플로우 테이블

Argo는 모든 연결을 추적합니다. 전체 덤프는 원칙적으로 제한이 없고 실제로 다루기 불편하기 때문에, 테이블에 무엇이 담겨 있는지보다 테이블을 어떻게 조회하는지가 더 중요합니다.

`flow-l-match`

거의 항상 원하는 것이 이 명령입니다. 주소 하나, 또는 주소와 포트를 받습니다.

{"command":["flow-l-match","100.127.192.10:53"]}

Flow table(size 41943040, entries 163840) @ Time 4937348

ICMP Aging time: 5000ms, UDP Aging time: 20000ms, TCP Aging time: 600000ms, Default Aging time: 30000ms
Flow eviction threshold: 50, Overflow eviction threshold: 25, Eviction count: 0
Entries: Created 10386 Added 10346 Deleted 11
Changed 1060 Processed 10372 Used Overflow entries 0
Add/Change Fails 1 Delete Fails 0
Eviction cycles:( )
(Created Flows/CPU: 0 0 0 0 0 0 0 0 0 0 0 0 4656 5730)(oflows 0)

Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port)
 Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop D(nh)=Destination NH D(L)=Destination Label
 Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked
       Fw=Forward Flow, L=Log the flow entry I=Evict Immediate
TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead

Listing flows matching ([100.127.192.10]:53)

    Index                Source:Port/Destination:Port                      Proto(V)
-----------------------------------------------------------------------------------

각 플로우의 action이 핵심입니다: F 전달, D 드롭, N NAT. action이 D인 플로우가 존재한다는 것은 데이터 플레인이 의도적인 결정을 내렸다는 의미이며, 이는 연결성 문제가 아니라 정책을 살펴보도록 안내합니다.

`flow-l`

전체 덤프입니다.

{"command":["flow-l"]}

Flow table(size 41943040, entries 163840) @ Time 4935568

ICMP Aging time: 5000ms, UDP Aging time: 20000ms, TCP Aging time: 600000ms, Default Aging time: 30000ms
Flow eviction threshold: 50, Overflow eviction threshold: 25, Eviction count: 0
Entries: Created 10376 Added 10336 Deleted 11
Changed 1060 Processed 10362 Used Overflow entries 0
Add/Change Fails 1 Delete Fails 0
Eviction cycles:( )
(Created Flows/CPU: 0 0 0 0 0 0 0 0 0 0 0 0 4653 5723)(oflows 0)

Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port)
 Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop D(nh)=Destination NH D(L)=Destination Label
 Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked
       Fw=Forward Flow, L=Log the flow entry I=Evict Immediate
TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead

    Index                Source:Port/Destination:Port                      Proto(V)
-----------------------------------------------------------------------------------
      532<=>6356         10.0.1.4:53012                                     17 (7)
                         168.63.129.16:53
(Gen: 0, K(Idx):15, Action:N(), Flags:FwIn, Pf:,  Stats:1/81
 QOS:-1, S(nh):19, D(nh):34, D(L):0, SPort: 58283, TTL: 0, CPU: 13,  Sinfo: <public-ip>
 Created: 4927963, Modified : 4927963, LastSeen: 4927963, Changed: 0, ACL: 1/2
Changes: Ac - - - - - -  )

      664<=>40552        168.63.129.16:53                                   17 (7)
                         10.0.1.4:36710
(Gen: 0, K(Idx):14, Action:N(), Flags:In, Pf:,  Stats:1/188
 E0:0, QOS:-1, S(nh):34, D(nh):19, D(L):0, SPort: 58702, TTL: 0, CPU: 12,
 Sinfo: <public-ip>
 Created: 4923714, Modified : 4923714, LastSeen: 4923732, Changed: 0, ACL: 1/2)

      792<=>24964        10.0.1.4:65003                                      6 (7->8)
                         169.254.0.10:42560
(Gen: 0, K(Idx):15, Action:N(SDPd), Flags:In, TCP:SSrEEr,  Stats:275/31337
 E0:1, QOS:-1, S(nh):19, D(nh):83, D(L):0, SPort: 62792, TTL: 0, CPU: 13,
 Sinfo: <public-ip>
 Created: 1581744, Modified : 3210907, LastSeen: 4930541, Changed: 1, ACL: 2/0
Changes: Vd - - - - - -  )

      964<=>6076         168.63.129.16:53                                   17 (7)
                         10.0.1.4:60034
(Gen: 0, K(Idx):14, Action:N(), Flags:In, Pf:,  Stats:1/236
 E0:0, QOS:-1, S(nh):34, D(nh):19, D(L):0, SPort: 52927, TTL: 0, CPU: 12,
 Sinfo: <public-ip>
 Created: 4923714, Modified : 4923714, LastSeen: 4923725, Changed: 0, ACL: 1/2)

     1316<=>36508        10.0.1.4:29855                                      6 (13->7)
                         <public-ip>:443
(Gen: 0, K(Idx):4107, Action:N(SPs), Flags:FwIn, TCP:SSrEEr,  Stats:1287/115766
 QOS:-1, S(nh):75, D(nh):34, D(L):0, SPort: 57213, TTL: 0, CPU: 13,  Sinfo: <public-ip>
 Created: 706687, Modified : 3209498, LastSeen: 4926852, Changed: 1, ACL: 65/1
Changes: Ac - - - - - -  )

     2260<=>7768         10.0.1.4:65003                                      6 (7->8)
                         169.254.0.10:42563
(Gen: 1, K(Idx):15, Action:N(SDPd), Flags:In, TCP:SSrEEr,  Stats:49/34723
 E0:0, QOS:-1, S(nh):19, D(nh):83, D(L):0, SPort: 60138, TTL: 0, CPU: 13,
 Sinfo: <public-ip>
 Created: 4903032, Modified : 4903032, LastSeen: 4932562, Changed: 0, ACL: 2/0)

... [capture trimmed: first 60 of 1222 lines]