11-12-2015 02:59 AM
This is a fork of https://live.paloaltonetworks.com/t5/General-Topics/Statistics-reports-on-how-much-SSL-traffic-you-g... but with a specific question.
Dealing with reports in PA I wonder if the counters/statistics regarding appid ssl includes other appid's who also use ssl such as gmail-base, facebook-base and the others?
That is lets say you got a report that says (in the below example both facebook and gmail uses https):
appid, port, bytes, sessions
ssl, 443, 10GB, 1M
ssl, 11111, 1GB, 0.1M
ssl, 22222, 2GB, 0.2M
facebook-base, 443, 2GB, 0.2M
gmail-base, 443, 5GB, 0.5M
Would the above mean that the total number of ssl-traffic during this timeframe was 13GB/1.3M sessions or 20GB/2M sessions?
11-12-2015 11:23 PM
I believe it's 20GB/2M (if you're not decrypting any traffic)
I'm pretty sure this report is drawn from traffic logs. In those logs each session is logged with one recognised application. So if a TCP session is recognised as gmail-base it will only count towards gmail statistics and not SSL.
Not sure how it's logged and reported for decrypted sessions.
11-12-2015 11:23 PM
I believe it's 20GB/2M (if you're not decrypting any traffic)
I'm pretty sure this report is drawn from traffic logs. In those logs each session is logged with one recognised application. So if a TCP session is recognised as gmail-base it will only count towards gmail statistics and not SSL.
Not sure how it's logged and reported for decrypted sessions.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
