# ACL and CoPP

## nv show acl

Shows the configured ACL rules on the switch.

In Cumulus Linux 5.9, you must run the `nv show acl --rev=applied` command to see the output.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl
                           Type  Summary
    ---------------------  ----  ----------
    EXAMPLE                mac   rule:   10
    EXAMPLE1               ipv4  rule:   10
    EXAMPLE3               ipv4  rule:   10
    acl-default-dos        ipv4  rule:   30
                                 rule:   40
                                 rule:   50
                                 rule:   60
                                 rule:   70
                                 rule:   80
                                 rule:   90
                                 rule:  100
                                 rule:  110
                                 rule:  120
                                 rule:  130
    acl-default-whitelist  ipv4  rule:    5
                                 rule:   10
                                 rule:   15
                                 rule:   20
                                 rule:   25
                                 rule:   30
                                 rule:   35
                                 rule:   40
                                 rule:   45
                                 rule:   50
                                 rule:   55
                                 rule:   60
                                 rule:   65
                                 rule:   70
                                 rule:   75
                                 rule:   80
                                 rule:   85
                                 rule:   90
                                 rule:   95
                                 rule:  100
                                 rule:  105
                                 rule:  110
                                 rule:  115
                                 rule:  120
                                 rule:  125
                                 rule:  130
                                 rule:  135
                                 rule:  140
                                 rule:  145
                                 rule:  150
                                 rule:  155
                                 rule:  160
                                 rule:  165
                                 rule:  170
                                 rule:  175
                                 rule:  180
                                 rule: 9999

## nv show acl acl-default-dos

Shows the firewall DoS rules on the switch.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show acl acl-default-dos
          applied  pending
    ----  -------  -------
    type  ipv4     ipv4
    rule
    =======
        Number  Summary
        ------  ----------------------------------------
        30      match.ip.protocol:                   tcp
        40      match.ip.protocol:                   tcp
        41      match.ip.protocol:                   tcp
        42      match.ip.protocol:                   tcp
        50
        60      match.ip.protocol:                   tcp
        70      match.ip.protocol:                   tcp
        80      match.ip.protocol:                   tcp
        90      match.ip.protocol:                   tcp
                match.ip.tcp.all-mss-except:   536-65535
        100     match.ip.recent-list.action:         set
                match.ip.tcp.dest-port:               22
        110     match.ip.recent-list.action:      update
                match.ip.recent-list.hit-count:      100
                match.ip.recent-list.update-interval: 60
                match.ip.tcp.dest-port:               22
        120     match.ip.hashlimit.burst:              2
                match.ip.hashlimit.expire:         30000
                match.ip.hashlimit.mode:          src-ip
                match.ip.hashlimit.name:          TCPRST
                match.ip.hashlimit.rate-above:     5/min
                match.ip.hashlimit.source-mask:       32
                match.ip.protocol:                   tcp
        130     match.ip.hashlimit.burst:             30
                match.ip.hashlimit.expire:         30000
                match.ip.hashlimit.mode:          src-ip
                match.ip.hashlimit.name:      TCPGENERAL
                match.ip.hashlimit.rate-above: 50/second
                match.ip.hashlimit.source-mask:       32
                match.ip.protocol:                   tcp

## nv show acl acl-default-dos rule <rule-id>

Shows information about the specified firewall DoS rule on the switch.

### Command Syntax

Syntax | Description
--- | ---
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@leaf01:mgmt:~$ nv show acl acl-default-dos rule 120
                       applied  pending
    -----------------  -------  -------
    match
      ip
        protocol       tcp      tcp
        hashlimit
          name         TCPRST   TCPRST
          rate-above   5/min    5/min
          burst        2        2
          source-mask  32       32
          expire       30000    30000
          mode         src-ip   src-ip

