Logging
The following scenarios show how to configure the conntrack logging option with different traffic policies and services enabled, in order to check that all fields are displayed correctly and all events are captured.
New events
Description
Check NEW sessions events are captured
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set system conntrack logging events new set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.593 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.593/0.593/0.593/0.000 ms
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.466 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.466/0.466/0.466/0.000 ms
Step 5: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[NEW\].*SRC=192.168.100.2Show output
Jul 24 14:19:03.358127 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.7M, max 13.8M, 12.0M free. Jul 24 14:19:03.359651 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:19:03.359713 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:19:03.370370 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:19:03.603220 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:19:03.845289 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:19:03.952623 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:19:04.048836 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events new'. Jul 24 14:19:04.187616 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:19:04.296380 osdx ubnt-cfgd[933091]: inactive Jul 24 14:19:04.328306 osdx INFO[933100]: FRR daemons did not change Jul 24 14:19:04.363727 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:19:04.431318 osdx WARNING[933174]: No supported link modes on interface eth0 Jul 24 14:19:04.433049 osdx modulelauncher[933174]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:19:04.433069 osdx modulelauncher[933174]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:19:04.434418 osdx modulelauncher[933174]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:19:04.434430 osdx modulelauncher[933174]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:19:04.484011 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:04.485052 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:04.485312 osdx ulogd[933194]: registering plugin `NFCT' Jul 24 14:19:04.485368 osdx ulogd[933194]: registering plugin `IP2STR' Jul 24 14:19:04.485414 osdx ulogd[933194]: registering plugin `PRINTFLOW' Jul 24 14:19:04.485471 osdx ulogd[933194]: registering plugin `SYSLOG' Jul 24 14:19:04.485475 osdx ulogd[933194]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:04.485526 osdx ulogd[933194]: NFCT plugin working in event mode Jul 24 14:19:04.485537 osdx ulogd[933194]: Changing UID / GID Jul 24 14:19:04.485628 osdx ulogd[933194]: initialization finished, entering main loop Jul 24 14:19:04.661001 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:19:04.661564 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:19:04.686753 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:19:05.863064 osdx ulogd[933194]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:05.995359 osdx ulogd[933194]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0
Update events
Description
Check UPDATE sessions events are captured
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set system conntrack logging events update set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.825 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.825/0.825/0.825/0.000 ms
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.529 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.529/0.529/0.529/0.000 ms
Step 5: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[UPDATE\].*SRC=192.168.100.2Show output
Jul 24 14:19:11.343754 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.9M, max 13.8M, 11.9M free. Jul 24 14:19:11.347620 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:19:11.347689 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:19:11.353443 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:19:11.576208 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:19:11.837832 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:19:11.944599 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:19:12.040454 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events update'. Jul 24 14:19:12.105276 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:19:12.200475 osdx ubnt-cfgd[933447]: inactive Jul 24 14:19:12.225897 osdx INFO[933456]: FRR daemons did not change Jul 24 14:19:12.259619 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:19:12.308441 osdx WARNING[933530]: No supported link modes on interface eth0 Jul 24 14:19:12.309859 osdx modulelauncher[933530]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:19:12.309870 osdx modulelauncher[933530]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:19:12.311019 osdx modulelauncher[933530]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:19:12.311026 osdx modulelauncher[933530]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:19:12.343935 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:12.344783 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:12.344848 osdx ulogd[933550]: registering plugin `NFCT' Jul 24 14:19:12.344895 osdx ulogd[933550]: registering plugin `IP2STR' Jul 24 14:19:12.344930 osdx ulogd[933550]: registering plugin `PRINTFLOW' Jul 24 14:19:12.344966 osdx ulogd[933550]: registering plugin `SYSLOG' Jul 24 14:19:12.344969 osdx ulogd[933550]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:12.345010 osdx ulogd[933550]: NFCT plugin working in event mode Jul 24 14:19:12.345020 osdx ulogd[933550]: Changing UID / GID Jul 24 14:19:12.345100 osdx ulogd[933550]: initialization finished, entering main loop Jul 24 14:19:12.529321 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:19:12.529824 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:19:12.546059 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:19:13.677393 osdx ulogd[933550]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:13.770694 osdx ulogd[933550]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0
Destroy events
Description
Check DESTROY sessions events are captured
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set service ssh set system conntrack logging events destroy set system conntrack timeout icmp 1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.694 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.694/0.694/0.694/0.000 ms
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.496 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=9.16 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.352 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2025ms rtt min/avg/max/mdev = 0.352/3.335/9.158/4.117 ms
Step 5: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[DESTROY\].*SRC=192.168.100.2Show output
Jul 24 14:19:19.361898 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:19:19.362785 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:19:19.362830 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:19:19.371605 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:19:19.591675 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:19:19.841335 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:19:19.944731 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:19:20.050439 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events destroy'. Jul 24 14:19:20.151054 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack timeout icmp 1'. Jul 24 14:19:20.215357 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set service ssh'. Jul 24 14:19:20.328049 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:19:20.404117 osdx ubnt-cfgd[933805]: inactive Jul 24 14:19:20.492034 osdx INFO[933829]: FRR daemons did not change Jul 24 14:19:20.530799 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:19:20.587436 osdx WARNING[933905]: No supported link modes on interface eth0 Jul 24 14:19:20.589318 osdx modulelauncher[933905]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:19:20.589329 osdx modulelauncher[933905]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:19:20.590806 osdx modulelauncher[933905]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:19:20.590815 osdx modulelauncher[933905]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:19:20.647121 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:20.648028 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:20.648149 osdx ulogd[933925]: registering plugin `NFCT' Jul 24 14:19:20.648190 osdx ulogd[933925]: registering plugin `IP2STR' Jul 24 14:19:20.648225 osdx ulogd[933925]: registering plugin `PRINTFLOW' Jul 24 14:19:20.648266 osdx ulogd[933925]: registering plugin `SYSLOG' Jul 24 14:19:20.648269 osdx ulogd[933925]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:20.648311 osdx ulogd[933925]: NFCT plugin working in event mode Jul 24 14:19:20.648320 osdx ulogd[933925]: Changing UID / GID Jul 24 14:19:20.648405 osdx ulogd[933925]: initialization finished, entering main loop Jul 24 14:19:20.727198 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Jul 24 14:19:20.742611 osdx sshd[933946]: Server listening on 0.0.0.0 port 22. Jul 24 14:19:20.742644 osdx sshd[933946]: Server listening on :: port 22. Jul 24 14:19:20.742794 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Jul 24 14:19:20.996788 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:19:20.997410 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:19:21.024699 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:19:23.284433 osdx ulogd[933925]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84
Default logging
Description
Set a simple configuration, send a ping command from one device to other
and check that default fields appear when running system journal show.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set system conntrack logging events all set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.682 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.682/0.682/0.682/0.000 ms
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.520 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.520/0.520/0.520/0.000 ms
Step 5: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*SRC=192.168.100.2Show output
