Bypass Tests

The following scenario shows different configuration alternatives to improve the OSDx firewall performance.

../../../_images/topology16.svg

Test Local Bypass

Description

Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0  54224      0 --:--:-- --:--:-- --:--:-- 64500

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.557 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.557/0.557/0.557/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.487 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.487/0.487/0.487/0.000 ms

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Expect this output in DUT2:
Connecting to host 40.0.0.2, port 5001
[  5] local 20.0.0.2 port 46394 connected to 40.0.0.2 port 5001
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  88.2 MBytes   740 Mbits/sec   16   1.65 MBytes
[  5]   1.00-2.00   sec  85.0 MBytes   713 Mbits/sec    0   1.80 MBytes
[  5]   2.00-3.00   sec  91.2 MBytes   765 Mbits/sec    0   1.93 MBytes
[  5]   3.00-4.00   sec  90.0 MBytes   755 Mbits/sec    0   2.03 MBytes
[  5]   4.00-5.00   sec  88.8 MBytes   744 Mbits/sec    0   2.10 MBytes
[  5]   5.00-6.00   sec  91.2 MBytes   765 Mbits/sec  129   1.55 MBytes
[  5]   6.00-7.00   sec  71.2 MBytes   598 Mbits/sec    0   1.64 MBytes
[  5]   7.00-8.00   sec  45.0 MBytes   377 Mbits/sec    0   1.70 MBytes
[  5]   8.00-9.00   sec  46.2 MBytes   388 Mbits/sec    0   1.75 MBytes
[  5]   9.00-10.00  sec  50.0 MBytes   419 Mbits/sec    0   1.78 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   747 MBytes   627 Mbits/sec  145             sender
[  5]   0.00-10.02  sec   745 MBytes   624 Mbits/sec                  receiver

iperf Done.

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$
Show output
10/30/2024-11:44:10.548163  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46388 -> 40.0.0.2:5001
10/30/2024-11:44:10.549164  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46394 -> 40.0.0.2:5001

Test Capture Bypass Using Packet Mark

Description

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.

Performance must improve considerably compared to the Local Bypass test.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0   4563      0 --:--:-- --:--:-- --:--:--  4607

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic label BYPASS
set traffic policy FW-SKIP rule 1 log prefix SKIP
set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS
set traffic policy FW-SKIP rule 1 set label BYPASS
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS
set traffic selector MARKED-PACKETS rule 1 mark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.595 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.595/0.595/0.595/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.453 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.453/0.453/0.453/0.000 ms

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Expect this output in DUT2:
Connecting to host 40.0.0.2, port 5001
[  5] local 20.0.0.2 port 50344 connected to 40.0.0.2 port 5001
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec   280 MBytes  2.35 Gbits/sec  132   1.41 MBytes
[  5]   1.00-2.00   sec   268 MBytes  2.24 Gbits/sec    0   1.54 MBytes
[  5]   2.00-3.00   sec   281 MBytes  2.36 Gbits/sec    0   1.67 MBytes
[  5]   3.00-4.00   sec   304 MBytes  2.55 Gbits/sec    0   1.80 MBytes
[  5]   4.00-5.00   sec   246 MBytes  2.07 Gbits/sec   36   1.34 MBytes
[  5]   5.00-6.00   sec   336 MBytes  2.82 Gbits/sec    0   1.51 MBytes
[  5]   6.00-7.00   sec   331 MBytes  2.78 Gbits/sec    0   1.67 MBytes
[  5]   7.00-8.00   sec   356 MBytes  2.99 Gbits/sec    0   1.82 MBytes
[  5]   8.00-9.00   sec   268 MBytes  2.24 Gbits/sec    0   1.92 MBytes
[  5]   9.00-10.00  sec   358 MBytes  3.00 Gbits/sec    0   2.05 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  2.96 GBytes  2.54 Gbits/sec  168             sender
[  5]   0.00-10.00  sec  2.96 GBytes  2.54 Gbits/sec                  receiver

iperf Done.

