Purpose: This document describes debug support available for:

IP and Port Feed
URL Feed
DNS Feed
IP Feed

Note: Commands starting with vsm-vcsn0> are executed within the vsmd vty (use vsh connect vsmd from the shell to access it)

IP and Port Feed

Syntax:

show orgs org-services versanet security threat-intelligence ip-port-feed stats

Description: Display per-feed statistics for IP-Port threat feeds, including message counts, add/delete/failure counts, match counts, and LEF messages sent.

Output:

   VMS VMS
   VMS FAILED FAILED VMS
   VMS ADD DELETE IP ADD IP DELETE IP IP VMS LEF
   VMS IP PORT PORT PORT PORT PORT MESSAGE
   MESSAGE ADDRESSES ADDRESSES ADDRESSES ADDRESSES MATCH SENT
NAME COUNT COUNT COUNT COUNT COUNT COUNT COUNT

ipf_feed 2 3 0 0 0 0 0

==========================================================

Syntax:

request orgs org-services Versa-Provider security threat-intelligence ip-port-feed logs

Description: Display the full operational log for IP-Port threat feed processing, showing message parsing, and processing details per feed.

Output:
result

Index Level Timestamp Event Seq-Number Feed-Name Tenant Message

1 info Tue 16 Dec 19:35 vms-message-received 0 ipf_feed Versa-Provider received: add: 2, delete: 0
info Tue 16 Dec 19:35 vms-message-parse 0 ipf_feed Versa-Provider added ip port address: 221.210.60.120, start-port: 53981, end-port: 62294
3 info Tue 16 Dec 19:35 vms-message-parse 0 ipf_feed Versa-Provider added ip port address: 12.36.107.5/32, start-port: 29109, end-port: 36508
4 info Tue 16 Dec 19:35 vms-message-process 0 ipf_feed Versa-Provider message processed. added: 2, deleted: 0, add-failed: 0, delete-failed: 0, total-entries: 2, time: 2ms

status success
[ok][2025-12-23 17:24:48]
===============================================================

Syntax:

request orgs org-services Versa-Provider security threat-intelligence ip-port-feed logs limit 2

Description: Display filtered IP-Port threat feed logs by log level and limit the output to the most recent N entries.

Output:
result Index Level Timestamp Event Seq-Number Feed-Name Tenant Message

1 info Tue 16 Dec 19:35 vms-message-parse 0 ipf_feed Versa-Provider added ip port address: 12.36.107.5/32, start-port: 29109, end-port: 36508
2 info Tue 16 Dec 19:35 vms-message-process 0 ipf_feed Versa-Provider message processed. added: 2, deleted: 0, add-failed: 0, delete-failed: 0, total-entries: 2, time: 2ms

status success

============================================================

Syntax:

request orgs org-services Versa-Provider security threat-intelligence ip-port-feed logs log-level info limit 3

Description: Display the most recent N operational log entries for IP-Port threat feed processing, filtered by the specified log level (info or error).

Output: result Index Level Timestamp Event Seq-Number Feed-Name Tenant Message

1 info Tue 16 Dec 19:35 vms-message-parse 0 ipf_feed Versa-Provider added ip port address: 221.210.60.120, start-port: 53981, end-port: 62294
2 info Tue 16 Dec 19:35 vms-message-parse 0 ipf_feed Versa-Provider added ip port address: 12.36.107.5/32, start-port: 29109, end-port: 36508
3 info Tue 16 Dec 19:35 vms-message-process 0 ipf_feed Versa-Provider message processed. added: 2, deleted: 0, add-failed: 0, delete-failed: 0, total-entries: 2, time: 2ms

status success
[ok][2025-12-23 17:27:57]
=================================================================

Syntax:

request orgs org-services Versa-Provider security threat-intelligence ip-port-feed logs log-level debug

Description: Display the full operational log for IP-Port threat feed processing, showing message reception, parsing, and processing details per feed.

Output:
result No log entries found
status success
=================================================================

Syntax:

request orgs org-services Versa-Provider security threat-intelligence ip-port-feed logs feed-name ipf_feed limit 2

Description: Display the full operational log for IP-Port threat feed processing, showing message reception, parsing, and processing details per feed.

