Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 8165 0 --:--:-- --:--:-- --:--:-- 8600
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.612 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.612/0.612/0.612/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.572 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.572/0.572/0.572/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 34796 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 62.0 MBytes 520 Mbits/sec 0 2.51 MBytes [ 5] 1.00-2.00 sec 83.8 MBytes 703 Mbits/sec 30 1.88 MBytes [ 5] 2.00-3.00 sec 93.8 MBytes 786 Mbits/sec 0 2.05 MBytes [ 5] 3.00-4.00 sec 100 MBytes 839 Mbits/sec 4 1.53 MBytes [ 5] 4.00-5.00 sec 104 MBytes 870 Mbits/sec 0 1.61 MBytes [ 5] 5.00-6.00 sec 101 MBytes 849 Mbits/sec 0 1.67 MBytes [ 5] 6.00-7.00 sec 82.5 MBytes 692 Mbits/sec 0 1.71 MBytes [ 5] 7.00-8.00 sec 50.0 MBytes 419 Mbits/sec 0 1.73 MBytes [ 5] 8.00-9.00 sec 50.0 MBytes 419 Mbits/sec 0 1.74 MBytes [ 5] 9.00-10.00 sec 50.0 MBytes 419 Mbits/sec 0 1.75 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 777 MBytes 652 Mbits/sec 34 sender [ 5] 0.00-10.02 sec 775 MBytes 649 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
06/24/2025-15:41:36.142991 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34786 -> 40.0.0.2:5001 06/24/2025-15:41:36.143974 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34796 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 8167 0 --:--:-- --:--:-- --:--:-- 8600
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.535 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.535/0.535/0.535/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.576 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.576/0.576/0.576/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 34708 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 53.6 MBytes 450 Mbits/sec 0 1.84 MBytes [ 5] 1.00-2.01 sec 152 MBytes 1.27 Gbits/sec 40 1.22 MBytes [ 5] 2.01-3.00 sec 245 MBytes 2.07 Gbits/sec 0 1.36 MBytes [ 5] 3.00-4.00 sec 261 MBytes 2.19 Gbits/sec 0 1.49 MBytes [ 5] 4.00-5.00 sec 268 MBytes 2.24 Gbits/sec 0 1.61 MBytes [ 5] 5.00-6.00 sec 252 MBytes 2.12 Gbits/sec 0 1.72 MBytes [ 5] 6.00-7.00 sec 221 MBytes 1.86 Gbits/sec 192 1.28 MBytes [ 5] 7.00-8.00 sec 224 MBytes 1.88 Gbits/sec 1 1.01 MBytes [ 5] 8.00-9.00 sec 232 MBytes 1.95 Gbits/sec 0 1.16 MBytes [ 5] 9.00-10.00 sec 255 MBytes 2.14 Gbits/sec 0 1.29 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.11 GBytes 1.82 Gbits/sec 233 sender [ 5] 0.00-10.00 sec 2.11 GBytes 1.81 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
06/24/2025-15:42:11.811577 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34700 -> 40.0.0.2:5001 06/24/2025-15:42:11.813361 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34708 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Jun 24 15:42:02.000458 osdx systemd-timedated[558441]: Changed local time to Tue 2025-06-24 15:42:02 UTC Jun 24 15:42:02.002468 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'set date 2025-06-24 15:42:02'. Jun 24 15:42:02.002918 osdx systemd-journald[165652]: Time jumped backwards, rotating. Jun 24 15:42:02.403959 osdx sudo[558445]: pam_limits(sudo:session): invalid line '@200:215 hard maxlogins ' - skipped Jun 24 15:42:02.407888 osdx systemd-journald[165652]: Runtime Journal (/run/log/journal/a9c8f5b24ca148a6b10e0198640df300) is 2.1M, max 15.3M, 13.2M free. Jun 24 15:42:02.410934 osdx systemd-journald[165652]: Received client request to rotate journal, rotating. Jun 24 15:42:02.411006 osdx systemd-journald[165652]: Vacuuming done, freed 0B of archived journals from /run/log/journal/a9c8f5b24ca148a6b10e0198640df300. Jun 24 15:42:02.412624 osdx sudo[558444]: pam_limits(sudo:session): invalid line '@200:215 hard maxlogins ' - skipped Jun 24 15:42:02.419904 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'system journal clear'. Jun 24 15:42:02.656465 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'system coredump delete all'. Jun 24 15:42:02.909204 osdx OSDxCLI[558020]: User 'admin' entered the configuration menu. Jun 24 15:42:02.991135 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jun 24 15:42:03.075641 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Jun 24 15:42:03.130218 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jun 24 15:42:03.244304 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Jun 24 15:42:03.323281 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Jun 24 15:42:03.436083 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Jun 24 15:42:03.530586 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'show