跳到內容
多雲網路

流量表

Argo 會追蹤每一條連線。查詢此表格的方式比表格本身的內容更為重要， 因為完整傾印在原理上是無界限的，實際操作上也相當不便。

flow-l-match

Section titled “flow-l-match”

幾乎總是你所需要的指令。接受一個位址，或是一個位址加通訊埠。

Terminal window
{"command":["flow-l-match","100.127.192.10:53"]}
Flow table(size 41943040, entries 163840) @ Time 4937348


ICMP Aging time: 5000ms, UDP Aging time: 20000ms, TCP Aging time: 600000ms, Default Aging time: 30000ms
Flow eviction threshold: 50, Overflow eviction threshold: 25, Eviction count: 0
Entries: Created 10386 Added 10346 Deleted 11
Changed 1060 Processed 10372 Used Overflow entries 0
Add/Change Fails 1 Delete Fails 0
Eviction cycles:( )
(Created Flows/CPU: 0 0 0 0 0 0 0 0 0 0 0 0 4656 5730)(oflows 0)


Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port)
 Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop D(nh)=Destination NH D(L)=Destination Label
 Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked
       Fw=Forward Flow, L=Log the flow entry I=Evict Immediate
TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead


Listing flows matching ([100.127.192.10]:53)


    Index                Source:Port/Destination:Port                      Proto(V)
-----------------------------------------------------------------------------------

每條流量上的動作才是重點：F 轉送、D 丟棄、N NAT。若某條流量存在 且動作為 D，表示資料平面做出了刻意的決定，這會將你的排查方向導向 政策，而非連線能力。

flow-l

Section titled “flow-l”

完整傾印。

Terminal window
{"command":["flow-l"]}
Flow table(size 41943040, entries 163840) @ Time 4935568


ICMP Aging time: 5000ms, UDP Aging time: 20000ms, TCP Aging time: 600000ms, Default Aging time: 30000ms
Flow eviction threshold: 50, Overflow eviction threshold: 25, Eviction count: 0
Entries: Created 10376 Added 10336 Deleted 11
Changed 1060 Processed 10362 Used Overflow entries 0
Add/Change Fails 1 Delete Fails 0
Eviction cycles:( )
(Created Flows/CPU: 0 0 0 0 0 0 0 0 0 0 0 0 4653 5723)(oflows 0)


Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port)
 Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop D(nh)=Destination NH D(L)=Destination Label
 Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked
       Fw=Forward Flow, L=Log the flow entry I=Evict Immediate
TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead


    Index                Source:Port/Destination:Port                      Proto(V)
-----------------------------------------------------------------------------------
      532<=>6356         10.0.1.4:53012                                     17 (7)
                         168.63.129.16:53
(Gen: 0, K(Idx):15, Action:N(), Flags:FwIn, Pf:,  Stats:1/81
 QOS:-1, S(nh):19, D(nh):34, D(L):0, SPort: 58283, TTL: 0, CPU: 13,  Sinfo: <public-ip>
 Created: 4927963, Modified : 4927963, LastSeen: 4927963, Changed: 0, ACL: 1/2
Changes: Ac - - - - - -  )


      664<=>40552        168.63.129.16:53                                   17 (7)
                         10.0.1.4:36710
(Gen: 0, K(Idx):14, Action:N(), Flags:In, Pf:,  Stats:1/188
 E0:0, QOS:-1, S(nh):34, D(nh):19, D(L):0, SPort: 58702, TTL: 0, CPU: 12,
 Sinfo: <public-ip>
 Created: 4923714, Modified : 4923714, LastSeen: 4923732, Changed: 0, ACL: 1/2)


      792<=>24964        10.0.1.4:65003                                      6 (7->8)
                         169.254.0.10:42560
(Gen: 0, K(Idx):15, Action:N(SDPd), Flags:In, TCP:SSrEEr,  Stats:275/31337
 E0:1, QOS:-1, S(nh):19, D(nh):83, D(L):0, SPort: 62792, TTL: 0, CPU: 13,
 Sinfo: <public-ip>
 Created: 1581744, Modified : 3210907, LastSeen: 4930541, Changed: 1, ACL: 2/0
Changes: Vd - - - - - -  )


      964<=>6076         168.63.129.16:53                                   17 (7)
                         10.0.1.4:60034
(Gen: 0, K(Idx):14, Action:N(), Flags:In, Pf:,  Stats:1/236
 E0:0, QOS:-1, S(nh):34, D(nh):19, D(L):0, SPort: 52927, TTL: 0, CPU: 12,
 Sinfo: <public-ip>
 Created: 4923714, Modified : 4923714, LastSeen: 4923725, Changed: 0, ACL: 1/2)


     1316<=>36508        10.0.1.4:29855                                      6 (13->7)
                         <public-ip>:443
(Gen: 0, K(Idx):4107, Action:N(SPs), Flags:FwIn, TCP:SSrEEr,  Stats:1287/115766
 QOS:-1, S(nh):75, D(nh):34, D(L):0, SPort: 57213, TTL: 0, CPU: 13,  Sinfo: <public-ip>
 Created: 706687, Modified : 3209498, LastSeen: 4926852, Changed: 1, ACL: 65/1
Changes: Ac - - - - - -  )


     2260<=>7768         10.0.1.4:65003                                      6 (7->8)
                         169.254.0.10:42563
(Gen: 1, K(Idx):15, Action:N(SDPd), Flags:In, TCP:SSrEEr,  Stats:49/34723
 E0:0, QOS:-1, S(nh):19, D(nh):83, D(L):0, SPort: 60138, TTL: 0, CPU: 13,
 Sinfo: <public-ip>
 Created: 4903032, Modified : 4903032, LastSeen: 4932562, Changed: 0, ACL: 2/0)


... [capture trimmed: first 60 of 1222 lines]