ASF (Buffered) Email Attachment Content-Disposition 1000byte & (Unbuffered) Yahoo MSG

hc2-1 (config) # show run
##

Running database "initial"

Generated at 2019/06/19 05:51:13 +0900

Software version on which this output was taken: GigaVUE-OS 5.4.00 98411 2018-07-24 02:03:59

Hostname: hc2-1

##

Note: If you are not an admin user some command invocations may be omitted

because you do not have permissions to see them.

##

##

Network interface configuration

##
interface eth0
create
no dhcp
ip address 192.168.44.71 /24
no shutdown
no zeroconf
exit

##

Routing configuration

##
ip default-gateway 192.168.44.1 eth0

##

Other IP configuration

##
hostname hc2-1
ip domain-list learn.local
ip name-server 192.168.44.4

##

Other IPv6 configuration

##
no ipv6 enable

##

Logging configuration

##
logging 192.168.44.60
logging 192.168.44.60 trap warning

##

Local user account configuration

##
username admin password 7 $1$o0F.tl2T$BR6jW4rLWr1rN/oJ7kkb1.

##

AAA remote server configuration

##

ldap bind-password ****

radius-server key ****

tacacs-server key ****

##

Chassis level configurations

##
chassis box-id 1 serial-num CD607 type hc2 gdp disable

##

Card level configurations

##
card slot 1/1 product-code 132-00BD
card slot 1/2 product-code 132-00B3
card slot 1/3 product-code 132-00BE
card slot 1/4 product-code 132-00BQ
card slot 1/5 product-code 132-00AT
card slot 1/cc1 product-code 132-00AN

##

Port level configurations

##
port 1/1/x1 type network
port 1/1/x1 params admin enable
port 1/1/x2 type network
port 1/1/x2 params admin enable
port 1/1/x3 type network
port 1/1/x3 params admin enable
port 1/1/x4 type network
port 1/1/x4 params admin enable
port 1/1/x5 type tool
port 1/1/x5 params admin enable
port 1/1/x6 type tool
port 1/1/x6 params admin enable
port 1/1/x7 type tool
port 1/1/x7 params admin enable
port 1/1/x8 type tool
port 1/1/x8 params admin enable
port 1/1/x9 type tool
port 1/1/x9 params admin enable
port 1/1/x10 type network
port 1/1/x10 params admin enable
port 1/1/x11 type network
port 1/1/x11 params admin enable
port 1/1/x12 type network
port 1/1/x12 params admin enable
port 1/1/x13 type network
port 1/1/x13 params admin enable discovery all gdp enable
port 1/1/x14 type network
port 1/1/x14 params admin enable discovery all gdp enable
port 1/1/x15 type tool
port 1/1/x15 alias CEM-WebTool
port 1/1/x15 params admin enable
port 1/1/x16 type tool
port 1/1/x16 params admin enable
port 1/1/x17 type tool
port 1/1/x17 params admin enable
port 1/1/x18 type tool
port 1/1/x18 params admin enable
port 1/1/x19 type tool
port 1/1/x19 params admin enable
port 1/1/x20 type network
port 1/1/x20 params admin enable
port 1/1/x21 type network
port 1/1/x21 params admin enable
port 1/1/x22 type network
port 1/1/x22 params admin enable
port 1/1/x23 type network
port 1/1/x23 params admin enable
port 1/1/x24 type network
port 1/1/x24 params admin enable
port 1/2/g1 type network
port 1/2/g1 params taptx passive
port 1/2/g2 type network
port 1/2/g2 params taptx passive
port 1/2/g3 type network
port 1/2/g3 params taptx passive
port 1/2/g4 type network
port 1/2/g4 params taptx passive
port 1/2/g5 type network
port 1/2/g5 params taptx passive
port 1/2/g6 type network
port 1/2/g6 params taptx passive
port 1/2/g7 type network
port 1/2/g7 params taptx passive
port 1/2/g8 type network
port 1/2/g8 params taptx passive
port 1/2/g9 type network
port 1/2/g9 params taptx passive
port 1/2/g10 type network
port 1/2/g10 params taptx passive
port 1/2/g11 type network
port 1/2/g11 params taptx passive
port 1/2/g12 type network
port 1/2/g12 params taptx passive
port 1/2/g13 type network
port 1/2/g13 params taptx passive
port 1/2/g14 type network
port 1/2/g14 params taptx passive
port 1/2/g15 type network
port 1/2/g15 params taptx passive
port 1/2/g16 type network
port 1/2/g16 params taptx passive
port 1/2/g17 type network
port 1/2/g17 params taptx passive
port 1/2/g18 type network
port 1/2/g18 params taptx passive
port 1/2/g19 type network
port 1/2/g19 params taptx passive
port 1/2/g20 type network
port 1/2/g20 params taptx passive
port 1/2/g21 type network
port 1/2/g21 params taptx passive
port 1/2/g22 type network
port 1/2/g22 params taptx passive
port 1/2/g23 type network
port 1/2/g23 params taptx passive
port 1/2/g24 type network
port 1/2/g24 params taptx passive
port 1/3/q1 type network
port 1/3/q2 type network
port 1/3/q3 type network
port 1/3/q4 type network
port 1/3/q5 type network
port 1/3/q6 type network
port 1/4/x1 type network
port 1/4/x2 type network
port 1/4/x3 type network
port 1/4/x4 type network
port 1/4/x5 type network
port 1/4/x6 type network
port 1/4/x7 type network
port 1/4/x8 type network
port 1/4/x9 type network
port 1/4/x10 type network
port 1/4/x11 type network
port 1/4/x12 type network
port 1/4/x13 type network
port 1/4/x14 type network
port 1/4/x15 type network
port 1/4/x16 type network
port 1/4/x17 type inline-net
port 1/4/x18 type inline-net
port 1/4/x19 type inline-net
port 1/4/x20 type inline-net
port 1/4/x21 type inline-net
port 1/4/x22 type inline-net
port 1/4/x23 type inline-net
port 1/4/x24 type inline-net