working'. Jun 24 15:42:03.626127 osdx ubnt-cfgd[558473]: inactive Jun 24 15:42:03.656055 osdx INFO[558483]: FRR daemons did not change Jun 24 15:42:03.674922 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jun 24 15:42:03.742929 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Jun 24 15:42:03.766127 osdx (udev-worker)[558603]: Network interface NamePolicy= disabled on kernel command line. Jun 24 15:42:03.940203 osdx cfgd[1460]: [558020]Completed change to active configuration Jun 24 15:42:03.954411 osdx OSDxCLI[558020]: User 'admin' committed the configuration. Jun 24 15:42:03.973641 osdx OSDxCLI[558020]: User 'admin' left the configuration menu. Jun 24 15:42:06.555229 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jun 24 15:42:06.649672 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Jun 24 15:42:06.733726 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Jun 24 15:42:07.480849 osdx sudo[558759]: pam_limits(sudo:session): invalid line '@200:215 hard maxlogins ' - skipped Jun 24 15:42:07.554720 osdx file_operation[558762]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Jun 24 15:42:07.595223 osdx sudo[558769]: pam_limits(sudo:session): invalid line '@200:215 hard maxlogins ' - skipped Jun 24 15:42:07.597274 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Jun 24 15:42:07.789805 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Jun 24 15:42:08.053744 osdx OSDxCLI[558020]: User 'admin' entered the configuration menu. Jun 24 15:42:08.131230 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Jun 24 15:42:08.243280 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Jun 24 15:42:08.321210 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Jun 24 15:42:08.412808 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Jun 24 15:42:08.473515 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Jun 24 15:42:08.628728 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Jun 24 15:42:08.722404 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Jun 24 15:42:08.807571 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Jun 24 15:42:08.874303 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Jun 24 15:42:08.964555 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Jun 24 15:42:09.020380 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Jun 24 15:42:09.125189 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Jun 24 15:42:09.182340 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Jun 24 15:42:09.284069 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Jun 24 15:42:09.356472 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Jun 24 15:42:09.419718 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Jun 24 15:42:09.551790 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Jun 24 15:42:09.662873 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Jun 24 15:42:09.761764 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Jun 24 15:42:09.848615 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Jun 24 15:42:09.986706 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'show working'. Jun 24 15:42:10.101288 osdx ubnt-cfgd[558813]: inactive Jun 24 15:42:10.168543 osdx INFO[558850]: FRR daemons did not change Jun 24 15:42:10.439053 osdx systemd[1]: Reloading. Jun 24 15:42:10.474927 osdx systemd-sysv-generator[558903]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Jun 24 15:42:10.631499 osdx systemd[1]: Starting logrotate.service - Rotate log files... Jun 24 15:42:10.636145 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Jun 24 15:42:10.657872 osdx systemd[1]: logrotate.service: Deactivated successfully. Jun 24 15:42:10.658114 osdx systemd[1]: Finished logrotate.service - Rotate log files. Jun 24 15:42:10.659396 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Jun 24 15:42:10.859520 osdx INFO[558885]: Rules successfully loaded Jun 24 15:42:10.860087 osdx cfgd[1460]: [558020]Completed change to active configuration Jun 24 15:42:10.862165 osdx OSDxCLI[558020]: User 'admin' committed the configuration. Jun 24 15:42:11.449432 osdx OSDxCLI[558020]: User 'admin' left the configuration menu. Jun 24 15:42:11.815034 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=32103 DF PROTO=TCP SPT=34700 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jun 24 15:42:11.815122 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=57811 DF PROTO=TCP SPT=34708 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jun 24 15:42:22.183678 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 41408 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 254 MBytes 2.13 Gbits/sec 88 1.32 MBytes [ 5] 