Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 4358 0 --:--:-- --:--:-- --:--:-- 4448
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.629 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.629/0.629/0.629/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.578 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.578/0.578/0.578/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 57390 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 45.6 MBytes 383 Mbits/sec 0 1.92 MBytes [ 5] 1.00-2.00 sec 46.2 MBytes 388 Mbits/sec 66 1.56 MBytes [ 5] 2.00-3.00 sec 70.0 MBytes 587 Mbits/sec 0 1.69 MBytes [ 5] 3.00-4.00 sec 129 MBytes 1.08 Gbits/sec 0 1.80 MBytes [ 5] 4.00-5.00 sec 151 MBytes 1.27 Gbits/sec 78 1.32 MBytes [ 5] 5.00-6.00 sec 150 MBytes 1.26 Gbits/sec 5 1007 KBytes [ 5] 6.00-7.00 sec 141 MBytes 1.18 Gbits/sec 0 1.08 MBytes [ 5] 7.00-8.00 sec 140 MBytes 1.17 Gbits/sec 0 1.17 MBytes [ 5] 8.00-9.00 sec 149 MBytes 1.25 Gbits/sec 0 1.26 MBytes [ 5] 9.00-10.00 sec 152 MBytes 1.28 Gbits/sec 0 1.35 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.15 GBytes 985 Mbits/sec 149 sender [ 5] 0.00-10.01 sec 1.14 GBytes 982 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/12/2026-18:21:21.099347 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57384 -> 40.0.0.2:5001 02/12/2026-18:21:21.102035 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:57390 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 45231 0 --:--:-- --:--:-- --:--:-- 64500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.775 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.775/0.775/0.775/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=4.63 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 4.626/4.626/4.626/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 56544 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 79.9 MBytes 670 Mbits/sec 174 1.78 MBytes [ 5] 1.00-2.00 sec 30.0 MBytes 252 Mbits/sec 136 1.37 MBytes [ 5] 2.00-3.00 sec 100 MBytes 837 Mbits/sec 0 1.47 MBytes [ 5] 3.00-4.00 sec 200 MBytes 1.68 Gbits/sec 0 1.54 MBytes [ 5] 4.00-5.00 sec 168 MBytes 1.40 Gbits/sec 0 1.59 MBytes [ 5] 5.00-6.00 sec 182 MBytes 1.53 Gbits/sec 0 1.65 MBytes [ 5] 6.00-7.00 sec 220 MBytes 1.85 Gbits/sec 0 1.74 MBytes [ 5] 7.00-8.00 sec 232 MBytes 1.95 Gbits/sec 0 1.83 MBytes [ 5] 8.00-9.00 sec 264 MBytes 2.21 Gbits/sec 0 1.92 MBytes [ 5] 9.00-10.00 sec 200 MBytes 1.68 Gbits/sec 84 1.42 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.64 GBytes 1.41 Gbits/sec 394 sender [ 5] 0.00-10.01 sec 1.63 GBytes 1.40 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/12/2026-18:22:02.631230 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56530 -> 40.0.0.2:5001 02/12/2026-18:22:02.633688 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56544 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 12 18:21:50.000357 osdx systemd-timedated[323394]: Changed local time to Thu 2026-02-12 18:21:50 UTC Feb 12 18:21:50.002242 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'set date 2026-02-12 18:21:50'. Feb 12 18:21:50.003248 osdx systemd-journald[1959]: Time jumped backwards, rotating. Feb 12 18:21:50.353030 osdx systemd-journald[1959]: Runtime Journal (/run/log/journal/fef7273cfed74888920ec39438478308) is 2.3M, max 17.2M, 14.9M free. Feb 12 18:21:50.355248 osdx systemd-journald[1959]: Received client request to rotate journal, rotating. Feb 12 18:21:50.355309 osdx systemd-journald[1959]: Vacuuming done, freed 0B of archived journals from /run/log/journal/fef7273cfed74888920ec39438478308. Feb 12 18:21:50.364267 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'system journal clear'. Feb 12 18:21:50.698368 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'system coredump delete all'. Feb 12 18:21:50.988999 osdx OSDxCLI[322896]: User 'admin' entered the configuration menu. Feb 12 18:21:51.081917 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 12 18:21:51.158070 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 12 18:21:51.274625 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 12 18:21:51.351525 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 12 18:21:51.470679 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 12 18:21:51.525237 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 12 18:21:51.712607 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'show working'. Feb 12 18:21:51.790830 osdx ubnt-cfgd[323427]: inactive Feb 12 18:21:52.351175 osdx INFO[323433]: FRR daemons did not change Feb 12 18:21:52.383255 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 12 18:21:52.401212 osdx WARNING[323473]: No supported link modes on interface eth1 Feb 12 18:21:52.402714 osdx modulelauncher[323473]: osdx.utils.xos cmd error: /sbin/ethtool -A eth1 autoneg on Feb 12 18:21:52.402726 osdx modulelauncher[323473]: Command '/sbin/ethtool -A eth1 autoneg on' returned non-zero exit status 76. Feb 12 18:21:52.404171 osdx modulelauncher[323473]: osdx.utils.xos cmd error: /sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off -- Feb 12 18:21:52.404180 osdx modulelauncher[323473]: Command '/sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 12 18:21:52.439259 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 12 18:21:52.489162 osdx WARNING[323553]: No supported link modes on interface eth0 Feb 12 18:21:52.491059 osdx modulelauncher[323553]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Feb 12 18:21:52.491072 osdx modulelauncher[323553]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Feb 12 18:21:52.492661 osdx modulelauncher[323553]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Feb 12 18:21:52.492672 osdx modulelauncher[323553]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 12 18:21:52.502985 osdx (udev-worker)[323569]: Network interface NamePolicy= disabled on kernel command line. Feb 12 18:21:52.545996 osdx (udev-worker)[323580]: Network interface NamePolicy= disabled on kernel command line. Feb 12 18:21:52.670640 osdx cfgd[1631]: [322896]Completed change to active configuration Feb 12 18:21:52.682679 osdx OSDxCLI[322896]: User 'admin' committed the configuration. Feb 12 18:21:52.699252 osdx OSDxCLI[322896]: User 'admin' left the configuration menu. Feb 12 18:21:55.616326 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 12 18:21:55.744597 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 12 18:21:55.885629 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 12 18:21:56.455736 osdx file_operation[323748]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 12 18:21:56.481044 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 12 18:21:56.762508 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 12 18:21:57.021204 osdx OSDxCLI[322896]: User 'admin' entered the configuration menu. Feb 12 18:21:57.219844 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 12 18:21:57.325846 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 12 18:21:57.388214 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 12 18:21:57.489145 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 12 18:21:57.648949 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 12 18:21:57.791576 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 12 18:21:58.001102 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 12 18:21:58.242965 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 12 18:21:58.300245 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 12 18:21:58.394877 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 12 18:21:58.458911 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 12 18:21:58.601612 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 12 18:21:58.668382 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 12 18:21:58.950478 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 12 18:21:59.024384 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 12 18:21:59.429453 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 12 18:21:59.541646 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 12 18:21:59.726307 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 12 18:21:59.853396 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 12 18:21:59.936599 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 12 18:22:00.083560 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'show working'. Feb 12 18:22:00.446555 osdx ubnt-cfgd[323801]: inactive Feb 12 18:22:00.633127 osdx INFO[323846]: FRR daemons did not change Feb 12 18:22:00.925600 osdx systemd[1]: Reloading. Feb 12 18:22:01.075272 osdx systemd-sysv-generator[323902]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 12 18:22:01.251653 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 12 18:22:01.268209 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 12 18:22:01.811029 osdx INFO[323883]: Rules successfully loaded Feb 12 18:22:01.811828 osdx cfgd[1631]: [322896]Completed change to active configuration Feb 12 18:22:01.814329 osdx OSDxCLI[322896]: User 'admin' committed the configuration. Feb 12 18:22:02.086136 osdx OSDxCLI[322896]: User 'admin' left the configuration menu. Feb 12 18:22:02.635277 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=14392 DF PROTO=TCP SPT=56530 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 12 18:22:02.635348 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=22458 DF PROTO=TCP SPT=56544 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 12 18:22:12.950573 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 51452 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 112 MBytes 937 Mbits/sec 98 1.77 MBytes [ 5] 1.00-2.00 sec 206 MBytes 1.73 Gbits/sec 47 1.35 MBytes [ 5] 2.00-3.00 sec 244 MBytes 2.04 Gbits/sec 0 1.47 MBytes [ 5] 3.00-4.00 sec 214 MBytes 1.79 Gbits/sec 0 1.56 MBytes [ 5] 4.00-5.00 sec 234 MBytes 1.96 Gbits/sec 0 1.66 MBytes [ 5] 5.00-6.00 sec 262 MBytes 2.20 Gbits/sec 0 1.77 MBytes [ 5] 6.00-7.00 sec 239 MBytes 2.00 Gbits/sec 133 1.38 MBytes [ 5] 7.00-8.00 sec 224 MBytes 1.88 Gbits/sec 