topic Re: Unable to see Current connection output of DOS Statistics. in General Topics

Unable to see Current connection output of DOS Statistics.

Rajendranahak — Thu, 08 Oct 2020 04:56:29 GMT

Bellow are the output.

PA-FW1 vsys4(active)> show dos-protection rule internet statistics

Rule: VDI-to-internet, idx: 0, id: 2
Classified profile: DOS-Classified
Classification Criteria: destination-only
Action: protect
Log Forwarding profile: default

Classified profile: DOS-Classified
------------------------------------------------------------------------------------------
tcp-syn
current: 0, dropped: 0
------------------------------------------------------------------------------------------
udp
current: 0, dropped: 0
------------------------------------------------------------------------------------------
icmp
current: 0, dropped: 0
------------------------------------------------------------------------------------------
other-ip
current: 0, dropped: 0
------------------------------------------------------------------------------------------
icmpv6
current: 0, dropped: 0
------------------------------------------------------------------------------------------
sessions
current: 990, dropped: 0
ip tracked: 2, ip blocked: 0
------------------------------------------------------------------------------------------

My i know how i will see the value of udp,icmp etc.

Lots of of tcp session is showing In session filter of destination ip which has called in DOS rule.

Re: Unable to see Current connection output of DOS Statistics.

reaper — Fri, 09 Oct 2020 15:09:35 GMT

how did you configure the DOS rule ?

Re: Unable to see Current connection output of DOS Statistics.

Alex_Kras — Fri, 02 Apr 2021 13:51:43 GMT

Friends,

I have the same problem and can't find an answer for a couple of days.

I can show my configuration, maybe someone will tell me what to do next.

DOS Profile:

DOS rule:

Trying to run a several "ping" commands from two different sources (3 icmp form one source and 4 from the second source)

CLI shows me this result:

show dos-protection rule "Test DOS Protection" statistics

Rule: Test DOS Protection, idx: 0, id: 1

Classified profile: Test_DOS

Classification Criteria: source-and-destination

Action: protect

Log Forwarding profile:

Classified profile: Test_DOS

------------------------------------------------------------------------------------------

tcp-syn

current: 0, dropped: 0

------------------------------------------------------------------------------------------

udp

current: 0, dropped: 0

------------------------------------------------------------------------------------------

icmp

current: 0, dropped: 69

------------------------------------------------------------------------------------------

other-ip

current: 0, dropped: 0

------------------------------------------------------------------------------------------

icmpv6

current: 0, dropped: 0

------------------------------------------------------------------------------------------

sessions

current: 32, dropped: 0

ip tracked: 18, ip blocked: 0

------------------------------------------------------------------------------------------

Yes, it shows me dropped packets. But my guess is that I should see 3 icmp in the current section as I am constantly using these 3 pings which do not exceed the limit specified in the DOS profile.