## nv show acl acl-default-whitelist

Shows the firewall whitelist rules on the switch.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show acl acl-default-whitelist
          applied  pending
    ----  -------  -------
    type  ipv4     ipv4
    rule
    =======
        Number  Summary
        ------  -------------------------------------------------
        5       match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                       ssh
        10      match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                       bgp
        15      match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                      ldap
        20      match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                      8765
        25      match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                     https
        30      match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                      clag
        35      match.ip.protocol:                            tcp
                match.ip.tcp.source-port:                      49
        40      match.ip.protocol:                            udp
                match.ip.udp.dest-port:               dhcp-client
        45      match.ip.protocol:                            udp
                match.ip.udp.dest-port:               dhcp-server
        50      match.ip.protocol:                            udp
                match.ip.udp.dest-port:                       ntp
        55      match.ip.protocol:                            udp
                match.ip.udp.dest-port:                       323
        60      match.ip.protocol:                            udp
                match.ip.udp.dest-port:                      snmp
        65      match.ip.protocol:                            udp
                match.ip.udp.dest-port:                      tftp
        70      match.ip.protocol:                            udp
                match.ip.udp.dest-port:                      ldap
        73      match.ip.udp.source-port:                    3020
        74      match.ip.udp.source-port:                    3022
        75      match.ip.protocol:                            udp
                match.ip.udp.source-port:                    1812
        80      match.ip.protocol:                            udp
                match.ip.udp.source-port:                    1813
        85      match.ip.protocol:                            udp
                match.ip.udp.dest-port:                      6343
        90      match.ip.protocol:                            udp
                match.ip.udp.dest-port:                      6344
        95      match.ip.protocol:                            udp
                match.ip.udp.dest-port:                       514
        100     match.ip.protocol:                            udp
                match.ip.udp.dest-port:                       bfd
        105     match.ip.protocol:                            udp
                match.ip.udp.dest-port:              bfd-multihop
        110     match.ip.protocol:                            udp
                match.ip.udp.dest-port:                      4789
        115     match.ip.protocol:                            udp
                match.ip.udp.dest-port:                       319
        120     match.ip.protocol:                            udp
                match.ip.udp.dest-port:                       320
        125     match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                      9339
        130     match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                     31980
                match.ip.tcp.dest-port:                     31982
        135     match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                       639
        140     match.ip.protocol:                            udp
                match.ip.udp.source-port:                      53
        145     match.ip.protocol:                            tcp
                match.ip.tcp.dest-port:                      9999
        150     match.ip.protocol:                           ospf
        155     match.ip.protocol:                            pim
        160     match.ip.protocol:                           vrrp
        165     match.ip.protocol:                           igmp
        170     match.ip.protocol:                           icmp
        175     match.ip.protocol:                            udp
                match.ip.udp.dest-port:                      clag
        9999    Log Level:                                      5
                action.log.log-prefix: IPTables-Dropped:
                Log Rate:                                       1

## nv show acl acl-default-whitelist rule <rule-id>

Shows information about the specified firewall whitelist rule on the switch.

### Command Syntax

Syntax | Description
--- | ---
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show acl acl-default-whitelist rule 150
                  applied  pending
    ------------  -------  -------
    match
      ip
        protocol  ospf     ospf

## nv show acl <acl-id>

Shows the specified ACL configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1
          applied
    ----  -------
    type  ipv4

    rule
    =======
        Number  Summary
        ------  -----------------------------
        10      match.ip.protocol:        tcp
                match.ip.tcp.dest-port:   123
                match.ip.tcp.source-port: 123

## nv show acl <acl-id> rule

Shows the rules for the specified ACL.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule
    Number  Summary
    ------  --------------------------------
    10      match.ip.dest-ip:   10.0.15.8/32
            match.ip.dest-port:          ANY
            match.ip.protocol:           tcp
            match.ip.source-ip: 10.0.14.2/32
            match.ip.source-port:        ANY

## nv show acl <acl-id> rule <rule-id>

Shows configuration information about the ACL with the specified rule number.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10
                         operational  applied
    -------------------  -----------  -------
    match
      ip
        protocol         tcp          tcp
        tcp
          [source-port]  123          123
          [dest-port]    123          123

