Displays basic file inspection statistics, including the number of signatures, IOCs, domains, URIs, hash files and IP addresses that have been matched.
Syntax
show bottracker stats
Parameters
None
Example
The following example displays basic file inspection statistics, including the number of signatures, IOCs, domains, URIs, hash files and IP addresses that have been matched.
hostname # show bottracker stats Pkt rcvd :374725768 Bytes rcvd :181714953843 Sigmatch packet sent :374725768 Sigmatch packet sent fail :0 Signature match :2396 ICAP signature match :16 ICAP IPS signature match :11 IP whitelist match count :0 Domain whitelist match count(IOC) :0 Domain whitelist match count(Policy) :3 IOC events :0 File hash event :0 Url match event :0 Domain match event :0 IP match event :0 Reconn events :0 Alert threshold count :1229 Bot sigmatch event :1028 blocking event :595 non-blocking event :433 FEBeta match :0 Event dropped :0 Pref match events :0 Pref event dropped :0 flows dropped :0 pkts dropped :0 bytes dropped :0 content match fastpath flows :0 content match fastpath pkts :0 sigmatch result multiple :130 sigmatch result pkt mismatch :0 sigmatch result pkt no flow :0 sigmatch result xff flow :0 sigmatch result eoh alert :0 sigmatch result eoh successive alert :0 sigmatch result eoh no flow :0 sigmatch result eoh not first :0 sigmatch result cache needed :0 sigmatch result cache alloc fail :0 sigmatch result cache alloced :0 sigmatch result cache freed :0 sigmatch result cache sent :0 sigmatch result trace flow :0 sigmatch result diff xff :0 num cached alerts :0 num raised alerts :0 ips policy exception matched :0 matched ALL :0 bott fast-forward path count :0
Output fields
The following table describes the output fields for the show bottracker stats command. Fields are listed in the approximate order in which they appear in the output.
Field | Description |
|---|---|
Pkt rcvd | Number of packets received from the underlying packet filter. |
Bytes rcvd | Number of bytes received from the kernel filter. |
Sigmatch packet sent | Number of times a packet was sent to the signature match library. |
Sigmatch packet sent fail | Number of times the send to signature match library was disabled. |
Signature match | Number of signature matches. |
ICAP signature match | Number of signatures detected by ICAP |
IOC events | Number of IOC events. |
File hash event | Number of hash file events that are collected from inline blocking. |
Url match event | Number of URL events that matched traffic collected from inline blocking. |
Domain match event | Number of domain events that matched traffic collected from inline blocking. |
IP match event | Number of IP addresses that matched traffic collected from inline blocking. |
Bot sigmatch event | Number of bot signature events reported. |
blocking event | Number of signature match blocking events reported. |
non-blocking event | Number of signature match non-blocking events reported. |
Pref match events | Number of times a rule was matched with a preference rule option. |
Pref event dropped | Number of times a preference event was dropped due to a preference check. |
Max packet rcvd latency usec | Maximum latency for users to see the packet. |
flows dropped | Number of flows dropped. |
pkts dropped | Number of packets dropped. |
bytes dropped | Number of bytes dropped. |
Content match timeout | Number of content type matches in the signature matches. |
content match fastpath flows | Number of flows set to bypass signature match library content matches. |
content match fastpath pkts | Number of packets set to bypass signature match library content matches. |
User role
Admin, Analyst, Monitor, or Operator
Command mode
Enable
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 8.3.5. The command output was enhanced to include the event count of the IOC events in Release 8.0. The command output was enhanced to include the domain whitelist match count in Release 8.3.0. Additional output fileds were added in Release 8.3.5.