R80.10: fw monitor – new inspection points (eE)

Earlier today a colleague found out that when he used fw monitor on R80.10 he saw two extra inspection points in the output. For years we’ve all seen iIoO but since R80.10 there is eE too! We’ve tried to find documentation about it but basically this is still undocumented.


[vs_0][fw_1] eth1:i[212]: 192.168.103.65 -> 10.11.11.23 (TCP) len=212 id=28330
TCP: 3421 -> 443
[vs_0][fw_1] eth1:I[212]: 192.168.103.65 -> 10.11.11.23 (TCP) len=212 id=28330
TCP: 3421 -> 443
[vs_0][fw_1] eth3:o[212]: 192.168.103.65 -> 10.11.11.23 (TCP) len=212 id=28330
TCP: 3421 -> 443
[vs_0][fw_1] eth3:O[212]: 192.168.103.65 -> 10.11.11.23 (TCP) len=212 id=28330
TCP: 3421 -> 443
[vs_0][fw_0] eth3:e[212]: 192.168.103.65 -> 10.11.11.23 (TCP) len=212 id=28330
TCP: 3421 -> 443
[vs_0][fw_0] eth3:E[212]: 192.168.103.65 -> 10.11.11.23 (TCP) len=212 id=28330
TCP: 3421 -> 443

We expected the e’s would have something to do with encryption.

Continue reading “R80.10: fw monitor – new inspection points (eE)”