Bypass Tests
The following scenario shows different configuration alternatives to improve the OSDx firewall performance.
Test Local Bypass
Description
Builds a scenario with three DUTs in which a performance test is carried out between DUT1 and DUT2, and DUT0 is the router running the firewall. “Local bypass” is set to allow the firewall to internally skips packets belonging to a flow that must be bypassed. The performance test may produce better results than the general tests.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 17815 0 --:--:-- --:--:-- --:--:-- 18428
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.879 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.879/0.879/0.879/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.566 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.566/0.566/0.566/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 56062 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 31.9 MBytes 267 Mbits/sec 0 1.33 MBytes [ 5] 1.00-2.00 sec 25.0 MBytes 210 Mbits/sec 23 1.47 MBytes [ 5] 2.00-3.00 sec 20.0 MBytes 168 Mbits/sec 11 397 KBytes [ 5] 3.00-4.00 sec 16.2 MBytes 136 Mbits/sec 1 1.41 KBytes [ 5] 4.00-5.00 sec 0.00 Bytes 0.00 bits/sec 1 1.41 KBytes [ 5] 5.00-6.00 sec 0.00 Bytes 0.00 bits/sec 1 1.41 KBytes [ 5] 6.00-7.00 sec 0.00 Bytes 0.00 bits/sec 1 1.41 KBytes [ 5] 7.00-8.00 sec 57.5 MBytes 483 Mbits/sec 33 1.76 MBytes [ 5] 8.00-9.00 sec 132 MBytes 1.11 Gbits/sec 0 1.94 MBytes [ 5] 9.00-10.00 sec 135 MBytes 1.13 Gbits/sec 113 1.46 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 418 MBytes 351 Mbits/sec 184 sender [ 5] 0.00-10.00 sec 416 MBytes 349 Mbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2026-10:38:32.114015 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56052 -> 40.0.0.2:5001 02/19/2026-10:38:32.115613 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:56062 -> 40.0.0.2:5001
Test Capture Bypass Using Packet Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. “Capture bypass” is set to allow the firewall to mark packets. An external tool can then decide what to do with the flow when the mark is seen. For this example, when packet marks are detected, the traffic is assigned a label, thereby allowing the possibility of classifying traffic. In particular, labeling avoids traffic from entering the firewall.
Performance must improve considerably compared to the Local Bypass test.
The test is extended by using other packet marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 3631 0 --:--:-- --:--:-- --:--:-- 3685
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic label BYPASS set traffic policy FW-SKIP rule 1 log prefix SKIP set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS set traffic policy FW-SKIP rule 1 set label BYPASS set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS set traffic selector MARKED-PACKETS rule 1 mark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.583 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.583/0.583/0.583/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.468 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.468/0.468/0.468/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 39644 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 44.6 MBytes 374 Mbits/sec 0 1.61 MBytes [ 5] 1.00-2.00 sec 70.0 MBytes 587 Mbits/sec 69 1.63 MBytes [ 5] 2.00-3.00 sec 225 MBytes 1.89 Gbits/sec 0 1.79 MBytes [ 5] 3.00-4.00 sec 225 MBytes 1.89 Gbits/sec 5 1.36 MBytes [ 5] 4.00-5.00 sec 241 MBytes 2.02 Gbits/sec 0 1.47 MBytes [ 5] 5.00-6.00 sec 209 MBytes 1.75 Gbits/sec 0 1.57 MBytes [ 5] 6.00-7.00 sec 225 MBytes 1.89 Gbits/sec 0 1.66 MBytes [ 5] 7.00-8.00 sec 192 MBytes 1.61 Gbits/sec 51 1.27 MBytes [ 5] 8.00-9.00 sec 216 MBytes 1.81 Gbits/sec 0 1.39 MBytes [ 5] 9.00-10.00 sec 242 MBytes 2.04 Gbits/sec 0 1.50 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 1.85 GBytes 1.59 Gbits/sec 125 sender [ 5] 0.00-10.00 sec 1.84 GBytes 1.58 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2026-10:39:06.523546 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39628 -> 40.0.0.2:5001 02/19/2026-10:39:06.524646 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39644 -> 40.0.0.2:5001
Step 8: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 19 10:38:57.000302 osdx systemd-timedated[455559]: Changed local time to Thu 2026-02-19 10:38:57 UTC Feb 19 10:38:57.001661 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'set date 2026-02-19 10:38:57'. Feb 19 10:38:57.002114 osdx systemd-journald[2186]: Time jumped backwards, rotating. Feb 19 10:38:57.368073 osdx systemd-journald[2186]: Runtime Journal (/run/log/journal/69bd8e6fd19244c08e519827aa7e309f) is 2.3M, max 17.2M, 14.8M free. Feb 19 10:38:57.370133 osdx systemd-journald[2186]: Received client request to rotate journal, rotating. Feb 19 10:38:57.370205 osdx systemd-journald[2186]: Vacuuming done, freed 0B of archived journals from /run/log/journal/69bd8e6fd19244c08e519827aa7e309f. Feb 19 10:38:57.380479 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'system journal clear'. Feb 19 10:38:57.683740 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'system coredump delete all'. Feb 19 10:38:57.971621 osdx OSDxCLI[455080]: User 'admin' entered the configuration menu. Feb 19 10:38:58.054813 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 19 10:38:58.207245 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 19 10:38:58.270696 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 