How to log out-of-state dropped packets ?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to log out-of-state dropped packets ?

L3 Networker


Last week we've replaced an FWSM cluster with a PA-5050 cluster. After the migration there were intermittent problems with our CRM application. Allthough we had no used applications but only services in our security policy, the PAN was applying the predefined siebel-crm application time-out of 60 seconds.After increasing the app timeout to 300 seconds the issue was solved.

The only way to find this out was by taking multiple traces at client and server side, finally we saw the dropped packets in the PAN drop-stage packet-capture. We lost almost a day.

Some questions regarding the above :

1° How does it come that dropped out-of-state packets  ( in this case of a timed-out session) are not logged ?
All other firewalls I know of are logging these kind of dropped packets.

2° How can we see the timed-out sessions ? ( in particular application-timeouts ) There must be a counter somewhere I guess.

To be more precise, the dropped out-of-state packets in question were FIN-ACK's from the client to the server.

Since the session was already timed-out on the PAN, the PAN was silently dropping these packets, with any visible trace in the logfiles.

Many thanks ,



L4 Transporter

Hi Bart,

Did you try doing a "show counter global | match drop" and check to see which drop counters were increasing?  This is one of my favorite troubleshooting commands.  From there you can also filter the counters to narrow down whether that is the issue for the flows you are investigting.  The counter names are typically pretty self explanitory, though I'm not sure how they would show up in this case.

Here's my cheat sheet:

  • Set a filter to control what traffic is counted
    • debug dataplane packet-diag set filter match <criteria>
    • debug dataplane packet-diag set filter on 
  • Show the drop counters (absolute or relative to last time command was run)
    • show counter global packet-filter yes | match drop
    • show counter global filter severity drop packet-filter yes delta yes

Hope that helps,


Hi Kelly,

Many many thanks !

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!