0 1.50 MBytes [ 5] 8.00-9.00 sec 242 MBytes 2.03 Gbits/sec 0 1.59 MBytes [ 5] 9.00-10.00 sec 230 MBytes 1.93 Gbits/sec 0 1.68 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.16 GBytes 1.85 Gbits/sec 278 sender [ 5] 0.00-10.01 sec 2.15 GBytes 1.85 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/12/2026-18:22:02.631230 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56530 -> 40.0.0.2:5001 02/12/2026-18:22:02.633688 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56544 -> 40.0.0.2:5001 02/12/2026-18:22:19.499305 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51438 -> 40.0.0.2:5001 02/12/2026-18:22:19.500859 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51452 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 12 18:21:50.000357 osdx systemd-timedated[323394]: Changed local time to Thu 2026-02-12 18:21:50 UTC Feb 12 18:21:50.002242 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'set date 2026-02-12 18:21:50'. Feb 12 18:21:50.003248 osdx systemd-journald[1959]: Time jumped backwards, rotating. Feb 12 18:21:50.353030 osdx systemd-journald[1959]: Runtime Journal (/run/log/journal/fef7273cfed74888920ec39438478308) is 2.3M, max 17.2M, 14.9M free. Feb 12 18:21:50.355248 osdx systemd-journald[1959]: Received client request to rotate journal, rotating. Feb 12 18:21:50.355309 osdx systemd-journald[1959]: Vacuuming done, freed 0B of archived journals from /run/log/journal/fef7273cfed74888920ec39438478308. Feb 12 18:21:50.364267 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'system journal clear'. Feb 12 18:21:50.698368 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'system coredump delete all'. Feb 12 18:21:50.988999 osdx OSDxCLI[322896]: User 'admin' entered the configuration menu. Feb 12 18:21:51.081917 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 12 18:21:51.158070 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 12 18:21:51.274625 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 12 18:21:51.351525 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 12 18:21:51.470679 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 12 18:21:51.525237 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 12 18:21:51.712607 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'show working'. Feb 12 18:21:51.790830 osdx ubnt-cfgd[323427]: inactive Feb 12 18:21:52.351175 osdx INFO[323433]: FRR daemons did not change Feb 12 18:21:52.383255 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 12 18:21:52.401212 osdx WARNING[323473]: No supported link modes on interface eth1 Feb 12 18:21:52.402714 osdx modulelauncher[323473]: osdx.utils.xos cmd error: /sbin/ethtool -A eth1 autoneg on Feb 12 18:21:52.402726 osdx modulelauncher[323473]: Command '/sbin/ethtool -A eth1 autoneg on' returned non-zero exit status 76. Feb 12 18:21:52.404171 osdx modulelauncher[323473]: osdx.utils.xos cmd error: /sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off -- Feb 12 18:21:52.404180 osdx modulelauncher[323473]: Command '/sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 12 18:21:52.439259 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 12 18:21:52.489162 osdx WARNING[323553]: No supported link modes on interface eth0 Feb 12 18:21:52.491059 osdx modulelauncher[323553]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Feb 12 18:21:52.491072 osdx modulelauncher[323553]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Feb 12 18:21:52.492661 osdx modulelauncher[323553]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Feb 12 18:21:52.492672 osdx modulelauncher[323553]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 12 18:21:52.502985 osdx (udev-worker)[323569]: Network interface NamePolicy= disabled on kernel command line. Feb 12 18:21:52.545996 osdx (udev-worker)[323580]: Network interface NamePolicy= disabled on kernel command line. Feb 12 18:21:52.670640 osdx cfgd[1631]: [322896]Completed change to active configuration Feb 12 18:21:52.682679 osdx OSDxCLI[322896]: User 'admin' committed the configuration. Feb 12 18:21:52.699252 osdx OSDxCLI[322896]: User 'admin' left the configuration menu. Feb 12 18:21:55.616326 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 12 18:21:55.744597 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 12 18:21:55.885629 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 12 18:21:56.455736 osdx file_operation[323748]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 12 18:21:56.481044 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 12 18:21:56.762508 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 12 18:21:57.021204 osdx OSDxCLI[322896]: User 'admin' entered the configuration menu. Feb 12 18:21:57.219844 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 12 18:21:57.325846 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 12 18:21:57.388214 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 12 18:21:57.489145 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 12 18:21:57.648949 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 12 18:21:57.791576 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 12 18:21:58.001102 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 12 18:21:58.242965 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 12 18:21:58.300245 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 12 18:21:58.394877 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 12 18:21:58.458911 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 12 18:21:58.601612 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 12 18:21:58.668382 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 12 18:21:58.950478 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 12 18:21:59.024384 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 12 18:21:59.429453 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 12 18:21:59.541646 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 12 18:21:59.726307 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 12 18:21:59.853396 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 12 18:21:59.936599 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 12 18:22:00.083560 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'show working'. Feb 12 18:22:00.446555 osdx ubnt-cfgd[323801]: inactive Feb 12 18:22:00.633127 osdx INFO[323846]: FRR daemons did not change Feb 12 18:22:00.925600 osdx systemd[1]: Reloading. Feb 12 18:22:01.075272 osdx systemd-sysv-generator[323902]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 12 18:22:01.251653 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 12 18:22:01.268209 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 12 18:22:01.811029 osdx INFO[323883]: Rules successfully loaded Feb 12 18:22:01.811828 osdx cfgd[1631]: [322896]Completed change to active configuration Feb 12 18:22:01.814329 osdx OSDxCLI[322896]: User 'admin' committed the configuration. Feb 12 18:22:02.086136 osdx OSDxCLI[322896]: User 'admin' left the configuration menu. Feb 12 18:22:02.635277 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=14392 DF PROTO=TCP SPT=56530 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 12 18:22:02.635348 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=22458 DF PROTO=TCP SPT=56544 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 12 18:22:12.950573 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Feb 12 18:22:13.110712 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'system journal show | cat'. Feb 12 18:22:13.400237 osdx OSDxCLI[322896]: User 'admin' entered the configuration menu. Feb 12 18:22:13.482907 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 12 18:22:13.590674 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 12 18:22:13.658495 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 12 18:22:13.754481 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 12 18:22:13.814192 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 12 18:22:14.170685 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 12 18:22:14.296038 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 12 18:22:14.355765 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 12 18:22:14.494169 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 12 18:22:14.595868 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 12 18:22:14.650461 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 12 18:22:14.811799 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 12 18:22:15.206244 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 12 18:22:15.316303 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 12 18:22:15.391674 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 12 18:22:15.419845 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 12 18:22:15.425212 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 12 18:22:15.425385 osdx systemd[1]: Finished logrotate.service - Rotate log files. Feb 12 18:22:15.500643 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 12 18:22:15.612894 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 12 18:22:15.730323 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 12 18:22:15.960726 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 12 18:22:16.023644 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 12 18:22:16.125292 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Feb 12 18:22:16.328750 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Feb 12 18:22:16.430217 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Feb 12 18:22:16.543793 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Feb 12 18:22:16.665991 osdx OSDxCLI[322896]: User 'admin' added a new cfg line: 'show changes'. Feb 12 18:22:16.787516 osdx ubnt-cfgd[324036]: inactive Feb 12 18:22:16.841521 osdx INFO[324056]: FRR daemons did not change Feb 12 18:22:17.087281 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Feb 12 18:22:19.001828 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Feb 12 18:22:19.001931 