cutom report: session/IP

[_slv_]

Hi

Recently I discoverred that on my device amount of session rised from ~500 to ~1000, Id like to know which IPs are generating most of this sessions.

I try to make custom report but there I cant find "sessions" counter, only "session ID"

Is it possible to make such report or check it from the CLI?

Regards

SLawek

[panos]

When creating custom reports choose Traffic  summary (not the slow databese) , you will see session columns there.

[_slv_]

thats I know...

I'd like to get report that will show me, ie:

if dashboard shows current session: 150 I'd like to make report that show me which IP genrated this 150 sessions (like on Minotor>Sesion browser) but counted per IP. ID like to know wchich IP generated most sessions (ie TOP 10).

REgards

SLawek

[wesa]

Custom report can be customized per source user or group and filtered session should be able to point out the source IP address that is generating these sessions.

[panos]

if you want a report for real time, I do not know a feature like that.if this is not the thing you want

then wait for another answer may help you.

[_slv_]

I need report for real time. I have 5.0.3 PAN - maybe in this "new" release is a new feature to get such data from PAN (maybe from CLI?)

REgards

SLaweke

[panos]

You may find a way maybe using API or something

with cli using command

show session all filter state active source 192.168.10.11 count yes

gives active session for that ip.Maybe there is a way pulling a data for all subnet and give it to Excel, and put them in an order there.