RTFM · Healthchecks

lb.saphira.ipproto: raw IP protocols, honestly labelled

ESP, OSPF, anything with an IP protocol number: this check speaks raw IP. Its honesty is its feature; in accept mode it certifies only that the protocol was not rejected, and it says exactly that on the tin.

What it proves: two documented modes

probe mode (default): a configured packet is sent, and health requires a reply from the peer that matches the optional expect regex. A true request/reply verdict for exotic protocols.

accept mode: for protocols with no request/reply model (ESP/AH/OSPF-class), health means NO ICMP destination-unreachable (protocol or admin) came back within the timeout. The check documents the caveat on its face: absence of an ICMP error is evidence of acceptance, NOT proof of health.

How it works

The probe engine sends via a raw datagram socket on the chosen protocol number and listens on a raw socket for replies, with an ICMP side-listener to catch destination-unreachable. IPv4 in v1; requires CAP_NET_RAW (runs as root, which ldirectord already does). Payload comes from LB_SAPHIRA_SEND_HEX or LB_SAPHIRA_SEND_FILE.

Configuration

Knobs
Variable	Default	Meaning
LB_SAPHIRA_IPPROTO	(required)	IP protocol number: 47 GRE, 50 ESP, 51 AH, 89 OSPF…
LB_SAPHIRA_IPPROTO_MODE	probe	probe = request/reply; accept = not-rejected
LB_SAPHIRA_SEND_HEX / SEND_FILE	-	Probe payload (probe mode)
LB_SAPHIRA_EXPECT	-	Reply regex (probe mode)
LB_SAPHIRA_TIMEOUT	3	Window for replies or ICMP

Wiring it up

ldirectord

# ldirectord.cf - ESP gateway pool via firewall marks
virtual = 21
    protocol = fwm
    scheduler = rr
    real = 192.168.20.130 gate 1
    checktype = external
    checkcommand = "/var/lib/lb/saphira/lb.saphira.ipproto"

ESP, accept mode

# /etc/saphira/lb-healthchecks.d/ipproto.conf
LB_SAPHIRA_IPPROTO=50
LB_SAPHIRA_IPPROTO_MODE=accept

Run it by hand

Manual run

LB_SAPHIRA_IPPROTO=50 LB_SAPHIRA_IPPROTO_MODE=accept \
  /var/lib/lb/saphira/lb.saphira.ipproto esp-pool 0 192.168.20.130 0
echo $?
# 0 = no ICMP rejection within the window (accept mode)
# 1 = ICMP protocol/admin unreachable - the protocol is refused
# 2 = no protocol number configured

Failure modes

ICMP unreachable: the peer (or a firewall in between) actively refuses the protocol: definitive
Silence in accept mode: reads healthy by design; read the mode documentation before quoting the verdict in an SLA

Did we miss something?

If this page left something unanswered, found an error, or there is another subject you would like documented, tell us. Saphira’s documentation grows from real problems people need to solve.

Send feedback or request a new section →

Prefer not to do it yourself?

Everything needed to do the work yourself is documented here and remains free; we charge for human time, not for withholding knowledge. Sometimes the missing resource is simply time. The same people who build Saphira can provide paid professional help with implementation, migration, troubleshooting and administration.

Ask about professional support →