Jul 24 14:19:33.364455 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:19:33.366481 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:19:33.366551 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:19:33.375126 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:19:33.633725 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:19:33.877238 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:19:33.979412 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:19:34.316283 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:19:34.399115 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:19:34.492714 osdx ubnt-cfgd[934223]: inactive Jul 24 14:19:34.516191 osdx INFO[934232]: FRR daemons did not change Jul 24 14:19:34.546547 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:19:34.595897 osdx WARNING[934306]: No supported link modes on interface eth0 Jul 24 14:19:34.597517 osdx modulelauncher[934306]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:19:34.597532 osdx modulelauncher[934306]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:19:34.598828 osdx modulelauncher[934306]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:19:34.598838 osdx modulelauncher[934306]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:19:34.651155 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:34.652547 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:34.652860 osdx ulogd[934326]: registering plugin `NFCT' Jul 24 14:19:34.652953 osdx ulogd[934326]: registering plugin `IP2STR' Jul 24 14:19:34.653030 osdx ulogd[934326]: registering plugin `PRINTFLOW' Jul 24 14:19:34.653122 osdx ulogd[934326]: registering plugin `SYSLOG' Jul 24 14:19:34.653130 osdx ulogd[934326]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:34.653218 osdx ulogd[934326]: NFCT plugin working in event mode Jul 24 14:19:34.653235 osdx ulogd[934326]: Changing UID / GID Jul 24 14:19:34.653389 osdx ulogd[934326]: initialization finished, entering main loop Jul 24 14:19:34.841203 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:19:34.841847 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:19:34.881227 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:19:36.038079 osdx ulogd[934326]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:36.038096 osdx ulogd[934326]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:36.119050 osdx ulogd[934326]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:36.119069 osdx ulogd[934326]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0
Identity logging
Description
Set a simple configuration with identity OSDx_DUT0 for logs entries, send a ping command from one device to other
and check that the identity has changed when running system journal show.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set system conntrack logging events all set system conntrack logging identity OSDx_DUT0 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.906 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.906/0.906/0.906/0.000 ms
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.626 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.626/0.626/0.626/0.000 ms
Step 5: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
OSDx_DUT0\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*SRC=192.168.100.2Show output
Jul 24 14:19:41.338062 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:19:41.340256 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:19:41.340327 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:19:41.349648 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:19:41.594228 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:19:41.913636 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:19:42.030445 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:19:42.101193 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:19:42.221063 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging identity OSDx_DUT0'. Jul 24 14:19:42.319088 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:19:42.439538 osdx ubnt-cfgd[934581]: inactive Jul 24 14:19:42.461981 osdx INFO[934590]: FRR daemons did not change Jul 24 14:19:42.496311 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:19:42.551658 osdx WARNING[934664]: No supported link modes on interface eth0 Jul 24 14:19:42.553342 osdx modulelauncher[934664]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:19:42.553356 osdx modulelauncher[934664]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:19:42.554828 osdx modulelauncher[934664]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:19:42.554837 osdx modulelauncher[934664]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:19:42.592706 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:42.594000 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:42.594177 osdx ulogd[934684]: registering plugin `NFCT' Jul 24 14:19:42.594228 osdx ulogd[934684]: registering plugin `IP2STR' Jul 24 14:19:42.594337 osdx ulogd[934684]: registering plugin `PRINTFLOW' Jul 24 14:19:42.594393 osdx ulogd[934684]: registering plugin `SYSLOG' Jul 24 14:19:42.594397 osdx ulogd[934684]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:42.594460 osdx ulogd[934684]: NFCT plugin working in event mode Jul 24 14:19:42.594471 osdx OSDx_DUT0[934684]: Changing UID / GID Jul 24 14:19:42.594577 osdx OSDx_DUT0[934684]: initialization finished, entering main loop Jul 24 14:19:42.769165 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:19:42.769712 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:19:42.785271 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:19:43.912498 osdx OSDx_DUT0[934684]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:43.912522 osdx OSDx_DUT0[934684]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:44.053609 osdx OSDx_DUT0[934684]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:44.053634 osdx OSDx_DUT0[934684]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0
Note
If the identity is not provided, “ulogd” will be used by default.
Step 6: Modify the following configuration lines in DUT0 :
delete system conntrack logging identity
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.536 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.536/0.536/0.536/0.000 ms
Step 8: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*SRC=192.168.100.2Show output
Jul 24 14:19:41.338062 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:19:41.340256 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:19:41.340327 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:19:41.349648 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:19:41.594228 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:19:41.913636 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:19:42.030445 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:19:42.101193 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:19:42.221063 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging identity OSDx_DUT0'. Jul 24 14:19:42.319088 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:19:42.439538 osdx ubnt-cfgd[934581]: inactive Jul 24 14:19:42.461981 osdx INFO[934590]: FRR daemons did not change Jul 24 14:19:42.496311 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:19:42.551658 osdx WARNING[934664]: No supported link modes on interface eth0 Jul 24 14:19:42.553342 osdx modulelauncher[934664]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:19:42.553356 osdx modulelauncher[934664]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:19:42.554828 osdx modulelauncher[934664]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:19:42.554837 osdx modulelauncher[934664]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:19:42.592706 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:42.594000 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:42.594177 osdx ulogd[934684]: registering plugin `NFCT' Jul 24 14:19:42.594228 osdx ulogd[934684]: registering plugin `IP2STR' Jul 24 14:19:42.594337 osdx ulogd[934684]: registering plugin `PRINTFLOW' Jul 24 14:19:42.594393 osdx ulogd[934684]: registering plugin `SYSLOG' Jul 24 14:19:42.594397 osdx ulogd[934684]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:42.594460 osdx ulogd[934684]: NFCT plugin working in event mode Jul 24 14:19:42.594471 osdx OSDx_DUT0[934684]: Changing UID / GID Jul 24 14:19:42.594577 osdx OSDx_DUT0[934684]: initialization finished, entering main loop Jul 24 14:19:42.769165 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:19:42.769712 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:19:42.785271 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:19:43.912498 osdx OSDx_DUT0[934684]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:43.912522 osdx OSDx_DUT0[934684]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:44.053609 osdx OSDx_DUT0[934684]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:44.053634 osdx OSDx_DUT0[934684]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:44.156041 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'. Jul 24 14:19:44.319974 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:19:44.390257 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'delete system conntrack logging identity'. Jul 24 14:19:44.495090 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show changes'. Jul 24 14:19:44.564345 osdx ubnt-cfgd[934736]: inactive Jul 24 14:19:44.590334 osdx INFO[934743]: FRR daemons did not change Jul 24 14:19:44.602593 osdx OSDx_DUT0[934684]: Terminal signal received, exiting Jul 24 14:19:44.602645 osdx systemd[1]: Stopping ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:44.603308 osdx systemd[1]: ulogd2.service: Deactivated successfully. Jul 24 14:19:44.603428 osdx systemd[1]: Stopped ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:44.628685 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:44.629672 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:44.629853 osdx ulogd[934751]: registering plugin `NFCT' Jul 24 14:19:44.629901 osdx ulogd[934751]: registering plugin `IP2STR' Jul 24 14:19:44.629944 osdx ulogd[934751]: registering plugin `PRINTFLOW' Jul 24 14:19:44.629992 osdx ulogd[934751]: registering plugin `SYSLOG' Jul 24 14:19:44.629996 osdx ulogd[934751]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:44.630051 osdx ulogd[934751]: NFCT plugin working in event mode Jul 24 14:19:44.630061 osdx ulogd[934751]: Changing UID / GID Jul 24 14:19:44.630146 osdx ulogd[934751]: initialization finished, entering main loop Jul 24 14:19:44.639754 osdx ulogd[934751]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 Jul 24 14:19:44.639773 osdx ulogd[934751]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 Jul 24 14:19:44.640254 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:19:44.640831 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:19:44.662949 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:19:44.829611 osdx ulogd[934751]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:19:44.829635 osdx ulogd[934751]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0
