net packet-tester security

net packet-tester security(1) BIG-IP TMSH Manual net packet-tester security(1)



NAME
       packet-tester - Shows if packet with given parameters passes through
       data path , which AFM policies and rules will be applied to the packet,
       if it will be dropped or not. This is shown for Dos in global and
       Virtual server context, IP Intelligence and ACL in global, route domain
       and listener context. You can only use the show command with this
       component.

MODULE
       net

SYNTAX
	show packet-tester security
	     dest-addr [IP address]
	     source-addr [IP address]
	     dest-port [TCP/UDP port]
	     source-port [TCP/UDP port]
	     protocol [protocol]
	     src-vlan [source vlan name]
	     check-staged[enable/disable]
	     trigger-log[enable/disable]
	     ttl[1 to 255]
	     syn[SYN TCP FLAG]
	     ack[ACK TCP FLAG]
	     rst[RST TCP FLAG]
	     fin[FIN TCP FLAG]
	     push[PUSH TCP FLAG]
	     urg[URG TCP FLAG]

DESCRIPTION
       With user provided VLAN, source/destination IP addresses, TCP/UDP ports
       and protocol, the command will craft a packet and insert into data path
       to match these parameters against user configured DOS, ACL rules and IP
       intelligence  global, route domain, VIP/SelfIP context, and return
       which policies, rules applied and the final action taken on packet.
       Both IPv4 and IPv6 addresses and IP/UDP/TCP/SCTP protocols are
       supported. Detail option with provide which specific policy and rule
       will be applied to such a packet. This command can be used as a
       diagnostic tool to trouble-shoot BigIP AFM configuration problem. It
       provides a faster way to identify which AFM config will have impact to
       the specified packet stream.

EXAMPLES
       [root@bigip208:Active:Standalone] rpm # tmsh -s -m show net packet-
       tester security dst-addr 41.41.41.41 dst-port 80 src-addr 8.8.8.1 src-
       port 99 protocol udp src-vlan /Common/internal detail

	*************************
	Packet Tester Data:
	*************************

	Source IP/Port:8.8.8.1/99 Src Vlan /Common/internal
	Destination IP/Port:41.41.41.41/80
	Packet Protocol: udp
	Packet Trace Option: Check Staged:Disable, Trigger Log:Disable

	Stage:Device-DoS
	Result: Allow, No Anomaly
	Other Information
	  Dos Vector: UDP flood
	  Dos White list: No
	  Log Config:Disable

	Stage:Device-IP Intelligence
	Result: No Policy
	Other Information
	  Policy Name: unset
	  Source Hit Type: No Match
	  Source Category: unset
	  Drop Source:No
	  Destination Hit Type: No Match
	  Destination Category: unset
	  Drop Destination:No
	  Log Config:Disable

	Stage:Device-Access Control
	Result: Allow
	Other Information
	  Policy Name: /Common/policy1
	  Policy Type: Enforced
	  Rule Name: packet_test_udp_rule
	  Source FQDN: No-lookup
	  Destination FQDN: No-lookup
	  Source Geo: No-lookup
	  Dest Geo: No-lookup
	  iRule:unset
	  Log Config:Disable

	Stage:Route Domain-IP Intelligence (/Common/0)
	Result: No Policy
	Other Information
	  Policy Name: unset
	  Source Hit Type: No Match
	  Source Category: unset
	  Drop Source:No
	  Destination Hit Type: No Match
	  Destination Category: unset
	  Drop Destination:No
	  Log Config:Disable

	Stage:Route Domain-Access Control (/Common/0)
	Result: Allow
	Other Information
	  Policy Name: /Common/policy1
	  Policy Type: Enforced
	  Rule Name: packet_test_udp_rule
	  Source FQDN: No-lookup
	  Destination FQDN: No-lookup
	  Source Geo: No-lookup
	  Destination Geo: No-lookup
	  iRule:unset
	  Log Config:Disable

	Stage:Listener-DoS (/Common/packet_test_catchall)
	Result: No Policy
	Other Information
	  Dos Profile Name: unset
	  Dos Vector: unset
	  Dos White list: No
	  Log Config:Disable

	Stage:Listener-IP Intelligence (/Common/packet_test_catchall)
	Result: No Policy
	Other Information
	  Policy Name: unset
	  Source Hit Type: No Match
	  Source Category: unset
	  Drop Source:No
	  Destination Hit Type: No Match
	  Destination Category: unset
	  Drop Destination:No
	  Log Config:Disable

	Stage:Listener-Access Control (/Common/packet_test_catchall)
	Result: Allow
	Other Information
	  Policy Name: /Common/policy1
	  Policy Type: Enforced
	  Rule Name: packet_test_udp_rule
	  Source FQDN: No-lookup
	  Destination FQDN: No-lookup
	  Source Geo: No-lookup
	  Destination Geo: No-lookup
	  iRule:unset
	  Log Config:Disable

	Final Result
	Source IP/Port:8.8.8.1/99 Src Vlan /Common/internal
	Destination IP/Port:41.41.41.41/80
	Packet Protocol: udp
	Packet Trace Option: Check Staged:Disable, Trigger Log:Disable
	Final Action : Allow
	Total records returned: 1

COPYRIGHT
       No part of this program may be reproduced or transmitted in any form or
       by any means, electronic or mechanical, including photocopying,
       recording, or information storage and retrieval systems, for any
       purpose other than the purchaser's personal use, without the express
       written permission of F5 Networks, Inc.

       F5 Networks and BIG-IP (c) Copyright 2008-2016. All rights reserved.



BIG-IP				  2016-09-13	 net packet-tester security(1)