The following command outputs are examples only; actual displays may differ depending on supported functionality and user configuration.
This command displays DHCP filter information.
The following is a sample command output for the command when no filter ID is specified.
This command displays DHCP6 filter information.
This command displays GRE tunnel template information.
The following output is an example of GRE tunnel template information.
This command displays IPv4 filter information.
When effective-action is specified, this command displays what effectively happens to a packet that matches the criteria associated with the IPv4 filter policy.
Show Filter (no policy specified) — The following is a sample output of IPv4 filter information when no policy is specified. Table 61 describes the command output fields.
Label | Description |
Filter Id | The IP filter ID |
Scope | Template — the filter policy is of type template |
Exclusive—the filter policy is of type exclusive | |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Description | The IP filter policy description |
Show Filter (no filter-id specified, embedded keyword specified) — The following is a sample output of IPv4 filter information when no filter ID is specified but the embedded keyword is specified. Table 62 describes the command output fields.
Label | Description |
In | Shows embedding filter index |
From | Shows embedded filters included |
Priority | Shows priority of embedded filter |
Inserted | Shows embedded/total number of entries from embedded filter. Status: OK — embedding operation successful, if any entries are overwritten this will also be indicated Failed — embedding failed, the reason is displayed (out of resources) |
Show Filter (with filter-id specified) — The following is a sample output of IPv4 filter information with the filter ID specified. Table 63 describes the command output fields.
Label | Description |
Filter Id | The IPv4 filter policy ID |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Scope | Template — the filter policy is of type template |
Exclusive — the filter policy is of type exclusive | |
Type | Normal — the filter policy is of type normal |
src-mac — the filter policy is of type src-mac | |
Packet-length — the filter policy is of type packet-length | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
System filter | Indicates if the filter has been chained to a system filter |
Radius Ins Pt | Indicates the RADIUS insertion point, if any |
CrCtl. Ins Pt | Indicates the Credit Control insertion point, if any |
RadSh. Ins Pt | Indicates the RADIUS shared insertion point, if any |
PccRl. Ins Pt | Indicates the PCC rule insertion point, if any |
Entries | The number of entries configured in this filter ID |
Description | The IPv4 filter policy entry description string |
Filter Match Criteria | IP — indicates the filter is an IPv4 filter policy |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Description | The IPv4 filter policy entry description string |
Log Id | The filter log ID |
Src. IP | The source IPv4 address and prefix length match criterion; “0.0.0.0/0” indicates no criterion specified for the filter entry |
Src. Port | The source TCP, UDP, or SCTP port number, port range, or port match list |
Dest. IP | The destination IPv4 address and prefix length match criterion; “0.0.0.0/0” indicates no criterion specified for the filter entry |
Dest. Port | The destination TCP, UDP, or SCTP port number, port range, or port match list |
Protocol | The protocol for the match criteria; undefined indicates no protocol specified |
Dscp | The DiffServ Code Point (DSCP) name |
ICMP Type | The ICMP type match criterion; undefined indicates no ICMP type specified |
ICMP Code | The ICMP code field in the ICMP header of an IPv4 packet |
Fragment | False — indicates if the filter is configured to match on all non-fragmented packets |
True — indicates if the filter is configured to match on all fragmented packets | |
First-Only — indicates if the filter is configured to match the first fragment of a fragmented packet | |
Non-First-Only — indicates if the filter is configured to match a fragment of a fragmented packet, but not the first fragment | |
Off — fragments are not a matching criteria. All fragments and non-fragments implicitly match | |
Src Route Opt | Indicates if the source route option has been set |
Sampling | Off — specifies that traffic sampling is disabled |
On—specifies that traffic matching the associated IPv4 filter entry is sampled | |
Int. Sampling | Off — interface traffic sampling is disabled |
On — interface traffic sampling is enabled | |
IP-Option | Specifies matching packets with a specific IPv4 option or a range of IPv4 options in the IPv4 header for IPv4 filter match criteria |
Multiple Option | Off — the option fields are not checked |
On — packets containing one or more option fields in the IPv4 header will be used as IPv4 filter match criteria | |
Tcp-flag | Specifies the list of TCP flags selected:
TCP flags not selected as match criteria are not displayed Example: Matching “tcp-ack true” and “tcp-rst false” is represented in the show command as Tcp-flag : Ack !Rst |
Option-present | Off — specifies not to search for packets that contain the option field or have an option field of zero |
On — matches packets that contain the option field or have an option field of zero be used as IPv4 filter match criteria | |
Egress PBR | Indicates if the egress-pbr flag is set for this entry |
Primary Action | Indicates the configured action, if any; indented sub-labels in the show output provide configured parameters for this action |
Secondary Action | Indicates the configured secondary action, if any; indented sub-labels in the show output provide configured parameters for this action |
PBR Target Status | The status of the target of the primary or secondary action based on simple checks |
Extended Action | Indicates the configured extended action, if any |
PBR Down Action | Indicates the action to take when the target is down; packets that match the entry criteria will be subject to the PBR Down Action in case the target of the main action is down |
Downloaded Action | The action downloaded by CPM to IOM |
Dest. Stickiness | Indicates whether stickiness is configured |
Hold Remain | The stickiness timer |
Ing. Matches | The number of ingress filter matches/hits for the filter entry |
Egr. Matches | The number of egress filter matches/hits for the filter entry |
Show Filter Associations — The following is a sample output of IPv4 filter information when the associations keyword is specified. Table 64 describes the command output fields.
