[Contents] [Prev] [Next] [Index] [Report an Error]

Verifying Application Security Information Using Trace Options

The JUNOS software trace function provides a tool for applications to write security debugging information to a file. The information that appears in this file is based on criteria you set. You can use this information to analyze security application issues.

The trace function operates in a distributed manner, with each thread writing to its own trace buffer. These trace buffers are then collected at one point, sorted, and written to trace files. Trace messages are delivered using the IPC (InterProcess Communications) protocol. A trace message has a lower priority than that of control protocol packets such as BGP, OSPF, and IKE and therefore delivery is not considered to be as reliable.

Setting Security Trace Options

This topic covers:

Verifying Application Security Flow Information

For flow trace options, you can define a packet filter using combinations of destination-port, destination-prefix, interface, protocol, source-port, and source-prefix. If the security flow trace flag for a certain module is set, the packet matching the specific packet filter triggers flow tracing and writes debugging information to the trace file.

The following example displays the options you can set by using security flow traceoptions:

For the packet filter named filter1, set the destination port “imap” for matching.user@host # set security flow traceoptions packet-filter filter1 destination-port imap
For the packet filter named filter1, set the destination IPv4 prefix address 1.2.3.4.user@host # set security flow traceoptions packet-filter filter1 destination-prefix 1.2.3.4
For the packet filter named filter1, set the logical interface as fxp0.user@host # set security flow traceoptions packet-filter filter1 interface fxp0
For the packet filter named filter1, set the IP protocol for matching as TCP.user@host # set security flow traceoptions packet-filter filter1 protocol tcp
For the packet filter named filter1, set the source port for matching as http.user@host # set security flow traceoptions packet-filter filter1 source-port http
For the packet filter named filter1, set the source IPv4 prefix address as 5.6.7.8.user@host # set security flow traceoptions packet-filter filter1 source-prefix 5.6.7.8

[Contents] [Prev] [Next] [Index] [Report an Error]