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$
Show output
10/30/2024-11:44:40.668885  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:50340 -> 40.0.0.2:5001
10/30/2024-11:44:40.669969  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:50344 -> 40.0.0.2:5001

Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:

(?m)^.*\[SKIP\-1\].*$
Show output
Oct 30 11:44:32.303410 osdx systemd-journald[1923]: Runtime Journal (/run/log/journal/877522c656344df9b9ad28416f5f036f) is 2.1M, max 15.3M, 13.2M free.
Oct 30 11:44:32.303877 osdx systemd-journald[1923]: Received client request to rotate journal, rotating.
Oct 30 11:44:32.303908 osdx systemd-journald[1923]: Vacuuming done, freed 0B of archived journals from /run/log/journal/877522c656344df9b9ad28416f5f036f.
Oct 30 11:44:32.314201 osdx OSDxCLI[77794]: User 'admin' executed a new command: 'system journal clear'.
Oct 30 11:44:32.670422 osdx osdx-coredump[78135]: Deleting all coredumps in /opt/vyatta/etc/config/coredump...
Oct 30 11:44:32.678112 osdx OSDxCLI[77794]: User 'admin' executed a new command: 'system coredump delete all'.
Oct 30 11:44:33.177194 osdx OSDxCLI[77794]: User 'admin' entered the configuration menu.
Oct 30 11:44:33.297390 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Oct 30 11:44:33.379231 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'.
Oct 30 11:44:33.433459 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Oct 30 11:44:33.533890 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'.
Oct 30 11:44:33.593160 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'.
Oct 30 11:44:33.689934 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'.
Oct 30 11:44:33.766582 osdx ERROR[78147]: unexpected
                                          Traceback (most recent call last):
                                            File "osdx/bin/op/fan_control.py", line 23, in _send_fan_control_cmd
                                          FileNotFoundError: [Errno 2] No such file or directory
Oct 30 11:44:33.773519 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'show working'.
Oct 30 11:44:33.891656 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0
Oct 30 11:44:33.967661 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1
Oct 30 11:44:33.995534 osdx (udev-worker)[78255]: Network interface NamePolicy= disabled on kernel command line.
Oct 30 11:44:34.210291 osdx cfgd[1636]: [77794]Completed change to active configuration
Oct 30 11:44:34.235648 osdx OSDxCLI[77794]: User 'admin' committed the configuration.
Oct 30 11:44:34.250931 osdx OSDxCLI[77794]: User 'admin' left the configuration menu.
Oct 30 11:44:36.264508 osdx OSDxCLI[77794]: User 'admin' executed a new command: 'ping 10.215.168.1      count 1 size 56 timeout 1'.
Oct 30 11:44:36.345195 osdx OSDxCLI[77794]: User 'admin' executed a new command: 'ping 40.0.0.2      count 1 size 56 timeout 1'.
Oct 30 11:44:36.432275 osdx OSDxCLI[77794]: User 'admin' executed a new command: 'ping 20.0.0.2      count 1 size 56 timeout 1'.
Oct 30 11:44:37.033169 osdx file_operation[78345]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running://
Oct 30 11:44:37.084024 osdx OSDxCLI[77794]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'.
Oct 30 11:44:37.209403 osdx OSDxCLI[77794]: User 'admin' executed a new command: 'file show running://test-performance.rules'.
Oct 30 11:44:37.372457 osdx OSDxCLI[77794]: User 'admin' entered the configuration menu.
Oct 30 11:44:37.443291 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'.
Oct 30 11:44:37.541425 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'.
Oct 30 11:44:37.596749 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'.
Oct 30 11:44:37.708336 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'.
Oct 30 11:44:37.815038 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'.
Oct 30 11:44:37.899577 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'.
Oct 30 11:44:38.018803 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'.
Oct 30 11:44:38.097395 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'.
Oct 30 11:44:38.177514 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'.
Oct 30 11:44:38.233898 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'.
Oct 30 11:44:38.341169 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic label BYPASS'.
Oct 30 11:44:38.402139 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'.
Oct 30 11:44:38.504822 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'.
Oct 30 11:44:38.565570 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'.
Oct 30 11:44:38.664215 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'.
Oct 30 11:44:38.735100 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'.
Oct 30 11:44:38.835415 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'.
Oct 30 11:44:38.921253 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'.
Oct 30 11:44:39.044845 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'.
Oct 30 11:44:39.108884 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'.
Oct 30 11:44:39.254358 osdx ERROR[78384]: unexpected
                                          Traceback (most recent call last):
                                            File "osdx/bin/op/fan_control.py", line 23, in _send_fan_control_cmd
                                          FileNotFoundError: [Errno 2] No such file or directory
Oct 30 11:44:39.256590 osdx OSDxCLI[77794]: User 'admin' added a new cfg line: 'show working'.
Oct 30 11:44:39.810731 osdx systemd[1]: Reloading.
Oct 30 11:44:39.911657 osdx systemd-sysv-generator[78477]: stat() failed on /etc/init.d/README, ignoring: No such file or directory
Oct 30 11:44:40.035980 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service...
Oct 30 11:44:40.053032 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service.
Oct 30 11:44:40.257452 osdx INFO[78460]: Rules successfully loaded
Oct 30 11:44:40.258250 osdx cfgd[1636]: [77794]Completed change to active configuration
Oct 30 11:44:40.260024 osdx OSDxCLI[77794]: User 'admin' committed the configuration.
Oct 30 11:44:40.284900 osdx OSDxCLI[77794]: User 'admin' left the configuration menu.
Oct 30 11:44:40.671734 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=36206 DF PROTO=TCP SPT=50340 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d
Oct 30 11:44:40.671817 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=54410 DF PROTO=TCP SPT=50344 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d
Oct 30 11:44:51.040619 osdx OSDxCLI[77794]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.

