Traffic log CSV Export Bytes Column

[indevis]

Hello everybody,

Software Version 3.0.5

when we make an CSV export for the traffic logs,
we have three columns with Bytes, called

- Bytes
- Bytes Send
- Bytes Received

All three columns have for the same row the same Byte values.
So, what is it for!

I thought there must be different values!

Can sombody explain this, or is there a fix in another release!?

Kind regards
Christian

[swhyte · Accepted solution]

Good Job Christian

This is an inconsistency in csv.

There is actually only one byte count and that is the total number of bytes. Right now we actually do not differentiate between the bytes received and bytes sent.....it's just one bucket of total bytes.

This is not yet addressed in a future version.

You can illiminate the bytes sent and bytes received collumn from the csv file as a soft work around.

If you would like to pursue this further, it definitely needs to come through support.

Thanks for alerting us of this.

[Mack]

swhyte wrote:
There is actually only one byte count and that is the total number of bytes. Right now we actually do not differentiate between the bytes received and bytes sent.....it's just one bucket of total bytes.
This is not yet addressed in a future version.

Differentiating bytes sent vs received is of interest to us too - not just in CSV, but also in traffic logs, reports, etc.  It appears that the 4.0.x code stream still does not differentiate.

Any idea if differentiating sent vs rcvd is forthcoming in a future release or if it has even been submitted as an enhancement request by anyone?

[Jamiefitzgerald]

Bytes in/out will be available in 4.1 on all platforms but the PA-4000 series. 

[Mack]

jfitz-gerald wrote:
Bytes in/out will be available in 4.1 on all platforms but the PA-4000 series.  

That's great news! But why not on the PA-4000s?

[ejohansen]

Has bytes in/out been made available in 4.1.2 for the PA-4000 series?

[Mack]

jfitz-gerald wrote:
Bytes in/out will be available in 4.1 on all platforms but the PA-4000 series.  

Bytes in/out do appear to be in 4.1.1 on our PA-5050s... except that the values are incorrect: the bytes-in and bytes-out fields always have the same value.

There are now three bytes-related fields in PANOS logs: Bytes, Bytes Sent and Bytes Received. Every log has the same equation for the various values:

Bytes Sent = Bytes Received = 1/2 Bytes 

I checked the release notes for 4.1.2, but there is no reference to a fix for this issue, nor a known outstanding issue.

[holmesw]

I opened a case on this very issue in February 2013.  The response: The PA-4000 series hardware does not support bidirectional counters. At this time, we do not see any change in a future software release.