Reference

This page is a reference for Path Analysis. The Syntax section covers query tokens, fields, types, and modes. The Behavior section covers query outcomes, anchor resolution, drop reasons, network functions, and the badges shown on path diffs.

For the pages that explain how to use these in context, see Running Path Analysis for building queries, Understanding Results for reading hops, and Troubleshooting & FAQ for common problems.

---

Syntax

Query Tokens

When you copy a query from the search bar as text, each clause appears in a single-letter shorthand. This table is here to decode that copied text — for example, to work out what f(...) u(...) z(delivered) means.

Token	Full name	Purpose
f	from	Source location (anchor)
t	to	Destination location (anchor)
u	through	Require transit through a device or interface
i	ingress	Require ingress at a device or interface within a path
e	egress	Require egress at a device or interface within a path
b	bypass	Exclude a device from the path
w	forwarding	Forwarding type (MPLS, VXLAN, etc.)
z	status	Outcome filter (delivered, dropped, etc.)
m	mode	Query mode (m(permit_all))

Anchor disambiguation modifiers at() and in() follow from() or to(); they don't have shorthand prefixes.

note

These shorthands are for reading a copied query, not for writing one. Build queries in the search bar using the full field names and the autocomplete suggestions, or, for programmatic access, use the Paths API. The shorthands are internal identifiers with no backward-compatibility guarantee — they can change between releases.

Running Path Analysis covers each token in context.

Anchors and Constraints

Clause	Argument	Notes
from(X)	IP, prefix, hostname, device name	Source anchor — where the path starts.
to(X)	IP, prefix, hostname, device name	Destination anchor — where the path ends.
at(D)	Device name	Restricts the preceding anchor to a specific device.
in(N)	Logical-network name	Restricts the preceding anchor to a Logical Network.
through(X)	Device or interface	Order-sensitive when repeated.
bypass(X)	Device or interface	Set-membership exclusion; order-agnostic.
ingress(X)	Device or interface	Order-sensitive when repeated.
egress(X)	Device or interface	Order-sensitive when repeated.

Anchor resolution covers how from() and to() resolve their arguments.

Outcome Values (z() / status())

Value	Meaning
delivered	Traffic egresses the modeled network edge toward the destination.
dropped	Explicit deny — an ACL or firewall rule rejected the traffic.
blackhole	Implicit drop — no forwarding entry matched.
inadmissible	Rejected as it entered the network — the ingress device wouldn't admit it (for example, a VLAN-tag mismatch on the ingress interface).
unreachable	Mid-path ARP or ND resolution failed.
loop	Traffic entered a forwarding loop.
undelivered	Meta-outcome — matches everything except delivered.

See Running Path Analysis → Outcome filters for query examples, and Outcome behavior for the distinctions between values.

Forwarding Types (w())

UI label	Query value
Direct L2	direct_l2
FabricPath	fabric_path
VXLAN	vxlan
Direct IP	direct_ip
MPLS	mpls
PBR (L2)	l2_pbr
PBR (L3)	l3_pbr

See Running Path Analysis → Forwarding-type filters for query examples.

Packet Header Fields

Header filters span Layer 2 through Layer 7. The tables below list every field the search bar accepts, grouped by layer. The Field column is the field name used throughout this documentation and in the API; examples here write it as field(value). The UI label is the name you actually see and pick in the product — the title-case form shown in the Filters facets and the sample-packet panel; the search bar's autocomplete offers the same fields under a hyphenated label, such as dest-ip.

Layer 2

Field	UI label	Notes
mac_src	Source MAC
mac_dst	Dest MAC
eth_type	Ethernet type	Hex (e.g., 0x800 IPv4, 0x86dd IPv6).
vlan_vid	VLAN ID
vlan_pcp	VLAN PCP
vlan_dei	VLAN DEI
fp_ftag	FTag	Cisco FabricPath tag.
sgt_src	Source SGT	Cisco TrustSec security group; see SGT.
sgt_dst	Dest SGT	Same as above.
optical_tag	Optical tag	Synthetic-optical-device only.