## nv show acl <acl-id> rule <rule-id> action

Shows the action for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 action
      operational  applied
      -----------  -------
                   permit

## nv show acl <acl-id> rule <rule-id> action erspan

Shows the ERSPAN session for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 action erspan
         operational  applied  pending
    ---  -----------  -------  -------
    ttl                        200

## nv show acl <acl-id> rule <rule-id> action police

Shows policing of matched packets and bytes for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The ACL rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 action police
           operational  applied
    -----  -----------  -------
    burst               200
    mode                packet
    rate                400

## nv show acl <acl-id> rule <rule-id> action recent

Shows the recent action for the ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show acl acl-default-whitelist rule 73 action recent

## nv show acl <acl-id> rule <rule-id> match

Shows the ACL match criteria for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 match
                       operational  applied
    -----------------  -----------  -------
    ip
      protocol         tcp          tcp
      tcp
        [source-port]  123          123
        [dest-port]    123          123

## nv show acl <acl-id> rule <rule-id> match inner-ip

Shows ACL match based on inner packet headers configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip
                     operational  applied
    ---------------  -----------  -----------
    source-ip        10.10.10.10  10.10.10.10
    dest-ip          20.20.20.20  20.20.20.20
    protocol         udp          udp
    dscp             10           10
    udp
      [source-port]  1000         1000
      [dest-port]    2000         2000

## nv show acl <acl-id> rule <rule-id> match inner-ip ecn

Shows the ACL inner ECN match configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip ecn
             operational  applied
    -------  -----------  -------
    [flags]               tcp-cwr

## nv show acl <acl-id> rule <rule-id> match inner-ip ecn flags

Shows the ACL inner ECN flag match configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip ecn flags
    operational  applied
    -----------  -------
    tcp-cwr      tcp-cwr

## nv show acl <acl-id> rule <rule-id> match inner-ip tcp

Shows the ACL inner TCP match configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip tcp
                 operational  applied  pending
    -----------  -----------  -------  -------
    [dest-port]                        1000

## nv show acl <acl-id> rule <rule-id> match inner-ip tcp dest-port

Shows the ACL inner TCP destination port match configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip tcp dest-port
    Ports
    -----
    2000

## nv show acl <acl-id> rule <rule-id> match inner-ip tcp dest-port <port-id>

Shows information about the ACL inner TCP match for a specific destination port.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip tcp dest-port 1000

## nv show acl <acl-id> rule <rule-id> match inner-ip tcp source-port

Shows the ACL inner TCP source port match configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip tcp source-port
    Ports
    -----
    1000

## nv show acl <acl-id> rule <rule-id> match inner-ip tcp source-port <port-id>

Shows information about the ACL inner TCP match for a specific source port.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip tcp source-port 1000

## nv show acl <acl-id> rule <rule-id> match inner-ip udp

Shows the ACL inner UDP match configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip udp
                 operational  applied
    -----------  -----------  -------
    [dest-port]               1000

## nv show acl <acl-id> rule <rule-id> match inner-ip tcp dest-port

Shows the ACL inner UDP destination port match configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip UDP dest-port
    Ports
    -----
    2000

## nv show acl <acl-id> rule <rule-id> match inner-ip udp dest-port <port-id>

Shows information about the ACL inner match for a specific UDP destination port.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip udp dest-port 1000

## nv show acl <acl-id> rule <rule-id> match inner-ip udp source-port

Shows the ACL inner UDP source port match configuration.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip udp source-port
    Ports
    -----
    1000

## nv show acl <acl-id> rule <rule-id> match inner-ip udp source-port <port-id>

Shows information about the ACL inner match for a specific UDP source port.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl ACL1 rule 10 match inner-ip udp source-port 1000

## nv show acl <acl-id> rule <rule-id> match ip

Shows the IPv4 or IPv6 match criteria for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 match ip
                     operational  applied
    ---------------  -----------  -------
    protocol         tcp          tcp
    tcp
      [source-port]  123          123
      [dest-port]    123          123

