163 lines
4.3 KiB
Markdown
163 lines
4.3 KiB
Markdown
# 【BJ环境】FlyVPN Application会话日志出现误匹配
|
||
|
||
| ID | Creation Date | Assignee | Status |
|
||
|----|----------------|----------|--------|
|
||
| OMPUB-1337 | 2024-06-24T14:20:45.000+0800 | 刘洋 | 已解决 |
|
||
|
||
|
||
---
|
||
|
||
1.Application name:FlyVPN_20240619，特征1配置为IP，特征2配置为FQDN and port(443)。
|
||
|
||
2.Session log出现会话匹配到了FlyVPN_20240619，FlyVPN没有配置会话中的IP和FQDN的特征。
|
||
|
||
!image-2024-06-24-14-17-41-620.png|width=517,height=307!
|
||
|
||
!image-2024-06-24-14-19-38-215.png|width=515,height=306!
|
||
|
||
|
||
|
||
!image-2024-06-24-14-20-20-863.png|width=475,height=282!
|
||
|
||
|
||
|
||
!image-2024-06-24-14-20-38-128.png|width=487,height=289!**liuxueli** commented on *2024-06-24T15:12:55.848+0800*:
|
||
|
||
* [~jianghuihui] 是否能稳定复现？若能稳定复现，请提供对应的数据包。
|
||
|
||
|
||
|
||
---
|
||
|
||
**jianghuihui** commented on *2024-06-24T15:26:16.029+0800*:
|
||
|
||
近一个小时内有误匹配的会话日志，因为误匹配，不确定是哪个客户端进行哪种操作会匹配到application产生会话日志，所以不太能找到数据包
|
||
|
||
|
||
|
||
---
|
||
|
||
**liuxueli** commented on *2024-06-24T16:14:11.894+0800*:
|
||
|
||
* 现象：
|
||
** 北京网关测试环境持续出现少量的FlyVPN_20240619（会话日志对应server IP、server Port 、server FQDN不符合FlyVPN_20240619对应的特征条件），故认为存在特征‘误匹配’
|
||
* 排查
|
||
** 根据 application=FlyVPN_20240619的特征，IP Objects最后一次修改时间为：2024-06-19 11:04:18；FQDN Objects最后一次修改时间为：2024-06-22 11:52:32；查询2024-06-22 13:00:00 to 2024-06-24 23:59:59会话日志，发现存在少量’误匹配‘的会话，但是加上start time字段大于2024-06-22 11:52:32的记录，不存在'误匹配’的现象；故怀疑2024-06-22 11:52:32前存在’误匹配‘的特征。
|
||
*** !image-2024-06-24-15-50-42-608.png|width=1434,height=486!
|
||
*** !image-2024-06-24-15-53-54-273.png|width=1433,height=485!
|
||
*** !image-2024-06-24-15-59-16-091.png|width=1434,height=326!
|
||
*** !image-2024-06-24-16-04-09-692.png|width=1437,height=534!
|
||
** 查询start time大于2024-06-22 11:52:32且server FQDN=drive.weixin.qq.com存在大量的会话日志，但是均未识别未FlyVPN_20240619
|
||
*** !image-2024-06-24-16-10-56-210.png|width=1436,height=284!
|
||
*** !image-2024-06-24-16-11-32-552.png|width=1435,height=456!
|
||
* 验证：
|
||
** 方案1：
|
||
*** 使用'误匹配'的会话对应的数据包验证是否真实存在’误匹配‘
|
||
** 方案2：
|
||
*** 重启sapp应用，查询日志是否持续出现FlyVPN_20240619’误匹配‘的现象
|
||
* [~jianghuihui] [~liuyang]
|
||
|
||
|
||
|
||
---
|
||
|
||
**jianghuihui** commented on *2024-06-24T16:44:15.342+0800*:
|
||
|
||
在排查过程中有使用日志过滤语句出现结果不对的情况。
|
||
|
||
上述排查过程：
|
||
|
||
!image-2024-06-24-16-35-27-116.png|width=851,height=86!
|
||
|
||
在BJ环境的日志过滤语句：
|
||
Application Transition LIKE '%.FlyVPN%' and Server IP != '16.162.66.185' and NOT EMPTY ( Server FQDN)，根据结果2024-06-24有误匹配
|
||
!image-2024-06-24-16-39-46-066.png|width=876,height=520!
|
||
加上 Start Time > '2024-06-23 13:00:00'，结果显示0，与预期不符。
|
||
!image-2024-06-24-16-42-08-234.png|width=862,height=512!
|
||
故目前系统仍存在‘误匹配’的特征
|
||
|
||
|
||
|
||
---
|
||
|
||
**liuxueli** commented on *2024-06-24T17:28:58.133+0800*:
|
||
|
||
* [~jianghuihui] 上述评论2024-06-24有’误匹配‘，日志详情中的start time时间早于2024-06-22 11:52:32，故符合推论（怀疑2024-06-22 11:52:32前存在’误匹配‘的特征）。
|
||
|
||
|
||
|
||
---
|
||
|
||
|
||
|
||
## Attachments
|
||
|
||
**59270/image-2024-06-24-14-13-00-157.png**
|
||
|
||
---
|
||
|
||
**59269/image-2024-06-24-14-17-41-620.png**
|
||
|
||
---
|
||
|
||
**59268/image-2024-06-24-14-19-38-215.png**
|
||
|
||
---
|
||
|
||
**59267/image-2024-06-24-14-20-20-863.png**
|
||
|
||
---
|
||
|
||
**59266/image-2024-06-24-14-20-38-128.png**
|
||
|
||
---
|
||
|
||
**59273/image-2024-06-24-15-50-12-599.png**
|
||
|
||
---
|
||
|
||
**59274/image-2024-06-24-15-50-42-608.png**
|
||
|
||
---
|
||
|
||
**59275/image-2024-06-24-15-53-54-273.png**
|
||
|
||
---
|
||
|
||
**59276/image-2024-06-24-15-59-16-091.png**
|
||
|
||
---
|
||
|
||
**59277/image-2024-06-24-16-04-09-692.png**
|
||
|
||
---
|
||
|
||
**59278/image-2024-06-24-16-08-15-688.png**
|
||
|
||
---
|
||
|
||
**59279/image-2024-06-24-16-10-56-210.png**
|
||
|
||
---
|
||
|
||
**59280/image-2024-06-24-16-11-32-552.png**
|
||
|
||
---
|
||
|
||
**59281/image-2024-06-24-16-35-05-251.png**
|
||
|
||
---
|
||
|
||
**59282/image-2024-06-24-16-35-27-116.png**
|
||
|
||
---
|
||
|
||
**59283/image-2024-06-24-16-39-46-066.png**
|
||
|
||
---
|
||
|
||
**59284/image-2024-06-24-16-42-08-234.png**
|
||
|
||
---
|
||
|