Label | Description |
Filter Id | The IPv4 filter policy ID |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Type | Normal — the filter policy is of type normal |
src-mac — the filter policy is of type src-mac | |
Packet-length — the filter policy is of type packet-length | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop—the default action for the filter ID for packets that do not match the filter entries is to drop | |
System filter | Indicates if the filter has been chained to a system filter |
Radius Ins Pt | Indicates the RADIUS insertion point, if any |
CrCtl. Ins Pt | Indicates the Credit Control insertion point, if any |
RadSh. Ins Pt | Indicates the RADIUS shared insertion point, if any |
PccRl. Ins Pt | Indicates the PCC rule insertion point, if any |
Entries | The number of entries configured in this filter ID |
Description | The IPv4 filter policy description |
Filter Association | Indicates the filter is an IPv4 filter policy |
Service Id | The service ID on which the filter policy ID is applied; the output also provides a list of service points where the filter has been applied |
Type | The type of service of the service ID |
(Ingress) | The filter policy ID is applied as an ingress filter policy on the interface |
(Egress) | The filter policy ID is applied as an egress filter policy on the interface |
Show Filter Counters — The following is a sample output of IPv4 filter information when the counters keyword is specified. Table 65 describes the command output fields.
Egress counters count the packets without Layer 2 encapsulation. Ingress counters count the packets with Layer 2 encapsulation.
Label | Description |
Filter Id | The IPv4 filter policy ID |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
System filter | Indicates if the filter has been chained to a system filter |
Radius Ins Pt | Indicates the RADIUS insertion point, if any |
CrCtl. Ins Pt | Indicates the Credit Control insertion point, if any |
RadSh. Ins Pt | Indicates the RADIUS shared insertion point, if any |
PccRl. Ins Pt | Indicates the PCC rule insertion point, if any |
Entries | The number of entries configured in this filter ID |
Description | The IPv4 filter policy description |
Filter Match Criteria | IP — indicates the filter is an IPv4 filter policy |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Ing. Matches | The number of ingress filter matches/hits for the filter entry |
Egr. Matches | The number of egress filter matches/hits for the filter entry |
Show Filter IP Output (with effective-action specified) — The following is a sample output of IPv4 filter information when the effective-action keyword is specified. Table 66 describes the command output fields.
If the main action (either primary or secondary) cannot be performed, a reason will be given. This will be displayed on the same line as the Effective Action. The reason codes as currently defined are:
Label | Description |
Filter Id | The IPv4 filter policy ID |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
Entries | The number of entries configured in this filter ID |
Description | The IPv4 filter policy description |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Stickiness | No — stickiness is not configured |
Yes — stickiness is configured | |
PBR Dwn Act Override | Indicates whether or not the action to take when the PBR target is down has been overridden |
PBR Down Action | Indicates the action to take when the target is down; packets that match the entry criteria will be subject to the PBR Down Action in case the target of the main action is down |
Configuration | Section of the output providing information on the configured parameters |
Primary Action | The configured action, if any; indented sub-labels in the show output provide configured parameters for this action |
Secondary Action | The configured secondary action, if any; indented sub-labels in the show output provide configured parameters for this action |
Status/Target status based on extended checks | Section of the output providing information on the operational status of certain parameters |
Primary Action | The status of the target of the primary action, if any configured, based on extended checks |
Secondary Action | The status of the target of the secondary action, if any configured, based on extended checks |
Downloaded Action | The action downloaded by the CPM to the IOM |
Stickiness Timer | The status of the stickiness timer, if any |
Effective Action based on application context | Section of the output providing the effective action, in the context of services, that a packet matching the criteria will be subject to |
Service Id | The service ID on which the filter policy ID is applied; the output also provides a list of service points where the filter has been applied |
Type | The service type in which the service has been applied |
Ingress/Egress | The direction in which the service has been applied |
Effective Action | The effective action that the packet will be subject to |
Extended Action | Indicates the configured extended action, if any |
This command shows IPv4 exception information.
The following output is an example of IPv4 exception filter information, and Table 67 describes the fields.