19 10:38:58.367154 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 19 10:38:58.441664 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 19 10:38:58.536893 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 19 10:38:58.612538 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'show working'. Feb 19 10:38:58.720297 osdx ubnt-cfgd[455592]: inactive Feb 19 10:38:58.747868 osdx INFO[455598]: FRR daemons did not change Feb 19 10:38:58.782118 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 19 10:38:58.807119 osdx WARNING[455638]: No supported link modes on interface eth1 Feb 19 10:38:58.809268 osdx modulelauncher[455638]: osdx.utils.xos cmd error: /sbin/ethtool -A eth1 autoneg on Feb 19 10:38:58.809292 osdx modulelauncher[455638]: Command '/sbin/ethtool -A eth1 autoneg on' returned non-zero exit status 76. Feb 19 10:38:58.811463 osdx modulelauncher[455638]: osdx.utils.xos cmd error: /sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off -- Feb 19 10:38:58.811479 osdx modulelauncher[455638]: Command '/sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 19 10:38:58.850114 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 19 10:38:58.896865 osdx WARNING[455718]: No supported link modes on interface eth0 Feb 19 10:38:58.899060 osdx modulelauncher[455718]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Feb 19 10:38:58.899074 osdx modulelauncher[455718]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Feb 19 10:38:58.900655 osdx modulelauncher[455718]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Feb 19 10:38:58.900672 osdx modulelauncher[455718]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 19 10:38:58.913472 osdx (udev-worker)[455734]: Network interface NamePolicy= disabled on kernel command line. Feb 19 10:38:59.090031 osdx cfgd[1859]: [455080]Completed change to active configuration Feb 19 10:38:59.103144 osdx OSDxCLI[455080]: User 'admin' committed the configuration. Feb 19 10:38:59.121878 osdx OSDxCLI[455080]: User 'admin' left the configuration menu. Feb 19 10:39:01.855520 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 19 10:39:02.285313 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 19 10:39:02.469916 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 19 10:39:03.039793 osdx file_operation[455916]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 19 10:39:03.097045 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 19 10:39:03.239578 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 19 10:39:03.390631 osdx OSDxCLI[455080]: User 'admin' entered the configuration menu. Feb 19 10:39:03.486029 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 10:39:03.573720 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 10:39:03.630231 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 10:39:03.728297 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 10:39:03.792491 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 10:39:03.948342 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 10:39:04.044016 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 10:39:04.114081 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 10:39:04.204578 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 10:39:04.259406 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 10:39:04.352078 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 10:39:04.409855 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 10:39:04.493619 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 10:39:04.550853 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 10:39:04.656695 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 10:39:04.721797 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 10:39:04.807775 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 10:39:04.876408 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 10:39:04.982035 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 10:39:05.043847 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 10:39:05.176084 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'show working'. Feb 19 10:39:05.262819 osdx ubnt-cfgd[455964]: inactive Feb 19 10:39:05.343208 osdx INFO[456009]: FRR daemons did not change Feb 19 10:39:05.652961 osdx systemd[1]: Reloading. Feb 19 10:39:05.722126 osdx systemd-sysv-generator[456065]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 19 10:39:05.842637 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 10:39:05.864889 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 10:39:06.082545 osdx INFO[456046]: Rules successfully loaded Feb 19 10:39:06.083117 osdx cfgd[1859]: [455080]Completed change to active configuration Feb 19 10:39:06.085071 osdx OSDxCLI[455080]: User 'admin' committed the configuration. Feb 19 10:39:06.122348 osdx OSDxCLI[455080]: User 'admin' left the configuration menu. Feb 19 10:39:06.526126 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=30002 DF PROTO=TCP SPT=39628 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 10:39:06.526217 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=46049 DF PROTO=TCP SPT=39644 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 10:39:16.674528 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 19 10:39:16.682969 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Feb 19 10:39:16.697957 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 19 10:39:16.698139 osdx systemd[1]: Finished logrotate.service - Rotate log files.
