show smartvision event-track asym-flow stats

Note

This command was deprecated in Release 9.1.0.

Displays statistics that were collected for asymmetric traffic flow events.

Note

Collection of asymmetric flow statistics must be enabled on the appliance.

The appliance collects and displays statistics for SYN-only flows and non-SYN-only asymmetric flows separately. To conserve system resources, each list can store no more than 100 statistics. After a list is filled to maximum capacity, the appliance stops collecting statistics for that type of flow. Statistics collection for the flow resume after you refresh the cache. The refresh operation refreshes both lists even if only one of the lists is full. Enabling statistics collection also refreshes both lists.

The statistics are automatically reset when the collection of asymmetric traffic flow events is enabled, or they can be reset using a refresh command.

Flow statistic consist of the source and destination host, the number of occurrences of the flow, and other information. The statistics are listed in decreasing order of flow count. Statistics for SYN‑only flows and non-SYN‑only asymmetric flows are displayed in separate sections of the output,

Note

You can also run this command remotely from the command line of an integrated TrellixCentral Management System appliance using the central management appliance proxying mechanism.

Syntax

show smartvision event-track asym-flow stats

Parameters

None

Output

SYN-Only Flows (<n>/100)

Lists statistics collected for SYN-only flows. The number <n> is the number of unique SYN‑only flows tracked by the appliance, up to a maximum of 100.

True Asym Flows (<n>/100)

Lists statistics collected for true asymmetric flows, such as mid-stream asymmetric traffic. The number <n> is the number of unique non-SYN-only asymmetric flows tracked by the appliance, up to a maximum of 100.

src_ip:src_port

The traffic flow source IP addresses and port numbers in the format <hostIpAddress>:<portNumber>.

dst_ip:dst_port

The traffic flow recipient IP addresses and port numbers in the format <hostIpAddress>:<portNumber>

flow_state

The flow state of the source TCP port.

tcp_state

The state of the TCP destination port.

pkt_count

Number of packets in the flow.

flow_count

Number of unique occurrences of the flow.

Examples

The following example reports statistics for one unique SYN‑only flow and two unique non-SYN‑only asymmetric flows.

hostname # show smartvision event-track asym-flow stats
 
SYN-Only Flows (1/100):                                  flow_    tcp_       pkt_    flow_
          src_ip:src_port --           dst_ip:dst_port   state    state      count   count
 145.254.160.237:3372     --   65.208.228.223:80         new      syn_sent   1       1
  
True Asym Flows (2/100):                                 flow_    tcp_       pkt_    flow_
          src_ip:src_port --           dst_ip:dst_port   state    state      count   count
 145.254.160.237:3372     --   65.208.228.223:80         new      syn_sent   16      1
 145.254.160.237:3371     --    216.239.59.99:80         new      (null)     3       1

In this example, the maximum number of statistics for true asymmetric traffic flows has been reached. When additional asymmetric flows of either type are detected, the appliance does not store statistics for them until you refresh the cache.

User role

Admin, Analyst, or Operator.

Command mode

Enable

Supported appliances

This command is supported on the following appliances running the specified releases or later: