Avi service engine may crash if filters are applied during SE packet capture

Products

• VMware Avi Load Balancer

Issue/Introduction

An Avi Service Engine (SE) may unexpectedly crash under specific diagnostic circumstances.

This issue is triggered when initiating a service engine-level packet capture while simultaneously applying traffic filters, such as Client IP or port number.

 

Example screenshot of starting a service engine packet capture via the UI (offending configuration highlighted in Red boxes):

 

Cause

The Service Engine crash is the result of a corner-case condition encountered by the SE packet capture utility's filtering mechanism.

Under certain specific circumstances, the filter logic fails, leading to the process crash.

Resolution

Permanent Fix

This issue is fully resolved in the upcoming Avi version 31.2.1 and all subsequent releases.

To permanently prevent this issue, we recommend upgrading your Avi controllers and Service Engines to this version once it is released.

Workaround:

You can safely perform a packet capture by initiating it without applying the filters (Client IP addresses, Source Port, Destination Start Port, and Destination End Port).

The full, unfiltered capture can then be downloaded and analyzed offline using tools like Wireshark, where you can apply the necessary display filters to isolate the traffic of interest.

Additional Information

Reference KB for service engine packet capture: https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/monitoring-and-operability-guide/application-troubleshooting/packet-capture/capturing-service-engine-traffic-using-cli.html