Note
The following steps are just a reiteration of the previous test, but with the difference that the packet mark is an extra mark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 1 mask 3294967295 set service firewall FW stream bypass extra-mark 1 value 3294967295 set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 59622 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 210 MBytes 1.77 Gbits/sec 195 1.29 MBytes [ 5] 1.00-2.00 sec 0.00 Bytes 0.00 bits/sec 2 1.41 KBytes [ 5] 2.00-3.00 sec 229 MBytes 1.92 Gbits/sec 565 1.51 MBytes [ 5] 3.00-4.00 sec 262 MBytes 2.20 Gbits/sec 0 1.64 MBytes [ 5] 4.00-5.00 sec 265 MBytes 2.22 Gbits/sec 0 1.75 MBytes [ 5] 5.00-6.00 sec 259 MBytes 2.17 Gbits/sec 0 1.83 MBytes [ 5] 6.00-7.00 sec 245 MBytes 2.06 Gbits/sec 0 1.91 MBytes [ 5] 7.00-8.00 sec 248 MBytes 2.08 Gbits/sec 0 1.99 MBytes [ 5] 8.00-9.00 sec 260 MBytes 2.18 Gbits/sec 0 2.09 MBytes [ 5] 9.00-10.00 sec 268 MBytes 2.24 Gbits/sec 0 2.17 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.19 GBytes 1.88 Gbits/sec 762 sender [ 5] 0.00-10.00 sec 2.19 GBytes 1.88 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2026-10:39:06.523546 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39628 -> 40.0.0.2:5001 02/19/2026-10:39:06.524646 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:39644 -> 40.0.0.2:5001 02/19/2026-10:39:23.376442 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59616 -> 40.0.0.2:5001 02/19/2026-10:39:23.377651 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:59622 -> 40.0.0.2:5001
Step 12: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
(?m)^.*\[SKIP\-1\].*$Show output
Feb 19 10:38:57.000302 osdx systemd-timedated[455559]: Changed local time to Thu 2026-02-19 10:38:57 UTC Feb 19 10:38:57.001661 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'set date 2026-02-19 10:38:57'. Feb 19 10:38:57.002114 osdx systemd-journald[2186]: Time jumped backwards, rotating. Feb 19 10:38:57.368073 osdx systemd-journald[2186]: Runtime Journal (/run/log/journal/69bd8e6fd19244c08e519827aa7e309f) is 2.3M, max 17.2M, 14.8M free. Feb 19 10:38:57.370133 osdx systemd-journald[2186]: Received client request to rotate journal, rotating. Feb 19 10:38:57.370205 osdx systemd-journald[2186]: Vacuuming done, freed 0B of archived journals from /run/log/journal/69bd8e6fd19244c08e519827aa7e309f. Feb 19 10:38:57.380479 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'system journal clear'. Feb 19 10:38:57.683740 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'system coredump delete all'. Feb 19 10:38:57.971621 osdx OSDxCLI[455080]: User 'admin' entered the configuration menu. Feb 19 10:38:58.054813 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Feb 19 10:38:58.207245 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 traffic nat source rule 1 address masquerade'. Feb 19 10:38:58.270696 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Feb 19 10:38:58.367154 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service dns static host-name WAN inet 10.215.168.1'. Feb 19 10:38:58.441664 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 address 40.0.0.1/8'. Feb 19 10:38:58.536893 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 address 20.0.0.1/8'. Feb 19 10:38:58.612538 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'show working'. Feb 19 10:38:58.720297 osdx ubnt-cfgd[455592]: inactive Feb 19 10:38:58.747868 osdx INFO[455598]: FRR daemons did not change Feb 19 10:38:58.782118 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth1 Feb 19 10:38:58.807119 osdx WARNING[455638]: No supported link modes on interface eth1 Feb 19 10:38:58.809268 osdx modulelauncher[455638]: osdx.utils.xos cmd error: /sbin/ethtool -A eth1 autoneg on Feb 19 10:38:58.809292 osdx modulelauncher[455638]: Command '/sbin/ethtool -A eth1 autoneg on' returned non-zero exit status 76. Feb 19 10:38:58.811463 osdx modulelauncher[455638]: osdx.utils.xos cmd error: /sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off -- Feb 19 10:38:58.811479 osdx modulelauncher[455638]: Command '/sbin/ethtool -s eth1 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 19 10:38:58.850114 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Feb 19 10:38:58.896865 osdx WARNING[455718]: No supported link modes on interface eth0 Feb 19 10:38:58.899060 osdx modulelauncher[455718]: osdx.utils.xos cmd error: /sbin/ethtool -A eth0 autoneg on Feb 19 10:38:58.899074 osdx modulelauncher[455718]: Command '/sbin/ethtool -A eth0 autoneg on' returned non-zero exit status 76. Feb 19 10:38:58.900655 osdx modulelauncher[455718]: osdx.utils.xos cmd error: /sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off -- Feb 19 10:38:58.900672 osdx modulelauncher[455718]: Command '/sbin/ethtool -s eth0 autoneg on advertise Asym_Pause off Pause off --' returned non-zero exit status 75. Feb 19 10:38:58.913472 osdx (udev-worker)[455734]: Network interface NamePolicy= disabled on kernel command line. Feb 19 10:38:59.090031 osdx cfgd[1859]: [455080]Completed change to active configuration Feb 19 10:38:59.103144 osdx OSDxCLI[455080]: User 'admin' committed the configuration. Feb 19 10:38:59.121878 osdx OSDxCLI[455080]: User 'admin' left the configuration menu. Feb 19 10:39:01.855520 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Feb 19 10:39:02.285313 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'ping 40.0.0.2 count 1 size 56 timeout 1'. Feb 19 10:39:02.469916 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'ping 20.0.0.2 count 1 size 56 timeout 1'. Feb 19 10:39:03.039793 osdx file_operation[455916]: using src url: http://10.215.168.1/~robot/test-performance.rules dst url: running:// Feb 19 10:39:03.097045 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'file copy http://10.215.168.1/~robot/test-performance.rules running:// force'. Feb 19 10:39:03.239578 