##

Gigastream hash configurations

##
gigastream advanced-hash slot 1/cc1 default

##

SAPF configurations

##
apps asf alias sessions-20p-2
bi-directional enable
buffer enable
buffer-count-before-match 20
packet-count disable
protocol tcp
sess-field add ipv4-5tuple outer
timeout 15
exit
apps asf alias sessions-unbuffered-2
bi-directional enable
buffer disable
buffer-count-before-match 3
packet-count disable
protocol tcp
sess-field add ipv4-protocol outer
sess-field add ipv4-src outer
timeout 15
exit

##

Gsgroup configurations

##
gsgroup alias GS51 port-list 1/5/e1

##

Gs params configurations

##
gsparams gsgroup GS51
cpu utilization type total rising 80
dedup-action drop
dedup-ip-tclass include
dedup-ip-tos include
dedup-tcp-seq include
dedup-timer 50000
dedup-vlan ignore
eng-watchdog-timer 60
erspan3-timestamp format none
flow-mask disable
flow-sampling-rate 5
flow-sampling-timeout 1
flow-sampling-type device-ip
generic-session-timeout 5
gtp-control-sample enable
gtp-flow timeout 48
gtp-persistence disable
gtp-persistence file-age-timeout 30
gtp-persistence interval 10
gtp-persistence restart-age-time 30
ip-frag forward enable
ip-frag frag-timeout 10
ip-frag head-session-timeout 30
lb failover disable
lb failover-thres lt-bw 80
lb failover-thres lt-pkt-rate 1000
lb replicate-gtp-c disable
lb use-link-spd-wt disable
resource buffer-asf 2
resource cpu overload-threshold 90
resource hsm-ssl buffer disable
resource hsm-ssl packet-buffer 1000
resource packet-buffer overload-threshold 80
resource xpkt-pmatch num-flows 0
sip-media timeout 30
sip-session timeout 30
sip-tcp-idle-timeout 20
ssl-decrypt decrypt-fail-action drop
ssl-decrypt enable
ssl-decrypt hsm-pkcs11 dynamic-object enable
ssl-decrypt hsm-pkcs11 load-sharing enable
ssl-decrypt hsm-timeout 1000
ssl-decrypt key-cache-timeout 10800
ssl-decrypt non-ssl-traffic drop
ssl-decrypt pending-session-timeout 60
ssl-decrypt session-timeout 300
ssl-decrypt tcp-syn-timeout 20
ssl-decrypt ticket-cache-timeout 10800
tunnel-arp-timeout 600
tunnel-health-check action pass
tunnel-health-check disable
tunnel-health-check dstport 54321
tunnel-health-check interval 600
tunnel-health-check protocol icmp
tunnel-health-check rcvport 54321
tunnel-health-check retries 5
tunnel-health-check roundtriptime 1
tunnel-health-check srcport 54321
tunnel-ndp-timeout 600
xpkt-pmatch disable
exit