Label | Description |
Filter-Id | The filter ID. |
Scope | Template — The filter policy is of type Template. Exclusive — The filter policy is of type Exclusive. |
Applied | No — The IPv6 exception filter has not been applied. Yes — The IPv6 exception filter is applied. |
Entries | The number of entries. |
Description | The description of the specified filter, if specified. |
Filter Name | The filter name. |
Filter Match Criteria | IP — indicates the filter is an IPv4 filter policy. |
Entry | The number of active or inactive entries. |
Description | The IPv4 filter policy entry description string. |
Src. IP | The source IP address of the logged packet. |
Src. Port | The source port of the logged packet. |
Dst. IP | The destination IP address of the logged packet. |
Dst. Port | The destination port of the logged packet. |
Protocol | The protocol for the match criteria; undefined indicates no protocol specified. |
ICMP Type | The ICMP type match criterion. Undefined indicates no ICMP type specified. |
Ing. Matches | The number of packets matched on ingress. |
Egr. Matches | The number of packets matched on egress. |
This command shows IPv6 filter information.
When effective-action is specified, this command displays what effectively happens to a packet that matches the criteria associated with the IPv6 filter policy.
Show Filter (no filter-id specified) — The following output is an example of IPv6 filter information when no filter ID is specified, and Table 68 describes the fields.
Label | Description |
Filter Id | The IPv6 filter ID |
Scope | Template — the filter policy is of type template |
Exclusive — the filter policy is of type exclusive | |
Applied | No — the filter policy ID has not been applied |
Yes—the filter policy ID is applied | |
Description | The IPv6 filter policy description |
In | Shows embedding filter index |
From | Shows embedded filters included |
Priority | Shows priority of embedded filter |
Inserted | Shows embedded/total number of entries from embedded filter Status: OK — embedding operation successful, if any entries are overwritten this will also be indicated Failed — embedding failed, the reason is displayed (out of resources) |
Show Filter (with filter-id specified) — The following output is an example of IPv6 filter information when filter-id is specified, and Table 69 describes the fields.
Label | Description |
Filter Id | The IPv6 filter policy ID |
Scope | Template — the filter policy is of type template |
Exclusive — the filter policy is of type exclusive | |
Entries | The number of entries configured in this filter ID |
Description | The IPv6 filter policy description |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
Filter Match Criteria | IP — indicates the filter is an IPv6 filter policy |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Log Id | The filter log ID |
Src. IP | The source IPv6 address and mask match criterion
|
Dest. IP | The destination IPv6 address and mask match criterion
|
Protocol | The protocol ID for the match criteria; undefined indicates no protocol specified |
ICMP Type | The ICMP type match criterion; undefined indicates no ICMP type specified |
Fragment | False — configures a match on all non-fragmented IPv6 packets |
True — configures a match on all fragmented IPv6 packets | |
Off — fragments are not a matching criteria; all fragments and nonfragments implicitly match | |
Sampling | Off — specifies that traffic sampling is disabled |
On — specifies that traffic matching the associated IPv6 filter entry is sampled | |
IP-Option | Specifies matching packets with a specific IPv6 option or a range of IPv6 options in the IPv6 header for IPv6 filter match criteria |
Match action | Default — the filter does not have an explicit forward or drop match action specified; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Drop — drop packets matching the filter entry | |
Forward—the explicit action to perform is forwarding of the packet; if the action is Forward, then if configured, the next hop information should be displayed, including nexthop: IPv6 address, Indirect: IPv6 address or Interface: IPv6 interface name | |
Ing. Matches | The number of ingress filter matches/hits for the filter entry |
Src. Port | The source TCP, UDP, or SCTP port number, port range, or port match list |
Dest. Port | The destination TCP, UDP, or SCTP port number, port range, or port match list |
Dscp | The DiffServ Code Point (DSCP) name |
ICMP Code | The ICMP code field in the ICMP header of an IPv6 packet |
Tcp-flag | Specifies the list of TCP flags selected:
TCP flags not selected as match criteria are not displayed Example: Matching “tcp-ack true” and “tcp-rst false” is represented in the show command as Tcp-flag : Ack !Rst |
Option-present | Off — specifies not to search for packets that contain the option field or have an option field of zero |
On — matches packets that contain the option field or have an option field of zero be used as IPv6 filter match criteria | |
Int. Sampling | Off — interface traffic sampling is disabled |
On — interface traffic sampling is enabled | |
Multiple Option | Off — the option fields are not checked |
On — packets containing one or more option fields in the IPv6 header will be used as IPv6 filter match criteria | |
Egr. Matches | The number of egress filter matches/hits for the filter entry |
Ing. Rate-limiter | The number of offered, forwarded, and dropped packet matches for the filter entry |
Show Filter Associations — The following output is an example of IPv6 filter information when the associations keyword is specified, and Table 70 describes the fields.
