Does statistics for appid ssl include other appid's using ssl such as gmail-base, facebook-base etc?

mikand — Thu, 12 Nov 2015 10:59:14 GMT

This is a fork of https://live.paloaltonetworks.com/t5/General-Topics/Statistics-reports-on-how-much-SSL-traffic-you-got/m-p/67945 but with a specific question.

Dealing with reports in PA I wonder if the counters/statistics regarding appid ssl includes other appid's who also use ssl such as gmail-base, facebook-base and the others?

That is lets say you got a report that says (in the below example both facebook and gmail uses https):

appid, port, bytes, sessions

ssl, 443, 10GB, 1M

ssl, 11111, 1GB, 0.1M

ssl, 22222, 2GB, 0.2M

facebook-base, 443, 2GB, 0.2M

gmail-base, 443, 5GB, 0.5M

Would the above mean that the total number of ssl-traffic during this timeframe was 13GB/1.3M sessions or 20GB/2M sessions?

Re: Does statistics for appid ssl include other appid's using ssl such as gmail-base, facebook-base

santonic — Fri, 13 Nov 2015 07:23:05 GMT

I believe it's 20GB/2M (if you're not decrypting any traffic)

I'm pretty sure this report is drawn from traffic logs. In those logs each session is logged with one recognised application. So if a TCP session is recognised as gmail-base it will only count towards gmail statistics and not SSL.

Not sure how it's logged and reported for decrypted sessions.

topic Does statistics for appid ssl include other appid's using ssl such as gmail-base, facebook-base etc? in General Topics

Does statistics for appid ssl include other appid's using ssl such as gmail-base, facebook-base etc?

Re: Does statistics for appid ssl include other appid's using ssl such as gmail-base, facebook-base