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Feb 12 18:22:19.001964 osdx systemd[1]: suricata@FW.service: Consumed 2.066s CPU time. Feb 12 18:22:19.015608 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 12 18:22:19.039207 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 12 18:22:19.260702 osdx INFO[324083]: Rules successfully loaded Feb 12 18:22:19.261225 osdx cfgd[1631]: [322896]Completed change to active configuration Feb 12 18:22:19.263242 osdx OSDxCLI[322896]: User 'admin' committed the configuration. Feb 12 18:22:19.289931 osdx OSDxCLI[322896]: User 'admin' left the configuration menu. Feb 12 18:22:19.503272 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=27523 DF PROTO=TCP SPT=51438 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 12 18:22:19.503371 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=65259 DF PROTO=TCP SPT=51452 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 12 18:22:20.034997 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Feb 12 18:22:29.756507 osdx OSDxCLI[322896]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 4581 0 --:--:-- --:--:-- --:--:-- 4607
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.781 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.781/0.781/0.781/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.543 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.543/0.543/0.543/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 55026 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 36.8 MBytes 308 Mbits/sec 0 1.45 MBytes [ 5] 1.00-2.00 sec 30.0 MBytes 252 Mbits/sec 0 2.52 MBytes [ 5] 2.00-3.00 sec 53.8 MBytes 451 Mbits/sec 463 1.31 MBytes [ 5] 3.00-4.00 sec 131 MBytes 1.10 Gbits/sec 0 1.38 MBytes [ 5] 4.00-5.00 sec 184 MBytes 1.54 Gbits/sec 0 1.43 MBytes [ 5] 5.00-6.00 sec 230 MBytes 1.93 Gbits/sec 0 1.52 MBytes [ 5] 6.00-7.00 sec 248 MBytes 2.08 Gbits/sec 0 1.63 MBytes [ 5] 7.00-8.00 sec 198 MBytes 1.66 Gbits/sec 94 1.23 MBytes [ 5] 8.00-9.00 sec 189 MBytes 1.58 Gbits/sec 0 1.35 MBytes [ 5] 9.00-10.00 sec 152 MBytes 1.28 Gbits/sec 0 1.46 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.42 GBytes 1.22 Gbits/sec 557 sender [ 5] 0.00-10.00 sec 1.42 GBytes 1.21 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/12/2026-18:22:59.754929 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55012 -> 40.0.0.2:5001 02/12/2026-18:22:59.760023 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55026 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=55012 dport=5001 packets=14 bytes=1198 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55012 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=63 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=63 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=55026 dport=5001 packets=1050198 bytes=1575281821 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55026 packets=107908 bytes=5614208 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=314 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=314 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 41500 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 259 MBytes 2.18 Gbits/sec 13 1.91 MBytes [ 5] 1.00-2.00 sec 228 MBytes 1.91 Gbits/sec 330 1.45 MBytes [ 5] 2.00-3.00 sec 239 MBytes 2.00 Gbits/sec 0 1.55 MBytes [ 5] 3.00-4.00 sec 244 MBytes 2.04 Gbits/sec 0 1.65 MBytes [ 5] 4.00-5.00 sec 258 MBytes 2.16 Gbits/sec 0 1.76 MBytes [ 5] 5.00-6.00 sec 211 MBytes 1.77 Gbits/sec 0 1.84 MBytes [ 5] 6.00-7.00 sec 242 MBytes 2.03 Gbits/sec 0 1.93 MBytes [ 5] 7.00-8.00 sec 276 MBytes 2.32 Gbits/sec 0 2.02 MBytes [ 5] 8.00-9.00 sec 231 MBytes 1.94 Gbits/sec 98 1.52 MBytes [ 5] 9.00-10.00 sec 274 MBytes 2.30 Gbits/sec 0 1.67 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.40 GBytes 2.07 Gbits/sec 441 sender [ 5] 0.00-10.01 sec 2.40 GBytes 2.06 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/12/2026-18:22:59.754929 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55012 -> 40.0.0.2:5001 02/12/2026-18:22:59.760023 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55026 -> 40.0.0.2:5001 02/12/2026-18:23:15.857604 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41484 -> 40.0.0.2:5001 02/12/2026-18:23:15.858667 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:41500 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=41500 dport=5001 packets=1783097 bytes=2674626529 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=41500 packets=217527 bytes=11302220 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=41484 dport=5001 packets=16 bytes=1300 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=41484 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 10045 0 --:--:-- --:--:-- --:--:-- 10526