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'file show running://test-performance.rules'. Feb 19 10:39:03.390631 osdx OSDxCLI[455080]: User 'admin' entered the configuration menu. Feb 19 10:39:03.486029 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 10:39:03.573720 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 10:39:03.630231 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 10:39:03.728297 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 10:39:03.792491 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 10:39:03.948342 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 10:39:04.044016 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 10:39:04.114081 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 10:39:04.204578 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 10:39:04.259406 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 10:39:04.352078 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 10:39:04.409855 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 10:39:04.493619 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 10:39:04.550853 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 10:39:04.656695 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 10:39:04.721797 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 10:39:04.807775 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 10:39:04.876408 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 10:39:04.982035 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 10:39:05.043847 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 10:39:05.176084 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'show working'. Feb 19 10:39:05.262819 osdx ubnt-cfgd[455964]: inactive Feb 19 10:39:05.343208 osdx INFO[456009]: FRR daemons did not change Feb 19 10:39:05.652961 osdx systemd[1]: Reloading. Feb 19 10:39:05.722126 osdx systemd-sysv-generator[456065]: stat() failed on /etc/init.d/README, ignoring: No such file or directory Feb 19 10:39:05.842637 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 10:39:05.864889 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 10:39:06.082545 osdx INFO[456046]: Rules successfully loaded Feb 19 10:39:06.083117 osdx cfgd[1859]: [455080]Completed change to active configuration Feb 19 10:39:06.085071 osdx OSDxCLI[455080]: User 'admin' committed the configuration. Feb 19 10:39:06.122348 osdx OSDxCLI[455080]: User 'admin' left the configuration menu. Feb 19 10:39:06.526126 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=30002 DF PROTO=TCP SPT=39628 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 10:39:06.526217 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=46049 DF PROTO=TCP SPT=39644 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d Feb 19 10:39:16.674528 osdx systemd[1]: Starting logrotate.service - Rotate log files... Feb 19 10:39:16.682969 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'. Feb 19 10:39:16.697957 osdx systemd[1]: logrotate.service: Deactivated successfully. Feb 19 10:39:16.698139 osdx systemd[1]: Finished logrotate.service - Rotate log files. Feb 19 10:39:16.794232 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'system journal show | cat'. Feb 19 10:39:16.981417 osdx OSDxCLI[455080]: User 'admin' entered the configuration menu. Feb 19 10:39:17.042321 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW ruleset file running://test-performance.rules'. Feb 19 10:39:17.166984 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW mode inline queue FW_Q'. Feb 19 10:39:17.239495 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW logging outputs fast'. Feb 19 10:39:17.363076 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW logging level config'. Feb 19 10:39:17.422815 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW validator-timeout 20'. Feb 19 10:39:17.526344 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic queue FW_Q elements 1'. Feb 19 10:39:17.635841 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN'. Feb 19 10:39:17.715377 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN'. Feb 19 10:39:17.821894 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mark 129834765'. Feb 19 10:39:17.899403 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass mask 129834765'. Feb 19 10:39:18.001753 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic label BYPASS'. Feb 19 10:39:18.132661 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 log prefix SKIP'. Feb 19 10:39:18.244870 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector MARKED-PACKETS'. Feb 19 10:39:18.371730 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 set label BYPASS'. Feb 19 10:39:18.431712 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic selector MARKED-PACKETS rule 1 mark 129834765'. Feb 19 10:39:18.833905 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_ENQUEUE rule 1 not label BYPASS'. Feb 19 10:39:18.948493 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 selector FW_SEL_ENQUEUE'. Feb 19 10:39:19.409708 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 101 traffic policy out FW-SKIP'. Feb 19 10:39:19.491496 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set interfaces ethernet eth1 vif 201 traffic policy out FW-SKIP'. Feb 19 10:39:19.627140 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW_PLAN rule 1 action enqueue FW_Q'. Feb 19 10:39:19.742624 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 value 3294967295'. Feb 19 10:39:19.821576 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set service firewall FW stream bypass extra-mark 1 mask 3294967295'. Feb 19 10:39:19.894287 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic policy FW-SKIP rule 1 selector FW_SEL_EXTRA_MARK'. Feb 19 10:39:20.342056 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'set traffic selector FW_SEL_EXTRA_MARK