## nv show acl <acl-id> rule <rule-id> match ip connection-state

Shows the connection state for the match IP ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show acl acl-default-whitelist rule 73 match ip connection-state
    applied
    -----------
    new
    established

## nv show acl <acl-id> rule <rule-id> match ip ecn flags

Shows the ECN protocol flag match criteria for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.2.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 match ip ecn flags
     operational  applied
      -----------  -------
                   tcp-cwr
                   tcp-ece
                   tcp-cwr
                   tcp-ece

## nv show acl <acl-id> rule <rule-id> match ip hashlimit

Shows the hash limit for the match IP ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show acl acl-default-whitelist rule 73 match ip hashlimit

## nv show acl <acl-id> rule <rule-id> match ip recent-list

Shows the recent list for the match IP ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.9.0

### Example

    cumulus@switch:~$ nv show acl acl-default-whitelist rule 73 match ip recent-list

## nv show acl <acl-id> rule <rule-id> match ip tcp flags

Shows TCP flag match criteria for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 match ip tcp flags
       operational  applied
       -----------  -------
                    syn

## nv show acl <acl-id> rule <rule-id> match ip tcp mask

Shows TCP protocol flag mask match criteria for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 match ip tcp mask
       operational  applied
       -----------  -------
                    syn

## nv show acl <acl-id> rule <rule-id> match mac

Shows MAC address match criteria for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 match mac
                     operational  applied
    ---------------  -----------  -----------------
    dest-mac                      08:9e:01:ce:e2:04
    dest-mac-mask                 ff:ff:ff:ff:ff:ff
    source-mac                    00:00:00:00:00:12
    source-mac-mask               ff:ff:ff:ff:ff:ff

## nv show acl <acl-id> rule <rule-id> match offset

Shows the packet offset match criteria for the specified ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 match offset
    Offset ID  Summary
    ---------  -------------
    34         value: 0x1200
    54         value: 0xabcd

## nv show acl <acl-id> rule <rule-id> match offset <offset-id>

Shows information for the specific packet offset match for the ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.16.0

### Example

    cumulus@switch:~$ nv show acl EXAMPLE1 rule 10 match offset 34
                operational      applied
    ----------  ---------------  ---------------
    value       0x1200           0x1200
    mask        0xFFFF           0xFFFF
    match-from  start-of-packet  start-of-packet

## nv show interface <interface-id> acl

Shows information about the ACLs configured on the specified interface. You use ACLs to match packets and take actions.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface on which the ACL operates.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show interface swp1 acl
    ACL Name  Rule ID  In Packets  In Bytes  Out Packets  Out Bytes
    --------  -------  ----------  --------  -----------  ---------
    EXAMPLE1  10                             0            0

## nv show interface <interface-id> acl <acl-id>

Shows information about a specific ACL on the specified interface. You use ACLs to match packets and take actions.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface on which the ACL operates.
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ Statistics
    ===============
    Rule  In Packet   In Byte          Out Packet  Out Byte         Action                  Match
    ----  ----------  ---------------  ----------  ---------------  ----------------------  ----------------------------
    10    0           0 Bytes                                       deny                    mac
                                                                                               dest-mac          : 08:9e:01:ce:e2:04
                                                                                               dest-mac-mask     : ff:ff:ff:ff:ff:ff
                                                                                               source-mac        : 00:00:00:00:00:12
                                                                                               source-mac-mask   : ff:ff:ff:ff:ff:ff

## nv show interface <interface-id> acl <acl-id> inbound

Shows information about the ACL applied for inbound traffic on the specified interface.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface on which the ACL operates.
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show interface swp1 acl EXAMPLE1 inbound

## nv show interface <interface-id> acl <acl-id> inbound control-plane

Shows information about the ACL applied for the control plane on the specified interface.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface on which the ACL operates.
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$
    Statistics
    ===============
    Rule  In Packet   In Byte           Action                                        Match
    ----  ----------  ----------------  --------------------------------------------  ----------------------------
    10    0           0 Bytes           deny                                          ip
                                                                                         protocol          : udp
                                                                                         udp
                                                                                           dest-port       : 50

