Syntax Error ? Invalid Character in Port List

book

Article ID: 36153

calendar_today

Updated On:

Products

APPLICATION DELIVERY ANALYSIS SUPERAGENT

Issue/Introduction

Introduction/Summary:

Syntax errors can occur when creating hardware filters.  The web UI does some amount of syntax checking but it is not exhaustive. 

Background: 

When looking at the nqnapacapd log, the first line (Command: ) will show the filter as it is stored in the MTP database.  This makes use of macros for specifying the filter such as mTcpSrcPort and mTCPDestPort.  The second line indicating the error displays the expanded syntax of the filter.

To resolve problems with syntax errors, correct the error and then restart the nqcapd process.

Environment: 

CA Multi-Port Monitor (any version)

Instructions:

1 - Syntax Error – Invalid Character in Port List

The following log snippet shows the error that was received when an invalid character was specified in a port list of the hardware filter.  Note that the list (80,443.8080) incorrectly contains a period in the list instead of a comma.

11:25:04 Command: Capture[Feed=1;Priority=5]=((mTCPSrcPort==80,443.8080 OR mTCPDestPort==80,443.8080) AND Channel==1)

Above line gives syntax stored in database which includes macros (mXXX)

11:25:04 Capture[Feed=1;Priority=5]=((Data[DynOffset=DynOffTCPFrame;Offset=0;DataType=[15:0]]==80,443.8080 OR Data[DynOffset=DynOffTCPFrame;Offset=2;DataType=[15:0]]==80,443.8080) AND Channel==1)

When error detected, driver returns command with macros expanded.

11:25:04 ^
11:25:04 * * * Error: Identifier expected

Detected error is indicated.  Carats roughly point to where in command syntax error was detected.

2 - Hardware Filter Syntax Error – Unbalanced Parenthesis in Advanced Filter

The following log snippet shows the error that was received when an invalid advanced filter was specified.  Note that the parenthesis in this list are not balanced.

20090402-12:12:31  Command:  Capture[Feed=2;SliceOffset=1;SliceAddHeader=Layer2And3And4HeaderSize]=((((mIPSrcAddr==[10.10.1.1] AND mIPDestAddr!=[10.10.2.2]) OR (mIPSrcAddr==[10.10.2.2] AND mIPDestAddr!=[10.10.1.1])) OR (mIPSrcAddr!=[10.10.1.1],[10.10.2.2]) AND Channel==2)

Above line gives syntax stored in database which includes macros (mXXX)

20090402-12:12:31  Capture[Feed=2;SliceOffset=1;SliceAddHeader=Layer2And3And4HeaderSize]=((((Data[DynOffset=DynOffIPv4Frame;Offset=12;DataType=IPv4Addr]==[10.10.1.1] AND Data[DynOffset=DynOffIPv4Frame;Offset=16;DataType=IPv4Addr]!=[10.10.2.2]) OR (Data[DynOffset=DynOffIPv4Frame;Offset=12;DataType=IPv4Addr]==[10.10.2.2] AND Data[DynOffset=DynOffIPv4Frame;Offset=16;DataType=IPv4Addr]!=[10.10.1.1])) OR (Data[DynOffset=DynOffIPv4Frame;Offset=12;DataType=IPv4Addr]!=[10.10.1.1],[10.10.2.2]) AND Channel==2)

When error detected, driver returns command with macros expanded.

20090402-12:12:31                                                                                                                                                                                                    20090402-12:12:31  * * * Error: Expeted rigth  [sic] parentheses

Detected error is indicated.  Carats roughly point to where in command syntax error was detected.

Environment

Release: "SA24TH99000-2.2-Application Delivery Analysis-Multi-Port Monitor
Component: