Does statistics for appid ssl include other appid's using ssl such as gmail-base, facebook-base etc?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Does statistics for appid ssl include other appid's using ssl such as gmail-base, facebook-base etc?

L6 Presenter

This is a fork of https://live.paloaltonetworks.com/t5/General-Topics/Statistics-reports-on-how-much-SSL-traffic-you-g... but with a specific question.

 

Dealing with reports in PA I wonder if the counters/statistics regarding appid ssl includes other appid's who also use ssl such as gmail-base, facebook-base and the others?

 

That is lets say you got a report that says (in the below example both facebook and gmail uses https):

 

appid, port, bytes, sessions

 

ssl, 443, 10GB, 1M

ssl, 11111, 1GB, 0.1M

ssl, 22222, 2GB, 0.2M

facebook-base, 443, 2GB, 0.2M

gmail-base, 443, 5GB, 0.5M

 

Would the above mean that the total number of ssl-traffic during this timeframe was 13GB/1.3M sessions or 20GB/2M sessions?

1 accepted solution

Accepted Solutions

L6 Presenter

I believe it's 20GB/2M (if you're not decrypting any traffic)

I'm pretty sure this report is drawn from traffic logs. In those logs each session is logged with one recognised application. So if a TCP session is recognised as gmail-base it will only count towards gmail statistics and not SSL. 

 

Not sure how it's logged and reported for decrypted sessions.

View solution in original post

1 REPLY 1

L6 Presenter

I believe it's 20GB/2M (if you're not decrypting any traffic)

I'm pretty sure this report is drawn from traffic logs. In those logs each session is logged with one recognised application. So if a TCP session is recognised as gmail-base it will only count towards gmail statistics and not SSL. 

 

Not sure how it's logged and reported for decrypted sessions.

  • 1 accepted solution
  • 1663 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!