show counter global filter delta yes -----drops

Reply
Highlighted
Cyber Elite

show counter global filter delta yes -----drops

when i run command

 

show counter global filter delta yes

 

i see below counters incrementing  need to understand which are these drops and why PA is dropping these packets?

do they impact the performance of the PA?

 

flow_tcp_non_syn_drop    

 

flow_fpga_egress_exception_err      

 

flow_fwd_l3_ttl_zero 

 

flow_action_close 

 

 

MP
Highlighted
L7 Applicator

Those names are pretty self explaining.

Also description field helps to explain.

 

For example description for  flow_tcp_non_syn_drop says:

Packets dropped: non-SYN TCP without session match

 

It means that if the first packet in a session is a TCP packet and it does not have the SYN bit set, the firewall discards it (default).

 

It might help you to get familiar how Palo processes packet.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
Cyber Elite

can you please explain about this 

 

flow_fpga_egress_exception_err      

MP
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!