topic Re: How can I see the session information (interface and ip details) of dropped packets because of ip spoof protection? in General Topics

How can I see the session information (interface and ip details) of dropped packets because of ip spoof protection?

Retired Member — Fri, 03 Apr 2015 21:56:11 GMT

thanks,

Emma

Re: How can I see the session information (interface and ip details) of dropped packets because of ip spoof protection?

Satish — Tue, 07 Apr 2015 05:05:13 GMT

Hi Emma,

As well as my knowledge. if you are getting logs, use below command in putty show session all and show session id (.......). if you are not able to find out any thing then try to packet capture.

I hope its help full.

Regards

Satish

Re: How can I see the session information (interface and ip details) of dropped packets because of ip spoof protection?

GobiernodeNavarra — Tue, 07 Apr 2015 09:02:04 GMT

It logs as a counter on the interface, show counter interface ethernet1/1.

For a detailed log you need to make a debug , follow this document Packet Based Troubleshooting - Configuring Packet Captures and Debug Logs

And you get something like that,

Packet received at ingress stage

Packet info: len 78 port 36 interface 269 vsys 1

wqe index 266614 packet 0x0x8000000419b930e2

Packet decoded dump:

L2: 3c:08:f6:2d:e6:c0->00:1b:17:00:02:24, VLAN 319 (0x8100 0x013f), type 0x0800

IP: 213.4.35.220->176.12.86.33, protocol 1

version 4, ihl 5, tos 0x00, len 60,

id 605, frag_off 0x0000, ttl 122, checksum 16214

ICMP: type 8, code 0, checksum 19796, id 1, seq 7

Flow lookup, key word0 0x1000700100100 word1 0

No active flow found, enqueue to create session

IP: 213.4.35.220->176.12.86.33, protocol 1

version 4, ihl 5, tos 0x00, len 60,

id 606, frag_off 0x0000, ttl 122, checksum 16213

ICMP: type 8, code 0, checksum 19795, id 1, seq 8

Session setup: vsys 1

Packet dropped, IP spoof on interface ethernet1/21.319

Packet dropped, Session setup failed

Re: How can I see the session information (interface and ip details) of dropped packets because of ip spoof protection?

Retired Member — Wed, 08 Apr 2015 00:54:18 GMT

Thanks!!

Emma

Re: How can I see the session information (interface and ip details) of dropped packets because of ip spoof protection?

yarinbenado — Thu, 16 Apr 2015 00:15:29 GMT

EmmaF what were you attempting to troubleshoot with the counters?