Cisco ASA Series Cli Configuration Manual page 255

Chapter 1 Configuring Multiple Context Mode
Resource
Syslogs [rate]
Conns
Xlates
Hosts
Conns [rate]
Inspects [rate]
Other VPN Sessions
Other VPN Burst
S = System: Combined context limits exceed the system limit; the system limit is shown.
The following is sample output from the show resource usage summary command, which shows the
limits for 25 contexts. Because the context limit for Telnet and SSH connections is 5 per context, then
the combined limit is 125. The system limit is only 100, so the system limit is shown.
hostname# show resource usage summary
Resource
Telnet
SSH
Conns
Hosts
S = System: Combined context limits exceed the system limit; the system limit is shown.
The following is sample output from the show resource usage system command, which shows the
resource usage for all contexts, but it shows the system limit instead of the combined context limits. The
counter all 0 option is used to show resources that are not currently in use. The Denied statistics indicate
how many times the resource was denied due to the system limit, if available.
hostname# show resource usage system counter all 0
Resource
Telnet
SSH
ASDM
Routes
IPSec
Syslogs [rate]
Conns
Xlates
Hosts
Conns [rate]
Inspects [rate]
Other VPN Sessions
Other VPN Burst
Monitoring SYN Attacks in Contexts
The ASA prevents SYN attacks using TCP Intercept. TCP Intercept uses the SYN cookies algorithm to
prevent TCP SYN-flooding attacks. A SYN-flooding attack consists of a series of SYN packets usually
originating from spoofed IP addresses. The constant flood of SYN packets keeps the server SYN queue
full, which prevents it from servicing connection requests. When the embryonic connection threshold of
a connection is crossed, the ASA acts as a proxy for the server and generates a SYN-ACK response to
the client SYN request. When the ASA receives an ACK back from the client, it can then authenticate
the client and allow the connection to the server.
Current Peak
1743 2132
584 763
8526 8966
254 254
270 535
270 535
0 10
0 10
Current Peak
1 1
2 2
56 90
89 102
Current Peak
0 0
0 0
0 0
0 0
0 0
1 18
0 1
0 0
0 2
1 1
0 0
0 10
0 10
Monitoring Security Contexts
Limit Denied Context
N/A 0 Summary
280000(S) 0 Summary
N/A 0 Summary
N/A 0 Summary
N/A 1704 Summary
N/A 0 Summary
10 740 Summary
10 730 Summary
Limit Denied Context
100[S] 0 Summary
100[S] 0 Summary
130000(S) 0 Summary
N/A 0 Summary
Limit Denied
100 0
100 0
32 0
N/A 0
5 0
N/A 0
280000 0
N/A 0
N/A 0
N/A 0
N/A 0
750 740
750 730
Cisco ASA Series CLI Configuration Guide
Context
System
System
System
System
System
System
System
System
System
System
System
System
System
1-35