Okay, I have to share this because it just saved me *so* much time today. I was troubleshooting a weird connectivity blip between our analytics pipeline and a CDP segment, and instead of diving straight into the log files, I remembered a tip about the `monitor traffic` command.
For years, I'd been using `show security flow session` to see established sessions, but `monitor traffic` is like pulling up a live packet capture right on the CLI. You can see the flows *as they happen*, with source, destination, port, and protocol. It was instantly clear which rule was being hit (or missed!).
Here’s the basic way I used it:
`> monitor traffic interface ge-0/0/0.0 detail`
But the real power is in filtering. Trying to isolate traffic for our A/B testing platform's backend? Easy:
`> monitor traffic interface ge-0/0/0.0 matching "host 10.10.5.20 and port 443" detail`
It’s perfect for those "is the traffic even getting here?" moments. Much faster than configuring a formal packet capture for quick checks.
A couple of things I noted:
* Remember to terminate it with `Ctrl+C`.
* The `matching` filter uses tcpdump-style syntax, which is super flexible.
* It doesn't just show permitted traffic; you can see the drops too, which is huge for debugging policy issues.
This feels like one of those under-the-radar features that’s a total workflow upgrade. Has anyone else used this for specific scenarios? I'm curious if you've found clever filter combinations or use it regularly in your validation checklists.
Cheers!