Output:

result Index Level Timestamp Event Seq-Number Feed-Name Tenant Message

status success

==========================================================

Syntax:

request orgs org-services versanet security threat-intelligence ip-port-feed search feed-name ipf_feed1 ip-port 181.113.212.101,26661-41906

Description: Search for a specific IP-port entry within a named feed. Returns found or not-found.

Output:

result not-found

status success

==========================================================

Syntax:

request orgs org-services versanet security threat-intelligence ip-port-feed search feed-name ipf_feed ip-port 181.113.212.101,26661-41906

Description: Check if a given destination IP and port matches any configured IP-Port threat feed. Returns the matched feed name if found.

Output:

result found

status success

=====================================

Syntax:

request orgs org-services ORG1 security threat-intelligence ip-port-feed match dst-ip 145.79.14.22 dst-port 35780

Description: Check if a given destination IP and port matches any configured IP-Port threat feed. Returns the matched feed name if found.

Output:
result matched-feed: IP-Port-Feed-1
status success
[ok][2026-02-17 14:38:25]

====================================================

Syntax:

request orgs org-services ORG1 security threat-intelligence ip-port-feed search feed-name IP-Port-Feed-1 ip-port-range 187.111.8.61-187.111.8.61,24355-24355

Description: Search for a specific IP-port range entry within a named feed. Returns found or not-found.

Output:
result not-found
status success

====================================================

Syntax:

vsm-vcsn0> show threat-intel ip-port-feed data ORG1-2 IP-Port-Feed-1

Description: Display all IP-port range entries programmed in a specific feed for the given tenant.

Output:

[1] : 6.142.75.147-6.142.75.147:4376-4376
[2] : 41.138.136.169-41.138.136.169:47115-47115
[3] : 163.92.137.182-163.92.137.182:21407-21407
[4] : 171.188.164.8-171.188.186.68:30965-41510
[5] : 183.153.237.247-183.153.237.247:3040-13917
[6] : 81.65.176.220-81.65.176.220:17066-50952
[7] : 115.198.23.98-115.198.78.235:46854-49057
[8] : 223.223.208.18-223.223.252.108:12575-52007
[9] : 26.43.153.135-26.43.153.135:18908-18908
[10] : 75.194.15.199-75.194.15.199:21818-21818

====================================================

Syntax:

vsm-vcsn0> show threat-intelligence ip-port-feed stats versanet-2

Description: Display VMS and datapath statistics for IP-Port threat feeds, including add/delete/failure counts, skipped/duplicate messages, and match/LEF counters.

Output:

VMS {

Message-count : 2

IPPort-add-count : 4

IPPort-delete-count : 0

IPPort-add-failed-count : 0

IPPort-delete-failed-count : 0

Skipped-message-count : 0

Duplicate-add-count : 0

Max-entries-discard-count : 0

}

Datapath {

IPPort-match-count : 0

LEF-log-sent-count : 0

}

====================================================

Syntax:

vsm-vcsn0> test threat-intelligence ip-port-feed export userdefined versanet-2 ipf_feed /tmp/ip-port-entries.txt

Description: Export all IP-port entries of a user-defined feed to a file on the device for debugging or inspection.

====================================================

DNS FEED

1 Show Database Statistics Only

Syntax:

show orgs org-services <org-name> dns-filtering threat-intel db-statistics

Description: Displays database-level counters for VMS feed synchronization. Shows success/failure counts for vsync message processing, database init, data exchange, and individual feed entry add/delete operations.

