This section describes the procedure to capture virtual service and SE traffic through CLI.

The Service Engine and virtual service can now use AND/OR/NOT filters for packet capture.

The new field capture_pkt_filter introduced as part of debugserviceengine / debugvirtualservice can now take a combination of atmost 20 different filters that can be OR’ed among each other.

Starting with Avi Load Balancer 30.2.1 version, IPv4, TCP filters are supported. The capture_pkt_filter provides the following schema:

[admin:controller]: debugserviceengine:capture_pkt_filter>
capture_tcp_filters   (submode)

[admin:controller]: debugserviceengine:capture_pkt_filter:capture_tcp_filters>
dst_port_range   (submode)
eth_proto        Ethernet Proto filter.
host_ip          (submode)
save             Save and exit the current submode
show_schema      show object schema
src_port_range   (submode)
tcpflag          (submode)

Field Name

Action

dst_port_range

Destination port range filter.

src_port_range

Source port range filter.

eth_proto

Ethernet protocol filter. This field supports only IPv4.

ip_proto

IP protocol filter. This field supports TCP only.

host_ip

Takes host address as input with multiple hosts or range of host IPs or prefix of a subnet.

tcpflags                        

Takes combination of TCP flags (tcp_syn, tcp_ack, tcp_fin, tcp_push, tcp_rst) as input and can be used with AND/ OR/ NOT filters.

match_operation

This is a part of each submode and take value as [IS_IN or IS_NOT_IN] to provide NOT like capability.

filter_operation

This is part of submode tcpflags only, takes value [AND or OR] to provide logical AND/ OR like capability.

Configuration Example

[admin:vmware-ctlr]: debug serviceengine Avi-se-vqnny capture_pkt_filters
[admin:vmware-ctlr]: debugserviceengine> capture_pkt_filter
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter> capture_tcp_filters
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters>
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:host_ip> addrs 1.1.1.1
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:host_ip> addrs 2.2.2.2
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:host_ip> save
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters> eth_proto eth_type_ipv4
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters> dst_port_range
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:dst_port_range> dst_port_start 2000
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:dst_port_range> dst_port_end 5000
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:dst_port_range> save
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:src_port_range> src_port_start 60124
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:src_port_range> src_port_end 62000
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:src_port_range> save
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters> tcpflag
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:tcpflag> tcp_syn
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:tcpflag> tcp_fin
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:tcpflag> match_operation is_in
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:tcpflag> filter_op or
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters:tcpflag> save
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter:capture_tcp_filters> save
[admin:vmware-ctlr]: debugserviceengine:capture_pkt_filter> save
[admin:vmware-ctlr]: debugserviceengine> save
[admin:vmware-ctlr]: debugserviceengine> save
+----------------------------+-----------------------------------------+
| Field                      | Value                                   |
+----------------------------+-----------------------------------------+
| uuid                       | se-df929027-a766-425a-b661-429e32eb405f |
| name                       | Avi-se-vqnny                            |
| capture_pkt_filters        |                                         |
|   capture_tcp_filter[1]    |                                         |
|     host_ip                |                                         |
|       [1]                  | 1.1.1.1                                 |
|       [2]                  | 2.2.2.2                                 |
|     eth_proto              | ETH_TYPE_IPV4                           |
|     dst_port_range         |                                         |
|       dst_port_start       | 2000                                    |
|       dst_port_end         | 5000                                    |
|     src_port_range         |                                         |
|       src_port_start       | 60124                                   |
|       src_port_end         | 62000                                   |
|     tcpflag                |                                         |
|       tcp_syn              | True                                    |
|       tcp_fin              | True                                    |
|       match_operation      | IS_IN                                   |
|       filter_op            | OR                                      |
| tenant_ref                 | admin                                   |
+----------------------------+-----------------------------------------+

The capture_tcp_filter field is a repeated field (max 20) and can be configured with different combinations. The set of capture_tcp_filter is OR’ed among each other.