Layer 2.5 (MPLS)

Field	UI label	Notes
mpls_label	MPLS label	Outermost label.
mpls_bos	MPLS BoS	Bottom-of-stack indicator.
mpls_cos	MPLS CoS
mpls_ttl	MPLS TTL

Layer 3

Field	UI label	Notes
ipv4_src	Source IP	IPv4 source address or prefix.
ipv4_dst	Dest IP	IPv4 destination address or prefix.
ipv6_src	Source IP	IPv6 source.
ipv6_dst	Dest IP	IPv6 destination.
ip_version	IP version	4 or 6.
ip_proto	IP protocol	TCP, UDP, ICMP, etc.
ip_tos	IP ToS	Type of service / DSCP byte.
ip_ttl	IP TTL
ip_frag_offset	IP frag offset
ip_frag_flags	IP frag flags
ip_bos	IP BoS
has_ip_options	Has IP Options
ipv6_flow_label	IPv6 flow label
arp_op	ARP opcode
arp_spa	ARP SPA	Sender protocol address.
arp_tpa	ARP TPA	Target protocol address.
arp_sha	ARP SHA	Sender hardware address.
arp_tha	ARP THA	Target hardware address.

Layer 4

Field	UI label	Notes
tp_src	L4 source port
tp_dst	L4 dest port
tcp_flags	TCP flags	Bitmask (e.g., 0x2 SYN, 0x10 ACK).
icmp_type	ICMP type
icmp_code	ICMP code
igmp_type	IGMP type
nd_target	ND target	IPv6 Neighbor Discovery.
nd_sll	ND SLL	Source link-layer address option.
nd_tll	ND TLL	Target link-layer address option.

Layer 7

Layer-7 fields can only appear after from(). They describe how traffic enters the network, not how it's delivered.

Field	UI label	Notes
app_id	App ID	Application identity (e.g., https, ssh).
user_group_id	User Group ID
user_id	User ID
url	URL	Labeled URL/Domain in facets and the sample-packet panel.
domain	Domain	Same facet/sample-packet label as url.
url_category	URL category

For semantics and platform support, see Layer-7 User-Group Filtering and Layer-7 URL Filtering.

Security Group Tags (SGT)

Layer-2 header fields for Cisco TrustSec.

Field	Meaning
sgt_src	Source SGT
sgt_dst	Destination SGT

Values are unsigned 32-bit integers (0 to 2³²−1). Forward parses SGT-aware access-control policy on Cisco ASA and Cisco FTD (FTD requires FMC collection for zone-to-interface mapping). On Cisco IOS and IOS-XE, Forward reads per-interface SGT assignments and the dynamic ACL from 802.1X/MAB-authenticated sessions, applying that downloadable ACL with the session's SGT as its source. It does not model SGT-to-SGT SGACL (cts role-based) policy enforcement.

For query examples, see Running Path Analysis → SGT.

Traffic Defaults

When the query doesn't pin a value, Forward optionally fills it in. Defaults are configurable at the org level (Settings → Org Preferences → Traffic defaults) and overridable per query in the Traffic Defaults panel.

Field	Default value	Org-level default	Effect when enabled
tcp_flags	0x2 (SYN)	Off	Models new connection establishment.
ip_frag_offset	0	Off	Models non-fragmented or first-fragment traffic.
ip_tos	0x0	Off	Default QoS / DSCP byte.
tp_src	65000	Off	Models an ephemeral source port.
app_id	unidentified	Off	Bypasses application-ID-based firewall rules.
url	none	On	Bypasses URL-based firewall rules.
user_id	unidentified	Off	Bypasses user-identity-based firewall rules.

