`SEArch`

Search a table for a byte pattern

SEArch

Shortest form: sea.

Search a table for entries that contain a byte pattern or have given field values, and print each match as <table>[<index>]: <entry> (Nothing found otherwise). Read-only, but it reads the whole table, which on large Trident 3 tables takes a while.

Grammar:

search [all | bin | fbin] <TABLE>[.<COPY>] { 0x<PATTERN> | <FIELD>=<VALUE>[,...] }

0x<PATTERN>: hex bytes that must appear anywhere in the entry, in big- or little-endian order.
<FIELD>=<VALUE>: every named field must be equal.
all searches a sorted table entirely instead of only its occupied part; bin and fbin do a binary search of a sorted table (field form only; fbin returns the lowest matching index).

The built-in help’s examples (search arl …, search l3 …) use table names of older chips.

The command first prints Searching <table> table indexes 0x<first> through 0x<last>..., then each match followed by an empty line. A search of the 65536-entry ING_L3_NEXT_HOP table took about two seconds on a running switch.

Hardware-validated — Which L3 interfaces use this router MAC?

drivshell> search EGR_L3_INTF 0x3c2c30785b80
Searching EGR_L3_INTF table indexes 0x0 through 0x3fff...
Nothing found

The MAC address above is not the router MAC of the switch it ran on, so nothing matched. Use the switch’s own router MAC (show platform syseeprom or ip link show Vlan<n> on the SONiC host) instead:

Hardware-validated — The same search with the MAC address of the switch it runs on

drivshell> search EGR_L3_INTF 0xe039d7883b00
Searching EGR_L3_INTF table indexes 0x0 through 0x3fff...
Nothing found

Hardware-validated — Next hops that drop

drivshell> search ING_L3_NEXT_HOP DROP=1
Searching ING_L3_NEXT_HOP table indexes 0x0 through 0xffff...
ING_L3_NEXT_HOP.ipipe0[0]: <VLAN_ID=0,URPF_DATA=0,RESERVED_EH_TM=0,RESERVED_1=0,RESERVED_0=0,PARITY_1=0,PARITY_0=0,L3_OIF=0,FWD_DATA=0x0200000400000000,ENTRY_TYPE=0,ENTRY_INFO_UPPER=0,EH_TAG_TYPE=0,EH_QUEUE_TAG=0,ECC_1=0,ECC_0=0,ECCP_1=0,ECCP_0=0,DVP_RES_INFO=0,DST_REALM_ID=0,DROP=1,DESTINATION=0x20000,COPY_TO_CPU=0>

ING_L3_NEXT_HOP.ipipe0[32806]: <VLAN_ID=2,URPF_DATA=0x8008,RESERVED_EH_TM=0,RESERVED_1=0,RESERVED_0=0,PARITY_1=0,PARITY_0=0,L3_OIF=0x2002,FWD_DATA=0x0200000400008008,ENTRY_TYPE=0,ENTRY_INFO_UPPER=2,EH_TAG_TYPE=0,EH_QUEUE_TAG=0,ECC_1=0,ECC_0=0,ECCP_1=0,ECCP_0=0,DVP_RES_INFO=2,DST_REALM_ID=0,DROP=1,DESTINATION=0x20000,COPY_TO_CPU=0>

Built-in help

1. Parameters: [ALL | BIN | FBIN] <TABLE>[.<COPY>] 0x<PATTERN>
    Dumps table entries containing the specified byte pattern
    anywhere in the entry in big- or little-endian order.
    Example: search arl 0x112233445566
2. Parameters: [ALL | BIN | FBIN] <TABLE>[.<COPY>]<FIELD>=<VALUE>[,...]
    Dumps table entries where the specified fields are equal
    to the specified values.
    Example: search l3 ip_addr=0xf4000001,pnum=10
    The ALL flag indicates to search sorted tables in their
    entirety instead of only entries known to contain data.
    The BIN flag does a binary search of sorted tables in
    the portion known to contain data.
    The FBIN flag does a binary search, and guarantees if there
    are duplicates the lowest matching index will be returned.