Monitoring Security Features

This topic contains the following instructions:

Monitoring Policies

Use the monitoring policies feature to view summary information such as names of the source and destination addresses of the policy, name of a preconfigured or custom application defined for the policy, or actions to be taken for packets matching the policies.

To access policies using the CLI, enter the following CLI commands:

To access policies using J-Web:

  1. Select Monitor>Security>Policies in the J-Web interface. The page layout is as follows:
    • Policy list pane—Displays all activated security policies. The details of the pane are described in Table 57
    • Graph pane —Displays the real-time chart for the selected counters. For details on the graph, see the graph pane.
    • Counters pane—Displays the currently selected policy counters. For details on the counter, see the counter pane.
  2. Click one of the following in the list pane:
    • Clear Statistics —Clears counters for the selected policies to zero.
    • Deactivate —Deactivates the policies selected. When you click Deactivate, the commit window pops up and you need to confirm the deactivation.
    • Move —Moves the position of the policy. You have the option to move the policy up, down, top or bottom.

Table 57 summarizes key output fields in the security policies information display.

Table 57: Summary of Key Security Policies List Pane

Field

Values

Additional Information

Combo Options

From Zone

Name of the source zone.

 

To Zone

Name of the destination zone.

 

Filter

Filters the policy according to the selected From and To zones and displays only the related policies.

 

Total Policies

Number of policies listed in the policy list pane including the default policy.

 

Default policy

Actions the device takes for a packet that does not match any user-defined policy:

  • permit-all—Permit all traffic that does not match a policy.
  • deny-all—Displays the configured default-policy.
 

Policy List Pane

From Zone

Name of the source zone.

 

To Zone

Name of the destination zone.

 

Name

Name of the policy.

 

Source Address

Names of the source addresses for a policy. Address sets are resolved to their individual names. (In this case, only the names are given, not their IP address).

 

Destination Address

Name of the destination address (or address set) as it was entered in the destination zone’s address book. A packet’s destination address must match this value for the policy to apply to it.

 

Applications

Name of a preconfigured or custom application whose type the packet matches, as specified at configuration time.

 

Action

Permitting application services under a policy results in permitting the following possibilities:

  • gprs-gtp-profile— Specify GPRS Tunneling Protocol profile name
  • idp— Performs Intrusion detection and prevention
  • redirect-wx— Sets WX redirection
  • reverse-redirect-wx— Sets WX reverse redirection
  • uac-policy — Enables unified access control enforcement of policy
 

Count

Enables a counter and records the number of packets hitting the particular policy, such as the input and output packets and bytes.

 

Log

Indicates the log options for log session. The options are:

  • Session initialization
  • Session close
  • Both
 

Graph Pane

The graph pane appears blank if the counters pane indicates "No data." If the counters pane contains data, the graph pane begins to draw the graph automatically for the selected counter after the refresh interval.

Policy Counter

If the selected policy has count enabled, the counters pane displays counters for that policy.

The counter are:

By default, the counters of input-byte-rate and output-byte-rate are selected. The counters pane is refreshed during each refresh interval.

Monitoring Screen Counters

To view screen statistics for a specified security zone, select Monitor>Security>Screen Counters in the J-Web interface, or enter the following CLI command:

show security screen statistics zone zone-name

Table 58 summarizes key output fields in the screen counters display.

Table 58: Summary of Key Screen Counters Output Fields

Field

Values

Additional Information

Zones  

ICMP Flood

Internet Control Message Protocol (ICMP) flood counter.

An ICMP flood typically occurs when ICMP echo requests use all resources in responding, such that valid network traffic can no longer be processed.

UDP Flood

User Datagram Protocol (UDP) flood counter.

UDP flooding occurs when an attacker sends IP packets containing UDP datagrams with the purpose of slowing down the resources, such that valid connections can no longer be handled.

TCP Winnuke

Number of Transport Control Protocol (TCP) WinNuke attacks.

WinNuke is a denial-of-service (DoS) attack targeting any computer on the Internet running Windows.

TCP Port Scan

Number of TCP port scans.