When a default is disabled, the field is left wildcarded and the engine can match a broader set of paths. When enabled, it's set to the listed value unless the query overrides it explicitly.

See Running Path Analysis → Traffic defaults for how defaults affect policy evaluation.

Traffic Exclusions

Classes of traffic that don't appear in results. Configurable at the org level (Settings → Org Preferences → Traffic filters) and overridable per query.

Category	Description
Misconfigured gateway traffic	Frames sent to an incorrect default-gateway MAC. Indicates host-side problems, not forwarding issues.
Traffic to network or broadcast addresses	Destinations like 0.0.0.0/8, 127.0.0.0/8, subnet network and broadcast addresses, or invalid unicast ranges.
L2 traffic consumed by the network	Control-plane and management frames (LLDP, CDP, STP, LACP, etc.) that the receiving device terminates.
Malformed or unhandled traffic	Packets Forward can't process through the modeled forwarding logic.
Glean traffic	L3 traffic that reaches a directly-connected subnet but is dropped because the host can't be resolved (no ARP).

See Running Path Analysis → Traffic exclusions for when to override an exclusion.

Query Mode (m())

Value	Meaning
permit_all	Treat ACLs and firewall rules as permits. Routing, L2 forwarding, and ARP/ND still run normally.

Permit-all is global to the path — it can't be scoped to a single device. See Running Path Analysis → Permit-all mode for query examples.

---

Behavior

Outcome Behavior

The z() token accepts the seven values listed in Outcome values. Distinctions:

• Delivered — the packet exited the modeled network at an edge interface, addressed toward its destination. It does not mean the receiving application got the traffic. Final delivery may happen outside the model — e.g., toward an uncollected adjacent network, or across a mid-path gap. See Understanding Results → Missing Devices.
• Dropped vs. blackhole — dropped means an explicit deny rule matched (ACL, firewall, NAT, RPF, etc.). Blackhole means no forwarding entry matched at all — the packet had nowhere to go.
• Inadmissible vs. blackhole — inadmissible is a blackhole right at the network edge: the ingress device rejected the packet at the first lookup, before it traversed any further. It typically indicates traffic that shouldn't have entered the network at that point — for example, a VLAN tag the ingress interface doesn't accept.
• Unreachable — the packet reached its destination subnet but the device couldn't resolve a neighbor (no ARP/ND entry).
• Loop — the path enters a forwarding loop. The hop where the loop is detected shows a "loop detected" message; see Hop status messages.
• Undelivered — a meta-outcome used in filter facets. Matches dropped, blackhole, inadmissible, unreachable, and loop.

Anchor Resolution

When from() or to() is given an IP, prefix, or hostname argument, Forward resolves the argument to a location in the modeled network — a device, interface, or host where that address terminates. The two anchors run the same resolution; what differs is what you pass in.

In the GUI, when an anchor resolves to more than one location, a picker prompts you to choose one and inserts it as an at() (device) or in() (logical network) refinement. at() and in() are GUI-only — the path-search API has no equivalent. The API accepts every matching location and returns paths from all of them; to constrain the search, give a device-qualified anchor or add header filters.

Resolution mechanics

Forward works down the tiers below in order and stops at the first one that matches. The earlier tiers look for an exact, specific placement; the later tiers fall back to the surrounding address space.

Priority	Match	When it applies	If several match 1
1	Interface address	The argument is a single address configured directly on a device interface.	All interfaces holding that address are kept.
2	Host	The argument matches a host discovered on a connected subnet (learned from ARP/ND entries or MAC tables).	All matching hosts are kept.
3	Connected subnet	The argument falls within a subnet on a device interface — used for a prefix argument, or an address with no exact interface or host match.	Longest prefix wins. 2 Equal-length matches are all kept and traced in parallel.
4	SNAT pool 3	The argument matches an SNAT post-translation address.	Kept only if its prefix is longer than a connected-subnet match; a tie keeps the subnet.
5	Internet node	The argument falls in a synthetic Internet Node region.	—
6	Routes	The argument matches a route-table entry on a modeled device.	No narrowing by prefix length — every overlapping route is kept. 4

¹ Every location kept at the matching tier becomes an anchor: the search runs from (or to) all of them and returns the paths produced by each. In the GUI, when more than one location is kept, the picker prompts you to choose; the published paths API runs against all of them at once. See Troubleshooting → The API picked a different ingress than I expected.

