topic Interface traffic on ASA in Network Security

Interface traffic on ASA

buffkata — Mon, 15 Nov 2021 17:04:49 GMT

Hi,

I just noticed something on our ASAs and was wondering if someone have seen this or if there is a better ezplanation for the difference between traffic(packets and bytes/s ) reported by an ASA on its Physical Interfaces number and nameif.

Below is the output of show traffic and show interface inside - you can see that interface inside is on t0/9 but still counters reported by both commands are different ?

asa# sh int inside
Interface TenGigabitEthernet0/9 "inside", is up, line protocol is up
Hardware is bcm56801 rev 01, BW 10000 Mbps, DLY 10 usec
(Full-duplex), (10000 Mbps)
Input flow control is unsupported, output flow control is off
Description:
MAC address 74a2.1111.cccf, MTU 1500
IP address 10.111.111.111, subnet mask 255.255.255.0
21955206181 packets input, 22567870384712 bytes, 0 no buffer
Received 40067 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause/resume input
0 L2 decode drops
0 switch ingress policy drops
6840386 packets output, 1648922903 bytes, 0 underruns
0 pause/resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 rate limit drops
0 switch egress policy drops
0 input reset drops, 0 output reset drops
Traffic Statistics for "inside":
3971284 packets input, 1080732198 bytes
6840386 packets output, 1521936904 bytes
11843 packets dropped
1 minute input rate 52 pkts/sec, 11127 bytes/sec
1 minute output rate 75 pkts/sec, 15210 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 65 pkts/sec, 13767 bytes/sec
5 minute output rate 72 pkts/sec, 12558 bytes/sec
5 minute drop rate, 0 pkts/sec

asa#
asa#
asa# sh traff | b TenGigabitEthernet0/9:
TenGigabitEthernet0/9:
received (in 253312.540 secs):
21968591127 packets 22573517347168 bytes
86013 pkts/sec 89113015 bytes/sec
transmitted (in 253312.540 secs):
6844864 packets 1649883618 bytes
10 pkts/sec 6004 bytes/sec
1 minute input rate 144457 pkts/sec, 61395974 bytes/sec
1 minute output rate 43 pkts/sec, 9487 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 137780 pkts/sec, 64563638 bytes/sec
5 minute output rate 72 pkts/sec, 13915 bytes/sec
5 minute drop rate, 0 pkts/sec

asa#

Re: Interface traffic on ASA

balaji.bandi — Mon, 15 Nov 2021 17:12:47 GMT

1 minute input rate 144457 pkts/sec, 61395974 bytes/sec
1 minute output rate 43 pkts/sec, 9487 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 137780 pkts/sec, 64563638 bytes/sec
5 minute output rate 72 pkts/sec, 13915 bytes/sec

are you referring this, if so, this may be different pattern every 1 or 5minutes depends on the usage of the network ? of somthing else you referring ?

Re: Interface traffic on ASA

buffkata — Mon, 15 Nov 2021 17:18:31 GMT

Not really - the interface input traffic reported with nameif inside should
be the same as t0/9 but it is not and there is a huge difference there.
I think this is because there of the dropped packets but still was not able
to find out anything online that can confirm that :
asa# sh int inside
Traffic Statistics for "inside":
3971284 packets input, 1080732198 bytes
6840386 packets output, 1521936904 bytes
11843 packets dropped
1 minute input rate 52 pkts/sec, 11127 bytes/sec
1 minute output rate 75 pkts/sec, 15210 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 65 pkts/sec, 13767 bytes/sec
5 minute output rate 72 pkts/sec, 12558 bytes/sec
5 minute drop rate, 0 pkts/sec

asa# sh traff | b TenGigabitEthernet0/9:
TenGigabitEthernet0/9:
received (in 253312.540 secs):
21968591127 packets 22573517347168 bytes
86013 pkts/sec 89113015 bytes/sec
transmitted (in 253312.540 secs):
6844864 packets 1649883618 bytes
10 pkts/sec 6004 bytes/sec
1 minute input rate 144457 pkts/sec, 61395974 bytes/sec
1 minute output rate 43 pkts/sec, 9487 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 137780 pkts/sec, 64563638 bytes/sec
5 minute output rate 72 pkts/sec, 13915 bytes/sec
5 minute drop rate, 0 pkts/sec