Rule with UDP and port 514 not matched

[ppalopa]

We have defined rule which is not matched till port si specified. If port is set ANY-ANY rule is working.
This rule is not working:

This rule is working

Why is not working.

[johnpoz]

@ppalopa If the rule was not working, then it wouldn't show evaluations, that 1.12MB - if started working when you changed it, the counters are reset.. So odd that both show exactly the same evaluations.

[luckman212]

@ppalopa You could give stv a try and run stv 'udp.*:514%' to view states matching UDP port 514, might help you track this down.

[ppalopa]

After reset counter is evaluate 0 byt first rule is still not used:

[johnpoz]

@ppalopa why are you seeing 2 hits on 2 different interfaces?

[ppalopa]

Because traffic is routed to IPSec tunnel

[ppalopa]

Hi do you have some recommendation?

[tinfoilmatt]

Mess not clear.

[ppalopa]

@tinfoilmatt said in Rule with UDP and port 514 not matched:

Mess not clear.

Do you nedd some specific logs. Rule i not matched if UDP prottocol is used.