Test Capture Bypass Using Conntrack Mark

Description

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.

Performance must improve considerably compared to the Local Bypass test.

Then, the test is broaden by configuring “Capture bypass drop” to also avoid dropped packets from entering the firewall.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0   6844      0 --:--:-- --:--:-- --:--:--  7166

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW stream bypass set-connmark
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 2 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.659 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.659/0.659/0.659/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.541 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.541/0.541/0.541/0.000 ms

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Expect this output in DUT2:
Connecting to host 40.0.0.2, port 5001
[  5] local 20.0.0.2 port 56598 connected to 40.0.0.2 port 5001
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec   315 MBytes  2.64 Gbits/sec  208   2.10 MBytes
[  5]   1.00-2.00   sec   289 MBytes  2.42 Gbits/sec  462   1.59 MBytes
[  5]   2.00-3.00   sec   299 MBytes  2.51 Gbits/sec    0   1.72 MBytes
[  5]   3.00-4.00   sec   369 MBytes  3.09 Gbits/sec    0   1.88 MBytes
[  5]   4.00-5.00   sec   311 MBytes  2.61 Gbits/sec   71   1.41 MBytes
[  5]   5.00-6.00   sec   330 MBytes  2.77 Gbits/sec    0   1.57 MBytes
[  5]   6.00-7.00   sec   319 MBytes  2.67 Gbits/sec    0   1.71 MBytes
[  5]   7.00-8.00   sec   274 MBytes  2.30 Gbits/sec    0   1.83 MBytes
[  5]   8.00-9.00   sec   324 MBytes  2.72 Gbits/sec   12   1.45 MBytes
[  5]   9.00-10.00  sec   328 MBytes  2.75 Gbits/sec    0   1.61 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec  3.08 GBytes  2.65 Gbits/sec  753             sender
[  5]   0.00-10.00  sec  3.08 GBytes  2.65 Gbits/sec                  receiver

iperf Done.

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$
Show output
10/30/2024-11:45:16.952904  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56594 -> 40.0.0.2:5001
10/30/2024-11:45:16.954030  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56598 -> 40.0.0.2:5001

Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$
Show output
tcp      6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=56594 dport=5001 packets=16 bytes=1297 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=56594 packets=13 bytes=1019 [ASSURED] (Sc: not-bypass) mark=129834765 use=1
icmp     1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=42 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=42 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1
tcp      6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=56598 dport=5001 packets=2285823 bytes=3428724977 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=56598 packets=351061 bytes=18249076 [ASSURED] (Sc: not-bypass) mark=129834765 use=1
icmp     1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=155 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=155 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1
conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.