Label | Description |
Filter Id | The IPv6 filter policy ID |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Entries | The number of entries configured in this filter ID |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
Service Id | The service ID on which the filter policy ID is applied; the output also provides a list of service points where the filter has been applied |
SAP | The Service Access Point on which the filter policy ID is applied |
(Ingress) | The filter policy ID is applied as an ingress filter policy on the interface |
(Egress) | The filter policy ID is applied as an egress filter policy on the interface |
Type | The type of service of the service ID |
Entry | The filter entry ID; if the filter entry ID indicates the entry is Inactive, the filter entry is incomplete, no action was specified |
Log Id | The filter log ID |
Src. IP | The source IPv6 address and mask match criterion
|
Dest. IP | The destination IPv6 address and mask match criterion
|
Protocol | The protocol ID for the match criteria; undefined indicates no protocol specified |
ICMP Type | The ICMP type match criterion; undefined indicates no ICMP type specified |
Fragment | False — configures a match on all non-fragmented IPv6 packets |
True — configures a match on all fragmented IPv6 packets | |
Off — fragments are not a matching criteria; all fragments and nonfragments implicitly match | |
Sampling | Off — specifies that traffic sampling is disabled |
On — specifies that traffic matching the associated IPv6 filter entry is sampled | |
IP-Option | Specifies matching packets with a specific IPv6 option or a range of IPv6 options in the IPv6 header for IPv6 filter match criteria |
TCP-syn | False — configures a match on packets with the SYN flag set to false |
True — configures a match on packets with the SYN flag set to true | |
Off — the state of the TCP SYN flag is not considered as part of the match criteria | |
Match action | Default — the filter does not have an explicit forward or drop match action specified; if the filter entry ID indicates the entry is Inactive, the filter entry is incomplete, no action was specified |
Drop — drop packets matching the filter entry | |
Forward — the explicit action to perform is forwarding of the packet; if the action is Forward, then if configured the nexthop information should be displayed, including Nexthop: <IPv6 address>, Indirect: <IPv6 address> or Interface: <IPv6 interface name> | |
Ing. Matches | The number of ingress filter matches/hits for the filter entry |
Src. Port | The source TCP, UDP, or SCTP port number, port range, or port match list |
Dest. Port | The destination TCP, UDP, or SCTP port number, port range, or port match list |
Dscp | The DiffServ Code Point (DSCP) name |
ICMP Code | The ICMP code field in the ICMP header of an IPv6 packet |
Option-present | Off — specifies not to search for packets that contain the option field or have an option field of zero |
On — matches packets that contain the option field or have an option field of zero be used as IPv6 filter match criteria | |
Int. Sampling | Off — interface traffic sampling is disabled |
On — interface traffic sampling is enabled | |
Multiple Option | Off — the option fields are not checked |
On — packets containing one or more option fields in the IPv6 header will be used as IPv6 filter match criteria | |
TCP-ack | False — configures a match on packets with the ACK flag set to false |
True — configured a match on packets with the ACK flag set to true | |
Off — the state of the TCP ACK flag is not considered as part of the match criteria | |
Egr. Matches | The number of egress filter matches/hits for the filter entry |
Show Filter Counters — The following output is an example of IPv6 filter information when the counters keyword is specified, and Table 71 describes the output fields.
Egress count the packets without Layer 2 encapsulation. Ingress counters count the packets with Layer 2 encapsulation.
Label | Description |
IP Filter Filter Id | The IPv6 filter policy ID |
Scope | Template — the filter policy is of type template |
Exclusive — the filter policy is of type exclusive | |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
Filter Match Criteria | IP — indicates the filter is an IPv6 filter policy |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Ing. Matches | The number of ingress filter matches/hits for the filter entry |
Egr. Matches | The number of egress filter matches/hits for the filter entry |
Egress count the packets without Layer 2 encapsulation. Ingress counters count the packets with Layer 2 encapsulation.
Show Filter IPv6 Output (with effective-action specified) — The following is a sample output of IPv6 filter information when the effective-action keyword is specified. Table 72 describes the command output fields.
If the main action (either primary or secondary) cannot be performed, a reason will be given. This will be displayed on the same line as the Effective Action. The reason codes as currently defined are:
Label | Description |
Filter Id | The IPv6 filter policy ID |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
Entries | The number of entries configured in this filter ID |
Description | The IPv6 filter policy description |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Origin | The type of filter entry |
Egress PBR | Indicates if the egress-pbr flag is set for this entry |
Stickiness | No — stickiness is not configured |
Yes — stickiness is configured | |
PBR Dwn Act Override | Indicates whether or not the action to take when the PBR target is down has been overridden |
PBR Down Action | Indicates the action to take when the target is down; packets that match the entry criteria will be subject to the PBR Down Action in case the target of the main action is down |
Configuration | Section of the output providing information on the configured parameters |
Primary Action | The configured action, if any; indented sub-labels in the show output provide configured parameters for this action |
Secondary Action | The configured secondary action, if any; indented sub-labels in the show output provide configured parameters for this action |
Status/Target status based on extended checks | Section of the output providing information on the operational status of certain parameters |
Primary Action | The status of the target of the primary action, if configured, based on extended checks |
Secondary Action | The status of the target of the secondary action, if configured, based on extended checks |
Downloaded Action | The action downloaded by the CPM to the IOM |
Stickiness Timer | The status of the stickiness timer, if any |
Effective Action based on application context | Section of the output providing the effective action, in the context of services, that a packet matching the criteria will be subject to |
Service Id | The service ID on which the filter policy ID is applied; the output also provides a list of service points where the filter has been applied |
Type | The service type in which the service has been applied |
Ingress/Egress | The direction in which the service has been applied |
Effective Action | Indicates the effective action the packet will be subject to |
Extended Action | Indicates the configured extended action, if any |
This command shows IPv6 exception information.