## nv show interface <interface-id> acl <acl-id> statistics

Shows statistics for a specific ACL on the specified interface.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface on which the ACL operates.
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.2.0

### Example

    cumulus@switch:~$ nv show interface swp1 acl EXAMPLE statistics
    Rule  In Packet   In Byte          Out Packet  Out Byte         Action                 Match
    ----  ----------  ---------------  ----------  ---------------  --------------------   ----------------------------
    10    0           0 Bytes                                       deny                   mac
                                                                                              dest-mac          :   08:9e:01:ce:e2:04
                                                                                              dest-mac-mask     :   ff:ff:ff:ff:ff:ff
                                                                                              source-mac        :   00:00:00:00:00:12
                                                                                              source-mac-mask   :   ff:ff:ff:ff:ff:ff

## nv show interface <interface-id> acl <acl-id> statistics <rule-id>

Shows statistics for a specific ACL rule on the specified interface.

### Command Syntax

Syntax | Description
--- | ---
`<interface-id>` | The interface on which the ACL operates.
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.2.0

### Example

    cumulus@switch:~$ nv show interface swp1 acl EXAMPLE statistics 10
                         operational        applied
    -------------------  -----------------  -------
    match
      mac
        source-mac       00:00:00:00:00:12
        source-mac-mask  ff:ff:ff:ff:ff:ff
        dest-mac         08:9e:01:ce:e2:04
        dest-mac-mask    ff:ff:ff:ff:ff:ff
    inbound
      packet             0
      byte               0 Bytes

## nv show interface acl-statistics

Shows ACL statistics for all interfaces.

### Version History

Introduced in Cumulus Linux 5.2.0

### Example

    cumulus@switch:~$ nv show interface acl-statistics
    Interface  ACL Name  Rule ID  In Packets  In Bytes  Out Packets  Out Bytes
    ---------  --------  -------  ----------  --------  -----------  ---------
    swp1       EXAMPLE   10       0           0 Bytes
    swp2       EXAMPLE3  10       0           0 Bytes
               EXAMPLE1  10                             0            0 Bytes
               EXAMPLE   10       0           0 Bytes
    swp3       EXAMPLE   10       0           0 Bytes
    swp4       EXAMPLE   10       0           0 Bytes
    swp5       EXAMPLE   10       0           0 Bytes
    swp6       EXAMPLE   10       0           0 Bytes
    swp7       EXAMPLE   10       0           0 Bytes
    swp8       EXAMPLE   10       0           0 Bytes
    swp9       EXAMPLE   10       0           0 Bytes
    swp10      EXAMPLE   10       0           0 Bytes
    swp11      EXAMPLE   10       0           0 Bytes
    swp12      EXAMPLE   10       0           0 Bytes
    swp13      EXAMPLE   10       0           0 Bytes
    swp14      EXAMPLE   10       0           0 Bytes
    swp15      EXAMPLE   10       0           0 Bytes
    swp16      EXAMPLE   10       0           0 Bytes
    swp17      EXAMPLE   10       0           0 Bytes
    swp18      EXAMPLE   10       0           0 Bytes
    swp19      EXAMPLE   10       0           0 Bytes
    swp20      EXAMPLE   10       0           0 Bytes
    swp21      EXAMPLE   10       0           0 Bytes
    ...