1.00-2.00 sec 262 MBytes 2.20 Gbits/sec 0 1.46 MBytes [ 5] 2.00-3.00 sec 260 MBytes 2.18 Gbits/sec 0 1.57 MBytes [ 5] 3.00-4.00 sec 280 MBytes 2.35 Gbits/sec 0 1.70 MBytes [ 5] 4.00-5.00 sec 268 MBytes 2.24 Gbits/sec 0 1.80 MBytes [ 5] 5.00-6.00 sec 272 MBytes 2.29 Gbits/sec 200 1.41 MBytes [ 5] 6.00-7.00 sec 291 MBytes 2.44 Gbits/sec 0 1.55 MBytes [ 5] 7.00-8.00 sec 284 MBytes 2.38 Gbits/sec 0 1.68 MBytes [ 5] 8.00-9.00 sec 278 MBytes 2.33 Gbits/sec 0 1.80 MBytes [ 5] 9.00-10.00 sec 231 MBytes 1.94 Gbits/sec 0 1.88 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.62 GBytes 2.25 Gbits/sec 288 sender [ 5] 0.00-10.00 sec 2.62 GBytes 2.25 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
06/24/2025-15:42:11.811577 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34700 -> 40.0.0.2:5001 06/24/2025-15:42:11.813361 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34708 -> 40.0.0.2:5001 06/24/2025-15:42:27.646592 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41394 -> 40.0.0.2:5001 06/24/2025-15:42:27.647797 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41408 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Jun 24 15:42:02.000458 osdx systemd-timedated[558441]: Changed local time to Tue 2025-06-24 15:42:02 UTC Jun 24 15:42:02.002468 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'set date 2025-06-24 15:42:02'. Jun 24 15:42:02.002918 osdx systemd-journald[165652]: Time jumped backwards, rotating. Jun 24 15:42:02.403959 osdx sudo[558445]: pam_limits(sudo:session): invalid line '@200:215 hard maxlogins ' - skipped Jun 24 15:42:02.407888 osdx systemd-journald[165652]: Runtime Journal (/run/log/journal/a9c8f5b24ca148a6b10e0198640df300) is 2.1M, max 15.3M, 13.2M free. Jun 24 15:42:02.410934 osdx systemd-journald[165652]: Received client request to rotate journal, rotating. Jun 24 15:42:02.411006 osdx systemd-journald[165652]: Vacuuming done, freed 0B of archived journals from /run/log/journal/a9c8f5b24ca148a6b10e0198640df300. Jun 24 15:42:02.412624 osdx sudo[558444]: pam_limits(sudo:session): invalid line '@200:215 hard maxlogins ' - skipped Jun 24 15:42:02.419904 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'system journal clear'. Jun 24 15:42:02.656465 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'system coredump delete all'. Jun 24 15:42:02.909204 osdx OSDxCLI[558020]: User 'admin' entered the configuration menu. Jun 24 15:42:02.991135 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jun 24 15:42:03.075641 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Jun 24 15:42:03.130218 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jun 24 15:42:03.244304 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Jun 24 15:42:03.323281 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Jun 24 15:42:03.436083 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Jun 24 15:42:03.530586 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'show working'. Jun 24 15:42:03.626127 osdx ubnt-cfgd[558473]: inactive Jun 24 15:42:03.656055 osdx INFO[558483]: FRR daemons did not change Jun 24 15:42:03.674922 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jun 24 15:42:03.742929 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Jun 24 15:42:03.766127 osdx (udev-worker)[558603]: Network interface NamePolicy= disabled on kernel command line. Jun 24 15:42:03.940203 osdx cfgd[1460]: [558020]Completed change to active configuration Jun 24 15:42:03.954411 osdx OSDxCLI[558020]: User 'admin' committed the configuration. Jun 24 15:42:03.973641 osdx OSDxCLI[558020]: User 'admin' left the configuration menu. Jun 24 15:42:06.555229 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jun 24 15:42:06.649672 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Jun 24 15:42:06.733726 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Jun 24 15:42:07.480849 osdx sudo[558759]: pam_limits(sudo:session): invalid line '@200:215 hard maxlogins ' - skipped Jun 24 15:42:07.554720 osdx file_operation[558762]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Jun 24 15:42:07.595223 osdx sudo[558769]: pam_limits(sudo:session): invalid line '@200:215 hard maxlogins ' - skipped Jun 24 15:42:07.597274 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Jun 24 15:42:07.789805 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Jun 24 15:42:08.053744 osdx OSDxCLI[558020]: User 'admin' entered the configuration menu. Jun 24 15:42:08.131230 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Jun 24 15:42:08.243280 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Jun 24 15:42:08.321210 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Jun 