rule 1 extra-mark 1 value 3294967295'. Feb 19 10:39:20.439146 osdx OSDxCLI[455080]: User 'admin' added a new cfg line: 'show changes'. Feb 19 10:39:20.569137 osdx ubnt-cfgd[456195]: inactive Feb 19 10:39:20.645794 osdx INFO[456215]: FRR daemons did not change Feb 19 10:39:20.873121 osdx systemd[1]: Stopping suricata@FW.service - Suricata client "FW" service... Feb 19 10:39:22.830712 osdx systemd[1]: suricata@FW.service: Deactivated successfully. Feb 19 10:39:22.830853 osdx systemd[1]: Stopped suricata@FW.service - Suricata client "FW" service. Feb 19 10:39:22.830892 osdx systemd[1]: suricata@FW.service: Consumed 2.119s CPU time. Feb 19 10:39:22.858580 osdx systemd[1]: Starting suricata@FW.service - Suricata client "FW" service... Feb 19 10:39:22.876198 osdx systemd[1]: Started suricata@FW.service - Suricata client "FW" service. Feb 19 10:39:23.123132 osdx INFO[456242]: Rules successfully loaded Feb 19 10:39:23.123671 osdx cfgd[1859]: [455080]Completed change to active configuration Feb 19 10:39:23.126011 osdx OSDxCLI[455080]: User 'admin' committed the configuration. Feb 19 10:39:23.155019 osdx OSDxCLI[455080]: User 'admin' left the configuration menu. Feb 19 10:39:23.378135 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=43967 DF PROTO=TCP SPT=59616 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 19 10:39:23.378216 osdx kernel: [SKIP-1] ACCEPT IN=eth1.201 OUT=eth1.101 MAC=de:ad:be:ef:6c:01:de:ad:be:ef:6c:20:08:00:45:00:00:59 SRC=20.0.0.2 DST=40.0.0.2 LEN=89 TOS=0x00 PREC=0x00 TTL=63 ID=53077 DF PROTO=TCP SPT=59622 DPT=5001 WINDOW=502 RES=0x00 ACK PSH URGP=0 MARK=0x7bd1f0d EMARK1=0xc46535ff Feb 19 10:39:27.032993 osdx systemd[1]: systemd-timedated.service: Deactivated successfully. Feb 19 10:39:33.574124 osdx OSDxCLI[455080]: User 'admin' executed a new command: 'service firewall FW show logging fast | tail'.
Test Capture Bypass Using Conntrack Mark
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later.
Performance must improve considerably compared to the Local Bypass test.
Then this test is broadened by using other conntrack marks that we have customized for the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 33938 0 --:--:-- --:--:-- --:--:-- 43000
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.585 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.585/0.585/0.585/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.518 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.518/0.518/0.518/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 54670 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 97.9 MBytes 821 Mbits/sec 84 1.77 MBytes [ 5] 1.00-2.00 sec 146 MBytes 1.23 Gbits/sec 68 1.36 MBytes [ 5] 2.00-3.00 sec 228 MBytes 1.91 Gbits/sec 0 1.45 MBytes [ 5] 3.00-4.00 sec 264 MBytes 2.21 Gbits/sec 0 1.58 MBytes [ 5] 4.00-5.00 sec 269 MBytes 2.25 Gbits/sec 190 1.21 MBytes [ 5] 5.00-6.00 sec 282 MBytes 2.37 Gbits/sec 0 1.37 MBytes [ 5] 6.00-7.00 sec 196 MBytes 1.65 Gbits/sec 0 1.46 MBytes [ 5] 7.00-8.00 sec 225 MBytes 1.88 Gbits/sec 0 1.56 MBytes [ 5] 8.00-9.00 sec 235 MBytes 1.97 Gbits/sec 0 1.66 MBytes [ 5] 9.00-10.00 sec 152 MBytes 1.28 Gbits/sec 27 1.27 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.05 GBytes 1.76 Gbits/sec 369 sender [ 5] 0.00-10.00 sec 2.04 GBytes 1.75 Gbits/sec receiver iperf Done.
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2026-10:39:59.141854 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54654 -> 40.0.0.2:5001 02/19/2026-10:39:59.143080 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54670 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*mark=129834765.*$Show output
icmp 1 19 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=26 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=26 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=54670 dport=5001 packets=1516307 bytes=2274438345 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=54670 packets=176839 bytes=9192720 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=54654 dport=5001 packets=16 bytes=1301 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=54654 packets=13 bytes=1018 [ASSURED] (Sc: not-bypass) mark=129834765 use=1 icmp 1 19 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=346 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=346 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Note
The following steps are just a reiteration of the previous test, but with the difference that the conntrack mark used is an extra connmark.
Step 9: Modify the following configuration lines in DUT0 :
set service firewall FW stream bypass extra-mark 2 mask 3294967295 set service firewall FW stream bypass extra-mark 2 set-extra-connmark set service firewall FW stream bypass extra-mark 2 value 3294967295 set traffic policy FW_PLAN rule 2 selector FW_SEL_EXTRA_MARK set traffic selector FW_SEL_EXTRA_MARK rule 1 not extra-connmark 2 value 3294967295
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1Expect this output in
DUT2:Connecting to host 40.0.0.2, port 5001 [ 5] local 20.0.0.2 port 58372 connected to 40.0.0.2 port 5001 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 170 MBytes 1.43 Gbits/sec 13 1.83 MBytes [ 5] 1.00-2.00 sec 220 MBytes 1.85 Gbits/sec 16 1.40 MBytes [ 5] 2.00-3.00 sec 205 MBytes 1.72 Gbits/sec 0 1.50 MBytes [ 5] 3.00-4.00 sec 208 MBytes 1.74 Gbits/sec 0 1.60 MBytes [ 5] 4.00-5.00 sec 260 MBytes 2.18 Gbits/sec 0 1.71 MBytes [ 5] 5.00-6.00 sec 245 MBytes 2.05 Gbits/sec 0 1.80 MBytes [ 5] 6.00-7.00 sec 210 MBytes 1.77 Gbits/sec 96 1.36 MBytes [ 5] 7.00-8.00 sec 259 MBytes 2.17 Gbits/sec 0 1.50 MBytes [ 5] 8.00-9.00 sec 241 MBytes 2.02 Gbits/sec 0 1.60 MBytes [ 5] 9.00-10.00 sec 266 MBytes 2.23 Gbits/sec 0 1.71 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 2.23 GBytes 1.92 Gbits/sec 125 sender [ 5] 0.00-10.00 sec 2.23 GBytes 1.91 Gbits/sec receiver iperf Done.
