traffic drop

[suthomas1]

Hi, I am looking for some command ( on CLI ) to see the conversation between two hosts. I am aware of the diag command , but will it show what packets are dropped by the firewall between those two hosts? eg. if host A talks to host B on port 2601 & assume the firewall is not yet allowing this port between them, how can we know if this port is dropped due to no policy in place. Thanks in advance.[size=2][/size][size=3][/size]

[emnoc]

If their' s no policy it should be drop. To answer your question, what diag command are you referencing? To give you an ideal of one way to monitor; diag debug reset diag debug flow filter port 2601 diag debug flow show console enable diag debug flow trace start 100 diag debug en Than you will have a trace message similar to this; id=36870 trace_id=398 msg=" vd-root received a packet(proto=6, 14.16.111.202:23747->19.1.15.78:2601) from wan1." id=36870 trace_id=398 msg=" allocate a new session-3bb092a8" id=36870 trace_id=398 msg=" find a route: gw-19.1.15.78 via wan2" id=36870 trace_id=398 msg=" Denied by forward policy check" id=36870 trace_id=399 msg=" vd-root received a packet(proto=6, 14.16.111.202:23747->19.1.15.78:2601) from wan1." id=36870 trace_id=399 msg=" allocate a new session-3bb094eb" id=36870 trace_id=399 msg=" find a route: gw-19.1.15.78 via wan2" id=36870 trace_id=399 msg=" Denied by forward policy check" Since no fwpolicy was inplace , the packets are denied by the forward policy check

[suthomas1]

Thank you for the reply. Considering that i do not know the port involved, do we have some similar command to trace communication between two IP' s and find out if any required ports are being dropped by firewall for not being in policy or for any other reasons. Appreciate the help.

[emnoc]

Sure just change the diag debug flow to a filter of the addr involved

diag debug reset diag debug flow filter addr x.x.x.x diag debug flow show console enable diag debug flow trace start 100 diag debug en

Suggestion, do a diag debug flow filter ? to see what filters you can apply diag debug is your friend. Alternative ( for general monitoring ) you can see what traffic is coming to your host using the diag sniffer command You can using diag sys session and filters to look at session to your host