Kernel Debug Procedure with Connection Life Cycle

Introduction

Connection Life Cycle is a debug tool.

This tool generates a formatted debug output file (in the Ruby format) that presents the debug messages hierarchically by connections and packets:

  • The first hierarchy level shows connections.

  • After you expand the connection, you see all the packets of this connection.

Important - You must use this tool in the Expert mode together with the regular kernel debug flags (see Kernel Debug Modules and Debug Flags).

Syntax for a Security Gateway / each Cluster Member

  • To start the debug capture:

    conn_life_cycle.sh -a start -o /<Path>/<Name of Raw Debug Output File> [{-t | -T}] [[-f "<Filter1>"] [-f "<Filter2>"] [-f "<Filter3>] [-f "<Filter4>] [-f "<Filter5>"]]

  • To stop the debug capture and prepare the formatted debug output:

    conn_life_cycle.sh -a stop -o /<Path>/<Name of Formatted Debug Output File>

Syntax for a Scalable Platform Security Group

  • To start the debug capture:

    g_all conn_life_cycle.sh -a start -o /<Path>/<Name of Raw Debug Output File> [{-t | -T}] [[-f "<Filter1>"] [-f "<Filter2>"] [-f "<Filter3>] [-f "<Filter4>] [-f "<Filter5>"]]

  • To stop the debug capture and prepare the formatted debug output:

    g_all conn_life_cycle.sh -a stop -o /<Path>/<Name of Formatted Debug Output File>

Parameters

Table: Parameters of the 'conn_life_cycle.sh' script

Parameter

Description

-a start

-a stop

Mandatory.

Specifies the action:

  • start - Starts the debug capture based on the debug flags you enabled and debug filters you specified.

  • stop - Stops the debug capture, resets the kernel debug options, resets the kernel debug filters.

-t | -T

Optional.

Specifies the resolution of a time stamp in front of each debug message:

  • -t - Prints the time stamp in milliseconds.

  • -T - Prints the time stamp in microseconds.

Best Practice - Always use the "-T" option to make the debug analysis easier.

-f "<Filter>"

Optional.

Specifies which connections and packets to capture.

For additional information, see Kernel Debug Filters.

Important - If you do not specify filters, then the tool prints debug messages for all traffic. This causes high load on the CPU and increases the time to format the debug output file.

Each filter must contain these five numbers (5-tuple) separated with commas:

"<Source IP Address>,<Source Port>,<Destination IP Address>,<Destination Port>,<Protocol Number>"

Example of capturing traffic from IP 192.168.20.30 from any port to IP 172.16.40.50 to port 22 over the TCP protocol:

-f "192.168.20.30,0,172.16.40.50,22,6"

 

Notes:

  • The tool supports up to five of such filters.

  • The tool treats the value 0 (zero) as "any".

  • If you specify two or more filters, the tool performs a logical "OR" of all the filters on each packet.

    If the packet matches at least one filter, the tool prints the debug messages for this packet.

  • "<Source IP Address>" and "<Destination IP Address>" - IPv4 or IPv6 address

  • "<Source Port>" and "<Destination Port>" - integers from 1 to 65535 (see IANA Service Name and Port Number Registry)

  • <Protocol Number> - integer from 0 to 254 (see IANA Protocol Numbers)

-o /<Path>/<Name of Raw Debug Output File>

Mandatory.

Specifies the absolute path and the name of the raw debug output file.

Example:

-o /var/log/kernel_debug.txt

-o /<Path>/<Name of Formatted Debug Output File>

Mandatory.

Specifies the absolute path and the name of the formatted debug output file (to analyze by an administrator).

Example:

-o /var/log/kernel_debug_formatted.txt

Procedure

Important - In clusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must perform these steps on all the Cluster Members in the same way.

Example