Connection Search : Configured Connection Search Tool


Connection Search is an application that allows the user to search for connections between endpoints on the ACI fabric.

General Overview

The Connection Search GUI provides a simple search bar. The user can enter a query into this search bar and the results are then displayed.

The results are in the format of a table where set of IP addresses or subnets in the first column corresponds to connection sources, a set of IP addresses or subnets in the second column corresponds to connection destinations, and a final column that shows which filters are applied to these connections.

Each row of the table is for a unique source-dest combination.

A search query consists of a set of attribute=value tuples. Any attribute can be used at most one time in a given search. If an attribute is not specified, then the search will assume those omitted attributes should not be used to qualify the results. For example, if NO attributes are specified, then ALL connections will be reported. If sip=10.11.12/24 is specified, then only connections that have a source that is covered by the subnet will be reported.


Connection Search is part of the acitoolkit and will be installed at the same time. The installation details can be found here.

Web based Usage

Connection Search should be run as a web application. Running Connection Search as a web application is done by switching to the connection_search directory and running the application:

cd acitoolkit/applications/connection_search

By default, Connection Search will run locally on the loopback address. Accessing the tool is done by running a web browser locally and pointing to the following URL:

Upon pointing the web browser to the Connection Search URL, the Connection Search welcome screen along with the navigation menu on the left hand side will be displayed.



Entering the APIC credentials is necessary for Connection Search to be able to perform searches. Selecting the Credentials in the navigation menu will bring up the Credentials screen where the APIC credentials can be entered.


A number of fields allow the entry of the APIC credentials. These fields are:

APIC IP Address: This field is the IP address used to communicate with the APIC.

Use secure connection: When selected, this checkbox indicates that the APIC communication uses https instead of http.

APIC Username: The username used when logging in to the APIC.

APIC Password: The password used when logging in to the APIC.

The credentials are stored with Connection Search by selecting the Save button. Once the credentials are entered, they will be saved as part of the user session on that browser. This means that another window or tab using Connection Search can be opened on the same machine without having to re-enter the credentials.

When entered, the current credentials are shown as in the screenshot below. Note that for security purposes, the password is not displayed. Clicking the Reset button will cause Connection Search to forget the current credentials, but will not impact the APIC in any way.



The following are a few examples of searches and explanation of the results.

Example 1

Find all the connections whose source IP address is in the subnet “”.


Here we see how the search is contructed, sip=192/8. This tells the application to find all connections whose source IP address has the first 8-bits equal to “192”.

The results show three connections. The first shows traffic from to This shows that all traffic from the mgmt tenant can be switched to Tenant1 L3Out-FW-outside as long as it is TCP traffic. It has a filter of ip tcp any-any any-any both which should be interpreted as:

  • EtherType = IP
  • IP protocol = TCP
  • L4 destination port minimum = any
  • L4 destination port maximum = any
  • L4 source port minimum = any
  • L4 source port maximum = any
  • Direction with respect to destination = both

The following two rows show connections from Tenant1 to Tenant1, i.e. they correspond to different traffic than the first row.

Note that there were additional results that are not shown in the above image.

Example 2

This next example shows a search looking for traffic in a tenant named “Tenant1”, whose destination is to anything in the subnet on any layer 4 destination port number in the range of 80 to 500.


The results show 3 connection groups. The first one is from a host IP of This looks funny and is probably a configuration error in the APIC. The destination here is and the filter is for any TCP traffic. in the destination column covers the search criteria of dip=, and the filter of any-any for the destination port range covers the search criteria of dport=80-500.

Example 3

In this query, the user wants to see all of the destinations that host in tenant “Tenant1” can send traffic to.


Here there are two results. The first shows that this host can send traffic to default route of 0/0 for any TCP traffic. The second row shows that this host can communicate with itself using any protocol. This second one has a fully open filter of any any any-any any-any both. When we place the cursor over this row we can see that this was an “implied” filter. The implied filter is created by the connection search tool to show that end-points within an EPG can communicate with each other without any constraint.


This is a simple summary screen with a link to the documentation and a description of the software license.


This screen provides the ability for the users to submit comments, suggestions, feature requests, and bug reports directly to the authors of the tool.

Command Line Usage

Connection Search can also be run as a command line application. This is done by switching to the Connection Search directory and running the application:

cd acitoolkit/applications/connection_search

The application is run with options provided in the command line. The help for this command is shown by:

python --help

The output for this command is shown below:

usage: [-h] [-u URL] [-l LOGIN] [-p PASSWORD]
                       [--snapshotfiles SNAPSHOTFILES [SNAPSHOTFILES ...]]
                       [-tenant TENANT] [-context CONTEXT] [-sip SIP]
                       [-dip DIP] [-dport DPORT] [-sport SPORT]
                       [-etherT ETHERT] [-prot PROT] [-arpOpc ARPOPC]
                       [-applyToFrag APPLYTOFRAG] [-tcpRules TCPRULES]

Connection Search tool for APIC.

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     APIC IP address.
  -l LOGIN, --login LOGIN
                        APIC login ID.
  -p PASSWORD, --password PASSWORD
                        APIC login password.
                        APIC configuration files
  -tenant TENANT        Tenant name (wildcards, "*", accepted), default "*"
  -context CONTEXT      Context name (wildcards, "*", accepted), default "*"
  -sip SIP              Source IP or subnet - e.g., default: "0/0"
  -dip DIP              Destination IP or subnet - e.g., default:
  -dport DPORT          Destination L4 Port value or range, e.g. 20-25 or 80.
                        Default: "any"
  -sport SPORT          Source L4 Port value or range, e.g. 20-25 or 80.
                        Default: "any"
  -etherT ETHERT        EtherType, e.g. "ip", "arp", "icmp". Default: "any"
  -prot PROT            Protocol, e.g. "tcp", "udp". Default: "any"
  -arpOpc ARPOPC        ARP Opcode, e.g. "req", "ack". Default: "any"
  -applyToFrag APPLYTOFRAG
                        Apply to fragment, e.g. "yes", "no". Default: "any"
  -tcpRules TCPRULES    TCP rules, e.g. "syn", "fin". Default: "any"

The APIC credentials are provided with the –url, –login, and –password options.

The remaining fields follow the attributes described above for the GUI version of the tool. Note that when is used from the command line in this manner, the APIC configuration will be loaded and a single search conducted. When the GUI version is used, the APIC configuration is loaded and multiple searches can be made against it without doing a re-load.