## nv show system acl

Shows the ACL mode setting; atomic or non-atomic

### Version History

Introduced in Cumulus Linux 5.3.0

### Example

    cumulus@switch:~$ nv show system acl
          applied
    ----  -------
    mode  atomic

## nv show system control-plane

Shows the control plane configuration.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show system control-plane
    trap
    =======
    No Data

    policer
    ==========
    No Data

    acl
    ======
        ACL Name               Rule ID  In Packets  In Bytes   Out Packets  Out Bytes
        ---------------------  -------  ----------  ---------  -----------  ---------
        acl-default-dos        30       4503        3.19 MB
                               40       0           0 Bytes
                               50       0           0 Bytes
                               60       0           0 Bytes
                               70       0           0 Bytes
                               80       0           0 Bytes
                               90       0           0 Bytes
                               100      4           240 Bytes
                               110      0           0 Bytes
                               120      0           0 Bytes
                               130      0           0 Bytes
        acl-default-whitelist  5        4           240 Bytes
                               10       0           0 Bytes
                               15       0           0 Bytes
                               20       0           0 Bytes
                               25       0           0 Bytes
                               30       0           0 Bytes
                               35       0           0 Bytes
    ...

## nv show system control-plane acl

Shows the control plane ACLs configured on the switch. You use control plane ACLs to apply a single rule for all packets forwarded to the CPU regardless of the source interface or destination interface on the switch. Control plane ACLs allow you to regulate traffic forwarded to applications on the switch with more granularity than traps and to configure ACLs to block SSH from specific addresses or subnets.

### Version History

Introduced in Cumulus Linux 5.5.0

### Example

    cumulus@switch:~$ nv show system control-plane acl
    ACL Name   Rule ID  In Packets  In Bytes  Out Packets  Out Bytes
    ---------  -------  ----------  --------  -----------  ---------
    ACL1       1        0           0         0            0
               65535    0           0         0            0
    ACL2       1        0           0         0            0
               65535    0           0         0            0

## nv show system control-plane acl <acl-id>

Shows information about the specified control plane ACL.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.5.0

### Example

    cumulus@switch:~$ nv show system control-plane acl ACL1

## nv show system control-plane acl <acl-id> inbound

Shows inbound ACL statistics for the specified control plane.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.15.0

### Example

    cumulus@switch:~$ nv show system control-plane acl ACL1 inbound

## nv show system control-plane acl <acl-id> outbound

Shows outbound ACL statistics for the specified control plane.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.15.0

### Example

    cumulus@switch:~$ nv show system control-plane acl ACL1 outbound

## nv show system control-plane acl <acl-id> statistics

Shows statistics for the specified control plane ACL.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.

### Version History

Introduced in Cumulus Linux 5.5.0

### Example

    cumulus@switch:~$ nv show system control-plane acl ACL1 statistics
    Rule  In Packet  In Byte  Out Packet  Out Byte  Summary

    ----  ---------  -------  ----------  --------  ---------------------------

    1     0          0 Bytes  0           0 Bytes   match.ip.dest-ip:   9.1.2.3

    2     0          0 Bytes  0           0 Bytes   match.ip.source-ip: 7.8.2.3

## nv show system control-plane acl <acl-id> statistics <rule-id>

Shows statistics for the specified control plane ACL rule.

### Command Syntax

Syntax | Description
--- | ---
`<acl-id>` | The ACL name.
`<rule-id>` | The rule number.

### Version History

Introduced in Cumulus Linux 5.5.0

### Example

    cumulus@switch:~$ nv show system control-plane acl ACL1 statistics 2

## nv show system control-plane policer

Shows control plane policer configuration. Add `--view=brief` to show configuration and statistics.

The command output changed in 5.11 and later. The command output in 5.11 and later is shown below.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show system control-plane policer
    Policer        Policer CIR  Policer CBS  To CPU Pkts  To CPU Bytes  Violated Packets
    -------------  -----------  -----------  -----------  ------------  ----------------
    acl-log        100          7            0            0             0
    arp            800          10           0            0             0
    bfd            2000         11           0            0             0
    bgp            2000         11           0            0             0
    catch-all      100          7            0            0             0
    clag           2000         11           0            0             0
    ...

