---
icon: material/check-decagram-outline
title: "Verifying"
description: "Falsify the outbound claims yourself: a packet capture per state, the image check, and the networkless run."
---

# Verifying

The cheapest test of the [three states](outbound.md#when-they-happen) is a
packet capture. Run all three.

```bash
sudo tcpdump -n -i any 'host prometheus.log10x.com or host api.log10x.com' &

# State 1: no license. Expect no vendor traffic.
tenx run @run/input/forwarder/fluentbit @apps/receiver

# State 3: a license AND an endpoint. Expect whoami, write, and the
# per-pattern metrics the shipped Receiver config sends to the same host.
TENX_LICENSE_KEY="$(cat license.jwt)" \
  TENX_BACKEND_ENDPOINT=https://prometheus.log10x.com/ \
  tenx run @run/input/forwarder/fluentbit @apps/receiver

# State 2: the same run, air-gapped. Expect no vendor traffic.
TENX_LICENSE_KEY="$(cat license.jwt)" \
  TENX_BACKEND_ENDPOINT=https://prometheus.log10x.com/ \
  TENX_AIRGAPPED=true \
  tenx run @run/input/forwarder/fluentbit @apps/receiver
```

The Receiver takes its input from a forwarder module, which is why each run
names one. To watch the engine's own two calls without the per-pattern
stream, run `@apps/dev` instead, whose config leaves the log10x metric
output commented out.

Confirming a pulled image carries no license is the other check worth running:

```bash
docker pull ghcr.io/log-10x/fluent-bit-10x:<tag>
docker inspect ghcr.io/log-10x/fluent-bit-10x:<tag> \
  --format '{{range .Config.Env}}{{println .}}{{end}}' | grep TENX_LICENSE_KEY
```

Running the engine in a container started with `--network none` is the
stronger version of the first test: the pipeline completes, because no
product function depends on a log10x endpoint.

For what is inside the artifact you just tested, every release ships a
[CycloneDX SBOM](sbom.md) naming each component.