Key fields: process-vsync-message-success

VMS sync messages processed OK

feed-data-addition-success

Domain entries added to DB

feed-data-deletion-success

Domain entries removed from DB

feed-data-add-low-mem-rejected

Entries rejected due to low memory

feed-data-del-domain-not-found

Delete attempted on missing domain

Output: admin@versa-flexvnf-cli> show orgs org-services provider dns-filtering threat-intel db-statistics

dns-filtering threat-intel db-statistics provider

process-vsync-message-success 3

domain-db-init-success 1

domain-db-data-exchange-success 1

feed-data-addition-success 30

feed-data-deletion-success 0

process-vsync-message-failure 0

invalid-vsync-message 0

domain-db-init-failure 0

domain-db-data-exchange-failure 0

feed-data-fetch-failure 0

feed-data-add-mem-failure 0

feed-data-add-failure 0

feed-data-deletion-failure 3

feed-data-add-null-record 0

feed-data-add-limit-reached 0

feed-data-add-tree-failure 0

feed-data-del-null-record 0

feed-data-del-domain-not-found 3

feed-data-del-feed-not-found 0

feed-data-add-low-mem-rejected 0

feed-data-del-low-mem-rejected 0

2 Action: Test Domain Match

Syntax: request orgs org-services <org-name> dns-filtering threat-intel match-domain domain <domain-name>

Description: Tests whether a given domain name exists in the threat-intel database for the specified organization. Useful for verifying that feed data has been loaded correctly.

3 Action: Clear Statistics

Syntax: request orgs org-services <org-name> dns-filtering threat-intel clear-stats

Description: Resets all threat-intel datapath and database statistics counters to zero for the specified organization.

4 Action: Clear Database

Syntax: request orgs org-services <org-name> dns-filtering threat-intel clear-database

Description: Clears the entire threat-intel domain database for the specified organization. Feed data will be repopulated on the next VMS sync.

WARNING: This removes all loaded feed entries. Traffic will not be matched against feeds until the database is repopulated.

5 Action: Show Domain Feed Logs

Syntax: request orgs org-services <org-name> dns-filtering threat-intel logs

[limit <N>] [feed-name <name>] [log-level <level>]

[event-type <type>] [seq-num <num>]

All parameters are optional. Without any parameters, shows the most recent log entries.

Description: Displays structured logs for threat-intel domain feed processing. Useful for debugging feed sync issues.

Parameters: limit Number of recent log entries

feed-name Filter by specific feed name

log-level Filter by level: info, error, debug

event-type Filter by event type

seq-num Filter by sequence number

Output: admin@versa-flexvnf-cli> request orgs org-services provider dns-filtering threat-intel logs

status success

result

Index Level Timestamp Event Seq-Number Feed-Name Tenant Message

------- ------- ------------------- -------------------------- ------------ ------------------- ------------------- -------

1 error Thu 12 Feb 05:20:00 vms-message-delete 0 test1 provider failed to delete, domain not found: qmiqodqunuvkyupg.tub

2 info Thu 12 Feb 05:20:00 vms-message-process 0 test1 provider message processed. added: 10, deleted: 0, add-failed: 0, delete-failed: 1, total-entries: 10, time: 0ms

3 info Thu 12 Feb 05:20:01 vms-message-received 0 test2 provider received: add: 10, delete: 1

4 error Thu 12 Feb 05:20:01 vms-message-delete 0 test2 provider failed to delete, domain not found: egdupddizispoonu.gns

5 info Thu 12 Feb 05:20:01 vms-message-process 0 test2 provider message processed. added: 10, deleted: 0, add-failed: 0, delete-failed: 1, total-entries: 20, time: 0ms

...

18 info Fri 13 Feb 03:57:53 vms-message-received 0 test1 provider received: add: 10, delete: 1

19 error Fri 13 Feb 03:57:53 vms-message-delete 0 test1 provider failed to delete, domain not found: luqhjrsflwcecspg.toh

20 info Fri 13 Feb 03:57:53 vms-message-process 0 test1 provider message processed. added: 10, deleted: 0, add-failed: 0, delete-failed: 1, total-entries: 10, time: 4ms

6. Action: Show Domain Feed Summary

Syntax: request orgs org-services <org-name> dns-filtering threat-intel summary

[ limit <N> ] [ feed-name <name> ]

All parameters are optional. Without any parameters, shows the most recent summaries.

Description: Displays a summary of threat-intel domain feed processing, showing per-feed statistics for recent sync operations.