Step 9: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   200  100   200    0     0    615      0 --:--:-- --:--:-- --:--:--   617

Step 10: Run command file show running://drop-performance.rules at DUT0 and expect this output:

Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)

Step 11: Modify the following configuration lines in DUT0:

set service firewall FW bypass action drop set connmark mark 147652983
set service firewall FW ruleset file 'running://drop-performance.rules'
set traffic policy FW_PLAN rule 1 action drop
set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP
set traffic selector FW_SEL_DROP rule 1 connmark 147652983

Step 12: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5000
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1
Expect this output in DUT2:
^C- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
iperf3: interrupt - the client has terminated
admin@osdx$

Step 13: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping TCP performance test traffic).+$
Show output
10/30/2024-11:45:16.952904  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56594 -> 40.0.0.2:5001
10/30/2024-11:45:16.954030  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56598 -> 40.0.0.2:5001
10/30/2024-11:45:30.768068  [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:33186 -> 40.0.0.2:5000

Step 14: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$
Show output
tcp      6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=33186 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=33186 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1
conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.

Step 15: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:

(?m)^1\s+FW_SEL_DROP\s+[1-9].*$
Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high

---------------------------------------------------------------------
rule      selector     pkts match  pkts eval  bytes match  bytes eval
---------------------------------------------------------------------
1      FW_SEL_DROP              4          5          210         270
2      FW_SEL_ENQUEUE           1          1           60          60
---------------------------------------------------------------------
Total                           5          5          270         270

Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high

---------------------------------------------------------------------
rule      selector     pkts match  pkts eval  bytes match  bytes eval
---------------------------------------------------------------------
1      FW_SEL_DROP              6          9          499         700
2      FW_SEL_ENQUEUE           3          3          201         201
---------------------------------------------------------------------
Total                           9          9          700         700

Test Capture And Offload

Description

Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.

Performance must improve considerably compared to the previous test, to reach its top value.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   129  100   129    0     0  24376      0 --:--:-- --:--:-- --:--:-- 25800

Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:

Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://test-performance.rules'
set service firewall FW stream bypass action accept set conntrack offload-flag
set service firewall FW stream bypass mark 129834765
set service firewall FW stream bypass mask 129834765
set service firewall FW stream bypass set-connmark
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 action enqueue FW_Q
set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE
set traffic queue FW_Q elements 1
set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.583 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.583/0.583/0.583/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.437 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.437/0.437/0.437/0.000 ms

Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance traffic).+$
Show output
10/30/2024-11:45:55.160884  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55562 -> 40.0.0.2:5001
10/30/2024-11:45:55.161948  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55568 -> 40.0.0.2:5001

Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$
Show output
tcp      6 src=20.0.0.2 dst=40.0.0.2 sport=55568 dport=5001 packets=67735 bytes=101594593 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55568 packets=10107 bytes=527164 [ASSURED] [OFFLOAD, packets=67722 bytes=101579392 packets=10105 bytes=527052] mark=129834765 use=2
icmp     1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=45 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=45 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1
icmp     1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=158 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=158 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1
tcp      6 src=20.0.0.2 dst=40.0.0.2 sport=55562 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55562 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=388 packets=4 bytes=211] mark=129834765 use=2
conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.

Step 9: Stop the current bandwidth test between DUT2 and DUT1

Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   133  100   133    0     0   4775      0 --:--:-- --:--:-- --:--:--  4925

Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:

Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)

Step 12: Modify the following configuration lines in DUT0:

set service firewall FW ruleset file 'running://test-performance-udp.rules'

Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1

Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Skipping test network performance UDP traffic).+$
Show output
10/30/2024-11:45:55.160884  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55562 -> 40.0.0.2:5001
10/30/2024-11:45:55.161948  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55568 -> 40.0.0.2:5001
10/30/2024-11:45:57.207853  [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55580 -> 40.0.0.2:5001
10/30/2024-11:45:57.209196  [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:56949 -> 40.0.0.2:5001
10/30/2024-11:45:57.219878  [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:56949 -> 40.0.0.2:5001

Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:

(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$
Show output
udp      17 src=20.0.0.2 dst=40.0.0.2 sport=56949 dport=5001 packets=14 bytes=19220 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=56949 packets=1 bytes=32 [OFFLOAD, packets=11 bytes=16236 packets=0 bytes=0] mark=129834765 use=2
tcp      6 src=20.0.0.2 dst=40.0.0.2 sport=55580 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55580 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=5 bytes=406 packets=4 bytes=211] mark=129834765 use=2
conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.

