topic Re: How to findout the individual total number of HTTP and HTTPS session count. in General Topics

How to findout the individual total number of HTTP and HTTPS session count.

Gururaj — Mon, 24 Aug 2015 07:43:09 GMT

Hi Team,

How to findout the individual total number of HTTP and HTTPS session count.

For example : Total session count is 1000

I need in this total 1000 session how many HTTP and HTTPS

HTTP session : 700

HTTPS session: 300

Regards,

Gururaj

Re: How to findout the individual total number of HTTP and HTTPS session count.

VinceM — Mon, 24 Aug 2015 08:16:24 GMT

Hi,

By cli, you can use: show system statistics application. Will provide you real time monitoring per apps.

If you want to have the info through WUI, you can use this command through the API. (exemple: pan(a)chrome) and docs: https://www.paloaltonetworks.com/content/dam/paloaltonetworks-com/en_US/assets/pdf/technical-documentation/pan-os-61/XML-API-6.1.pdf)

Hope help

Re: How to findout the individual total number of HTTP and HTTPS session count.

Lucky — Mon, 24 Aug 2015 09:17:44 GMT

Hello Gururaj,

to count active HTTP sessions you can use CLI command:
show session all filter application web-browsing count yes

To count active HTTPS sessions, just change application:
show session all filter application ssl count yes

Regards

Luciano

Re: How to findout the individual total number of HTTP and HTTPS session count.

santonic — Mon, 24 Aug 2015 10:42:08 GMT

This one is close, but not accuate. Especially on port 80 you will have many different applications, not just web-browsing.

Try instead:

show session all filter destination-port 443 count yes

show session all filter destination-port 80 count yes

Re: How to findout the individual total number of HTTP and HTTPS session count.

santonic — Mon, 24 Aug 2015 10:39:35 GMT

Or if you want to make it automatic or need data for the past:

Custom report -> from Traffic Log -> Query: (port.dst eq 80) or (port.dst eq 443) -> Columns: Destination port, Repeat Count -> Group by destination port, Sort by repeat count.

Then you get something like this:

Re: How to findout the individual total number of HTTP and HTTPS session count.

Lucky — Mon, 24 Aug 2015 12:11:01 GMT

Good catch, santonic - but generally, that is the principle. Show session all filter _something_ and optionally count yes.