Global couter historical blockages or drops due to asymmetric traffic.

To test this feature, visit your live site.

Hello, good evening, as always thanks for the collaboration.

Is it possible to review the history, not what changed in the last hour, minutes or seconds, but the history of the last 6 or 8 hours ?

Is it possible ?

If I run a show counter global filter packet-filter packet-filter no | match drop

Without using the delta, these values that appear for example this output, indicates zero drop and value 3118246

show counter global filter packet-filter no | match flow_tcp_non_syn_drop

flow_tcp_non_syn_drop 3118246 0 drop flow session Packets dropped: non-SYN TCP without session match

show counter global filter packet-filter no | match out_of_wnd

tcp_drop_out_of_wnd 225073 0 warn tcp resource out-of-window packets dropped

show counter global filter packet-filter no | match tcp_out_of_sync

tcp_out_of_sync 949 0 warn tcp pktproc can't continue tcp reassembly because it is out of sync

To better interpret this, in first 3118246 value, what time does it correspond to? and this 0, well I guess it is not or has not

applied drop to any connection, right?

Thanks

I remain attentive

Best regards

7 comments

Comments (7)

Reaper

Oct 29, 2023

Sorry I missed part (or many parts) of your question

The count is "lifetime" it simply adds since the last reboot

The next number is rate, which indicates how many have been seen between your last 2 deltas

The nonsyntcp is ack packets for which no syn was seen, this can happen if the firewall is "in" the asymmetry (syn used different path, ack came back via firewall)

Out-of window is when the firewall receives packets that don't belong to the current tcp window, this can be due to upstream asymmetry where some packets take a longer route

Out of sync is when packers are truly completely scrambled

MetgatzGR

Oct 29, 2023

Replying to

name value rate severity category aspect description

(active)> show counter global | match flow_tcp_non_syn

flow_tcp_non_syn 3119822 0 info flow session Non-SYN TCP packets without session match

flow_tcp_non_syn_drop 3119822 0 drop flow session Packets dropped: non-SYN TCP without session match

(active)> show counter global | match flow_tcp_non_syn

flow_tcp_non_syn 3119825 0 info flow session Non-SYN TCP packets without session match

flow_tcp_non_syn_drop 3119825 0 drop flow session Packets dropped: non-SYN TCP without session match

(active)> show counter global | match flow_tcp_non_syn

flow_tcp_non_syn 3119825 0 info flow session Non-SYN TCP packets without session match

flow_tcp_non_syn_drop 3119825 0 drop flow session Packets dropped: non-SYN TCP without session match

So this show o drop, 0 info, change number from 3119822 to 3119825 but then there is no drop ? is it correct ? the counter goes up but there is no drop as such ? I did this second by second by second immediately one after the other.

Reaper

Oct 29, 2023

Replying to

if the value is increasing, it means there are drops

if the rate is 0 that means it is either happening very slowly, or in bursts when you are not looking

there's only 3 difference in the value between your first and last show counters, so the number of dropped packets is so small there is no 'rate' (rate should be interpreted as a spedometer, we're dropping x packets per y time. If the 'velocity' is very low the spedometer won't register anything but you're still moving)

Reaper

Oct 29, 2023

I think it's dp-monitor.log btw :)

Reaper

Oct 29, 2023

Yes it is, but it's in the (dataplane) logs rather than the show counters

A full "show counters global" is recorded every 10 or 15 minutes in one of the dataplane logs (I don't have access to a device right now and the name of the log eludes me)

I should be able to provide you the exact log later today ;)

MetgatzGR

Oct 29, 2023

Replying to

Thanks a lot master @Reaper, that counter is about asymmetric traffic

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSHCA0#:~:text=counters%20can%20increment%3A

MetgatzGR

Oct 29, 2023

Replying to

Revisando el dp-log monitor si veo esto:

:Session setup

: TCP - reject non-SYN first packet: True

: Hardware session offloading: False

: Software Cut Through: True

: Hardware UDP session offloading: False

: Run-to-completion mode: True

: Tunnel acceleration: True

: IPv6 firewalling: True

: Strict TCP/IP checksum: True

: Strict TCP RST sequence: True

: Reject TCP small initial window: False

: Reject TCP SYN with different seq/options: True

: ICMP Unreachable Packet Rate: 200 pps

:--------------------------------------------------------------------------------

:Application trickling scan parameters:

: Timeout to determine application trickling: 10 secs

: Resource utilization threshold to start scan: 80%

: Scan scaling factor over regular aging: 8

:--------------------------------------------------------------------------------

:Session behavior when resource limit is reached: drop

:--------------------------------------------------------------------------------

:Pcap token bucket rate : 10485760

:--------------------------------------------------------------------------------

:Max pending queued mcast packets per session : 0

:--------------------------------------------------------------------------------

:Global counters:

:Elapsed time since last sampling: 213.701 seconds

:name value rate

:-------------------------------------------------------------------------------

:pkt_recv 25439666681 3273

:pkt_recv_retry 2323328 0

:pkt_recv_zero 25432836938 3270

:pkt_recv_qos_3 219 0

:pkt_recv_qos_4 25415 0

:pkt_recv_qos_5 6804109 2

:pkt_runtc_np 25439666681 3273

:pkt_session_closed_fastpath 3 0

:pkt_sent_lo 25353667430 3247

:pkt_sent_hi 3826623423 629

:pkt_swbuf_clone 836 0

:pkt_sent_host 385283201 121

:pkt_xmt_rt 22185681 7

:pkt_stp_rcv 7473 0

:pkt_pvst_rcv 7473 0

:pkt_pvst_non_L2 7473 0

:pkt_lacp_sent 202160 0

:pkt_lacp_recv 6030951 1

:session_allocated 225034510 81

:session_freed 225031375 79

:session_installed 224639922 81

:session_discard 569630 0

:session_install_error 179 0

:session_install_error3 179 0

:session_install_error_c2s 1 0

:session_install_error_s2c 178 0

:session_unverified_rst 309972 0

:session_pkt_in_closed_state 2 0

:session_reuse_tcp_session 4614 0

:session_hash_insert_duplicate 179 0

:session_servobj_timeout_override 439912890 189

:session_from_ha_prep_reuse 83 0

:flow_rcv_dot1q_tag_err 958571 0

:flow_no_interface 958571 0

:flow_ipv6_disabled 125 0

:flow_policy_nofwd 3404558 1

:flow_policy_deny 8682873 0

:flow_tcp_non_syn 3117285 0

:flow_tcp_non_syn_drop 3117285 0

:flow_fwd_l3_mcast_drop 2701790 0

:flow_fwd_l3_ttl_zero 369 0

Globally the firewall is dropping asymmetric traffic:

If with this counter, dp-log monitor estorico, I look for the date time of my suspicion, we validate that indeed in that lapse if the block/drop ?

I remain attentive

Best regards

Forum: Forum