The purpose of this attack is to scan the available services in the hopes that at least one port will respond, thus identifying a service to target.

ICMP Address Sweep

Number of ICMP address sweeps.

An IP address sweep can occur with the intent of triggering responses from active hosts.

IP Tear Drop

Number of teardrop attacks.

Teardrop attacks exploit the reassembly of fragmented IP packets.

TCP SYN Attack

Number of TCP SYN attacks.

 

IP Spoofing

Number of IP spoofs.

IP spoofing occurs when an invalid source address is inserted in the packet header to make the packet appear to come from a trusted source.

ICMP Ping of Death

ICMP ping of death counter.

Ping of death occurs when IP packets are sent that exceed the maximum legal length (65,535 bytes).

IP Source Route

Number of IP source route attacks.

 

TCP Land Attack

Number of land attacks.

Land attacks occur when attacker sends spoofed SYN packets containing the IP address of the victim as both the destination and source IP address.

TCP SYN Fragment

Number of TCP SYN fragments.

 

TCP No Flag

Number of TCP headers without flags set.

A normal TCP segment header has at least one control flag set.

IP Unknown Protocol

Number of unknown Internet protocols.

 

IP Bad Options

Number of invalid options.

 

IP Record Route Option

Number of packets with the IP record route option enabled.

This option records the IP addresses of the network devices along the path that the IP packet travels.

IP Timestamp Option

Number of IP timestamp option attacks.

This option records the time (in Universal Time) when each network device receives the packet during its trip from the point of origin to its destination.

IP Security Option

Number of IP security option attacks.

 

IP Loose route Option

Number of IP loose route option attacks.

This option specifies a partial route list for a packet to take on its journey from source to destination.

IP Strict Source Route Option

Number of IP strict source route option attacks.

This option specifies the complete route list for a packet to take on its journey from source to destination.

IP Stream Option

Number of stream option attacks.

This option provides a way for the 16-bit SATNET stream identifier to be carried through networks that do not support streams.

ICMP Fragment

Number of ICMP fragments.

Because ICMP packets contain very short messages, there is no legitimate reason for ICMP packets to be fragmented. If an ICMP packet is so large that it must be fragmented, something is amiss.

ICMP Large Packet

Number of large ICMP packets.

 

TCP SYN FIN Packet

Number of TCP SYN FIN packets.

 

TCP FIN without ACK

Number of TCP FIN flags without the acknowledge (ACK) flag.

 

TCP SYN-ACK-ACK Proxy

Number of TCP flags enabled with SYN-ACK-ACK.

To prevent flooding with SYN-ACK-ACK sessions, you can enable the SYN-ACK-ACK proxy protection screen option. After the number of connections from the same IP address reaches the SYN-ACK-ACK proxy threshold, Junos OS rejects further connection requests from that IP address.

IP Block Fragment

Number of IP block fragments.

 

Monitoring IDP

IDP monitoring pages allow you to display detailed information about the IDP Status, Memory, Counters, Policy rulebase statistics and Attack table statistics

This topic contains:

Monitoring IDP Status

To view Intrusion Detection and Prevention (IDP) table information, select Monitor>Security>IDP>Status in the J-Web interface, or enter the following CLI command:

Table 59 summarizes key output fields in the IDP display.

Table 59: Summary of IDP Status Output Fields

Field

Values

Additional Information

IDP Status  

Status of IDP

Displays the status of the current IDP policy.

 

Up Since

Displays the time from when the IDP policy first began running on the system.

 

Packets/Second

Displays the number of packets received and returned per second.

 

Peak

Displays the maximum number of packets received per second and the time when the maximum was reached.

 

Kbits/Second

Displays the aggregated throughput (kilobits per second) for the system.

 

Peak Kbits

Displays the maximum kilobits per second and the time when the maximum was reached.

 

Latency (Microseconds)

Displays the delay, in microseconds, for a packet to receive and return by a node .

 

Current Policy

Displays the name of the current installed IDP policy.

 
IDP Memory Statistics

Displays the status of all IDP data plane memory.