The following output is an example of IPv6 exception filter information, and Table 73 describes the fields.
Label | Description |
Configured IPv6-Exception Filters | The number of configured IPv6 exception filters. |
Filter-Id | The filter ID. |
Scope | Template — The filter policy is of type Template. Exclusive — The filter policy is of type Exclusive. |
Applied | No — The IPv6 exception filter has not been applied. Yes — The IPv6 exception filter is applied. |
Entries | The number of entries. |
Description | The description of the specified filter, if specified. |
Filter Name | The filter name. |
Num IPv6-Exception filters | The number of IPv6 exception filters. |
Entry | The number of active or inactive entries. |
Src. IP | The source IP address of the logged packet. |
Src. Port | The source port of the logged packet. |
Dst. IP | The destination IP address of the logged packet. |
Dst. Port | The destination port of the logged packet. |
Next Header | 8-bit selector. Identifies the type of header immediately following the IPv6 header. |
ICMP Type | The ICMP type match criterion. Undefined indicates no ICMP type specified. |
ICMP Code | The ICMP code field in the ICMP header of an IPv6 packet. |
Ing. Matches | The number of packets matched on ingress. |
Egr. Matches | The number of packets matched on egress. |
Filter Association | Indicates the filter is an IPv6 filter policy. |
Service Id | The service ID on which the IPv6 exception ID is applied. |
Filter association with IOM | The number of filters associated with an IOM. |
This command shows the contents of a memory-based or a file-based filter log.
If the optional keyword match and string parameter are given, the command displays the given filter log from the first occurrence of the given string.
The following output is an example of filter log entry information, and Table 74 describes the fields. If log summary is active, the filter log mini-tables contain the information described in Table 75.
A summary log will be printed only in case TotCnt is different from 0. Only the address types with at least 1 entry in the mini-table will be printed.
Log Message Formatting — Each filter log entry contains the following information in case summary log feature is not active (as appropriate).
Label | Description |
yyyy/mm/dd hh:mm:ss | The date and timestamp for the log filter entry where yyyy is the year, mm is the month, dd is the day, hh is the hour, mm is the minute and ss is the second |
Filter | The filter ID and the entry ID which generated the filter log entry in the form Filter_ID:Entry_ID |
Desc | The description of the filter entry ID which generated the filter log entry |
Interface | The IP interface on which the filter ID and entry ID was associated which generated the filter log entry |
Action | The action of the filter entry on the logged packet |
Src MAC | The source MAC address of the logged packet |
Dst MAC | The destination MAC of the logged packet |
EtherType | The Ethernet type of the logged Ethernet type II packet |
Src IP | The source IP address of the logged packet; the source port will be displayed after the IP address as appropriate separated with a colon |
Dst IP | The destination IP address of the logged packet; the source port will be displayed after the IP address as appropriate separated with a colon |
Flags (IP flags) | M — the more fragments IP flag is set in the logged packet DF — the do not fragment IP flag is set in the logged packet |
TOS | The ToS byte value in the logged packet |
Protocol | The IP protocol of the logged packet (TCP, UDP, ICMP or a protocol number in hex) |
Flags (TCP flags) | URG — Urgent bit set ACK — Acknowledgment bit set RST — Reset bit set SYN — Synchronize bit set FIN — Finish bit set |
HEX | If an IP protocol does not have a supported decode, the first 32 bytes following the IP header are printed in a hex dump Log entries for non-IP packets include the Ethernet frame information and a hex dump of the first 40 bytes of the frame after the Ethernet header |
Total Log Instances (Allowed) | Specifies the maximum allowed instances of filter logs allowed on the system |
Total Log Instances (In Use) | Specifies the instances of filter logs presently existing on the system |
Total Log Bindings | Specifies the count of the filter log bindings presently existing on the system |
Type | The type of service of the service ID |
Filter ID | Uniquely identifies an IP filter as configured on the system |
Entry ID | The identifier which uniquely identifies an entry in a filter table |
Log | Specifies an entry in the filter log table |
Instantiated | Specifies if the filter log for this filter entry has or has not been instantiated |
If the packet being logged does not have a source or destination MAC address (that is, POS) then the MAC information output line is omitted from the log entry.