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2026-10:39:59.141854 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54654 -> 40.0.0.2:5001 02/19/2026-10:39:59.143080 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:54670 -> 40.0.0.2:5001 02/19/2026-10:40:14.036017 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58356 -> 40.0.0.2:5001 02/19/2026-10:40:14.037161 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:58372 -> 40.0.0.2:5001
Step 12: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.*emark2=3294967295.*$Show output
tcp 6 9 CLOSE src=20.0.0.2 dst=40.0.0.2 sport=58372 dport=5001 packets=1653793 bytes=2480681721 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=58372 packets=203173 bytes=10555532 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 tcp 6 19 TIME_WAIT src=20.0.0.2 dst=40.0.0.2 sport=58356 dport=5001 packets=16 bytes=1297 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=58356 packets=13 bytes=1020 [ASSURED] (Sc: not-bypass) mark=129834765 emark2=3294967295 use=1 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Test Bypass-Drop Using Conntrack Marks
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test is aimed at configuring “Capture bypass drop” to avoid dropped packets from entering the firewall.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 572 0 --:--:-- --:--:-- --:--:-- 571
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW bypass action drop set connmark mark 147652983 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action drop set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic queue FW_Q elements 1 set traffic selector FW_SEL_DROP rule 1 connmark 147652983
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.648 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.648/0.648/0.648/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.627 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.627/0.627/0.627/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2026-10:40:50.083339 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47982 -> 40.0.0.2:5000
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*mark=147652983.*$Show output
icmp 1 26 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=349 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=349 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 26 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=29 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=29 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=47982 dport=5000 packets=8 bytes=610 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=47982 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=147652983 use=1 conntrack v1.4.7 (conntrack-tools): 3 flow entries have been shown.
Step 9: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 4 7 210 438 2 - 3 3 228 228 ------------------------------------------------------------------ Total 7 7 438 438 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high ------------------------------------------------------------------ rule selector pkts match pkts eval bytes match bytes eval ------------------------------------------------------------------ 1 FW_SEL_DROP 6 11 499 868 2 - 5 5 369 369 ------------------------------------------------------------------ Total 11 11 868 868
Note
Testing with another conntrack mark.
Step 10: Modify the following configuration lines in DUT0 :
delete service firewall FW bypass action drop set connmark mark set service firewall FW bypass action drop set connmark extra-mark 2 value 3967295294 set traffic policy FW_PLAN rule 1 selector FW_SEL_DROP_EM set traffic selector FW_SEL_DROP_EM rule 1 extra-connmark 2 value 3967295294
Step 11: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 12: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2026-10:40:50.083339 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47982 -> 40.0.0.2:5000 02/19/2026-10:40:57.165137 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47982 -> 40.0.0.2:5000 02/19/2026-10:40:58.711820 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:50970 -> 40.0.0.2:5000
Step 13: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5000.*emark2=3967295294.*$Show output
tcp 6 29 LAST_ACK src=20.0.0.2 dst=40.0.0.2 sport=50970 dport=5000 packets=9 bytes=700 src=40.0.0.2 dst=20.0.0.2 sport=5000 dport=50970 packets=5 bytes=270 [ASSURED] (Sc: not-bypass) mark=0 emark2=3967295294 use=1 conntrack v1.4.7 (conntrack-tools): 1 flow entries have been shown.
Step 14: Run command traffic policy FW_PLAN show at DUT0 and check if output matches the following regular expressions:
(?m)^1\s+FW_SEL_DROP_EM\s+[1-9].*$Show output
Policy FW_PLAN -- ifc eth1.101 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 4 7 210 376 2 - 3 3 166 166 --------------------------------------------------------------------- Total 7 7 376 376 Policy FW_PLAN -- ifc eth1.201 -- hook in prio very-high --------------------------------------------------------------------- rule selector pkts match pkts eval bytes match bytes eval --------------------------------------------------------------------- 1 FW_SEL_DROP_EM 6 11 499 830 2 - 5 5 331 331 --------------------------------------------------------------------- Total 11 11 830 830
Test Capture And Offload
Description
Builds a scenario with three DUTs in which a performance test is conducted between DUT1 and DUT2, and DUT0 is the router running the firewall. This test sets the conntrack mark directly, thus skipping all the steps required to set it later. In addition, OSDx is instructed to accelerate the flow using internal accelerators.