Policies logging
Description
Set a simple configuration with mark and label traffic policies,
send a ping command from one device to other
and check that default, mark and label fields appear when running system journal show.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 traffic policy in POLICY set system conntrack logging events all set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label TEST set traffic policy POLICY rule 1 set connmark 33 set traffic policy POLICY rule 1 set label TEST
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.695 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.695/0.695/0.695/0.000 ms
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 2 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.514 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.381 ms --- 192.168.100.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1010ms rtt min/avg/max/mdev = 0.381/0.447/0.514/0.066 ms
Step 5: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*MARK=33.*LABELS=TESTShow output
Jul 24 14:19:51.302479 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:19:51.304383 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:19:51.304434 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:19:51.312003 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:19:51.522047 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:19:51.737867 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:19:51.830902 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic policy in POLICY'. Jul 24 14:19:51.891656 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic label TEST'. Jul 24 14:19:51.983130 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy POLICY rule 1 set connmark 33'. Jul 24 14:19:52.037974 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy POLICY rule 1 set label TEST'. Jul 24 14:19:52.132439 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:19:52.185200 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:19:52.290520 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:19:52.350125 osdx ubnt-cfgd[934976]: inactive Jul 24 14:19:52.387865 osdx INFO[934995]: FRR daemons did not change Jul 24 14:19:52.420385 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:19:52.467495 osdx WARNING[935069]: No supported link modes on interface eth0 Jul 24 14:19:52.468933 osdx modulelauncher[935069]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:19:52.468944 osdx modulelauncher[935069]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:19:52.470132 osdx modulelauncher[935069]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:19:52.470139 osdx modulelauncher[935069]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:19:52.508638 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:52.509365 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:52.509514 osdx ulogd[935089]: registering plugin `NFCT' Jul 24 14:19:52.509551 osdx ulogd[935089]: registering plugin `IP2STR' Jul 24 14:19:52.509583 osdx ulogd[935089]: registering plugin `PRINTFLOW' Jul 24 14:19:52.509621 osdx ulogd[935089]: registering plugin `SYSLOG' Jul 24 14:19:52.509624 osdx ulogd[935089]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:52.509663 osdx ulogd[935089]: NFCT plugin working in event mode Jul 24 14:19:52.509671 osdx ulogd[935089]: Changing UID / GID Jul 24 14:19:52.509743 osdx ulogd[935089]: initialization finished, entering main loop Jul 24 14:19:52.518956 osdx ulogd[935089]: Terminal signal received, exiting Jul 24 14:19:52.519040 osdx systemd[1]: Stopping ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:52.519262 osdx systemd[1]: ulogd2.service: Deactivated successfully. Jul 24 14:19:52.519359 osdx systemd[1]: Stopped ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:52.520296 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:19:52.521345 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:19:52.521407 osdx ulogd[935095]: registering plugin `NFCT' Jul 24 14:19:52.521594 osdx ulogd[935095]: registering plugin `IP2STR' Jul 24 14:19:52.521631 osdx ulogd[935095]: registering plugin `PRINTFLOW' Jul 24 14:19:52.521674 osdx ulogd[935095]: registering plugin `SYSLOG' Jul 24 14:19:52.521710 osdx ulogd[935095]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:19:52.521750 osdx ulogd[935095]: NFCT plugin working in event mode Jul 24 14:19:52.521784 osdx ulogd[935095]: Changing UID / GID Jul 24 14:19:52.521851 osdx ulogd[935095]: initialization finished, entering main loop Jul 24 14:19:52.910123 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:19:52.910632 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:19:52.928526 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:19:54.027612 osdx ulogd[935095]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 MARK=33 LABELS=TEST Jul 24 14:19:54.027636 osdx ulogd[935095]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 MARK=33 Jul 24 14:19:54.133577 osdx ulogd[935095]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 MARK=33 LABELS=TEST Jul 24 14:19:54.133601 osdx ulogd[935095]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 MARK=33
VRF logging
Description
Set a simple configuration with a vrf,
send a ping command from one device to other
and check that default and vrf fields appear when running system journal show.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 vrf RED set protocols vrf RED static route 0.0.0.0/0 next-hop 192.168.100.2 set system conntrack logging events all set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf RED
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.955 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.955/0.955/0.955/0.000 ms
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.479 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.479/0.479/0.479/0.000 ms
Step 5: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*VRF=REDShow output
Jul 24 14:20:00.319570 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:00.323017 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:00.323082 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:00.329977 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:00.542981 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:00.767349 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:00.864922 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 vrf RED'. Jul 24 14:20:00.940959 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set protocols vrf RED static route 0.0.0.0/0 next-hop 192.168.100.2'. Jul 24 14:20:01.066139 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system vrf RED'. Jul 24 14:20:01.143281 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:20:01.245583 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:20:01.320941 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:01.405345 osdx ubnt-cfgd[935397]: inactive Jul 24 14:20:01.430801 osdx INFO[935406]: FRR daemons did not change Jul 24 14:20:01.442050 osdx (udev-worker)[935416]: RED: Could not disable auto negotiation, ignoring: Operation not supported Jul 24 14:20:01.442078 osdx (udev-worker)[935416]: Network interface NamePolicy= disabled on kernel command line. Jul 24 14:20:01.479100 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:01.529764 osdx WARNING[935501]: No supported link modes on interface eth0 Jul 24 14:20:01.531517 osdx modulelauncher[935501]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:01.531529 osdx modulelauncher[935501]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:01.532730 osdx modulelauncher[935501]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:01.532738 osdx modulelauncher[935501]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:01.547018 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:01.639348 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:01.640128 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:01.640351 osdx ulogd[935582]: registering plugin `NFCT' Jul 24 14:20:01.640398 osdx ulogd[935582]: registering plugin `IP2STR' Jul 24 14:20:01.640442 osdx ulogd[935582]: registering plugin `PRINTFLOW' Jul 24 14:20:01.640489 osdx ulogd[935582]: registering plugin `SYSLOG' Jul 24 14:20:01.640493 osdx ulogd[935582]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:01.640544 osdx ulogd[935582]: NFCT plugin working in event mode Jul 24 14:20:01.640552 osdx ulogd[935582]: Changing UID / GID Jul 24 14:20:01.640637 osdx ulogd[935582]: initialization finished, entering main loop Jul 24 14:20:01.809349 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:01.819370 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:01.841562 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:03.199190 osdx ulogd[935582]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 VRF=RED PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 VRF=RED PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:03.199216 osdx ulogd[935582]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 VRF=RED PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 VRF=RED PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:03.307443 osdx ulogd[935582]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 VRF=RED PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 VRF=RED PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:03.307468 osdx ulogd[935582]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 VRF=RED PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 VRF=RED PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0
Not-Bypass logging
Description
Set a simple configuration with a firewall service,
send a ping command from one device to other
and check that default and bypass fields appear when running system journal show.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.406 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.406/0.406/0.406/0.000 ms
Step 3: Run the command file copy http://10.215.168.1/~robot/test-performance.rules running:// force on DUT0 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 266 100 266 0 0 19219 0 --:--:-- --:--:-- --:--:-- 20461
Step 4: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 traffic policy in POLICY set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set system conntrack logging events all set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy POLICY rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 5: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=1.73 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.727/1.727/1.727/0.000 ms
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.700 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.700/0.700/0.700/0.000 ms
