Method for determining the operations performed on packets by a network device
Methods and systems for determining the operations performed on packets by a network device are described. A simulated packet is input into a network device. The path taken by the simulated packet is traced. Also, the operations performed on the simulated packet are logged. Further, the operations performed on the simulated packet and configuration information of the operations are analyzed and displayed.
1. A method for determining operations performed on packets by a network device, the method comprising:
generating a simulated packet comprising user defined attribute information including one or more of the following: ingress interface data, source Internet Protocol (IP) address, destination IP address, communication protocol, source port data, destination port data or hex dump data;
inputting the simulated packet into the network device;
tracing a path taken by the simulated packet through the network device;
logging operations performed on the simulated packet during processing by the network device;
analyzing operations performed on the simulated packet and configuration information of the operations to verify that the network device is permitting or denying other packets according to the configuration information; and
displaying operations and configuration information.
2. The method of claim 1 further comprises correlating an operation of the operations performed on the simulated packet with an associated entry from the configuration information.
3. The method of claim 1 , wherein the simulated packet is generated from a hex dump of a packet.
4. The method of claim 1 , wherein the simulated packet is removed from the path if the simulated packet is dropped.
5. The method of claim 1 , wherein the simulated packet is removed from the path if the simulated packet reaches an egress interface of the network device.
6. The method of claim 1 , wherein key attributes of the simulated packet is defined by a user via a command line interface (CLI).
7. The method of claim 1 , wherein the network device is a firewall.
8. The method of claim 1 , wherein the network device is a router.
9. The method of claim 1 , wherein the network device is an Intrusion Prevention Device.
10. The method of claim 1 , wherein the logging comprises adding a tag to the simulated packet to indicate the operations performed on the simulated packet.
11. A system for determining operations performed on packets by a network device, the system comprising:
means for generating a simulated packet from a hex dump of a non-simulated packet;
means for inputting the simulated packet into the network device;
means for tracing a path taken by the simulated packet through the network device;
means for logging operations performed on the simulated packet during processing by the network device;
means for analyzing operations performed on the simulated packet and configuration information of the operations to verify that the network device is permitting or denying other packets according to the configuration information; and
means for displaying operations and configuration information.
12. The system of claim 11 , wherein the means for logging comprises means for adding tags to the simulated packet.
13. The system of claim 12 , wherein the tags indicate a plurality of actions taken on the simulated packet.
14. An apparatus for determining actions taken on packets by a network device, comprising:
an ingress interface for receiving a simulated packet into the network device wherein the simulated packet is generated from user defined attribute information;
a logger for logging actions taken on the simulated packet during processing by the network device and for recording a path taken by the simulated packet as the simulated packet travels through the network device;
a processor for processing actions taken on the simulated packet and configuration information of the actions to verify that the network device is permitting or denying other packets according to the configuration information; and
a display for displaying actions and configuration information.
15. The apparatus of claim 14 , wherein the network device is a router.
16. The apparatus of claim 14 , wherein the processor automatically correlates an action of the actions taken on the simulated packet with an associated entry from the configuration information.
17. The apparatus of claim 14 , wherein the simulated packet is removed from the path if the simulated packet is dropped.
18. The apparatus of claim 14 , wherein the simulated packet is removed from the path if the simulated packet reaches an egress interface of the network device.
19. The apparatus of claim 14 , wherein the user defined attribute information of the simulated packet is defined by a user via a command line interface (CLI).
20. The apparatus of claim 19 , wherein the user defined attribute information comprises ingress interface information, source Internet Protocol address, and destination Internet Protocol address.