Monitoring Advanced Threat Detection Statistics - Cisco ASA Series Configuration Manual

Chapter 18 Threat Detection
1-hour ACL
1-hour SYN attck:
10-min
1-hour
1-hour Bad
10-min
1-hour
10-min DoS attck:
1-hour DoS attck:
10-min Interface:
1-hour Interface:

Monitoring Advanced Threat Detection Statistics

To monitor advanced threat detection statistics, use the commands shown in the following table. The
display output shows the following:
•
•
•
•
The ASA stores the count at the end of each burst period, for a total of 30 completed burst intervals. The
unfinished burst interval presently occurring is not included in the average rate. For example, if the
average rate interval is 20 minutes, then the burst interval is 20 seconds. If the last burst interval was
from 3:00:00 to 3:00:20, and you use the show command at 3:00:25, then the last 5 seconds are not
included in the output.
The only exception to this rule is if the number of events in the unfinished burst interval already exceeds
the number of events in the oldest burst interval (#1 of 30) when calculating the total events. In that case,
the ASA calculates the total events as the last 29 complete intervals, plus the events so far in the
unfinished burst interval. This exception lets you monitor a large increase in events in real time.
Command
show threat-detection statistics
[min-display-rate min_display_rate] top
[[access-list | host | port-protocol]
[rate-1 | rate-2 | rate-3] |
tcp-intercept [all] detail]]
drop:
Scanning:
Scanning:
pkts:
Firewall:
Firewall:
The average rate in events/sec over fixed time periods.
The current burst rate in events/sec over the last completed burst interval, which is 1/30th of the
average rate interval or 10 seconds, whichever is larger
The number of times the rates were exceeded (for dropped traffic statistics only)
The total number of events over the fixed time periods.
Purpose
Displays the top 10 statistics. If you do not enter any options, the top 10
statistics are shown for all categories.
The min-display-rate min_display_rate argument limits the display to
statistics that exceed the minimum display rate in events per second. You
can set the min_display_rate between 0 and 2147483647.
Following rows explain optional keywords.
0 0
5 0
0 0
106 0
76 0
0 0
76 0
0 0
0 0
0 0
88 0
Cisco ASA Series Firewall CLI Configuration Guide
Monitoring Threat Detection
0 112
2 21438
29 193
10 384776
2 274690
3 22
2 274844
0 6
0 42
0 204
0 318225
18-9