Step 8: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*Sc: not-bypassShow output
Jul 24 14:20:09.305115 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:09.307788 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:09.307836 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:09.314318 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:09.587185 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:09.843906 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:09.934806 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 24 14:20:10.045164 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:10.111046 osdx ubnt-cfgd[935921]: inactive Jul 24 14:20:10.138635 osdx INFO[935930]: FRR daemons did not change Jul 24 14:20:10.171805 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:10.225743 osdx WARNING[936001]: No supported link modes on interface eth0 Jul 24 14:20:10.227606 osdx modulelauncher[936001]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:10.227621 osdx modulelauncher[936001]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:10.229640 osdx modulelauncher[936001]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:10.229652 osdx modulelauncher[936001]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:10.417343 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:10.417913 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:10.460845 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:10.634400 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jul 24 14:20:10.821442 osdx file_operation[936068]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Jul 24 14:20:10.870170 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Jul 24 14:20:11.024758 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:11.119094 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic policy in POLICY'. Jul 24 14:20:11.232288 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Jul 24 14:20:11.291126 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Jul 24 14:20:11.386570 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass'. Jul 24 14:20:11.451372 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Jul 24 14:20:11.569235 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Jul 24 14:20:11.633367 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass set-connmark'. Jul 24 14:20:11.731701 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Jul 24 14:20:11.790850 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy POLICY rule 1 action enqueue FW_Q'. Jul 24 14:20:11.920889 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:20:11.974767 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:20:12.094472 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:12.174832 osdx ubnt-cfgd[936103]: inactive Jul 24 14:20:12.221257 osdx INFO[936125]: FRR daemons did not change Jul 24 14:20:12.276059 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:12.276965 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:12.277101 osdx ulogd[936165]: registering plugin `NFCT' Jul 24 14:20:12.277140 osdx ulogd[936165]: registering plugin `IP2STR' Jul 24 14:20:12.277172 osdx ulogd[936165]: registering plugin `PRINTFLOW' Jul 24 14:20:12.277208 osdx ulogd[936165]: registering plugin `SYSLOG' Jul 24 14:20:12.277211 osdx ulogd[936165]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:12.277251 osdx ulogd[936165]: NFCT plugin working in event mode Jul 24 14:20:12.277258 osdx ulogd[936165]: Changing UID / GID Jul 24 14:20:12.277324 osdx ulogd[936165]: initialization finished, entering main loop Jul 24 14:20:12.420705 osdx ulogd[936165]: Terminal signal received, exiting Jul 24 14:20:12.420820 osdx systemd[1]: Stopping ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:12.421093 osdx systemd[1]: ulogd2.service: Deactivated successfully. Jul 24 14:20:12.421188 osdx systemd[1]: Stopped ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:12.440095 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:12.440926 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:12.441053 osdx ulogd[936189]: registering plugin `NFCT' Jul 24 14:20:12.441098 osdx ulogd[936189]: registering plugin `IP2STR' Jul 24 14:20:12.441137 osdx ulogd[936189]: registering plugin `PRINTFLOW' Jul 24 14:20:12.441182 osdx ulogd[936189]: registering plugin `SYSLOG' Jul 24 14:20:12.441186 osdx ulogd[936189]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:12.441237 osdx ulogd[936189]: NFCT plugin working in event mode Jul 24 14:20:12.441246 osdx ulogd[936189]: Changing UID / GID Jul 24 14:20:12.441321 osdx ulogd[936189]: initialization finished, entering main loop Jul 24 14:20:12.494664 osdx systemd[1]: Reloading. Jul 24 14:20:12.551787 osdx systemd-sysv-generator[936211]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Jul 24 14:20:12.684171 osdx systemd[1]: Starting logrotate.service - Rotate log files... Jul 24 14:20:12.688542 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Jul 24 14:20:12.705680 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Jul 24 14:20:12.707997 osdx systemd[1]: logrotate.service: Deactivated successfully. Jul 24 14:20:12.708105 osdx systemd[1]: Finished logrotate.service - Rotate log files. Jul 24 14:20:13.175616 osdx INFO[936191]: Rules successfully loaded Jul 24 14:20:13.227004 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:13.227536 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:13.251837 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:14.317848 osdx ulogd[936189]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 (Sc: not-bypass) Jul 24 14:20:14.317871 osdx ulogd[936189]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 (Sc: not-bypass) Jul 24 14:20:14.449961 osdx ulogd[936189]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 (Sc: not-bypass) Jul 24 14:20:14.449986 osdx ulogd[936189]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 (Sc: not-bypass)
Offload flag
Description
Set a simple configuration with DUT0 as an intermediary between DUT1
and DUT2. Initiate a ssh connection from DUT1 to DUT2
and check that default and offload fields appear when running system journal show.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set interfaces ethernet eth0 address 192.168.200.1/24 set system conntrack logging events all set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Set the following configuration in DUT2 :
set interfaces ethernet eth0 address 192.168.200.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.200.1 set service ssh set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.838 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.838/0.838/0.838/0.000 ms
Step 5: Ping the IP address 192.168.200.1 from DUT2:
admin@DUT2$ ping 192.168.200.1 count 1 size 56 timeout 1Show output
PING 192.168.200.1 (192.168.200.1) 56(84) bytes of data. 64 bytes from 192.168.200.1: icmp_seq=1 ttl=64 time=0.392 ms --- 192.168.200.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.392/0.392/0.392/0.000 ms
Step 6: Initiate an SSH connection from DUT1 to IP address 192.168.200.2 using user admin:
admin@DUT1$ ssh admin@192.168.200.2 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/nullShow output
Warning: Permanently added '192.168.200.2' (ECDSA) to the list of known hosts. admin@192.168.200.2's password: Welcome to Teldat OSDx v4.2.10.3 This system includes free software. Contact Teldat for licenses information and source code. Last login: Fri Jul 24 14:13:45 2026 from 10.215.168.64 admin@osdx$
Step 7: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*\[OFFLOAD\]Show output
Jul 24 14:20:22.335528 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:22.336674 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:22.336736 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:22.347523 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:22.574389 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:22.791082 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:22.929155 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.200.1/24'. Jul 24 14:20:22.989198 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:20:23.094738 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:20:23.182602 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:23.286500 osdx ubnt-cfgd[936532]: inactive Jul 24 14:20:23.326257 osdx INFO[936541]: FRR daemons did not change Jul 24 14:20:23.364690 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:23.421571 osdx WARNING[936618]: No supported link modes on interface eth0 Jul 24 14:20:23.423053 osdx modulelauncher[936618]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:23.423067 osdx modulelauncher[936618]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:23.424594 osdx modulelauncher[936618]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:23.424604 osdx modulelauncher[936618]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:23.484987 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:23.486013 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:23.486210 osdx ulogd[936638]: registering plugin `NFCT' Jul 24 14:20:23.486257 osdx ulogd[936638]: registering plugin `IP2STR' Jul 24 14:20:23.486299 osdx ulogd[936638]: registering plugin `PRINTFLOW' Jul 24 14:20:23.486348 osdx ulogd[936638]: registering plugin `SYSLOG' Jul 24 14:20:23.486353 osdx ulogd[936638]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:23.486405 osdx ulogd[936638]: NFCT plugin working in event mode Jul 24 14:20:23.486414 osdx ulogd[936638]: Changing UID / GID Jul 24 14:20:23.486502 osdx ulogd[936638]: initialization finished, entering main loop Jul 24 14:20:23.662631 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:23.663279 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:23.694378 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:26.201432 osdx ulogd[936638]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:26.201454 osdx ulogd[936638]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:26.297038 osdx ulogd[936638]: [NEW] ORIG: SRC=192.168.200.2 DST=192.168.200.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.1 DST=192.168.200.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:26.297058 osdx ulogd[936638]: [UPDATE] ORIG: SRC=192.168.200.2 DST=192.168.200.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.1 DST=192.168.200.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:26.391215 osdx ulogd[936638]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.200.2 PROTO=TCP SPT=44300 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.2 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=44300 PKTS=0 BYTES=0 Jul 24 14:20:26.391371 osdx ulogd[936638]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.200.2 PROTO=TCP SPT=44300 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.2 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=44300 PKTS=0 BYTES=0 Jul 24 14:20:26.391546 osdx ulogd[936638]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.200.2 PROTO=TCP SPT=44300 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.2 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=44300 PKTS=0 BYTES=0 [OFFLOAD] Jul 24 14:20:26.701272 osdx ulogd[936638]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.200.2 PROTO=TCP SPT=44300 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.2 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=44300 PKTS=0 BYTES=0 Jul 24 14:20:26.701382 osdx ulogd[936638]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.200.2 PROTO=TCP SPT=44300 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.2 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=44300 PKTS=0 BYTES=0 Jul 24 14:20:26.702916 osdx ulogd[936638]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.200.2 PROTO=TCP SPT=44300 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.2 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=44300 PKTS=0 BYTES=0 Jul 24 14:20:26.703108 osdx ulogd[936638]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.200.2 PROTO=TCP SPT=44300 DPT=22 PKTS=0 BYTES=0 , REPLY: SRC=192.168.200.2 DST=192.168.100.2 PROTO=TCP SPT=22 DPT=44300 PKTS=0 BYTES=0 [OFFLOAD]