24 15:42:08.412808 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Jun 24 15:42:08.473515 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Jun 24 15:42:08.628728 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Jun 24 15:42:08.722404 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Jun 24 15:42:08.807571 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Jun 24 15:42:08.874303 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Jun 24 15:42:08.964555 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Jun 24 15:42:09.020380 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Jun 24 15:42:09.125189 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Jun 24 15:42:09.182340 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Jun 24 15:42:09.284069 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Jun 24 15:42:09.356472 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Jun 24 15:42:09.419718 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Jun 24 15:42:09.551790 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Jun 24 15:42:09.662873 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Jun 24 15:42:09.761764 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Jun 24 15:42:09.848615 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Jun 24 15:42:09.986706 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'show working'. Jun 24 15:42:10.101288 osdx ubnt-cfgd[558813]: inactive Jun 24 15:42:10.168543 osdx INFO[558850]: FRR daemons did not change Jun 24 15:42:10.439053 osdx systemd[1]: Reloading. Jun 24 15:42:10.474927 osdx systemd-sysv-generator[558903]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Jun 24 15:42:10.631499 osdx systemd[1]: Starting logrotate.service - Rotate log files... Jun 24 15:42:10.636145 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Jun 24 15:42:10.657872 osdx systemd[1]: logrotate.service: Deactivated successfully. Jun 24 15:42:10.658114 osdx systemd[1]: Finished logrotate.service - Rotate log files. Jun 24 15:42:10.659396 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Jun 24 15:42:10.859520 osdx INFO[558885]: Rules successfully loaded Jun 24 15:42:10.860087 osdx cfgd[1460]: [558020]Completed change to active configuration Jun 24 15:42:10.862165 osdx OSDxCLI[558020]: User 'admin' committed the configuration. Jun 24 15:42:11.449432 osdx OSDxCLI[558020]: User 'admin' left the configuration menu. Jun 24 15:42:11.815034 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=32103 DF PROTO=TCP SPT=34700 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jun 24 15:42:11.815122 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=57811 DF PROTO=TCP SPT=34708 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Jun 24 15:42:22.183678 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Jun 24 15:42:22.292753 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'system journal show | cat'. Jun 24 15:42:22.560249 osdx OSDxCLI[558020]: User 'admin' entered the configuration menu. Jun 24 15:42:22.631473 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Jun 24 15:42:22.741675 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Jun 24 15:42:22.806048 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Jun 24 15:42:22.931176 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Jun 24 15:42:22.989586 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Jun 24 15:42:23.090084 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Jun 24 15:42:23.175111 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Jun 24 15:42:23.257412 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Jun 24 15:42:23.312263 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Jun 24 15:42:23.411258 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Jun 24 15:42:23.475561 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Jun 24 15:42:23.581869 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Jun 24 15:42:23.653160 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Jun 24 15:42:23.841597 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Jun 24 15:42:23.907471 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Jun 24 15:42:24.010220 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Jun 24 15:42:24.068208 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Jun 24 15:42:24.170071 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Jun 24 15:42:24.262757 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Jun 24 15:42:24.336051 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Jun 24 15:42:24.492206 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Jun 24 