HP Comware 5 Debug Manual Vol 1

Table 33 Output from the debugging flow-redirect packet command
Field
Description
Thread thread-id, received xxx packets:
(src-ip-addr)->(dst-ip-addr), mm bytes.
Thread thread-id received mm bytes of xxx packets.
The packet source IP address is src-ip-addr,
destination IP address is dst-ip-addr. The xxx indicates
the type of the received packets, including TCP RST,
TCP RST, and other.
Thread thread-id, the packet from source-zone to
destination-zone is permitted to be redirected:
(src-ip-addr)-> (dst-ip-addr), mm bytes, ACL
acl-number.
Thread thread-id received a packet from source-zone
to destination-zone, which is permitted to be
redirected. The packet's source IP address is
src-ip-addr, destination IP address is dst-ip-addr,
length is mm bytes, and the ACL used is acl-number.
Thread thread-id, the packet from source-zone to
destination-zone is denied to be redirected:
(src-ip-addr)-> (dst-ip-addr), mm bytes.
Thread thread-id received a packet from source-zone
to destination-zone, which is not allowed to be
redirected.
The packet's source IP address is src-ip-addr,
destination IP address is dst-ip-addr, and length is mm
bytes.
Thread thread-id, the packet from source-zone to
destination-zone is a no-session packet and does not
redirect: (src-ip-addr)-> (dst-ip-addr), mm bytes.
Thread thread-id received a packet from source-zone
to destination-zone. The thread did not find a session
for the packet and did not redirect the packet. The
packet's source IP address is src-ip-addr, destination IP
address is dst-ip-addr, and length is mm bytes.
Examples
The output in the following examples was created when the firewall receives packets from zone Untrust
to zone Trust (which corresponds to segment ID 1) under the following conditions:
•
An advanced security policy is configured on the firewall for in-depth security inspection.
•
The packets match ACL 3005 referenced by the policy.
# Enable packet debugging for service flow redirection.
<Sysname> debugging flow-redirect packet
*Jun 25 10:38:49:761 2007 Sysname DPFLWRDR/7/DEBUG:
Thread 1, the packet from untrust to trust is permitted to redirect: (136.65.86.4)->
(15.34.96.56), 852 bytes, ACL 3005.
// Thread 1 received a packet from zone Untrust to zone Trust, which is permitted to be redirected. The
packet's source IP address is 136.65.86.4, destination IP address is 15.34.96.56, length is 852 bytes,
and the ACL used is 3005.
# Enable event debugging for service flow redirection.
<Sysname> debugging flow-redirect event
*Jun 25 10:38:49:761 2007 Sysname DPFLWRDR/7/DEBUG:
Received an original packet.
// The DPFLWRDR module received an original packet returned from another system.
82