App detect logging
Description
Set a simple configuration enabling app detection in system conntrack, send a ping command from DUT1
and check app detect field appears when running system journal show. After that, enabling app detection
in system conntrack for http host, try to copy index.html from a http server
and check that the app detect field appears and belongs to the http server when running system journal show.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set system conntrack app-detect set system conntrack logging events all set system conntrack timeout icmp 1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.629 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.629/0.629/0.629/0.000 ms
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 3 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.266 ms 64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.292 ms 64 bytes from 192.168.100.1: icmp_seq=3 ttl=64 time=0.289 ms --- 192.168.100.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2027ms rtt min/avg/max/mdev = 0.266/0.282/0.292/0.011 ms
Step 5: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[NEW\].*APPDETECT\[L3:1\]Show output
Jul 24 14:20:32.303600 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:32.307162 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:32.307232 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:32.317065 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:32.536476 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:32.743944 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:32.801537 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect'. Jul 24 14:20:32.895737 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack timeout icmp 1'. Jul 24 14:20:32.981123 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:20:33.043884 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:20:33.151683 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:33.214843 osdx ubnt-cfgd[936894]: inactive Jul 24 14:20:33.239166 osdx INFO[936903]: FRR daemons did not change Jul 24 14:20:33.323157 osdx kernel: nfUDPlink: module init Jul 24 14:20:33.323226 osdx kernel: app-detect: module init Jul 24 14:20:33.323245 osdx kernel: app-detect: registered: sysctl net.appdetect Jul 24 14:20:33.323263 osdx kernel: nfUDPlink: connected 127.0.0.1:49000 Jul 24 14:20:33.323276 osdx kernel: nfUDPlink: added destination 127.0.0.1:49000 Jul 24 14:20:33.323287 osdx kernel: app-detect: registered: /proc/net/stat/appdetect Jul 24 14:20:33.323299 osdx kernel: app-detect: expression init Jul 24 14:20:33.323310 osdx kernel: app-detect: appid cache initialized (override=yes, chained=yes) Jul 24 14:20:33.323321 osdx kernel: app-detect: cache changes counter set appid_changes_count found (klen=4, dlen=4) Jul 24 14:20:33.331970 osdx modulelauncher[936906]: AppDetect: no appdetect_chain refresh needed, nothing more to do Jul 24 14:20:33.334516 osdx INFO[936931]: Stopping Traffic Categorization (TCATD) service ... Jul 24 14:20:33.391154 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:33.439041 osdx WARNING[937008]: No supported link modes on interface eth0 Jul 24 14:20:33.440527 osdx modulelauncher[937008]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:33.440541 osdx modulelauncher[937008]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:33.441799 osdx modulelauncher[937008]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:33.441809 osdx modulelauncher[937008]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:33.491731 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:33.492801 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:33.493020 osdx ulogd[937028]: registering plugin `NFCT' Jul 24 14:20:33.493070 osdx ulogd[937028]: registering plugin `IP2STR' Jul 24 14:20:33.493206 osdx ulogd[937028]: registering plugin `PRINTFLOW' Jul 24 14:20:33.493259 osdx ulogd[937028]: registering plugin `SYSLOG' Jul 24 14:20:33.493264 osdx ulogd[937028]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:33.493321 osdx ulogd[937028]: NFCT plugin working in event mode Jul 24 14:20:33.493333 osdx ulogd[937028]: Changing UID / GID Jul 24 14:20:33.493492 osdx ulogd[937028]: initialization finished, entering main loop Jul 24 14:20:33.701223 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:33.701722 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:33.717544 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:34.756628 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.756652 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.835594 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.835618 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:35.838561 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:35.838586 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:35.838602 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.007429 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:36.862560 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:36.862589 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.862605 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1]
Step 6: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[UPDATE\].*APPDETECT\[L3:1\]Show output
Jul 24 14:20:32.303600 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:32.307162 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:32.307232 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:32.317065 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:32.536476 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:32.743944 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:32.801537 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect'. Jul 24 14:20:32.895737 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack timeout icmp 1'. Jul 24 14:20:32.981123 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:20:33.043884 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:20:33.151683 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:33.214843 osdx ubnt-cfgd[936894]: inactive Jul 24 14:20:33.239166 osdx INFO[936903]: FRR daemons did not change Jul 24 14:20:33.323157 osdx kernel: nfUDPlink: module init Jul 24 14:20:33.323226 osdx kernel: app-detect: module init Jul 24 14:20:33.323245 osdx kernel: app-detect: registered: sysctl net.appdetect Jul 24 14:20:33.323263 osdx kernel: nfUDPlink: connected 127.0.0.1:49000 Jul 24 14:20:33.323276 osdx kernel: nfUDPlink: added destination 127.0.0.1:49000 Jul 24 14:20:33.323287 osdx kernel: app-detect: registered: /proc/net/stat/appdetect Jul 24 14:20:33.323299 osdx kernel: app-detect: expression init Jul 24 14:20:33.323310 osdx kernel: app-detect: appid cache initialized (override=yes, chained=yes) Jul 24 14:20:33.323321 osdx kernel: app-detect: cache changes counter set appid_changes_count found (klen=4, dlen=4) Jul 24 14:20:33.331970 osdx modulelauncher[936906]: AppDetect: no appdetect_chain refresh needed, nothing more to do Jul 24 14:20:33.334516 osdx INFO[936931]: Stopping Traffic Categorization (TCATD) service ... Jul 24 14:20:33.391154 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:33.439041 osdx WARNING[937008]: No supported link modes on interface eth0 Jul 24 14:20:33.440527 osdx modulelauncher[937008]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:33.440541 osdx modulelauncher[937008]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:33.441799 osdx modulelauncher[937008]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:33.441809 osdx modulelauncher[937008]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:33.491731 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:33.492801 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:33.493020 osdx ulogd[937028]: registering plugin `NFCT' Jul 24 14:20:33.493070 osdx ulogd[937028]: registering plugin `IP2STR' Jul 24 14:20:33.493206 osdx ulogd[937028]: registering plugin `PRINTFLOW' Jul 24 14:20:33.493259 osdx ulogd[937028]: registering plugin `SYSLOG' Jul 24 14:20:33.493264 osdx ulogd[937028]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:33.493321 osdx ulogd[937028]: NFCT plugin working in event mode Jul 24 14:20:33.493333 osdx ulogd[937028]: Changing UID / GID Jul 24 14:20:33.493492 osdx ulogd[937028]: initialization finished, entering main loop Jul 24 14:20:33.701223 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:33.701722 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:33.717544 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:34.756628 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.756652 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.835594 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.835618 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:35.838561 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:35.838586 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:35.838602 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.007429 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:36.862560 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:36.862589 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.862605 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.973341 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'.