Parameters: limit Number of recent summaries

feed-name Filter by specific feed name

Output: admin@versa-flexvnf-cli> request orgs org-services provider dns-filtering threat-intel summary

status success

result

Feed Batch Summary for tenant: provider

# Timestamp Seq-Range Feed-Name Msgs Recv-Add Recv-Del Add-Ok Add-Fail Del-Ok Del-Fail Entries Time Status

---- -------------------- ---------------- -------------------- ----- --------- --------- --------- --------- --------- --------- --------- ---------- ---------

1 Thu 12 Feb 05:12:34 0-0 test1 1 10 1 0 10 0 1 0 0ms rejected

2 Thu 12 Feb 05:12:36 0-0 test2 1 10 1 0 10 0 1 0 0ms rejected

3 Thu 12 Feb 05:12:40 0-0 test3 1 10 1 0 10 0 1 0 0ms rejected

4 Thu 12 Feb 05:20:00 0-0 test1 1 10 1 10 0 0 1 10 0ms processed

5 Thu 12 Feb 05:20:01 0-0 test2 1 10 1 10 0 0 1 20 0ms processed

...

12 Fri 13 Feb 03:57:53 0-0 test1 1 10 1 10 0 0 1 10 4ms processed

13 Fri 13 Feb 04:10:52 0-0 test5 3 30 3 0 30 0 3 0 0ms rejected

14 Fri 13 Feb 04:11:46 0-0 test1 6 60 6 0 60 0 6 0 0ms rejected

---- -------------------- ---------------- -------------------- ----- --------- --------- --------- --------- --------- --------- --------- ---------- ---------

TOTAL 36 360 36 70 290 0 36

19 batch(es) shown

7. Show DB Entries - All Tenants

Syntax:

vsm-vcsn0> show dnsfilter threat-intel db entries all-tenants

Description: Dumps the entire threat-intel domain database across all tenants, including predefined (global) feeds. Each domain is listed with all the feeds it belongs to.

Output: vsm-vcsn0> show dnsfilter threat-intel db entries all-tenants

======== Predefined Feeds (Global) ========

Data not present for Tenant 0

======== Tenant provider ========

Domain cvulwgrzuczkklex.evf {

Feeds:

test1

}

Domain dcxsevqxsfyspgzg.eyd {

Feeds:

test1

}

Domain dnyhxnhahfiveugl.tzx {

Feeds:

test2

}

...

8. Show DB Entries - Predefined (Global)

Syntax: show dnsfilter threat-intel db entries predefined

Description: Displays domain entries from the predefined (global) feeds database. Predefined feeds are shared across all tenants.

Output: vsm-vcsn0> show dnsfilter threat-intel db entries predefined

======== Predefined Feeds (Global) ========

Data not present for Tenant 0

9 Show DB Entries - Per Tenant

Syntax: show dnsfilter threat-intel db entries tenant <tenant-name>

Description: Displays all domain entries in the threat-intel database for a specific tenant. Each domain shows all feeds it belongs to.

Output: vsm-vcsn0> show dnsfilter threat-intel db entries tenant provider

Domain cvulwgrzuczkklex.evf {

Feeds:

test1

}

Domain dcxsevqxsfyspgzg.eyd {

Feeds:

test1

}

Domain dnyhxnhahfiveugl.tzx {

Feeds:

test2

}

...

10 Show DB Feed Entries - Per Tenant

Syntax: show dnsfilter threat-intel db feed-entries tenant <tenant-name> <feed-name>

Description: Lists all domains belonging to a specific feed under a tenant. Unlike "db entries" which groups by domain, this command groups by

feed -- making it easy to see exactly what a feed contains.

Output: vsm-vcsn0> show dnsfilter threat-intel db feed-entries tenant provider test1