If log summary is active, the filter log mini-tables contain the information described in Table 75.
Label | Description |
Summary Log LogID | Displays the log ID |
Crit1 | Summary criterion that is used as index into the mini-tables of the log |
TotCnt | The total count of logs |
ArpCnt | Displays the total number of ARP messages logged for this log ID |
Src... Dst... | The address type indication of the key in the mini-table |
count | The number of messages logged with the specified source/destination address |
address | The address for which count messages where received |
This command displays MAC filter information.
When effective-action is specified, this command displays what effectively happens to a packet that matches the criteria associated with the MAC filter policy.
No Parameters Specified — A brief listing of MAC filters is produced when no parameters are specified; Table 76 describes the output fields.
Label | Description |
Filter Id | The MAC filter ID |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Description | The MAC filter policy description |
Filter ID Specified — The following output is an example of MAC filter information when the filter ID is specified, and Table 77 describes the fields. Detailed filter information for the filter ID and its entries is produced when the filter ID is specified.
Label | Description |
MAC Filter Filter Id | The MAC filter policy ID |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Description | The MAC filter policy description |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
Filter Match Criteria | MAC — indicates the filter is an MAC filter policy |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Description | The filter entry description |
FrameType | Ethernet — the entry ID match frame type is Ethernet IEEE 802.3 |
Ethernet II — the entry ID match frame type is Ethernet Type II | |
Src MAC | The source MAC address and mask match criterion; when both the MAC address and mask are all zeros, no criterion specified for the filter entry |
Dest MAC | The destination MAC address and mask match criterion; when both the MAC address and mask are all zeros, no criterion specified for the filter entry |
Dot1p | The IEEE 802.1p value for the match criteria; undefined indicates no value is specified |
Ethertype | The Ethertype value match criterion |
DSAP | The DSAP value match criterion; undefined indicates no value specified |
SSAP | SSAP value match criterion; undefined indicates no value specified |
Snap-pid | The Ethernet SNAP PID value match criterion; undefined indicates no value specified |
Esnap-oui-zero | Non-Zero — filter entry matches a non-zero value for the Ethernet SNAP OUI |
Zero — filter entry matches a zero value for the Ethernet SNAP OUI | |
Undefined — no Ethernet SNAP OUI value specified | |
Match action | Default — the filter does not have an explicit forward or drop match action specified; if the filter entry ID indicates the entry is Inactive, the filter entry is incomplete, no action was specified |
Drop — packets matching the filter entry criteria will be dropped | |
Forward — packets matching the filter entry criteria is forwarded | |
Ing. Matches | The number of ingress filter matches/hits for the filter entry |
Egr. Matches | The number of egress filter matches/hits for the filter entry |
Filter Associations — The associations for a filter ID will be displayed if the associations keyword is specified. The association information is appended to the filter information.
The following output is an example of MAC filter information when the associations keyword is specified, and Table 78 describes the fields.
Label | Description |
Filter Association | Mac — the filter associations displayed are for a MAC filter policy ID |
Service Id | The service ID on which the filter policy ID is applied; the output also provides a list of service points where the filter has been applied |
SAP | The Service Access Point or spoke/mesh SDP on which the filter policy ID is applied |
Type | The type of service of the Service ID |
(Ingress) | The filter policy ID is applied as an ingress filter policy on the interface |
(Egress) | The filter policy ID is applied as an egress filter policy on the interface |
Filter Entry Counters Output — When the counters keyword is specified, the filter entry output displays the filter matches/hit information. The following table describes the command output for the command.
Label | Description |
Mac Filter Filter Id | The MAC filter policy ID |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Description | The MAC filter policy description |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
Filter Match Criteria | Mac — indicates the filter is an MAC filter policy |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
FrameType | Ethernet — the entry ID match frame type is Ethernet IEEE 802.3 |
802.2LLC — the entry ID match frame type is Ethernet IEEE 802.2 LLC | |
802.2SNAP — the entry ID match frame type is Ethernet IEEE 802.2 SNAP | |
Ethernet II — the entry ID match frame type is Ethernet Type II | |
Ing. Matches | The number of ingress filter matches/hits for the filter entry |
Egr. Matches | The number of egress filter matches/hits for the filter entry |
Show Filter MAC Output (with effective-action specified) — The following is a sample output of MAC filter information when the effective-action keyword is specified. Table 80 describes the command output fields.