Performance must improve considerably compared to the previous test, to reach its top value.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/test-performance.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 129 100 129 0 0 19439 0 --:--:-- --:--:-- --:--:-- 21500
Step 2: Run command file show running://test-performance.rules at DUT0 and expect this output:
Show output
alert tcp any any -> any 5001 (msg: "Skipping test network performance traffic"; bypass; flow: established, to_server; sid: 40;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://test-performance.rules' set service firewall FW stream bypass action accept set conntrack offload-flag set service firewall FW stream bypass mark 129834765 set service firewall FW stream bypass mask 129834765 set service firewall FW stream bypass set-connmark set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic policy FW_PLAN rule 2 action enqueue FW_Q set traffic policy FW_PLAN rule 2 selector FW_SEL_ENQUEUE set traffic queue FW_Q elements 1 set traffic selector FW_SEL_ENQUEUE rule 1 not connmark 129834765
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.534 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.534/0.534/0.534/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.536 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.536/0.536/0.536/0.000 ms
Step 6: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5001 parallel 1
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance traffic).+$Show output
02/19/2026-10:41:23.806743 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53362 -> 40.0.0.2:5001 02/19/2026-10:41:23.807898 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53368 -> 40.0.0.2:5001
Step 8: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^tcp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53362 dport=5001 packets=8 bytes=589 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53362 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53368 dport=5001 packets=12797 bytes=19189753 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53368 packets=2462 bytes=128044 [ASSURED] [OFFLOAD, packets=12785 bytes=19176052 packets=2460 bytes=127932] mark=129834765 use=2 icmp 1 29 src=20.0.0.2 dst=40.0.0.2 type=8 code=0 id=32 packets=1 bytes=84 src=40.0.0.2 dst=20.0.0.2 type=0 code=0 id=32 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 icmp 1 29 src=40.0.0.2 dst=20.0.0.2 type=8 code=0 id=352 packets=1 bytes=84 src=20.0.0.2 dst=40.0.0.2 type=0 code=0 id=352 packets=1 bytes=84 (Sc: not-bypass) mark=0 use=1 conntrack v1.4.7 (conntrack-tools): 4 flow entries have been shown.
Step 9: Stop the current bandwidth test between DUT2 and DUT1
Step 10: Run command file copy http://10.215.168.1/~robot/test-performance-udp.rules running:// force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 133 100 133 0 0 2177 0 --:--:-- --:--:-- --:--:-- 2180
Step 11: Run command file show running://test-performance-udp.rules at DUT0 and expect this output:
Show output
alert udp any any -> any 5001 (msg: "Skipping test network performance UDP traffic"; bypass; flow: established, to_server; sid: 41;)
Step 12: Modify the following configuration lines in DUT0 :
set service firewall FW ruleset file 'running://test-performance-udp.rules'
Step 13: Initiate a background bandwidth test from DUT2 to DUT1. The control is returned back allowing to perform another tasks while test is running
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 udp port 5001 parallel 1
Step 14: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Skipping test network performance UDP traffic).+$Show output
02/19/2026-10:41:23.806743 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53362 -> 40.0.0.2:5001 02/19/2026-10:41:23.807898 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53368 -> 40.0.0.2:5001 02/19/2026-10:41:25.765578 [**] [1:40:0] Skipping test network performance traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:53378 -> 40.0.0.2:5001 02/19/2026-10:41:25.767249 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:39006 -> 40.0.0.2:5001 02/19/2026-10:41:25.778008 [**] [1:41:0] Skipping test network performance UDP traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:39006 -> 40.0.0.2:5001
Step 15: Run command system conntrack show at DUT0 and check if output matches the following regular expressions:
(?m)^udp\s+.*src=20.0.0.2 dst=40.0.0.2.+dport=5001.+OFFLOAD.+mark=129834765.*$Show output
udp 17 src=20.0.0.2 dst=40.0.0.2 sport=39006 dport=5001 packets=9 bytes=11840 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=39006 packets=1 bytes=32 [OFFLOAD, packets=5 bytes=7380 packets=0 bytes=0] mark=129834765 use=2 tcp 6 src=20.0.0.2 dst=40.0.0.2 sport=53378 dport=5001 packets=8 bytes=607 src=40.0.0.2 dst=20.0.0.2 sport=5001 dport=53378 packets=7 bytes=376 [ASSURED] [OFFLOAD, packets=2 bytes=104 packets=4 bytes=211] mark=129834765 use=3 conntrack v1.4.7 (conntrack-tools): 2 flow entries have been shown.
Step 16: Stop the current bandwidth test between DUT2 and DUT1
Test Traffic Early Dropping
Description
Builds a scenario with three DUTs and a simple ruleset to drop TCP traffic between DUT1 and DUT2. Such traffic must pass through port 5000 for the rule to match. Later, XDP is queried to check if packets are being dropped at the specified interface.
