-ip src-mac all
                      get fprofile packet none-ip src-mac
                      get fprofile packet none-ip dst-mac top <NUMBER>
                      get fprofile packet none-ip dst-mac all
                      get fprofile packet none-ip dst-mac
                      get fprofile packet none-ip top <NUMBER>
                      get fprofile packet none-ip all
                      get fprofile packet none-ip
                      get fprofile packet top <NUMBER>
                      get fprofile packet all
                      get fprofile packet
                      get fprofile
                       
                      set fprofile packet enable
                      set fprofile packet count <NUMBER>
                      set fprofile packet wrap
                      set fprofile packet start
                      set fprofile packet stop
                      

Open in new window

1
10,136 Views
Qlemo"Batchelor", Developer and EE Topic Advisor
CERTIFIED EXPERT

Comments (0)

Have a question about something in this article? You can receive help directly from the article author. Sign up for a free trial to get started.