If the main action (either primary or secondary) cannot be performed, a reason will be given. This will be displayed on the same line as the Effective Action. The reason codes as currently defined are:
Label | Description |
Filter Id | The MAC filter policy ID |
Applied | No — the filter policy ID has not been applied |
Yes — the filter policy ID is applied | |
Scope | Template — the filter policy is of type Template |
Exclusive — the filter policy is of type Exclusive | |
Def. Action | Forward — the default action for the filter ID for packets that do not match the filter entries is to forward |
Drop — the default action for the filter ID for packets that do not match the filter entries is to drop | |
Entries | The number of entries configured in this filter ID |
Type | The type of entries configures in this filter |
Description | The MAC filter policy description |
Entry | The filter entry ID; if the filter entry ID indicates the entry is (Inactive), then the filter entry is incomplete as no action has been specified |
Stickiness | No — stickiness is not configured |
Yes — stickiness is configured | |
PBR Dwn Act Override | Indicates whether or not the action to take when the PBR target is down has been overridden |
PBR Down Action | The action to take in case the target is down |
Configuration | Section of the output providing information on the configured parameters |
Primary Action | The configured action, if any; indented sub-labels in the show output provide configured parameters for this action |
Secondary Action | The configured secondary action, if any; indented sub-labels in the show output provide configured parameters for this action |
Status/Target status based on extended checks | Section of the output providing information on the operational status of certain parameters |
Primary Action | The status of the target of the primary action, if configured, based on extended checks |
Secondary Action | The status of the target of the secondary action, if configured, based on extended checks |
Downloaded Action | The action downloaded by the CPM to the IOM |
Stickiness Timer | The status of the stickiness timer, if any |
Effective Action based on application context | Section of the output providing the effective action, in the context of services, that a packet matching the criteria will be subject to |
Service Id | The service ID on which the filter policy ID is applied; the output also provides a list of service points where the filter has been applied |
Type | The service type in which the service has been applied |
Ingress/Egress | The direction in which the service has been applied |
Effective Action | Indicates the effective action the packet will be subject to |
This command enables the context to display information for match lists used in filter policies (IOM/FP and CPM).
This command displays IPv4 prefixes information for match criteria in IPv4 ACL and CPM filter policies.
This command displays IPv6 prefixes information for match criteria in IPv6 ACL and CPM filter policies.
This command displays TCP/UDP/SCTP port values or ranges for match criteria in IPv4 and IPv6 ACL and CPM filter policies.
This command displays the protocol-list information.
This command displays information about filter IDs that have been automatically assigned by SR OS using the md-auto-id functionality. See the md-auto-id configuration command for further details.
The following output is an example of md-auto-id filter information and Table 81 describes the output fields.
Label | Description |
Start | Displays the start of the range for an automatic filter policy ID |
End | Displays the end of the range for an automatic filter policy ID |
Ip-filter Count | Displays the number of IP filter policies with automatically-assigned IDs |
Ipv6-filter Count | Displays the number of IPv6 filter policies with automatically-assigned IDs |
Mac-filter Count | Displays the number of MAC filter policies with automatically-assigned IDs |
This command shows redirect filter information.
ipv4-address: | a.b.c.d. |
ipv6-address: | x:x:x:x:x:x:x:x (eight 16-bit pieces) |
x:x:x:x:x:x:d.d.d.d | |
x: [0 to FFFF]H | |
d: [0 to 255]D |
Redirect Policy Output — The following output is an example of redirect policy information, and Table 82 describes the fields.
Label | Description |
Redirect Policy | Specifies a specific redirect policy |
Applied | Specifies whether the redirect policy is applied to a filter policy entry |
Description | Displays the user-provided description for this redirect policy |
Active Destination | IP address — specifies the IP address of the active destination |
none — indicates that there is currently no active destination | |
Destination | Specifies the destination IP address |
Oper Priority | Specifies the operational value of the priority for this destination; the highest operational priority across multiple destinations is used as the preferred destination |
Admin Priority | Specifies the configured base priority for the destination |
Admin State | Specifies the configured state of the destination |
Out of Service — tests for this destination will not be conducted | |
Oper State | Specifies the operational state of the destination |
Ping Test | Specifies the name of the ping test |
Source Address | Specifies the source address of the ping test (if any) |
Timeout | Specifies the amount of time in seconds that is allowed for receiving a response from the far-end host; if a reply is not received within this time the far-end host is considered unresponsive |
Interval | Specifies the amount of time in seconds between consecutive requests sent to the far end host |
Drop Count | Specifies the number of consecutive requests that must fail for the destination to declared unreachable |
Hold Down | Specifies the amount of time in seconds that the system should be held down if any of the test has marked it unreachable |
Hold Remain | Specifies the amount of time in seconds that the system will remain in a hold down state before being used again |
Last Action at | Displays a time stamp of when this test received a response for a probe that was sent out |
This command shows configured redirect-policy bindings information.
Redirect Policy Output — The following output is an example of redirect policy binding information, and Table 83 describes the fields.
Label | Description |
Test Binding | Specifies a specific test binding field |
This command shows system filter information.
No Parameters Specified — When no parameters are specified, the output is grouped for IPv4 and IPv6, and displays information about the active system filter and all filters with scope system.
