Description

This KB explains the meaning of Tagged Miss and Uncontrol Pass in the "show security macsec statistics interface" output 

user@host> show security macsec statistics interface xe-0/1/0 detail

  Interface name: xe-0/1/0
    Secure Channel transmitted
        Encrypted packets: 123858
        Encrypted bytes:   32190903
        Protected packets: 0
        Protected bytes:   0
    Secure Association transmitted
        Encrypted packets: 123858
        Protected packets: 0
    Secure Channel received
        Accepted packets:  123877
        Validated bytes:   0
        Decrypted bytes:   32196238
    Secure Association received
        Accepted packets:  123877
        Validated bytes:   0
        Decrypted bytes:   32196238
    Error and debug
    Secure Channel transmitted packets
        Untagged: 0, Too long: 0
    Secure Channel received packets
        Control: 0, Tagged miss: 3202804
        Untagged hit: 0, Untagged: 0
        No tag: 0, Bad tag: 0
        Unknown SCI: 0, No SCI: 0
        Control pass: 0, Control drop: 0
        Uncontrol pass: 123877, Uncontrol drop: 0
        Hit dropped: 0, Invalid accept: 0
        Late drop: 0, Delayed accept: 0
        Unchecked: 0, Not valid drop: 0
        Not using SA drop: 0, Unused SA accept: 0

Solution

Tagged Miss refers to a condition where a frame is received on a port that is expected to have MACsec security, but the frame does not contain the expected MACsec tag or header information. This means that the frame lacks the necessary MACsec metadata that is used for encryption and integrity protection.

Uncontrolled pass typically refers to the state where traffic is allowed to pass through a MACsec-enabled interface without being subjected to MACsec encryption and authentication. In this state, the interface is essentially operating as a regular, non-MACsec interface, and no MACsec security features are applied to the traffic.

Modification History

11-08-2023 Initial Draft