Step 7: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[DESTROY\].*APPDETECT\[L3:1\]Show output
Jul 24 14:20:32.303600 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:32.307162 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:32.307232 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:32.317065 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:32.536476 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:32.743944 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:32.801537 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect'. Jul 24 14:20:32.895737 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack timeout icmp 1'. Jul 24 14:20:32.981123 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:20:33.043884 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:20:33.151683 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:33.214843 osdx ubnt-cfgd[936894]: inactive Jul 24 14:20:33.239166 osdx INFO[936903]: FRR daemons did not change Jul 24 14:20:33.323157 osdx kernel: nfUDPlink: module init Jul 24 14:20:33.323226 osdx kernel: app-detect: module init Jul 24 14:20:33.323245 osdx kernel: app-detect: registered: sysctl net.appdetect Jul 24 14:20:33.323263 osdx kernel: nfUDPlink: connected 127.0.0.1:49000 Jul 24 14:20:33.323276 osdx kernel: nfUDPlink: added destination 127.0.0.1:49000 Jul 24 14:20:33.323287 osdx kernel: app-detect: registered: /proc/net/stat/appdetect Jul 24 14:20:33.323299 osdx kernel: app-detect: expression init Jul 24 14:20:33.323310 osdx kernel: app-detect: appid cache initialized (override=yes, chained=yes) Jul 24 14:20:33.323321 osdx kernel: app-detect: cache changes counter set appid_changes_count found (klen=4, dlen=4) Jul 24 14:20:33.331970 osdx modulelauncher[936906]: AppDetect: no appdetect_chain refresh needed, nothing more to do Jul 24 14:20:33.334516 osdx INFO[936931]: Stopping Traffic Categorization (TCATD) service ... Jul 24 14:20:33.391154 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:33.439041 osdx WARNING[937008]: No supported link modes on interface eth0 Jul 24 14:20:33.440527 osdx modulelauncher[937008]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:33.440541 osdx modulelauncher[937008]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:33.441799 osdx modulelauncher[937008]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:33.441809 osdx modulelauncher[937008]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:33.491731 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:33.492801 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:33.493020 osdx ulogd[937028]: registering plugin `NFCT' Jul 24 14:20:33.493070 osdx ulogd[937028]: registering plugin `IP2STR' Jul 24 14:20:33.493206 osdx ulogd[937028]: registering plugin `PRINTFLOW' Jul 24 14:20:33.493259 osdx ulogd[937028]: registering plugin `SYSLOG' Jul 24 14:20:33.493264 osdx ulogd[937028]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:33.493321 osdx ulogd[937028]: NFCT plugin working in event mode Jul 24 14:20:33.493333 osdx ulogd[937028]: Changing UID / GID Jul 24 14:20:33.493492 osdx ulogd[937028]: initialization finished, entering main loop Jul 24 14:20:33.701223 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:33.701722 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:33.717544 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:34.756628 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.756652 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.835594 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.835618 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:35.838561 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:35.838586 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:35.838602 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.007429 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:36.862560 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:36.862589 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.862605 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.973341 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'. Jul 24 14:20:37.089971 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'.
Step 8: Modify the following configuration lines in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set system conntrack app-detect http-host
Step 9: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.556 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.556/0.556/0.556/0.000 ms
Step 10: Run the command file copy http://10.215.168.1/~robot/ running://index.html force on DUT0 and expect the following output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 4573 0 4573 0 0 681k 0 --:--:-- --:--:-- --:--:-- 744k
Step 11: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
ulogd\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*APPDETECT\[L4:80 http-host:10.215.168.1\]Show output
Jul 24 14:20:32.303600 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:32.307162 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:32.307232 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:32.317065 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:32.536476 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:32.743944 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:32.801537 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect'. Jul 24 14:20:32.895737 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack timeout icmp 1'. Jul 24 14:20:32.981123 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:20:33.043884 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:20:33.151683 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:33.214843 osdx ubnt-cfgd[936894]: inactive Jul 24 14:20:33.239166 osdx INFO[936903]: FRR daemons did not change Jul 24 14:20:33.323157 osdx kernel: nfUDPlink: module init Jul 24 14:20:33.323226 osdx kernel: app-detect: module init Jul 24 14:20:33.323245 osdx kernel: app-detect: registered: sysctl net.appdetect Jul 24 14:20:33.323263 osdx kernel: nfUDPlink: connected 127.0.0.1:49000 Jul 24 14:20:33.323276 osdx kernel: nfUDPlink: added destination 127.0.0.1:49000 Jul 24 14:20:33.323287 osdx kernel: app-detect: registered: /proc/net/stat/appdetect Jul 24 14:20:33.323299 osdx kernel: app-detect: expression init Jul 24 14:20:33.323310 osdx kernel: app-detect: appid cache initialized (override=yes, chained=yes) Jul 24 14:20:33.323321 osdx kernel: app-detect: cache changes counter set appid_changes_count found (klen=4, dlen=4) Jul 24 14:20:33.331970 osdx modulelauncher[936906]: AppDetect: no appdetect_chain refresh needed, nothing more to do Jul 24 14:20:33.334516 osdx INFO[936931]: Stopping Traffic Categorization (TCATD) service ... Jul 24 14:20:33.391154 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:33.439041 osdx WARNING[937008]: No supported link modes on interface eth0 Jul 24 14:20:33.440527 osdx modulelauncher[937008]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:33.440541 osdx modulelauncher[937008]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:33.441799 osdx modulelauncher[937008]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:33.441809 osdx modulelauncher[937008]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:33.491731 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:33.492801 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:33.493020 osdx ulogd[937028]: registering plugin `NFCT' Jul 24 14:20:33.493070 osdx ulogd[937028]: registering plugin `IP2STR' Jul 24 14:20:33.493206 osdx ulogd[937028]: registering plugin `PRINTFLOW' Jul 24 14:20:33.493259 osdx ulogd[937028]: registering plugin `SYSLOG' Jul 24 14:20:33.493264 osdx ulogd[937028]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:33.493321 osdx ulogd[937028]: NFCT plugin working in event mode Jul 24 14:20:33.493333 osdx ulogd[937028]: Changing UID / GID Jul 24 14:20:33.493492 osdx ulogd[937028]: initialization finished, entering main loop Jul 24 14:20:33.701223 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:33.701722 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:33.717544 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:34.756628 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.756652 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.835594 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:34.835618 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:35.838561 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:35.838586 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:35.838602 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.007429 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:36.862560 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:36.862589 osdx