The following output is an example of system filter information when no parameters are specified.
With chained-to Option Specified — The following output is an example of system filter information when the chained-to option is specified.
Clears the counters associated with the entries of the specified IPv4 filter policy.
By default, the counters associated with each entry of the specified filter policy are all cleared. The scope of which counters are cleared can be narrowed using the command line parameters.
Clears all counters associated with each entry of the specified IPv4 filter policy.
This command clears the counters associated with the entries of the specified IP exception filter policy.
Clears the counters associated with the entries of the specified IPv6 filter policy.
By default, the counters associated with each entry of the specified filter policy are all cleared. The scope of which counters are cleared can be narrowed using the command line parameters.
Clears all counters associated with each entry of the specified IPv6 filter policy.
This command clears the information about the IPv6 exception filter.
Clears the contents of a memory or file based filter log.
This command has no effect on a syslog based filter log.
Clears the counters associated with the entries of the specified MAC filter policy.
By default, the counters associated with each entry of the specified filter policy are all cleared. The scope of which counters are cleared can be narrowed using the command line parameters.
Clears all counters associated with each entry of the specified MAC filter policy.
The following command outputs are examples only; actual displays may differ depending on supported functionality and user configuration.
This command monitors the counters associated with the specified entry of the specified IP filter policy.
This command monitors the counters associated with the IPv6 filter policy.
This command monitors the counters associated with the specified entry of the specified MAC filter policy.
The following command outputs are examples only; actual displays may differ depending on supported functionality and user configuration.
This command, when used without parameters, specifies the utilization per CAM table for line card ACL filters per FP for FP4 based cards in the system. Optionally, the card number can be provided as a parameter to limit the output to a single card.
The following output is an example of CAM utilization information for filters.
This command, when used without parameters, allows the operator to identify filter memory banks with one or more policies in overload in the system by slot number, FP number, direction (ingress or egress), and type (IP-MAC or IPv6).
The command, when used with only the card and fp parameters, lists the filter policy ID as well as the number of entries in overload on a specified FP when the optional parameters slot-number and fp-number are specified.
This command, when used with the ip, ipv6, or mac parameters in conjunction with the direction parameter, displays the entries not programmed for a specified filter policy due to an overload condition.
This command, when used with the cpm-ip, cpm-ipv6, or cpm-mac parameters, displays the entries not programmed for a specified CPM filter policy. This command is available on applicable platforms only. Refer to the 7450 ESS, 7750 SR, 7950 XRS, and VSR System Management Guide, CPM Filters and Traffic Management section for more details.
The following output is an example of filter overload status.
Sample overload output with card and fp parameters only:
Sample overload output with card, fp, {cpm-ip, cpm-ipv6, or cpm-mac} parameters only
Sample overload output with card, fp, {ip, ipv6, or mac} and direction parameters only:
This command displays information about filter resource utilization on the CPM, consumption by filter-using services such as OpenFlow, and the filters that use the most resources.
The following output is an example of filter resource utilization information.
This command displays information about resources pertaining to tracked targets.
The following output is an example of filter resource SAP destination tracking information.
The following output is an example of filter resource SAP destination tracking detailed information.
This command displays the number of allocated unique egress PBR destinations.
The following output is an example of filter resource egress PBR destination information.
This command displays how many GRE tunnel templates are configured.
The following output is an example of filter resource GRE tunnel templates information.
This command displays the number of unique and total installed HTTP redirect destinations per system.
The following output is an example of filter resource HTTP redirect information.
This command shows information about filter resource utilization on all IOMs or a specified IOM. Resource utilization per filter type is available, as well as filters using most resources on a given line card.
The following output is an example of filter resource utilization information for all IOMs.
This command displays information about the specified IP filter including resource utilization on CPM and IOM, the IOMs on which the filter is used, and the entries using the most resources.
The following output is an example of IP filter resource utilization information.
This command displays information about the specified IPv6 filter including resource utilization on CPM and IOM, the IOMs on which the filter is used, and the entries using the most resources.
The following output is an example of IPv6 filter resource utilization information.
This command displays information about the specified MAC filter including resource utilization on CPM and IOM, the IOMs on which the filter is used, and the entries using the most resources.
The following output is an example of MAC filter resource utilization information.
This command displays pattern match records.
The following output is an example of detailed pattern match records.
This command displays information about resources pertaining to sticky destinations timers.
The following output is an example of sticky destination filter action information.
This command allows an operator to activate the primary action for the given filter policy entry. If the primary action is already active, the command has no effect. If a secondary action is active, the primary action will be activated unless the primary target is down. If the sticky destination timer is running for the primary action entry, it will expire.
This command allows the operator to force a PBR switch to the best destination selected by the redirect policy when that destination is not currently active as result of sticky destination functionality being enabled for the specified redirect policy. If hold-time-up is running, the timer is also expired.