 

PIC Name

Displays the name of the PIC.

 

Total IDP Data Plane Memory (MB)

Displays the total memory space, in megabytes, allocated for the IDP data plane.

 

Used (MB)

Displays the used memory space, in megabytes, for the data plane.

 

Available (MB)

Displays the available memory space, in megabytes, for the data plane.

 

Monitoring Flow Session Statistics

The J-Web interface provides session statistics according to the session filter you select on the Flow Session Statistics page.

This section contains the following topics:

Monitoring Flow Session Statistics Summary Information

To view summary information about existing sessions, including types of sessions, active and failed sessions, and the maximum allowed number of sessions, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select summary from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session summary

Table 60 summarizes key output fields in the flow session statistics display.

Table 60: Summary of Key Flow Session Statistics Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—summary (By default)

Unicast-sessions

Total number of active unicast sessions.

 

Multicast-sessions

Total number of active multicast sessions.

 

Failed-sessions

Total number of failed sessions.

 

Active-sessions

Total number of active sessions.

 

Maximum-sessions

Maximum number of supported sessions.

 

Monitoring Flow Information for All Sessions

To view information about all currently active security sessions on the device, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select all from the Session Filter list and click Show. To view information about the incoming and outgoing source and destination addresses and the protocol and interface for a specific session, select the session ID on the Flow Session Statistics page.

Alternatively, enter the following CLI command:

show security flow session

Table 61 summarizes key output fields in the flow all session display.

Table 61: Summary of Key Flow All Session Information Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—all

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 
Flow Session Statistics: Session ID

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Information for Application Sessions

To view information about each session of the specified application type, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select application from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session application application-name

Table 62 summarizes key output fields in the flow session application display.

Table 62: Summary of Key Flow Application Session Information Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—application

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Session Destination Port Information

To view information about each session that uses the specified destination port, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select destination port from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session destination-port destination-port-number

Table 63 summarizes key output fields in the flow session destination port display.

Table 63: Summary of Key Flow Destination Port Session Information Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—destination port

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Session Destination Prefix Information

To view information about each session that uses the specified destination prefix, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select destination prefix from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session destination-prefix destination-prefix-number

Table 64 summarizes key output fields in the flow session destination prefix display.

Table 64: Summary of Key Flow Destination Prefix Session Information Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—destination prefix

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Session Interface Information

To view information about each session that uses the specified incoming or outgoing interface, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select interface from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session interface interface-name

Table 65 summarizes key output fields in the flow session interface display.

Table 65: Summary of Key Flow Interface Session Information Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—interface

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Session Protocol Information

To view information about each session that uses the specified protocol, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select protocol from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session protocol protocol-name

Table 66 summarizes key output fields in the flow session protocol display.

Table 66: Summary of Key Flow Protocol Session Information Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—protocol

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Session Resource Manager

To view information about sessions created by the resource manager, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select resource manager from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session resource-manager

Table 67 summarizes key output fields in the flow session resource manager display.

Table 67: Summary of Key Flow Resource Manager Session Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—resource manager

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

Resource information

Information about the session particular to the resource manager, including the name of the ALG, the group ID. and the resource ID.

 
Flow Session Statistics: Session ID

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Session Identifier Session

To view information about the session, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select session identifier from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session session-identifier session-identifier

Table 68 summarizes key output fields in the flow session identifier session display.

Table 68: Summary of Key Flow Session Identifier Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—session identifier

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Status

Session status.

 

Flag

Internal flag depicting the state of the session, used for debugging purposes.

 

Virtual system

Virtual system to which the session belongs.

 

Policy name

Name and ID of the policy that the first packet of the session matched.

 

Maximum timeout

Maximum session timeout.

 

Current timeout

Remaining time for the session unless traffic exists in the session.

 

Start time

Time when the session was created, offset from the system start time.

 

Duration

Length of time for which the session is active.