Feed test1 {

cvulwgrzuczkklex.evf

dcxsevqxsfyspgzg.eyd

drfghlyultrnmizw.wlc

gjsntqgmlfpmobfa.idp

hgfrxzvjklidkpod.vmw

hjtkfwpuscgzmeco.kaq

hwbagwatjbhhwttt.zda

igzoyzqjkndmmsrl.shx

ijpzyctecqoxtgeb.ppb

ldxcqjmpijcktmbt.mfo

pxsrjofkhrrxlzes.idi

rqmkmldmwnponugy.uiu

sgmkualbateryalj.wtc

sieghzoldfcesfdv.xnj

skzxwnqpzkzylwoq.lme

tiqypifsfdhpsejl.nxr

tkmughfggqdwbdmu.lmg

xnezaokenqbsikes.gef

zgkrewsiqbnawyqu.nba

zxncpyowsvaafjzt.hak

Total: 20

}

vsm-vcsn0> show dnsfilter threat-intel db feed-entries tenant provider test2

Feed test2 {

dnyhxnhahfiveugl.tzx

lmsthwpnklohkvdm.toy

mxoknhvdkejvrvnk.dlb

nvzyqqufczqgroua.rre

pdoopiidauiontdz.ijy

rjnjpgxjhqdnrjto.zmi

svmhdxeilxwllvzy.kit

tspyggibxjnhyqwp.hgx

zedxpruorezktums.mem

zgtbwlmthowqtjqb.idk

Total: 10

}

URL String and Pattern

Syntax: show orgs org-services ORG1 url-filtering threat-intel feeds list

Description: List all URL Feeds from VMS

Output: admin@BR1-cli> show orgs org-services ORG1 url-filtering threat-intel feeds list

FEED ID FEED NAME

----------------------------

689929143 ORG1-URL-Feed-1

Syntax: show orgs org-services ORG1 url-filtering threat-intel feeds stats

Description: Give stats for all the URL Feeds

Output: admin@BR1-cli> show orgs org-services ORG1 url-filtering threat-intel feeds stats ORG1-URL-Feed-1

LAST LAST URLS URLS URLS URLS URLS URLS

SUCCESS FAILED ADDED ADDED ADDED DELETED DELETED DELETED

FEED NAME LAST UPDATE TIME SEQ NUM SEQ NUM TOTAL SUCCESS FAILED TOTAL SUCCESS FAILED ERROR MESSAGE

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

ORG1-URL-Feed-1 2026-02-17 18:53:27 11376000 6640000 2432000 2432000 255515 2432000 2432000 192000 -

Syntax: show orgs org-services ORG1 url-filtering threat-intel history brief

Description: Brief of URL history

Output: admin@BR1-cli> show orgs org-services ORG1 url-filtering threat-intel history brief

FULL INCR EXCL

REGEX REGEX REGEX

TENANT JOB COMPILE VAL SRC DB DB DB STRINGS TIME

ID ID TIMESTAMP ID STATUS WHEN TYPE TYPE CNT CNT CNT DB CNT TAKEN FEED NAME

-------------------------------------------------------------------------------------------------------------------------------

52 2 2026-02-17 17:43:38 25 success End String VMS 0 0 0 64000 0.00 ORG1-URL-Feed-1

51 2 2026-02-17 17:43:32 25 NA Start String VMS 0 0 0 64000 0.00 -NA-

50 2 2026-02-17 17:37:12 24 success End String VMS 0 0 0 64000 0.00 ORG1-URL-Feed-1

49 2 2026-02-17 17:37:02 24 NA Start String VMS 0 0 0 64000 0.00 -NA-

48 2 2026-02-17 17:33:04 23 success End String VMS 0 0 0 64000 0.00 ORG1-URL-Feed-1

47 2 2026-02-17 17:32:58 23 NA Start String VMS 0 0 0 64000 0.00 -NA-

46 2 2026-02-17 17:28:00 22 success End String VMS 0 0 0 64000 0.00 ORG1-URL-Feed-1

45 2 2026-02-17 17:27:54 22 NA Start String VMS 0 0 0 64000 0.00 -NA-

======================================================================

Syntax: request orgs org-services ORG1 url-filtering threat-intel history detail id <id>

Description: Details of a particular URL history ID

Output: admin@BR1-cli> request orgs org-services ORG1 url-filtering threat-intel history detail id 5

status success

Threat Intel URL Database History Detail

==============================================================

ID : 5

Tenant ID : 2

Timestamp : 2026-02-17 15:43:15

Job ID : 2

Compile Status : NA

When : Start

Value Type : String

Source Type : VMS

Compile Type : None

Full Regex DB Count : 0

Incremental Regex DB Count : 0

Exclude Regex DB Count : 0

Strings DB Count : 0

Full Regex Count : 0

Incremental Regex Count : 0

Exclude Regex Count : 0

Strings Count : 0

Time Taken : 0.00 seconds

Feed Name : -NA-

Message : -NA-

VTY Commands

Need to enable debug

vsm-vcsn0> test urlf config async-thread-data debug enable

Syntax: show urlf vms threat-intel feeds list 2

show urlf vms threat-intel feeds list 2

Description: List the URL Feeds from VSMD

Output:

Total feeds: 1

Total threat intel URLs: 0 (tenant: 0, global: 0)

| Id - Feed

----------------------------------------------------------

| 689929143 - ORG1-URL-Feed-1

Syntax: show urlf vms threat-intel feeds stats 2 URL-Feed-1

vsm-vcsn0> show urlf vms threat-intel feeds stats 2 ORG1-URL-Feed-1

Description: Stats details for a particular Feed (VSMD)

Output:

| Name : ORG1-URL-Feed-1

| Last update time : 2026-02-17 18:57:57

| Last success sequence num : 11504000

| Last failed sequence num : 6640000

| No.of URLs added : 2496000 (Success: 2496000, failed: 255515)

| No.of URLs deleted : 2496000 (Success: 2496000, failed: 192000)

| Job entry : Not cached

| Error msg : -

----------------------------------------------------------------------------------------------

Syntax:

vsm-vcsn0> clear urlf vms threat-intel feeds stats for-feed 1 FEED_STRING

Description: To clear the stats

Output: If the URL feed count is below 1000, the command will display the feed data. However, if the count exceeds 1000, no output will be shown. In such cases, the test lookup command can be used to verify matches.

---------------------------------------------------------------------------------------------------------------------------

Description: To Dump String (if it is less than 1000)

vsm-vcsn0> show urlf config detail async-thread-data fixed-tree 2

Total nodes: 2

| URL

---------------------------------------------------------------
| test800.example.com/

| test801.example.com/

===========================

Description: To Dump RegEx pattern (if it is less than 1000)

Syntax:

vsm-vcsn0> show urlf config detail async-thread-data regex-tree 2

Output:

Total nodes: 3

| URL

---------------------------------------------------------------

| .*.auth.microsoft.cn/

| .*.google.com

| .*\.test200\.example\.com

Description: Lookup RegEx pattern

Syntax:

vsm-vcsn0> test urlf config async-thread-data lookup all regex 2 google.com

test urlf config async-thread-data lookup all regex 2 .*\.test229\.example\.com

Output:

Total nodes: 203

URL : .*\.test229\.example\.com

Gen id : 32

Cat ids : 131,

Rep ids : 3,

Feed ids : 487516495,

--------------------------------------------------------------

Description: Lookup String

Syntax:

vsm-vcsn0> test urlf config async-thread-data lookup all strings 2

test urlf config async-thread-data lookup all strings 2 test886.example.com/

Output:

Total nodes: 100

URL : test886.example.com/

Gen id : 0

Cat ids :

Rep ids :

Feed ids : 900701949,

Description: Tenant Level Stats for URL (VMS+ Other sources)

Syntax:

vsm-vcsn0> show urlf datapath url-lookup-db details 1

Output:

Last compile message: job: 4, tnt: 1, full compile finished in 0 secs, status: Success

----------------------------------

Total URLs : 303 (Fixed: 100, Regex: 203)

Total threat intel URLs : 400 (tenant: 400, global: 400)

Total incremental include regex urls : 0

Total incremental exclude regex urls : 0

Incremental threshold : 1000

----------------------------------

Active slot index : 0

+-----------------------------+

| slot index : 0

| update timestamp : 2026-02-17 13:34:37

| db ref_cnt : 2

| strings db : Exist

| strings count (unique) : 100

| strings db ref_cnt : 1

| regex db,

| full hsdb : Exist

| full hsdb scratch : Allocated

| full hsdb count : 103

| full hsdb ref count : 1

| include hsdb : -

| include hsdb scratch : -

| include hsdb count : 0

| include hsdb ref count : 0

| exclude hsdb : -

| exclude hsdb scratch : -

| exclude hsdb count : 0

| exclude hsdb ref count : 0

+-----------------------------+

| slot index : 1

| update timestamp : 2026-02-17 13:34:37

+-----------------------------+

Description: RegEX Compilation status

Syntax:

vsm-vcsn0> show urlf datapath url-lookup-db regex-compile-status 1

Output:

----------------------------------

Total Include Exclude

------------------------------------

103 0 0

Latest compile status,

Compile type : full,

Compile state : success,

----------------------------------

Description: Export all URL strings of a feed to a file on the device for debugging or inspection.