15:42:24.552348 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Jun 24 15:42:24.676568 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Jun 24 15:42:24.784334 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Jun 24 15:42:24.909220 osdx OSDxCLI[558020]: User 'admin' added a new cfg line: 'show changes'. Jun 24 15:42:25.005924 osdx ubnt-cfgd[559031]: inactive Jun 24 15:42:25.051826 osdx INFO[559047]: FRR daemons did not change Jun 24 15:42:25.298739 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Jun 24 15:42:27.142142 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Jun 24 15:42:27.142283 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Jun 24 15:42:27.142332 osdx systemd[1]: suricata@FW.service: Consumed 1.820s CPU time. Jun 24 15:42:27.163241 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Jun 24 15:42:27.181873 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Jun 24 15:42:27.388814 osdx INFO[559072]: Rules successfully loaded Jun 24 15:42:27.389579 osdx cfgd[1460]: [558020]Completed change to active configuration Jun 24 15:42:27.391482 osdx OSDxCLI[558020]: User 'admin' committed the configuration. Jun 24 15:42:27.408543 osdx OSDxCLI[558020]: User 'admin' left the configuration menu. Jun 24 15:42:27.646958 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=10426 DF PROTO=TCP SPT=41394 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Jun 24 15:42:27.651123 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=63533 DF PROTO=TCP SPT=41408 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Jun 24 15:42:32.032884 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Jun 24 15:42:37.974344 osdx OSDxCLI[558020]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 610 0 --:--:-- --:--:-- --:--:-- 611
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.638 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.638/0.638/0.638/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.491 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.491/0.491/0.491/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 47008 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 79.0 MBytes 663 Mbits/sec 53 1.80 MBytes [ 5] 1.00-2.00 sec 141 MBytes 1.18 Gbits/sec 0 1.99 MBytes [ 5] 2.00-3.00 sec 262 MBytes 2.20 Gbits/sec 0 2.14 MBytes [ 5] 3.00-4.00 sec 259 MBytes 2.17 Gbits/sec 2 1.60 MBytes [ 5] 4.00-5.00 sec 251 MBytes 2.11 Gbits/sec 0 1.70 MBytes [ 5] 5.00-6.00 sec 252 MBytes 2.12 Gbits/sec 0 1.80 MBytes [ 5] 6.00-7.00 sec 266 MBytes 2.23 Gbits/sec 0 1.90 MBytes [ 5] 7.00-8.00 sec 259 MBytes 2.17 Gbits/sec 0 1.99 MBytes [ 5] 8.00-9.00 sec 289 MBytes 2.42 Gbits/sec 29 1.48 MBytes [ 5] 9.00-10.00 sec 274 MBytes 2.30 Gbits/sec 0 1.64 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.28 GBytes 1.96 Gbits/sec 84 sender [ 5] 0.00-10.00 sec 2.28 GBytes 1.95 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
06/24/2025-15:43:04.224108 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46998 -> 40.0.0.2:5001 06/24/2025-15:43:04.225086 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47008 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=47008 dport=5001 packets=1688886 bytes=2533320229 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=47008 packets=232510 bytes=12082560 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=46998 dport=5001 packets=16 bytes=1300 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=46998 packets=13 bytes=1018 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=120 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=120 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=495 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=495 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 40406 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 224 MBytes 1.88 Gbits/sec 12 1.90 MBytes [ 5] 1.00-2.00 sec 245 MBytes 2.06 Gbits/sec 112 1.45 MBytes [ 5] 2.00-3.00 sec 269 MBytes 2.25 Gbits/sec 0 1.58 MBytes [ 5] 3.00-4.00 sec 242 MBytes 2.04 Gbits/sec 0 1.68 MBytes [ 5] 4.00-5.00 sec 255 MBytes 2.14 Gbits/sec 0 1.79 MBytes [ 5] 5.00-6.00 sec 241 MBytes 2.02 Gbits/sec 0 1.87 MBytes [ 5] 6.00-7.00 sec 254 MBytes 2.13 Gbits/sec 0 1.97 MBytes [ 5] 7.00-8.00 sec 242 MBytes 2.03 Gbits/sec 205 1.50 MBytes [ 5] 8.00-9.00 sec 241 MBytes 2.02 Gbits/sec 0 1.64 MBytes [ 5] 9.00-10.00 sec 244 MBytes 2.04 Gbits/sec 0 1.75 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.40 GBytes 2.06 Gbits/sec 329 sender [ 5] 0.00-10.01 sec 2.40 GBytes 2.06 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
