Filter
Top Products
Chapter 5
Packet Classification and Labelling
E-NIT-CTC-20041213-0013 v0.5
47
5.3.2 Rule debug commands
Introduction Under the subgroup rule there is an other subgroup called debug. This subgroup is
used to debug the rules.
There are only three parameters that can be used here :
Traceconfig
Execute the following CLI command to enable the trace output:
Traceconfig result The output will look similar to this one:
When a packet is received it will be checked against all the rules.
On the first line we see that the packet is checked against the rule 17 in the chain
qos_default_labels.
On the second line we see that rule 17 aplies to all packets of the ike type.
Line three shows that the packet does not match the rule. (- expr serv ike)
Line four shows the next rule that will be checked. This is rule 18 of the chain
qos_defqult_labels.
Line five shows that this rule applies to all packets of the icmp type.
Line six and seven show that this rule applies to this packet. (+ expr serv icmp)
Line eight shows that the rule matching has ended.
Traceconfig values Description
enable If the parameter has been enabled the label rules will
be shown in the trace output.
disable If the parameter has been disabled the label rules will
not be shown in the trace output.
{Administrator}=>:label rule debug label rule debug traceconfig
state=enabled
To enable the trace output press “Ctrl+Q” in the CLI connection to disable
the trace output press “Ctrl+S”
[PF] chain qos_default_labels rule 17:
[PF] > expr serv ike
[PF] > - expr serv ike
[PF] chain qos_default_labels rule 18:
[PF] > expr serv icmp
[PF] > + expr icmp[1] : proto=1
[PF] > + expr serv icmp
[PF] chain qos_default_labels rule 18 applies, processing STOP,
returning 2