Syntax:

vsm-vcsn0> test urlf vms threat-intel export strings 1 FEED_STRING /tmp/urlf-string.txt

=============================

Description: Export all URL regex of a feed to a file on the device for debugging or inspection.

Syntax:

vsm-vcsn0> test urlf vms threat-intel export strings 1 FEED_PATTERN /tmp/urlf-regex.txt

IP Feed CLI

1 Show Statistics

Syntax: show orgs org-services versanet security threat-intelligence statistics ip-prefix-feed <predefined/user-defined> feed <feed_name>

Description: Check statistics of ip-prefix feed. Give predefined / user-defined followed by feed name

=====================

2 Feed Lookup

Syntax: request orgs org-services versanet security threat-intelligence ip-prefix-feed lookup ip-address <addr> feed-name <name>

Description: This command takes an ip address, does the lookup (best match) and tells the feeds to which the given ip address belongs to. Feed-name is optional, if not specified returns all matching feeds

=====================

3 Feed Search

Syntax: request orgs org-services versanet security threat-intelligence ip-prefix-feed search ip-address <prefix> feed-name <name>

Description: This command takes an ip prefix and feed-name, does the lookup (exact match) and tells if the given ip-prefix belongs to the given feed or not.

IP Address Feed VSMD VTY

1 Add Data

Syntax:

vsm-vcsn0> test vms-ctrl vsync-msg ip <tenant> <num_record_to_add> <num_record_to_del> <Pre-Defined/ User-Defined> <feed_name> <batch_flag>

Description: This command can be used to add data to ip feed.

2 Print Internal Tree

Syntax:

vsm-vcsn0> test vms-ctrl vsync-msg ipf-edl print-tree

Description: This command prints the internal radix tree used to store the prefix-feed data

3 Add specific ip-prefix

Syntax: test vms-ctrl vsync-msg ipf-edl add-ipv4-address <tenant> <feed_name> <feed_type> <prefix>

Description: This command can be used to add a specific ip prefix to a specific feed. Feed_type is 0-> Userdefined, 1-> Predefined

4 Delete specific ip-prefix

Syntax: test vms-ctrl vsync-msg ipf-edl del-ipv4-address <tenant> <feed_name> <feed_type> <prefix>

Description: This command can be used to delete a specific ip prefix from a specific feed. Feed_type is 0-> Userdefined, 1-> Predefined

5 Lookup ip-prefix

Syntax: test vms-ctrl vsync-msg ipf-lookup <tenant> <feed_name> <prefix>

Description: This command can be used to lookup an ip-address and know the list of feeds it belongs to.

6 Delete specific ip-prefix

Syntax: show threat-intelligence IP-prefix-feed id-allocation-table <tnt_id> <print_name_table> <print_id_table>

Description: This command can be used to see the id allocation table for IP feed. It tells how many id’s are free, next available id etc. You can give 1 to print name table, else 0. Similarly for id table.

7 Delete specific ip-prefix

Syntax: test threat-intelligence IP-prefix-feed id-allocation-table add-feed-name <feed_name> <tnt_id> <initialise_if_necessary>

Description: This command can be used to test id allocation for feeds. Give 1 for the last parameter if you want to explicitly initialise id tables if not initialised previously.

8 Delete specific ip-prefix

Syntax: test threat-intelligence IP-prefix-feed id-allocation-table remove-feed-name <feed_name> <tnt_id>

Description: This command can be used to free an id by removing a feed. It can only be freed if the feed doesn’t contain any data.

VMS Threat-Intel Validation Commands

status success

More articles in Troubleshooting