ulogd[937028]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.862605 osdx ulogd[937028]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:36.973341 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'. Jul 24 14:20:37.089971 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'. Jul 24 14:20:37.213532 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal show | cat'. Jul 24 14:20:37.392583 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:37.479228 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 24 14:20:37.554878 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect http-host'. Jul 24 14:20:37.624428 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show changes'. Jul 24 14:20:37.726587 osdx ubnt-cfgd[937096]: inactive Jul 24 14:20:37.751510 osdx INFO[937105]: FRR daemons did not change Jul 24 14:20:37.787158 osdx kernel: app-detect: expression destroy Jul 24 14:20:37.795162 osdx kernel: app-detect: expression init Jul 24 14:20:37.795214 osdx kernel: app-detect: appid cache initialized (override=yes, chained=yes) Jul 24 14:20:37.795228 osdx kernel: app-detect: cache changes counter set appid_changes_count found (klen=4, dlen=4) Jul 24 14:20:37.802537 osdx modulelauncher[937108]: AppDetect: no appdetect_chain refresh needed, nothing more to do Jul 24 14:20:37.805273 osdx INFO[937124]: Stopping Traffic Categorization (TCATD) service ... Jul 24 14:20:37.900820 osdx ulogd[937028]: [DESTROY] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=1 BYTES=84 APPDETECT[L3:1] Jul 24 14:20:37.901205 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:37.901621 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:37.915846 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:38.092964 osdx ulogd[937028]: [NEW] ORIG: SRC=10.215.168.64 DST=10.215.168.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=10.215.168.1 DST=10.215.168.64 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:38.092987 osdx ulogd[937028]: [UPDATE] ORIG: SRC=10.215.168.64 DST=10.215.168.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=10.215.168.1 DST=10.215.168.64 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 APPDETECT[L3:1] Jul 24 14:20:38.094033 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jul 24 14:20:38.238224 osdx file_operation[937191]: using src url: http://10.215.168.1/~robot/ dst url: running://index.html Jul 24 14:20:38.244694 osdx ulogd[937028]: [NEW] ORIG: SRC=10.215.168.64 DST=10.215.168.1 PROTO=TCP SPT=44888 DPT=80 PKTS=0 BYTES=0 , REPLY: SRC=10.215.168.1 DST=10.215.168.64 PROTO=TCP SPT=80 DPT=44888 PKTS=0 BYTES=0 APPDETECT[L4:80] Jul 24 14:20:38.244824 osdx ulogd[937028]: [UPDATE] ORIG: SRC=10.215.168.64 DST=10.215.168.1 PROTO=TCP SPT=44888 DPT=80 PKTS=0 BYTES=0 , REPLY: SRC=10.215.168.1 DST=10.215.168.64 PROTO=TCP SPT=80 DPT=44888 PKTS=0 BYTES=0 APPDETECT[L4:80] Jul 24 14:20:38.244840 osdx ulogd[937028]: [UPDATE] ORIG: SRC=10.215.168.64 DST=10.215.168.1 PROTO=TCP SPT=44888 DPT=80 PKTS=0 BYTES=0 , REPLY: SRC=10.215.168.1 DST=10.215.168.64 PROTO=TCP SPT=80 DPT=44888 PKTS=0 BYTES=0 APPDETECT[L4:80] Jul 24 14:20:38.247198 osdx ulogd[937028]: [UPDATE] ORIG: SRC=10.215.168.64 DST=10.215.168.1 PROTO=TCP SPT=44888 DPT=80 PKTS=0 BYTES=0 , REPLY: SRC=10.215.168.1 DST=10.215.168.64 PROTO=TCP SPT=80 DPT=44888 PKTS=0 BYTES=0 APPDETECT[L4:80 http-host:10.215.168.1] Jul 24 14:20:38.247265 osdx ulogd[937028]: [UPDATE] ORIG: SRC=10.215.168.64 DST=10.215.168.1 PROTO=TCP SPT=44888 DPT=80 PKTS=0 BYTES=0 , REPLY: SRC=10.215.168.1 DST=10.215.168.64 PROTO=TCP SPT=80 DPT=44888 PKTS=0 BYTES=0 APPDETECT[L4:80 http-host:10.215.168.1] Jul 24 14:20:38.247301 osdx ulogd[937028]: [UPDATE] ORIG: SRC=10.215.168.64 DST=10.215.168.1 PROTO=TCP SPT=44888 DPT=80 PKTS=0 BYTES=0 , REPLY: SRC=10.215.168.1 DST=10.215.168.64 PROTO=TCP SPT=80 DPT=44888 PKTS=0 BYTES=0 APPDETECT[L4:80 http-host:10.215.168.1] Jul 24 14:20:38.266705 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/ running://index.html force'.
App Detect Drop Packet
Description
Set a traffic policy with action drop for all the packets matching an appid specified by a traffic selector.
Enable http-host and http-url option in system conntrack appdetect path in order to see relevant information about http packets.
Finnally, log that packets with app-id option and check that appdetect field appear in journal when
running system journal show
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic policy out DROP set system conntrack app-detect dictionary 130 local app-id custom 155 fqdn 10.215.168.1 set system conntrack app-detect enable_dict_match_priv_ip set system conntrack app-detect http-host set system conntrack app-detect http-url set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy DROP rule 1 action drop set traffic policy DROP rule 1 log app-id set traffic policy DROP rule 1 selector APPID set traffic selector APPID rule 1 app-detect app-id custom 155
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.604 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.604/0.604/0.604/0.000 ms
Step 3: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
osdx kernel:.*APPDETECT\[U6:155 http-url:/~robot/ http-host:10.215.168.1\]Show output
Jul 24 14:20:44.372876 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:44.375492 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:44.375573 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:44.383851 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:44.613317 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:44.843405 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:44.908571 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect dictionary 130 custom app-id 155 fqdn 10.215.168.1'. Jul 24 14:20:45.005562 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect enable_dict_match_priv_ip'. Jul 24 14:20:45.072566 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect http-url'. Jul 24 14:20:45.176247 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic selector APPID rule 1 app-detect app-id custom 155'. Jul 24 14:20:45.228260 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy DROP rule 1 selector APPID'. Jul 24 14:20:45.338918 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy DROP rule 1 action drop'. Jul 24 14:20:45.403810 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set traffic policy DROP rule 1 log app-id'. Jul 24 14:20:45.545417 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic policy out DROP'. Jul 24 14:20:45.596074 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 24 14:20:45.706406 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack app-detect http-host'. Jul 24 14:20:45.784016 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:45.883036 osdx ubnt-cfgd[937440]: inactive Jul 24 14:20:45.935314 osdx INFO[937469]: FRR daemons did not change Jul 24 14:20:46.035497 osdx kernel: nfUDPlink: module init Jul 24 14:20:46.035548 osdx kernel: app-detect: module init Jul 24 14:20:46.035557 osdx kernel: app-detect: registered: sysctl net.appdetect Jul 24 14:20:46.035565 osdx kernel: nfUDPlink: connected 127.0.0.1:49000 Jul 24 14:20:46.035572 osdx kernel: nfUDPlink: added destination 127.0.0.1:49000 Jul 24 14:20:46.035580 osdx kernel: app-detect: registered: /proc/net/stat/appdetect Jul 24 14:20:46.035588 osdx kernel: app-detect: expression init Jul 24 14:20:46.035600 osdx kernel: app-detect: appid cache initialized (override=yes, chained=yes) Jul 24 14:20:46.035608 osdx kernel: app-detect: cache changes counter set appid_changes_count found (klen=4, dlen=4) Jul 24 14:20:46.059520 osdx INFO[937504]: Updated /etc/default/osdx_tcatd.conf Jul 24 14:20:46.059564 osdx INFO[937504]: Restarting Traffic Categorization (TCATD) service ... Jul 24 14:20:46.091837 osdx systemd[1]: Starting osdx-tcatd.service - App-Detect Traffic Categorization daemon... Jul 24 14:20:46.098397 osdx systemd[1]: Started osdx-tcatd.service - App-Detect Traffic Categorization daemon. Jul 24 14:20:46.135519 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:46.181622 osdx WARNING[937580]: No supported link modes on interface eth0 Jul 24 14:20:46.183469 osdx modulelauncher[937580]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:46.183487 osdx modulelauncher[937580]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:46.185101 osdx modulelauncher[937580]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:46.185111 osdx modulelauncher[937580]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:46.572592 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:46.573100 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:46.588258 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:46.785692 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jul 24 14:20:46.939318 