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.554 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.554/0.554/0.554/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.576 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.576/0.576/0.576/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/12/2026-18:23:53.502240 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35468 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=317 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=317 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=35468 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=35468 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=66 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=66 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/12/2026-18:23:53.502240 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35468 -> 40.0.0.2:5000 02/12/2026-18:23:59.765167 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:35468 -> 40.0.0.2:5000 02/12/2026-18:24:01.371232 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:52936 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=52936 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=52936 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 780 2 - 5 5 281 281 --------------------------------------------------------------------- Total 11 11 780 780
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 29778 0 --:--:-- --:--:-- --:--:-- 32250
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.587 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.587/0.587/0.587/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.568 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.568/0.568/0.568/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/12/2026-18:24:26.737199 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55766 -> 40.0.0.2:5001 02/12/2026-18:24:26.738627 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55772 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=320 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=320 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=55766 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55766 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=55772 dport=5001 packets=7670 bytes=11499253 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55772 packets=1216 bytes=63240 [ASSURED] [OFFLOAD, packets=7657 bytes=11484052 packets=1214 bytes=63128] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=69 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=69 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 7102 0 --:--:-- --:--:-- --:--:-- 7388
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
02/12/2026-18:24:26.737199 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55766 -> 40.0.0.2:5001 02/12/2026-18:24:26.738627 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55772 -> 40.0.0.2:5001 02/12/2026-18:24:29.690760 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:55780 -> 40.0.0.2:5001 02/12/2026-18:24:29.696840 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:49107 -> 40.0.0.2:5001 02/12/2026-18:24:29.707669 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:49107 -> 40.0.0.2:5001 02/12/2026-18:24:29.721206 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:49107 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=55780 dport=5001 packets=7 bytes=555 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=55780 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=246 packets=4 bytes=211] mark=129834765 use=3 udp 17 src=20.0.0.2 dst=40.0.0.2 sport=49107 dport=5001 packets=14 bytes=19220 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=49107 packets=1 bytes=32 [OFFLOAD, packets=10 bytes=14760 packets=0 bytes=0] mark=129834765 use=2 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 20881 0 --:--:-- --:--:-- --:--:-- 22222
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.876 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.876/0.876/0.876/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.861 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.861/0.861/0.861/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/12/2026-18:24:53.383278 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51064 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 51064 yes 201 0 0 0 20.0.0.2 40.0.0.2 51064 5000 yes 201 0 9 731
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250188s ending at 1770920697.304816 XDP_DROP 10 pkts ( 4 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 7253397 pkts ( 8 pps) 9697379 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
02/12/2026-18:24:53.383278 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:51064 -> 40.0.0.2:5000 02/12/2026-18:24:57.506245 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:52780 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5000 51064 yes 201 0 0 0 40.0.0.2 20.0.0.2 5001 52780 no 201 0 0 0 20.0.0.2 40.0.0.2 51064 5000 yes 201 0 12 905 20.0.0.2 40.0.0.2 52780 5001 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250137s ending at 1770920701.167275 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 7253437 pkts ( 0 pps) 9697382 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)