² Longest-prefix matching applies only from the connected-subnet tier down; the interface-address and host tiers are exact matches.

³ SNAT resolution applies to from() only. from() resolves against SNAT post-translation (pool) addresses, so you can anchor a query on a translated source IP. to() skips that step entirely, so a DNAT virtual IP — one that exists only as a NAT rule and not on an interface — won't resolve as a to() anchor. Set it as an ipv4_dst header filter instead, and the path traces through the DNAT rule to the back-end address.

⁴ The route tier keeps every overlapping route, which can return more ingresses than expected. With no earlier match, from(10.21.0.0/17) resolves to every device that has a matching route, including a device whose only match is a broad aggregate (a /8, say) or the 0.0.0.0/0 default route. The engine does not prefer the most-specific route or otherwise pick one "best" ingress — it traces a path from every matched device, and the resulting paths are grouped and ordered like any other result (see Understanding Results → Path Groups). A path rooted at the broad-aggregate device can therefore rank above the one you expected. To pin the ingress you want, qualify the anchor with a specific device (from(...) at(...)) or a narrower prefix.

Drop Reasons

When a network function or interface stops the traffic, the hop status reads Dropped because <reason> (explicit deny) or Blackholed because <reason> (implicit termination). The tables below list every reason string, grouped by function family.

ACL / firewall

Reason
interface is not in a security zone
packet is going from lower to higher security level
packet is failing RPF check
internet zone is empty, therefore no traffic can flow through trusted zones
packet with an IPsec tunnel match condition arrived on a non-IPsec interface
packet with a private source IP cannot be sent out to the public internet

IP route

Reason
traffic was destined to a Class D or E IP address
traffic was blocked by the device's configuration
traffic was destined to a broadcast address
traffic was destined to an IP address that has no route
traffic was destined to a subnet's network address
traffic was destined to an unused multicast address
traffic was destined to a subnet with an unknown output port
traffic was destined to a link local address
no static route was configured on the gateway that matches the destination address
no BGP route was received on the gateway that matches the destination address
transit gateway attachment does not have an associated route table
destination subnet is not reachable or does not exist
drop only established connections

ARP / ND

Reason
the MAC entry was missing from the ARP cache

NAT

The NAT panel renders the matched rule, the pre/post values, and one of the following reason strings.

Reason
the packet's destination IP matches the external IP of a Virtual IP object
the translated address matches the external IP of an existing Virtual IP object or is in the IP range of an existing IP pool
the packet only partially matches on the applicable Twice NAT rule
the response packet was not sent to the same port that the request packet was received on
a dynamic object is referenced in a rule but could not be resolved
a dynamic object is referenced in a rule but resolved to an empty set
NAT control is enabled but the sample packet does not hit a NAT rule
the packet is targeted to virtual server address, but doesn't match its transport layer port
the packet doesn't match on any virtual IP and port
virtual server has no active pool member
the packet doesn't match on any NAT rule on the ingress interface shared between contexts
the packet is not destined to a public address of VPC
traffic arrived at load balancer in a different zone than its target
sending traffic from private to public IP address of an interface is not allowed
traffic destined to an internal load balancer located in a different region is dropped
no target load balancer is available or configured

OpenFlow

A single user-facing token: Drop is rendered as the action label next to "Explicit". OpenFlow tables on collected switches express drops as a flow rule with an explicit Drop action.

Interface-level

Reason
packet was denied by ACL rule
<interface> was down
<interface> was not configured to accept EtherType
traffic didn't match EtherTypes configured on <interface>
packet was dropped by NAT rule

U-turn

Reason
packet cannot be sent out input port

Blackhole Reasons

Blackholed because <reason> for paths that terminate without an explicit deny.

Reason
no matching cloud route table entry
no matching transit gateway entry
no matching virtual WAN entry
no destination MAC matched at the input port
no VLAN matched at the input port
no destination IP matched at the input port
no L2 forwarding entry matched any header field
L2 input port mismatch
L2 output port mismatch
L2 VLAN mismatch
no L3 forwarding entry matched (VRF-scoped variant when a VRF is in scope)
no NAT entry matched
input arrived on a device acting as backup
VNI mismatch at input

Hop Status Messages

In addition to per-function Dropped because… lines, hops carry these top-level status messages:

Message	When
Skipped further analysis of this path because a loop was detected	A previously-visited device-state pair recurs; the search abandons further evaluation.
Skipped further analysis of this path because it could potentially lead to a loop	Loop heuristic fires (e.g., overlapping VXLAN VNI on the same hop).
Dropped because packet cannot be sent out input port	U-turn: the packet's only egress is the same interface it arrived on.
Dropped because <reason> (at the interface layer)	Interface dropped the packet (down link, EtherType mismatch, ACL or NAT denial).

Network Functions

Each hop's detail panel groups operations by layer. The catalog below covers the on-prem layers; cloud devices render in a separate panel — see Cloud panel.

Access Control

Function	Title in the panel	Key attributes
ACL rule	Rule name (or Unnamed rule; default rule tag where applicable)	Type, context (ingress / egress / policy-based / VLAN / stateful response), layer, matched fields, action (Permit, Deny, Conditional with drop reason).
Reverse ACL	Same layout, "stateful response" context	Renders the rule that permits return traffic for an established flow.
PBR rule	Rule name	"Route by policy" or "VACL redirect" plus IP-route actions (next-hop, out_port, MPLS).
L2 PBR	Rule name	"VACL redirect" actions only.

NAT

Function	Title in the panel
Source NAT	Source NAT
Destination NAT	Destination NAT
NAT64	NAT64
Virtual IP	Virtual IP
Proxy	Proxy
Reverse Source NAT	Reverse Source NAT
Reverse Dest NAT	Reverse Destination NAT
Reverse NAT64	Reverse NAT64
Reverse Virtual IP	Reverse Virtual IP
Reverse Proxy	Reverse Proxy

Each NAT function shows a stateful tag, the matched entry name, the matched header fields, and an original → translated table for each transformed field. Drop reasons appear inline when the entry rejects the packet.

L3

Function	Notes
IP route	Header reads "Destined to prefix" / "Forwarded by shared tree" / "Forwarded by (S, G) tree" plus a "Routed to" or "Redirected to" block. Shows VRF, next-hop, out_port, MPLS push/pop, "Next hop is self (receive)", "Route is directly connected", or drop reason.
ARP	"ARP Lookup" — shows next-hop IP → MAC, or drop reason if the MAC can't be resolved.
Auto-route	"Routed to" — the route was learned from the related request traffic (return-path leg).
MPLS	"Destined to label" / "Routed to" — shows MPLS labels, VRF, ECMP next-hops, and label push / pop / pop-all.
L3 VXLAN	"VxLAN" / "Mapped to" — VNI/tunnel matching, mapped VRF or BDIs.

L2

Function	Notes
MAC forwarding	"Destined to MAC" / "Forwarded to" — shows the MAC vendor, "Learned from IP" entry, out_port, or "self (receive)".
Broadcast-domain forwarding	"Destined to" / "Forwarded to L2 domain" — shows the matched fields, the list of out_ports per bucket, and any blocked-port markers.
FabricPath	"Destined to FabricPath" / "Forwarded to" / "Exited FabricPath" — match fields and ECMP next-hops.
L2 VXLAN	"VxLAN" / "Mapped to" — VNI → BDIs / vlan_vid.
Ingress EPG	ACI ingress endpoint group with a Source EPG row.
Egress EPG	ACI egress endpoint group with a Destination EPG row.

