SecureXL Debug Modules and Debug Flags

To see the available SecureXL debug modules and their debug flags, run: fwaccel dbg

• Module default

  Flag	Description
  acct	Connection accounting information
  ant	Anticipated connections
  conf	Configuration of the SecureXL (for example, interfaces)
  conn	Processing of connections
  conn_app	Processing of connections
  corr	Correction layer
  cpdrv	Currently not in use
  del	Deletion of connections
  drv	Driver information
  err	General errors
  gtp	Processing of GTP tunnel connections
  gtp_pkt	Processing of GTP tunnel packets
  htab	Hash table
  infra_ids	Allocating IDs for a given range in Identity Awareness
  init	Initialization
  ioctl	Changes in the configuration, which were initiated from the user space
  iter	Connection table iterator
  kdrv	Driver information
  lock	Lock initializing and finalizing
  nat	Processing of NAT connections
  offload	Offloading of connections from the Firewall to the SecureXL
  queue	Connections queue
  relations	Related connections (such as FTP data connections)
  rngs	Handling of SecureXL ranges
  rngs_print	Printing of SecureXL ranges
  routing	Handling of SecureXL routing
  stat	Handling of SecureXL statistics
  svm	Registering templates or connections for System Counters in Security Gateway object in SmartConsole
  tag	Tags that were added to the packets by the SecureXL before forwarding them to the Firewall
  tcp_sv	Verification of sequence in TCP packets
  update	Updates of connections
  util	Utilization

• Module pkt (Packet)

  Flag	Description
  acct	Connection accounting information
  caf	Mirror and Decrypt feature - Mirror only of all traffic
  corr	Correction layer
  cpls	ClusterXL Load Sharing
  deliver	Packet delivery
  drop	Packets dropped by SecureXL
  err	General errors
  f2f	Reason for forwarding a packet to the Firewall
  frag	Processing of fragments
  nat	Processing of NAT connections
  notif	Notifications sent to the Firewall
  pkt	Processing of packets
  pxl	PXL (PacketXL) handling - API between the SecureXL and PSL (Packet Streaming Layer), which is a TCP Streaming engine that parses TCP streams
  qos	QoS acceleration
  routing	Handling of SecureXL routing
  spoof	Handling of SecureXL Anti-Spoofing
  sv	Validation of sequence in TCP packets
  tcp_state	Validation of TCP state in TCP packets
  tcp_state_pkt	Validation of TCP packets
  user	Currently not in use
  vlan	Handling of VLAN tags
  wrp	Handling of WRP interfaces in VSX

• Module db (Database)

  Flag	Description
  ant	Anticipated connections
  del	Deleting of data from the SecureXL database
  err	General errors
  get	Retrieving of data from the SecureXL database
  init	Initializing and finalizing of SecureXL database
  nmr	"No Match Ranges" templates, which allow SecureXL Accept Templates for rules that contain Dynamic objects or Domain objects (or for rules located below such rules)
  nmt	"No Match Time" templates, which allow SecureXL Accept Templates for rules that contain Time objects (or for rules located below such rules)
  profile	Operations on profile table
  save	Saving of data to the SecureXL database
  tmo	Handling of timeouts for SecureXL database entries
  tmpl	Handling of SecureXL templates database

• Module api (Application Programmable Interface)

  Flag	Description
  acct	Connection accounting information
  add	Adding of connections
  add_sa	Offloading of VPN SA to SecureXL
  conf	Configuration of the SecureXL (for example, interfaces)
  del	Deletion of connections
  del_all_sas	Deletion of all VPN SAs from SecureXL
  del_all_tmpl	Deletion of the SecureXL Templates
  del_sa	Deletion of VPN SA from SecureXL
  err	General errors
  get_features	Getting features buffer (in SecureXL initialization)
  get_stat	Retrieving of SecureXL statistics
  get_state	Getting the connection state from SecureXL
  get_tab	Some extra printouts when processing SecureXL tables
  gtp	Processing of GTP tunnel connections
  infra	SecureXL infrastructure
  init	Enabling and disabling of SecureXL
  long_ver	Prints additional verbose information about connections
  misc	Prints additional information about SecureXL internals
  notif	Notifications sent to the Firewall
  pxl	PXL (PacketXL) handling - API between the SecureXL and PSL (Packet Streaming Layer), which is a TCP Streaming engine that parses TCP streams
  qos	QoS acceleration
  reset_stat	Prints statistics IDs that are reset
  stat	Handling of SecureXL statistics
  sv	Validation of sequence in TCP packets
  tag	Tags that were added to the packets by the SecureXL before forwarding them to the Firewall
  tmpl	Handling of SecureXL Templates
  tmpl_info	Information about SecureXL Templates
  upd_conf	Update of SecureXL in ClusterXL Load Sharing
  upd_if_inf	Prints some text that shows if SecureXL updated information about interfaces
  upd_link_sel	Updates of VPN Link Selection
  update	Updates of connections
  vpn	Processing of VPN connection