 

In

For the input flow:

  • Source and destination addresses and protocol tuple for the input flow.
  • Interface: Input flow interface.
  • Session token: Internal token derived from the virtual routing instance.
  • Flag: Internal debugging flags.
  • Route: Internal next hop of the route to be used by the flow.
  • Gateway: Next-hop gateway of the flow.
  • Tunnel: If the flow is going into a tunnel, the tunnel ID. Otherwise, 0 (zero).
  • Port Sequence, FIN sequence, FIN state, Cookie: Internal TCP state tracking information.
 

Out

For the reverse flow:

  • Source and destination addresses and protocol tuple for the input flow.
  • Interface: Input flow interface.
  • Session token: Internal token derived from the virtual routing instance.
  • Flag: Internal debugging flags.
  • Route: Internal next hop of the route to be used by the flow.
  • Gateway: Next-hop gateway of the flow.
  • Tunnel: If the flow is going into a tunnel, the tunnel ID. Otherwise, 0 (zero).
  • Port Sequence, FIN sequence, FIN state, Cookie: Internal TCP state tracking information.
 

Monitoring Flow Session Source Port Information

To view information about each session that uses the specified source port, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select source port from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session source–port source-port-number

Table 69 summarizes key output fields in the flow session source port display.

Table 69: Summary of Key Flow Source Port Session Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—source port

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Session Source Prefix Information

To view information about each session that uses the specified source prefix, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select source prefix from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session source–prefix source-prefix-number

Table 70 summarizes key output fields in the flow session source prefix display.

Table 70: Summary of Key Flow Source Prefix Session Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—source prefix

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Out

Reverse flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring Flow Session Tunnel Information

To view information about all tunnel session, select Monitor>Security>Flow Session Statistics in the J-Web interface. Then select tunnel from the Session Filter list and click Show. Alternatively, enter the following CLI command:

show security flow session tunnel

Table 71 summarizes key output fields in the flow session tunnel display.

Table 71: Summary of Key Flow Tunnel Session Output Fields

Field

Values

Additional Information

Flow Session Statistics: session filter—tunnel

Session ID

Number that identifies the session. Use this ID to get more information about the session.

 

Policy name

Policy that permitted the traffic.

 

Timeout

Idle timeout after which the session expires.

 

In

Incoming flow (source and destination IP addresses, application protocol, and interface).

 

Monitoring IDP

For information about monitoring Intrusion Detection and Prevention features, see the Junos OS Security Configuration Guide.

Monitoring Flow Gate Information

To view information about temporary openings known as pinholes or gates in the security firewall, select Monitor>Security>Flow Gate Information in the J-Web interface, or enter the following CLI command:

show security flow gate

Table 72 summarizes key output fields in the flow gate display.

Table 72: Summary of Key Flow Gate Output Fields

Field

Values

Additional Information

Flow Gate Information

Hole

Range of flows permitted by the pinhole.

 

Translated

Tuples used to create the session if it matches the pinhole:

  • Source address and port
  • Destination address and port
 

Protocol

Application protocol, such as UDP or TCP.

 

Application

Name of the application.

 

Age

Idle timeout for the pinhole.

 

Flags

Internal debug flags for pinhole.

 

Zone

Incoming zone.

 

Reference count

Number of resource manager references to the pinhole.

 

Resource

Resource manager information about the pinhole.

 

Monitoring Firewall Authentication

The J-Web interface provides information about user authentications and history of authentications.

This section contains the following topics:

Monitoring Firewall Authentication Table

The firewall authentication user information is divided into multiple parts. To view information about authentication table, select Monitor>Security>Firewall Authentication>Authentication Table in the J-Web interface. To view detailed information about the user with a particular identifier, select the ID on the Authentication Table page. To view detailed information about the user at a particular source IP address, select the Source IP on the Authentication Table page.

Alternatively, enter the following CLI commands:

Table 73 summarizes key output fields in firewall authentication table display.

Table 73: Summary of Key Firewall Authentication Table Output Fields

Field

Values

Additional Information

Firewall authentication users

Total users in table

Number of users in the authentication table.

 
Authentication table

ID

Authentication identification number.

 

Source Ip

IP address of the authentication source.

 

Age

Idle timeout for the user.