06/24/2025-15:43:04.224108 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:46998 -> 40.0.0.2:5001 06/24/2025-15:43:04.225086 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47008 -> 40.0.0.2:5001 06/24/2025-15:43:19.062861 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40394 -> 40.0.0.2:5001 06/24/2025-15:43:19.063840 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:40406 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=40406 dport=5001 packets=1778818 bytes=2668212141 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=40406 packets=245956 bytes=12791136 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=40394 dport=5001 packets=16 bytes=1300 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=40394 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 12621 0 --:--:-- --:--:-- --:--:-- 13333
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.599 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.599/0.599/0.599/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.448 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.448/0.448/0.448/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
06/24/2025-15:43:53.215736 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49484 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=49484 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=49484 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=498 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=498 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=123 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=123 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
06/24/2025-15:43:53.215736 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49484 -> 40.0.0.2:5000 06/24/2025-15:43:59.431881 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49484 -> 40.0.0.2:5000 06/24/2025-15:44:00.526184 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:49484 -> 40.0.0.2:5000 06/24/2025-15:44:02.138830 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:34244 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=34244 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=34244 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 780 2 - 5 5 281 281 --------------------------------------------------------------------- Total 11 11 780 780
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 23289 0 --:--:-- --:--:-- --:--:-- 25800
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.626 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.626/0.626/0.626/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.882 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.882/0.882/0.882/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
06/24/2025-15:44:27.342245 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39062 -> 40.0.0.2:5001 06/24/2025-15:44:27.343702 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39070 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=501 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=501 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=39062 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=39062 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=39070 dport=5001 packets=8958 bytes=13432701 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=39070 packets=1403 bytes=72964 [ASSURED] [OFFLOAD, packets=8945 bytes=13417500 packets=1401 bytes=72852] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=126 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=126 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 2916 0 --:--:-- --:--:-- --:--:-- 2955
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
06/24/2025-15:44:27.342245 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39062 -> 40.0.0.2:5001 06/24/2025-15:44:27.343702 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39070 -> 40.0.0.2:5001 06/24/2025-15:44:30.686716 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39072 -> 40.0.0.2:5001 06/24/2025-15:44:30.692704 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:40885 -> 40.0.0.2:5001 06/24/2025-15:44:30.705617 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:40885 -> 40.0.0.2:5001 06/24/2025-15:44:30.715808 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:40885 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=39072 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=39072 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=2 udp 17 src=20.0.0.2 dst=40.0.0.2 sport=40885 dport=5001 packets=24 bytes=33980 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=40885 packets=1 bytes=32 [OFFLOAD, packets=20 bytes=29520 packets=0 bytes=0] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1