Understanding debug ffilters
Knowledge Base ID: KB6709
Version: 5.0
Published: 07 Oct 2008
Updated: 07 Oct 2008
Categories: . Firewall/IPSec_VPN
. ScreenOS

Synopsis:
Understanding debug ffilters

Problem:
Environment:
  • ffilter
  • flow filters
Symptoms & Errors:
  • not capturing the debug data

Solution:

When configuring debug ffilters, the filters can be configured to be logical AND or OR statements.

OR operation:

When the filters are entered on separate lines the filters will be logically OR :

set ffilter src-ip <ip address X>
set ffilter dst-ip <ip address Y>
set ffilter ip-proto <protocol #>

This will capture the data if the source OR destination matches the specified IP address OR if the data matches the specified IP protocol

AND operation:

When the ffilters are entered on the same line, they will be logically AND:

set ffilter src-ip <ip address X> dst-ip <ip address Y> ip-proto <protocol#>

Only data where the source address matches the specified ip address X   AND the destination address matches the specified ip address Y AND the protocol # matches the specified # will be captured.  A match must be found for all statements or the data will not be captured.

Purpose:
Configuration