Ping log with 0 bytes sent

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Ping log with 0 bytes sent

Hi Guys,

 

I noticed some strange logs on one of our 5200 firewalls.

There is device behind the firewall that is running constant ping to google dns, traffic is allowed and working normally.

I noticed a some logs that bytes sent is zero... I can explain bytes received with no reply, but I don't have any explanation why log entry will have bytes sent with zero:

AlexanderAstardzhiev_0-1623937334598.png

AlexanderAstardzhiev_1-1623937505092.png

 

Does anyone have notice something similar?
Googling around I found another discussion in Reddit - https://www.reddit.com/r/paloaltonetworks/comments/9pg27s/0_byte_sent_logs/ But there they discuss TCP/UDP traffic, which I can guess can be related to predicted sessions, but I cannot explain it for ICMP traffic.

2 REPLIES 2

Cyber Elite
Cyber Elite

Good Day

 

I too, have similar packets with zero bytes, and others with some bytes in it.  It may have to do with how quickly the pings are going, if a session is being set up (slow path) vs fast path.  I think it OK to see these, and nothing wrong with your FW.

 

Any other questions can I assist with?

 

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Hi @S.Cantwell ,

 

That is intersting suggestion, but in my humble opition (by default) ping will never take the fast path.

Looking at the logs it seems that any request creates new log entry, therefor create new session. Which means after FW receives the ping reply it will close the session and next request will create new session which will take again slow path.

 

I was thinking if it could be related something with the fact that 5200 seriese and above have multiple Data Processors (DPs).

Another direction I was starting to think - "bytes sent", does this means that FW didn't forward this packet - it receive it, create session and log, but drops it before reaching the egress interface. But this means that we will see packet lost in the ping (I am not able to confirm this at the moment)

 

 

  • 3247 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!