##

Gsop configurations

##
gsop alias ASF-buffered-2 apf set asf sessions-20p-2 port-list GS51
gsop alias ASF-unbuffered-2 apf set asf sessions-unbuffered-2 port-list GS51

##

Vport configurations

##
vport alias vp51-2 gsgroup GS51
vport alias vp51-2 failover-action vport-bypass

##

Inline-network configurations

##
inline-network alias default_inline_net_1_4_1
pair net-a 1/4/x17 and net-b 1/4/x18
physical-bypass enable
traffic-path bypass
exit
inline-network alias default_inline_net_1_4_2
pair net-a 1/4/x19 and net-b 1/4/x20
physical-bypass enable
traffic-path bypass
exit
inline-network alias default_inline_net_1_4_3
pair net-a 1/4/x21 and net-b 1/4/x22
physical-bypass enable
traffic-path bypass
exit
inline-network alias default_inline_net_1_4_4
pair net-a 1/4/x23 and net-b 1/4/x24
physical-bypass enable
traffic-path bypass
exit

##

Traffic map connection configurations

##
map alias map-email-2
type firstLevel byRule
roles replace admin to owner_roles
rule add pass portdst 25 bidir
to vp51-2
from 1/1/x11
exit
map alias map-IPv4-2
type firstLevel byRule
roles replace admin to owner_roles
rule add pass ipver 4
to vp51-2
from 1/1/x11
exit
map alias email-attachments-2
type secondLevel byRule
roles replace admin to owner_roles
use gsop ASF-buffered-2
gsrule add pass pmatch string Content-Disposition 0..1000
to 1/1/x15
from vp51-2
exit
map alias yahooMsg-2
type secondLevel byRule
roles replace admin to owner_roles
use gsop ASF-unbuffered-2
gsrule add pass pmatch string ymsg}ypns}yahoo 34..1000
to 1/1/x17
from vp51-2
exit
map-scollector alias vp51-collector-2
roles replace admin to owner_roles
from vp51-2
collector 1/1/x16
exit

##

Notifications

##

notifications target ip 192.168.44.60 port 5672 non-secure username admin password **

##

SNMP configuration

##
no snmp-server host 192.168.44.60 disable
snmp-server host 192.168.44.60 traps port 162 version 2c public

##

X.509 certificates configuration

##
#

Certificate name system-self-signed, ID 16a1327fbd87a1006edb042febc21e03f011810a

(public-cert config omitted since private-key config is hidden)

ASF (Buffered) Email Attachment Content-Disposition 1000byte + (unbuffered) Yahoo Msg

##

Web configuration

##

web proxy auth basic password ****

##

Time/NTP configuration

##
clock timezone Asia Southeast Seoul

##

Flat Panel Display configuration

##

lcd password ****

##

E-mail configuration

##

email auth password ****

email autosupport auth password ****

##

Miscellaneous other settings

##
internal set modify - /gv/notf/config/chassis/C7823 value string C7823
internal set modify - /gv/notf/config/chassis/C8B76 value string C8B76
hc2-1 (config) #