Optical (L0)

Renders only on synthetic optical devices. Shows an optical_tag and an out_port row.

OpenFlow

Renders on devices configured with OpenFlow rules (a binary OF file). Shows the matching table, the rule priority, the matched fields, and the action buckets (Set, Goto table, Push, Pop, Drop, Resubmit, Flood, Output to all ports, Output back on input port, Send to normal pipeline processing, Send to controller).

Cloud Panel

Cloud devices (AWS, Azure, GCP, IBM Cloud, Alkira) render their functions in a separate Cloud panel rather than under the on-prem layers. Every cloud panel always shows a Name and ID row at the top; the rows below vary by function. Empty attribute arrays are skipped, so the rows shown in any given panel are exactly the ones the snapshot populated.

Function	Panel title	Rows shown
Cloud Subnet	Cloud Subnet	Cloud VPC, Route Table.
Cloud Security Group	Cloud Security	Direction, Applied To, Source/Dest IP, IP protocol, Dest port.
Cloud Network ACL	Cloud Network ACL	Direction, Applied To, plus all matched header fields.
Cloud Firewall	Cloud Firewall	Any of: Direction, Applied To, Action Type, Action Value, Drop Reason, Cloud VPC, Subnet.
Cloud Load Balancer	Cloud Load Balancer	Front End, Matched Rule (URLs), Back Ends, Targets.
Cloud App Load Balancer	Cloud App Load Balancer	Any of: Cloud VPC, Subnet, Backend Type, Action Type, Action Value. Frontend/Backend/Targets composites if present.
Cloud NAT	Cloud NAT	Source/Destination IPs, NAT Entry Name, Action.
Cloud Routing	Cloud Routing	"Destined to dest IP" subnet → forwarding action with type.
Cloud VPN Gateway	Cloud VPN Gateway	Customer IP, Cloud Provider IP.
Internet Gateway	Internet Gateway	Any of: Cloud VPC, Public IP, Private IP, Action Type, Action Value.
Cloud Direct Connect	Cloud Direct Connect	Any of: Peer IP, Cloud IP, Cloud VLAN, Connections, Cloud VPC.
Cloud Instance	Cloud Instance	Type, Interface composite (ID, Name, IP, MAC).
Cloud Endpoint	Cloud Endpoint	Same as Cloud Instance.
Cloud VPC Peering	Cloud VPC Peering	Source VPC, Target VPC.
Cloud TGW Attachment	Cloud TGW Attachment	Any of: Cloud VPC, Source VPC, Target VPC, Subnet, Action Type, Action Value.

Health and Violation Badges

Hops can carry small icons over the device or interface in the path diagram.

Badge	Severity → color	What triggers it
Unhealthy device	High → red, Medium → yellow	Device is flagged by the unhealthy-devices service: CPU, memory, or interface utilization above the corresponding threshold.
Unhealthy interface	High → red, Medium → yellow	One or more of the hop's interfaces are flagged by the unhealthy-interfaces service. High severity wins over Medium when both are present.
Has violations	Red	An enabled NQE decorator returned a violation row for this hop.

When the deployment collects performance data, a Health status button at the top of the result list opens a drawer with per-path device and interface metrics — CPU, memory, interface utilization, and uptime — with a toggle to show only unhealthy entities.

---

Where to Go Next

• Running Path Analysis — query construction, filters, and common intents.
• Understanding Results — reading hops, sample packets, and path diffs.
• Troubleshooting & FAQ — symptom-keyed recipes.
• Layer-7 User-Group Filtering and Layer-7 URL Filtering — L7 filter semantics in depth.