Step 16: Stop the current bandwidth test between DUT2 and DUT1

Test Traffic Early Dropping

Description

Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.

The contents of the rule file are:

drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)

This rule allows the connection to be established and traffic to be dropped later.

Scenario

Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:

Show output
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   200  100   200    0     0  36771      0 --:--:-- --:--:-- --:--:-- 40000

Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:

Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)

Step 3: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 vif 101 address 40.0.0.1/8
set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN
set interfaces ethernet eth1 vif 201 address 20.0.0.1/8
set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns static host-name WAN inet 10.215.168.1
set service firewall FW logging level config
set service firewall FW logging outputs fast
set service firewall FW mode inline queue FW_Q
set service firewall FW ruleset file 'running://drop-performance.rules'
set service firewall FW stream bypass action drop set xdp-early-drop eth1
set service firewall FW validator-timeout 20
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set traffic policy FW_PLAN rule 1 action enqueue FW_Q
set traffic queue FW_Q elements 1

Step 4: Ping IP address 20.0.0.2 from DUT1:

admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1
Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data.
64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.517 ms

--- 20.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.517/0.517/0.517/0.000 ms

Step 5: Ping IP address 40.0.0.2 from DUT2:

admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1
Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data.
64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.557 ms

--- 40.0.0.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.557/0.557/0.557/0.000 ms

Step 6: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5000
admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1
Expect this output in DUT2:
^C- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
iperf3: interrupt - the client has terminated
admin@osdx$

Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping TCP performance test traffic).+$
Show output
10/30/2024-11:46:15.523349  [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:37196 -> 40.0.0.2:5000

Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:

yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*
Show output
------------------------------------------------------------------------
  src       dst     src port  dst port  tcp  vlan_0  vlan_1  pkts  bytes
------------------------------------------------------------------------
40.0.0.2  20.0.0.2      5000     37196  yes     201       0     0      0
20.0.0.2  40.0.0.2     37196      5000  yes     201       0     9    731

Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:

Show output
Pin path: /sys/fs/bpf/eth1
Period of 0.250137s ending at 1730288779.197889
XDP_DROP               9 pkts (         0 pps)           0 KiB (     0 Mbits/s)
XDP_PASS              13 pkts (         0 pps)           1 KiB (     0 Mbits/s)
XDP_TX                 0 pkts (         0 pps)           0 KiB (     0 Mbits/s)
XDP_REDIRECT           0 pkts (         0 pps)           0 KiB (     0 Mbits/s)

Step 10: Initiate a bandwidth test from DUT2 to DUT1

admin@DUT1$ monitor test performance server port 5001
admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1
Expect this output in DUT2:
^C- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams
iperf3: interrupt - the client has terminated
admin@osdx$

Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:

(?m)^.+(Dropping UDP performance test traffic).+$
Show output
10/30/2024-11:46:15.523349  [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:37196 -> 40.0.0.2:5000
10/30/2024-11:46:19.357661  [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:43756 -> 40.0.0.2:5001

Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:

yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*
Show output
------------------------------------------------------------------------
  src       dst     src port  dst port  tcp  vlan_0  vlan_1  pkts  bytes
------------------------------------------------------------------------
40.0.0.2  20.0.0.2      5001     43756  no      201       0     0      0
40.0.0.2  20.0.0.2      5000     37196  yes     201       0     0      0
20.0.0.2  40.0.0.2     43756      5001  no      201       0     0      0
20.0.0.2  40.0.0.2     37196      5000  yes     201       0    12    905

Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:

Show output
Pin path: /sys/fs/bpf/eth1
Period of 0.250185s ending at 1730288783.025969
XDP_DROP              12 pkts (         0 pps)           0 KiB (     0 Mbits/s)
XDP_PASS              33 pkts (         0 pps)           2 KiB (     0 Mbits/s)
XDP_TX                 0 pkts (         0 pps)           0 KiB (     0 Mbits/s)
XDP_REDIRECT           0 pkts (         0 pps)           0 KiB (     0 Mbits/s)