The contents of the rule file are:
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;)
This rule allows the connection to be established and traffic to be dropped later.
Scenario
Step 1: Run command file copy http://10.215.168.1/~robot/drop-performance.rules running://drop-performance.rules force at DUT0 and expect this output:
Show output
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 200 100 200 0 0 22537 0 --:--:-- --:--:-- --:--:-- 25000
Step 2: Run command file show running://drop-performance.rules at DUT0 and expect this output:
Show output
drop tcp any any -> any 5000 (msg: "Dropping TCP performance test traffic"; sid: 1; flow: established, to_server;) drop udp any any -> any 5001 (msg: "Dropping UDP performance test traffic"; sid: 2;)
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 traffic nat source rule 1 address masquerade set interfaces ethernet eth1 vif 101 address 40.0.0.1/8 set interfaces ethernet eth1 vif 101 traffic policy in FW_PLAN set interfaces ethernet eth1 vif 201 address 20.0.0.1/8 set interfaces ethernet eth1 vif 201 traffic policy in FW_PLAN set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns static host-name WAN inet 10.215.168.1 set service firewall FW logging level config set service firewall FW logging outputs fast set service firewall FW mode inline queue FW_Q set service firewall FW ruleset file 'running://drop-performance.rules' set service firewall FW stream bypass action drop set xdp-early-drop eth1 set service firewall FW validator-timeout 20 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set traffic policy FW_PLAN rule 1 action enqueue FW_Q set traffic queue FW_Q elements 1
Step 4: Ping IP address 20.0.0.2 from DUT1:
admin@DUT1$ ping 20.0.0.2 count 1 size 56 timeout 1Show output
PING 20.0.0.2 (20.0.0.2) 56(84) bytes of data. 64 bytes from 20.0.0.2: icmp_seq=1 ttl=63 time=0.681 ms --- 20.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.681/0.681/0.681/0.000 ms
Step 5: Ping IP address 40.0.0.2 from DUT2:
admin@DUT2$ ping 40.0.0.2 count 1 size 56 timeout 1Show output
PING 40.0.0.2 (40.0.0.2) 56(84) bytes of data. 64 bytes from 40.0.0.2: icmp_seq=1 ttl=63 time=0.623 ms --- 40.0.0.2 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.623/0.623/0.623/0.000 ms
Step 6: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5000 admin@DUT2$ monitor test performance client 40.0.0.2 duration 10 port 5000 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr iperf3: interrupt - the client has terminated admin@osdx$
Step 7: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping TCP performance test traffic).+$Show output
02/19/2026-10:41:48.123981 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47054 -> 40.0.0.2:5000
Step 8: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 20.0.0.2 40.0.0.2 47054 5000 yes 201 0 8 673 40.0.0.2 20.0.0.2 5000 47054 yes 201 0 0 0
Step 9: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250157s ending at 1771497711.786512 XDP_DROP 9 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 13 pkts ( 0 pps) 1 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)
Step 10: Initiate a bandwidth test from DUT2 to DUT1
admin@DUT1$ monitor test performance server port 5001 admin@DUT2$ monitor test performance client 40.0.0.2 duration 30 udp port 5001 parallel 1Expect this output in
DUT2:^C- - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams iperf3: interrupt - the client has terminated admin@osdx$
Step 11: Run command service firewall FW show logging fast | tail at DUT0 and check if output matches the following regular expressions:
(?m)^.+(Dropping UDP performance test traffic).+$Show output
02/19/2026-10:41:48.123981 [Drop] [**] [1:1:0] Dropping TCP performance test traffic [**] [Classification: (null)] [Priority: 3] {TCP} 20.0.0.2:47054 -> 40.0.0.2:5000 02/19/2026-10:41:51.955504 [Drop] [**] [1:2:0] Dropping UDP performance test traffic [**] [Classification: (null)] [Priority: 3] {UDP} 20.0.0.2:47481 -> 40.0.0.2:5001
Step 12: Run command service firewall FW show early-drop-stats eth1 at DUT0 and check if output matches the following regular expressions:
yes\s+201\s+\d+\s+[1-9]\d*\s+[1-9]\d*Show output
------------------------------------------------------------------------ src dst src port dst port tcp vlan_0 vlan_1 pkts bytes ------------------------------------------------------------------------ 40.0.0.2 20.0.0.2 5001 47481 no 201 0 0 0 20.0.0.2 40.0.0.2 47054 5000 yes 201 0 12 905 40.0.0.2 20.0.0.2 5000 47054 yes 201 0 0 0 20.0.0.2 40.0.0.2 47481 5001 no 201 0 0 0
Step 13: Run command interfaces ethernet eth1 monitor xdp-stats times 1 at DUT0 and expect this output:
Show output
Pin path: /sys/fs/bpf/eth1 Period of 0.250155s ending at 1771497715.641170 XDP_DROP 12 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_PASS 33 pkts ( 0 pps) 2 KiB ( 0 Mbits/s) XDP_TX 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s) XDP_REDIRECT 0 pkts ( 0 pps) 0 KiB ( 0 Mbits/s)