Cisco ASA 5506-X Configuration Manual page 335

Chapter 15 Threat Detection
8-hour Sent byte:
24-hour Sent byte:
1-hour Sent pkts:
8-hour Sent pkts:
24-hour Sent pkts:
20-min Sent drop:
1-hour Sent drop:
1-hour Recv byte:
8-hour Recv byte:
24-hour Recv byte:
1-hour Recv pkts:
8-hour Recv pkts:
24-hour Recv pkts:
20-min Recv drop:
1-hour Recv drop:
Host:10.0.0.0: tot-ses:1 act-ses:0 fw-drop:0 insp-drop:0 null-ses:0 bad-acc:0
1-hour Sent byte:
8-hour Sent byte:
24-hour Sent byte:
1-hour Sent pkts:
8-hour Sent pkts:
24-hour Sent pkts:
20-min Sent drop:
1-hour Sent drop:
1-hour Recv byte:
8-hour Recv byte:
24-hour Recv byte:
1-hour Recv pkts:
The following table explains the output.
Table 15-3
Field
Host
tot-ses
act-ses
fw-drop
insp-drop
null-ses
bad-acc
367
122
28
2697
337
112
29
42
14
show threat-detection statistics host
Description
The host IP address.
The total number of sessions for this host since it was added to the database.
The total number of active sessions that the host is currently involved in.
The number of firewall drops. Firewall drops is a combined rate that includes
all firewall-related packet drops tracked in basic threat detection, including
ACL denials, bad packets, exceeded connection limits, DoS attack packets,
suspicious ICMP packets, TCP SYN attack packets, and no data UDP attack
packets. It does not include non-firewall-related drops such as interface
overload, packets failed at application inspection, and scanning attack
detected.
The number of packets dropped because they failed application inspection.
The number of null sessions, which are TCP SYN sessions that did not
complete within the 3-second timeout, and UDP sessions that did not have any
data sent by its server 3 seconds after the session starts.
The number of bad access attempts to host ports that are in a closed state.
When a port is determined to be in a null session (see the null-ses field
description), the port state of the host is set to HOST_PORT_CLOSE. Any
client accessing the port of the host is immediately classified as a bad access
without the need to wait for a timeout.
0
0
0
3 0
1 0
9 0
3 0
0
0
0
0
3 0
1 0
0
0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
0 0
Cisco ASA Series Firewall CLI Configuration Guide
Monitoring Threat Detection
0 10580308
0 10580308
0 104043
0 104043
0 104043
1 10851
1 10851
0 9712670
0 9712670
0 9712670
0 104846
0 104846
0 104846
3 50567
1 50567
0 614
0 614
0 614
0 6
0 6
0 6
0 4
0 4
0 706
0 706
0 706
0 7
15-11