In the command output:

- `Policer` is the name of the COPP rule that describes the traffic to match
- `Policer CIR` (Committed Information Rate) is the maximum number of packets per second for this rule allowed to reach the CPU.
- `Policer CBS` (Committed Burst Size) is the maximum burst of packets above the CIR for this rule allowed to reach the CPU. In units of 2 raised to this power packets. For example, a CBS value of 8 means 2^8 = 256 packets.
- `To CPU Pkts` is the count of packets matching this rule allowed to reach the CPU.
- `To CPU Bytes` is the count of bytes matching this rule allowed to reach the CPU.
- `Violated Packets` is the count of packets matching this rule not allowed to reach the CPU.

## nv show system control-plane policer <policer-id>

Shows configuration information for a specific control plane policer. The policer can be: `acl-log`, `arp`, `bfd`, `bgp`, `brief`, `catch-all`, `clag`, `dhcp`, `eapol`, `icmp6-def-mld`, `icmp6-neigh`, `icmp-def`, `igmp`, `ip2me`, `l3-local`, `lacp`, `lldp-ptp`, `nat`, `pim-ospf-rip`, `rpvst`, `span-cpu`, `ssh`, `stp`, or `unknown-ipmc`.

### Command Syntax

Syntax | Description
--- | ---
`<policer-id>` | The policer ID.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show system control-plane policer bfd
                     operational  applied
    ---------------  -----------  -------
    burst            2000
    rate             2000
    state            on
    statistics
      policer-cbs    11
      policer-cir    2000
      policer-id     10
      to-cpu-bytes   0
      to-cpu-pkts    0
      violated-pkts  0

In the command output:

- `policer-cir` (Committed Information Rate) is the maximum number of packets per second for this rule allowed to reach the CPU.
- `policer-cbs` (Committed Burst Size) is the maximum burst of packets above the CIR for this rule allowed to reach the CPU. In units of 2 raised to this power packets. For example, a CBS value of 8 means 2^8 = 256 packets.
- `to-cpu-pkts` is the count of packets matching this rule allowed to reach the CPU.
- `to-cpu-bytes` is the count of bytes matching this rule allowed to reach the CPU.
- `violated-pkts` is the count of packets matching this rule not allowed to reach the CPU.

## nv show system control-plane policer <policer-id> statistics

Shows statistics for a specific control plane policer. The policer can be: `acl-log`, `arp`, `bfd`, `bgp`, `brief`, `catch-all`, `clag`, `dhcp`, `eapol`, `icmp6-def-mld`, `icmp6-neigh`, `icmp-def`, `igmp`, `ip2me`, `l3-local`, `lacp`, `lldp-ptp`, `nat`, `pim-ospf-rip`, `rpvst`, `span-cpu`, `ssh`, `stp`, or `unknown-ipmc`.

### Command Syntax

Syntax | Description
--- | ---
`<policer-id>` | The policer ID.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show system control-plane policer bfd statistics
                   operational  applied
    -------------  -----------  -------
    policer-cbs    11
    policer-cir    2000
    policer-id     10
    to-cpu-bytes   0
    to-cpu-pkts    0
    violated-pkts  0

In the command output:

- `policer-cir` (Committed Information Rate) is the maximum number of packets per second for this rule allowed to reach the CPU.
- `policer-cbs` (Committed Burst Size) is the maximum burst of packets above the CIR for this rule allowed to reach the CPU. In units of 2 raised to this power packets. For example, a CBS value of 8 means 2^8 = 256 packets.
- `to-cpu-pkts` is the count of packets matching this rule allowed to reach the CPU.
- `to-cpu-bytes` is the count of bytes matching this rule allowed to reach the CPU.
- `violated-pkts` is the count of packets matching this rule not allowed to reach the CPU.

## nv show system control-plane trap

Shows the control plane trap configuration.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show system control-plane trap

## nv show system control-plane trap <trap-id>

Shows specific control plane trap configuration.

### Command Syntax

Syntax | Description
--- | ---
`<trap-id>` | The trap ID.

### Version History

Introduced in Cumulus Linux 5.0.0

### Example

    cumulus@switch:~$ nv show system control-plane trap l3-mtu-err
           operational  applied
    -----  -----------  -------
    state  off          off