osdx file_operation[937670]: using src url: http://10.215.168.1/~robot/ dst url: running://index.html Jul 24 14:20:46.947503 osdx kernel: [DROP-1] DROP IN= OUT=eth0 SRC=10.215.168.64 DST=10.215.168.1 LEN=306 TOS=0x00 PREC=0x00 TTL=64 ID=5853 DF PROTO=TCP SPT=53288 DPT=80 WINDOW=502 RES=0x00 ACK PSH URGP=0 APPDETECT[U6:155 http-url:/~robot/ http-host:10.215.168.1] Jul 24 14:20:47.151505 osdx kernel: [DROP-1] DROP IN= OUT=eth0 SRC=10.215.168.64 DST=10.215.168.1 LEN=306 TOS=0x00 PREC=0x00 TTL=64 ID=5854 DF PROTO=TCP SPT=53288 DPT=80 WINDOW=502 RES=0x00 ACK PSH URGP=0 APPDETECT[U6:155 http-url:/~robot/ http-host:10.215.168.1] Jul 24 14:20:47.563516 osdx kernel: [DROP-1] DROP IN= OUT=eth0 SRC=10.215.168.64 DST=10.215.168.1 LEN=306 TOS=0x00 PREC=0x00 TTL=64 ID=5855 DF PROTO=TCP SPT=53288 DPT=80 WINDOW=502 RES=0x00 ACK PSH URGP=0 APPDETECT[U6:155 http-url:/~robot/ http-host:10.215.168.1] Jul 24 14:20:48.391562 osdx kernel: [DROP-1] DROP IN= OUT=eth0 SRC=10.215.168.64 DST=10.215.168.1 LEN=306 TOS=0x00 PREC=0x00 TTL=64 ID=5856 DF PROTO=TCP SPT=53288 DPT=80 WINDOW=502 RES=0x00 ACK PSH URGP=0 APPDETECT[U6:155 http-url:/~robot/ http-host:10.215.168.1] Jul 24 14:20:49.918874 osdx file_operation.py[937670]: Operation aborted by user. Jul 24 14:20:49.931494 osdx kernel: [DROP-1] DROP IN= OUT=eth0 SRC=10.215.168.64 DST=10.215.168.1 LEN=306 TOS=0x00 PREC=0x00 TTL=64 ID=5857 DF PROTO=TCP SPT=53288 DPT=80 WINDOW=502 RES=0x00 ACK PSH FIN URGP=0 APPDETECT[U6:155 http-url:/~robot/ http-host:10.215.168.1] Jul 24 14:20:49.937233 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/ running://index.html force'. Jul 24 14:20:50.027493 osdx kernel: [DROP-1] DROP IN= OUT=eth0 SRC=10.215.168.64 DST=10.215.168.1 LEN=306 TOS=0x00 PREC=0x00 TTL=64 ID=5858 DF PROTO=TCP SPT=53288 DPT=80 WINDOW=502 RES=0x00 ACK PSH FIN URGP=0 APPDETECT[U6:155 http-url:/~robot/ http-host:10.215.168.1]
Identity Values
Description
Conntrack identity is able to contain any printed character (max 92 characters) but not spaces
Scenario
Step 1: Run the command configure on DUT0 and expect the following output:
Show output
admin@osdx#
Step 2: Run the command set system conntrack logging identity "he||o w@rld!" on DUT0 and check whether the output contains the following tokens:
Identity name must be 92 characters or less and must contain printable characters except those defined as part of the space character classShow output
Identity name must be 92 characters or less and must contain printable characters except those defined as part of the space character class Value validation failed CLI Error: Command error
Step 3: Run the command set system conntrack logging identity Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-amet-vita on DUT0 and check whether the output contains the following tokens:
Identity name must be 92 characters or less and must contain printable characters except those defined as part of the space character classShow output
Identity name must be 92 characters or less and must contain printable characters except those defined as part of the space character class Value validation failed CLI Error: Command error
Step 4: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 192.168.100.1/24 set system conntrack logging events all set system conntrack logging identity Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 5: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 192.168.100.2/24 set protocols static route 0.0.0.0/0 next-hop 192.168.100.1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.749 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.749/0.749/0.749/0.000 ms
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.612 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.612/0.612/0.612/0.000 ms
Step 8: Run the command system journal show | cat on DUT0 and check whether the output matches the following regular expressions:
Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit\[.*\]:.*\[((NEW)|(UPDATE)|(DESTROY))\].*SRC=192.168.100.2Show output
Jul 24 14:20:55.319343 osdx systemd-journald[919354]: Runtime Journal (/run/log/journal/3a8dbab828fc40a183893e468c03e10b) is 1.8M, max 13.8M, 11.9M free. Jul 24 14:20:55.319783 osdx systemd-journald[919354]: Received client request to rotate journal, rotating. Jul 24 14:20:55.319817 osdx systemd-journald[919354]: Vacuuming done, freed 0B of archived journals from /run/log/journal/3a8dbab828fc40a183893e468c03e10b. Jul 24 14:20:55.328567 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system journal clear'. Jul 24 14:20:55.549762 osdx OSDxCLI[919171]: User 'admin' executed a new command: 'system coredump delete all'. Jul 24 14:20:55.806243 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:55.884410 osdx cfgd[1923]: [919171]Command output: Identity name must be 92 characters or less and must contain printable characters except those defined as part of the space character class Value validation failed Jul 24 14:20:55.885664 osdx OSDxCLI[919171]: User 'admin' entered an invalid command: 'set system conntrack logging identity "he||o w@rld!"'. Jul 24 14:20:55.962163 osdx cfgd[1923]: [919171]Command output: Identity name must be 92 characters or less and must contain printable characters except those defined as part of the space character class Value validation failed Jul 24 14:20:55.963379 osdx OSDxCLI[919171]: User 'admin' entered an invalid command: 'set system conntrack logging identity Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-amet-vita'. Jul 24 14:20:55.990940 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:56.163764 osdx OSDxCLI[919171]: User 'admin' entered the configuration menu. Jul 24 14:20:56.263655 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 192.168.100.1/24'. Jul 24 14:20:56.339306 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging events all'. Jul 24 14:20:56.494899 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'set system conntrack logging identity Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit'. Jul 24 14:20:56.620007 osdx OSDxCLI[919171]: User 'admin' added a new cfg line: 'show working'. Jul 24 14:20:56.752083 osdx ubnt-cfgd[937922]: inactive Jul 24 14:20:56.800399 osdx INFO[937931]: FRR daemons did not change Jul 24 14:20:56.835781 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 24 14:20:56.896566 osdx WARNING[938005]: No supported link modes on interface eth0 Jul 24 14:20:56.898219 osdx modulelauncher[938005]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Jul 24 14:20:56.898231 osdx modulelauncher[938005]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Jul 24 14:20:56.900041 osdx modulelauncher[938005]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Jul 24 14:20:56.900050 osdx modulelauncher[938005]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Jul 24 14:20:56.944975 osdx systemd[1]: Starting ulogd2.service - Netfilter Userspace Logging Daemon... Jul 24 14:20:56.946053 osdx systemd[1]: Started ulogd2.service - Netfilter Userspace Logging Daemon. Jul 24 14:20:56.946104 osdx ulogd[938025]: registering plugin `NFCT' Jul 24 14:20:56.946149 osdx ulogd[938025]: registering plugin `IP2STR' Jul 24 14:20:56.946193 osdx ulogd[938025]: registering plugin `PRINTFLOW' Jul 24 14:20:56.946242 osdx ulogd[938025]: registering plugin `SYSLOG' Jul 24 14:20:56.946246 osdx ulogd[938025]: building new pluginstance stack: 'ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,sys1:SYSLOG' Jul 24 14:20:56.946298 osdx ulogd[938025]: NFCT plugin working in event mode Jul 24 14:20:56.946309 osdx Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit[938025]: Changing UID / GID Jul 24 14:20:56.946395 osdx Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit[938025]: initialization finished, entering main loop Jul 24 14:20:57.122488 osdx cfgd[1923]: [919171]Completed change to active configuration Jul 24 14:20:57.123328 osdx OSDxCLI[919171]: User 'admin' committed the configuration. Jul 24 14:20:57.146897 osdx OSDxCLI[919171]: User 'admin' left the configuration menu. Jul 24 14:20:58.395998 osdx Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit[938025]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:58.396019 osdx Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit[938025]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:58.488420 osdx Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit[938025]: [NEW] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 Jul 24 14:20:58.488444 osdx Lorem-ipsum-dolor-sit-amet-consectetur-adipiscing-elit-quisque-lorem-ipsum-dolor-sit-ame-vit[938025]: [UPDATE] ORIG: SRC=192.168.100.2 DST=192.168.100.1 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0 , REPLY: SRC=192.168.100.1 DST=192.168.100.2 PROTO=ICMP TYPE=0 CODE=8 PKTS=0 BYTES=0