topic Re: Ping log with 0 bytes sent in General Topics

Ping log with 0 bytes sent

aleksandar.astardzhiev — Thu, 17 Jun 2021 13:54:53 GMT

Hi Guys,

I noticed some strange logs on one of our 5200 firewalls.

There is device behind the firewall that is running constant ping to google dns, traffic is allowed and working normally.

I noticed a some logs that bytes sent is zero... I can explain bytes received with no reply, but I don't have any explanation why log entry will have bytes sent with zero:

Does anyone have notice something similar?
Googling around I found another discussion in Reddit - https://www.reddit.com/r/paloaltonetworks/comments/9pg27s/0_byte_sent_logs/ But there they discuss TCP/UDP traffic, which I can guess can be related to predicted sessions, but I cannot explain it for ICMP traffic.

Re: Ping log with 0 bytes sent

S.Cantwell — Thu, 17 Jun 2021 14:12:56 GMT

Good Day

I too, have similar packets with zero bytes, and others with some bytes in it. It may have to do with how quickly the pings are going, if a session is being set up (slow path) vs fast path. I think it OK to see these, and nothing wrong with your FW.

Any other questions can I assist with?

Re: Ping log with 0 bytes sent

aleksandar.astardzhiev — Thu, 17 Jun 2021 16:14:45 GMT

Hi @S.Cantwell ,

That is intersting suggestion, but in my humble opition (by default) ping will never take the fast path.

Looking at the logs it seems that any request creates new log entry, therefor create new session. Which means after FW receives the ping reply it will close the session and next request will create new session which will take again slow path.

I was thinking if it could be related something with the fact that 5200 seriese and above have multiple Data Processors (DPs).

Another direction I was starting to think - "bytes sent", does this means that FW didn't forward this packet - it receive it, create session and log, but drops it before reaching the egress interface. But this means that we will see packet lost in the ping (I am not able to confirm this at the moment)