• Module adp (acceleration cards - sk116242)

  Flag	Description
  ac_print	Prints additional information
  bond	Information about Bond interfaces
  bpl	Information about packet processing in the backplane
  bplinf	Information about packet processing in the backplane
  drop	Information about packet drops in the backplane
  err	General errors
  eth	Information about ports from the acceleration card's point of view
  heth	Information about ports from the Host Security Appliance's point of view
  if	Information about interfaces
  inf	Information about slots and ports
  ipsctl	Information about slots
  mbeinf	Information about packet processing in the backplane
  mbs	Information about packet processing in the backplane
  nh	Handling of next hop routing
  rt	Handling of general routing
  wrp	Handling of WRP interfaces in VSX
  xmode	Events in the known neighbors database
  xnp	Information about slots

• Module infras (Identity Awareness - Identities Infrastructure)

  Flag	Description
  err	General errors
  pm	Pattern Matcher
  reorder	Reordering of packets in queue

• Module nac (Identity Awareness - Network Access Control)

  Flag	Description
  db	Updating, adding, deleting of identities
  db_get	Updating, fetching, searching of identities
  err	General errors
  idnt	Identity Tags
  ioctl	Changes in the configuration, which were initiated from the user space
  nac	Network Access Control
  offload	Offloading of connections from the Firewall to the SecureXL
  pkt	Forwarding of connections to Firewall (when identity is not found or revoked, or NAC packet tagging verification failed)
  pkt_ex	NAC packet-tagging verification
  signature	Signing of packets

• Module vpn (VPN)

  Flag	Description
  err	General errors
  linksel	VPN Link Selection
  routing	VPN Encryption routing information
  vpn	Processing of VPN connections
  vpnpkt	Processing of VPN packets

• Module cpaq (Internal Asynchronous Queue)

  Flag	Description
  cbuf	Information about queue buffers
  client	Information about queue clients
  error	General errors
  exp	Information about expiration of queue items
  init	Initializing of queue
  opreg	Currently not in use
  server	Information about queue servers
  transport	Information about sending messages in queue
  transport_utils	Additional information about sending messages in queue

• Module dos (Denial of Service Defender)

  Flag	Description
  detailed	Detailed tracing of DoS Rate Limiting logic in the packet flow. Important - This debug flag is not suitable for large traffic volumes because it prints a large number of messages. This causes high load on the CPU.
  drop	Dropped packets
  err	General errors
  fw1-cfg	Information about DoS Rate Limiting configuration in the Firewall kernel module
  fw1-pkt	Information about DoS Rate Limiting packet flow in the Firewall kernel module
  sim-cfg	Information about DoS Rate Limiting configuration in the SecureXL kernel module
  sim-pkt	Information about DoS Rate Limiting packet flow in the SecureXL kernel module

• Module synatk (Accelerated SYN Defender)

  Flag	Description
  conf	Receiving and updating of Accelerated SYN Defender module's configuration
  conn	Handling of TCP connections
  err	General errors
  init	Initializing of the Accelerated SYN Defender module
  log	Prints time of the last sent monitor log and interval between the monitor logs
  msg	Information about internal messages in the Accelerated SYN Defender module
  pkt	Handling of TCP packets
  proxy	Currently not in use
  state	Information about states of the Accelerated SYN Defender module

• Module tmpl (Drop Templates)

  Flag	Description
  err	General errors
  dtmpl_get	Getting of Drop Templates
  dtmpl_notif	Notifications about Drop Templates
  tmpl	Information about Drop Templates