AFP, ASF Sample

gigamon-2c013c (config) # sh running-config
##
## Running database "initial"
## Generated at 2019/12/23 05:23:44 +0000
## Software version on which this output was taken: GigaVUE-OS 5.7.01 142718 2019-09-23 23:20:06
##
## Port level configurations
##
port 1/1/g1 type network
port 1/1/g2 type network
port 1/1/g3 type network
port 1/1/g4 type network
port 1/1/x1 type hybrid
port 1/1/x1 params admin enable
port 1/1/x2 type network
port 1/1/x2 params admin enable
port 1/1/x3 type tool
port 1/1/x3 params admin enable
port 1/1/x4 type network
port 1/1/x4 params admin enable
port 1/1/x5 type network
port 1/1/x6 type tool
port 1/1/x6 params admin enable
port 1/1/x7 type tool
port 1/1/x7 params admin enable
port 1/1/x8 type tool
port 1/1/x8 params admin enable
port 1/1/x9 type network
port 1/1/x10 type tool
port 1/1/x10 params admin enable
port 1/1/x11 type network
port 1/1/x12 type tool
port 1/1/x12 params admin enable
port 1/2/x1 type network
port 1/2/x2 type network
port 1/2/x3 type network
port 1/2/x4 type network
port 1/2/x5 type inline-net
port 1/2/x5 params admin enable speed 1000
port 1/2/x6 type inline-net
port 1/2/x6 params admin enable speed 1000
port 1/2/x7 type inline-net
port 1/2/x8 type inline-net
port 1/3/g1 type network
port 1/3/g1 params taptx passive
port 1/3/g2 type network
port 1/3/g2 params taptx passive
port 1/3/g3 type network
port 1/3/g3 params taptx passive
port 1/3/g4 type network
port 1/3/g4 params taptx passive
port 1/3/g5 type network
port 1/3/g5 params taptx passive
port 1/3/g6 type network
port 1/3/g6 params taptx passive
port 1/3/g7 type network
port 1/3/g7 params taptx passive
port 1/3/g8 type network
port 1/3/g8 params taptx passive

##
## Gigastream hash configurations
##
gigastream advanced-hash slot 1/cc1 default

##
## Gigastream configurations
##
gigastream alias T-LB-1
  port-list 1/1/x6,1/1/x8 params hash advanced
  exit
gigastream alias T-LB-2
  port-list 1/1/x10,1/1/x12 params hash advanced
  exit

##
## SAPF configurations
##
apps asf alias youtube-asf
  bi-directional enable
  buffer enable
  buffer-count-before-match 6
  packet-count disable
  protocol tcp-udp
  sess-field add ipv4-5tuple outer
  timeout 15
  exit

##
## Gsgroup configurations
##
gsgroup alias GS1 port-list 1/1/e1

##
## Gs params configurations
##
gsparams gsgroup GS1
  cpu utilization type total rising 80
  dedup-action drop
  dedup-ip-tclass include
  dedup-ip-tos include
  dedup-tcp-seq include
  dedup-timer 50000
  dedup-vlan ignore
  diameter-packet timeout 2
  diameter-s6a-session limit 10000
  diameter-s6a-session timeout 30
  eng-watchdog-timer 60
  erspan3-timestamp format none
  flow-mask disable
  flow-sampling-rate 5
  flow-sampling-timeout 1
  flow-sampling-type device-ip
  generic-session-timeout 5
  gtp-control-sample enable
  gtp-flow timeout 48
  gtp-persistence disable
  gtp-persistence file-age-timeout 30
  gtp-persistence interval 10
  gtp-persistence restart-age-time 30
  gtp-randomsample disable
  gtp-randomsample interval 12
  ip-frag forward enable
  ip-frag frag-timeout 10
  ip-frag head-session-timeout 30
  lb failover disable
  lb failover-thres lt-bw 80
  lb failover-thres lt-pkt-rate 1000
  lb replicate-gtp-c disable
  lb use-link-spd-wt disable
  node-role disable
  resource buffer-asf 2
  resource cpu overload-threshold 90
  resource hsm-ssl buffer disable
  resource hsm-ssl packet-buffer 1000
  resource inline-ssl standalone enable
  resource metadata disable
  resource packet-buffer overload-threshold 80
  resource xpkt-pmatch num-flows 0
  session logging level none
  sip-media timeout 30
  sip-nat disable
  sip-session timeout 30
  sip-tcp-idle-timeout 20
  ssl-decrypt decrypt-fail-action drop
  ssl-decrypt enable
  ssl-decrypt hsm-pkcs11 dynamic-object enable
  ssl-decrypt hsm-pkcs11 load-sharing enable
  ssl-decrypt hsm-timeout 1000
  ssl-decrypt key-cache-timeout 10800
  ssl-decrypt non-ssl-traffic drop
  ssl-decrypt pending-session-timeout 60
  ssl-decrypt session-timeout 300
  ssl-decrypt tcp-syn-timeout 20
  ssl-decrypt ticket-cache-timeout 10800
  tunnel-health-check action pass
  tunnel-health-check disable
  tunnel-health-check dstport 54321
  tunnel-health-check interval 600
  tunnel-health-check protocol icmp
  tunnel-health-check rcvport 54321
  tunnel-health-check retries 5
  tunnel-health-check roundtriptime 1
  tunnel-health-check srcport 54321
  xpkt-pmatch disable
  exit