 

Status

Status of authentication (success or failure).

 

user

Name of the user.

 
Detailed report per ID selected: ID

Source Zone

Name of the source zone.

 

Destination Zone

Name of the destination zone.

 

profile

Name of the profile.

Users information.

Authentication method

Path chosen for authentication.

 

Policy Id

Policy Identifier.

 

Interface name

Name of the interface.

 

Bytes sent by this user

Number of packets in bytes sent by this user.

 

Bytes received by this user

Number of packets in bytes received by this user.

 

Client-groups

Name of the client group.

 
Detailed report per Source Ip selected

Entries from Source IP

IP address of the authentication source.

 

Source Zone

Name of the source zone.

 

Destination Zone

Name of the destination zone.

 

profile

Name of the profile.

 

Age

Idle timeout for the user.

 

Status

Status of authentication (success or failure).

 

user

Name of the user.

 

Authentication method

Path chosen for authentication.

 

Policy Id

Policy Identifier.

 

Interface name

Name of the interface.

 

Bytes sent by this user

Number of packets in bytes sent by this user.

 

Bytes received by this user

Number of packets in bytes received by this user.

 

Client-groups

Name of the client group.

 

Monitoring Firewall Authentication History

The firewall authentication history information is divided into multiple parts. To view information about the authentication history, select Monitor>Security>Firewall Authentication>Authentication History in the J-Web interface. To view the detailed history of the authentication with this identifier, select the ID on the Firewall Authentication History page. To view a detailed authentication history of this source IP address, select the Source IP on the Firewall Authentication History page.

Alternatively, enter the following CLI show commands:

Table 74 summarizes key output fields in firewall authentication history display.

Table 74: Summary of Key Firewall Authentication History Output Fields

Field

Values

Additional Information

History of Firewall Authentication Data

Total authentications

Number of authentication.

 
History Table

ID

Identification number.

 

Source Ip

IP address of the authentication source.

 

Start Date

Authentication date.

 

Start Time

Authentication time.

 

Duration

Authentication duration.

 

Status

Status of authentication (success or failure).

 

User

Name of the user.

 
Detail history of selected Id: ID

Authentication method

Path chosen for authentication.

 

Policy Id

Security policy identifier.

 

Source zone

Name of the source zone.

 

Destination Zone

Name of the destination zone.

 

Interface name

Name of the interface.

 

Bytes sent by this user

Number of packets in bytes sent by this user.

 

Bytes received by this user

Number of packets in bytes received by this user.

 

Client-groups

Name of the client group.

 
Detail history of selected Source Ip:Source Ip

User

Name of the user.

 

Start Date

Authentication date.

 

Start Time

Authentication time.

 

Duration

Authentication duration.

 

Status

Status of authentication (success or failure).

 

Profile

Name of the profile.

 

Authentication method

Path chosen for authentication.

 

Policy Id

Security policy identifier.

 

Source zone

Name of the source zone.

 

Destination Zone

Name of the destination zone.

 

Interface name

Name of the interface.

 

Bytes sent by this user

Number of packets in bytes sent by this user.

 

Bytes received by this user

Number of packets in bytes received by this user.

 

Client-groups

Name of the client group.

 

Monitoring 802.1x

To view information about 802.1X properties, select Monitor>Security>802.1x in the J-Web interface or enter the following CLI commands:

Table 75 summarizes the Dot1X output fields.

Table 75: Summary of Dot1X Output Fields

Field

Values

Additional Information

Select Port

List of ports for selection.

 

Number of connected hosts

Total number of hosts connected to the port.

 

Number of authentication bypassed hosts

Total number of authentication-bypassed hosts with respect to the port.

 
Authenticated Users Summary

MAC Address

MAC address of the connected host.

 

User Name

Name of the user.

 

Status

Information about the host connection status.

 

Authentication Due

Information about host authentication.

 
Authentication Failed Users Summary

MAC Address

MAC address of the authentication-failed host.

 

User Name

Name of the authentication-failed user.

 
Copyright© 1999-2010 Juniper Networks, Inc. All rights reserved.