## Gsop configurations
gsop alias youtube-gsop apf set asf set port-list GS1

## Vport configurations
vport alias vp1 gsgroup GS1
vport alias vp1 failover-action vport-bypass
vport alias vp1 outer-traffic-path to-inline-tool
vport alias vp1 inner-traffic-path to-inline-tool
vport alias vp1 deferred-binding disable
vport alias vp1 asf profile youtube-asf
vport alias vp1 mmon disable

## Inline-network configurations
inline-network alias default_inline_net_1_2_1
  pair net-a 1/2/x5 and net-b 1/2/x6
  physical-bypass disable
  traffic-path bypass
  exit

##
## Traffic map connection configurations

# 인라인네트워크에서 특정 포트로 미러패킷을 전달(전체 패킷-rx) #
map-passall alias N1-map-source-packet-rx
  roles replace admin to owner_roles
  to 1/1/x1
  from 1/2/x5
  exit
# 인라인네트워크에서 특정 포트로 미러패킷을 전달(전체 패킷-tx) #
map-passall alias N1-map-source-packet-tx
  roles replace admin to owner_roles
  to 1/1/x1
  from 1/2/x6
  exit

# 인라인네트워크에서 받은 미러패킷을 버철포트로 전달 #
map alias All-traffic
  type firstLevel byRule
  roles replace admin to owner_roles
  comment " "
  rule add pass macsrc 00:00:00:00:00:00 00:00:00:00:00:00 bidir
  to vp1
  from 1/1/x1
  exit

# 유투브사이트에서 비디오 플레이 될때 탐지함. #
map alias traffic-sapf-youtube
  type secondLevel byRule
  roles replace admin to owner_roles
  use gsop youtube-gsop
  gsrule add pass pmatch RegEx youtube|ytimg|yt3.ggpht|tubeMogul|tmogul|googlevideo|tmogulyoutu 0..1460
  to 1/1/x3
  from vp1
  exit

# PC에서 시만텍서버와 클라이언트 또는 패턴 업데이트 될때 탐지함. #
map alias traffic-sapf-symatec
  type secondLevel byRule
  roles replace admin to owner_roles
  use gsop youtube-gsop
  gsrule add pass pmatch RegEx symantec|syma|sep|livet|symant 0..1460
  to 1/1/x3
  from vp1
  exit

# 번외 - 특정 헥사 코드값 만을 탐지 #
map alias traffic-sapf-hex
  type secondLevel byRule
  roles replace admin to owner_roles
  comment hex-.ama
  use gsop youtube-gsop
  gsrule add pass pmatch protocol ipv4 pos 1 RegEx [\\x2e\\x61\\x6d\\x61] 0..80
  to 1/1/x7
  from vp1
  exit

# The RegEx expression identifies the 
SSL handshake type Client Hello patterns and All Buffered packets(TCP) # 
# pos -> number presenting the occurrence(발생 될 숫자 지정) # 

# HTTPS사이트에 접근하면 탐지 #
map alias traffic-sapf-https
  type secondLevel byRule
  roles replace admin to owner_roles
  use gsop youtube-gsop
  gsrule add pass pmatch protocol tcp pos 1 RegEx \\x16\\x03.{3}\\x01 0..6
  to 1/1/x7
  from vp1
  exit

# 특정 지정한 패킷(HTTPS,youtube,symatec 등) 외 탐지 #
map-scollector alias traffice-non-asf
  roles replace admin to owner_roles
  from vp1
  collector T-LB-1
  exit

ASF Example : instant messaging

# port 1/1/x5..x8 type tool
# gsgroup alias GS5 port-list 1/5/e1
# vport alias vp51 gsgroup GS5
# apps asf alias sessions-unbuffered
    # packet-count disable
    # sess-field add ipv4-src outer
    # sess-field add ipv4-dst outer
    # exit
# gsop alias ASF-unbuffered app set asf sessions-unbuffered port-list GS5
#

# map alias map-IPv4
    # rule add pass Ipver 4
    # from 1/1/x1
    # to vp51
    # exit
# map alias yahooMsg
    # from vp51
    # use gsop ASF-unbuffered
    # gsrule add pass pmatch string "(ymsg|ypns|yhoo)" 16..1000
    # to 1/1/x5
    # exit