topic Negative connection value meaning? in Network Security

Negative connection value meaning?

Machi Ma — Tue, 12 Mar 2019 08:53:23 GMT

Hello,

Could you please advise what is meaning of negative current connection value when run 'show service-policy'

Like below

----

Class-map: Incoming
Set connection policy: per-client-max 2000
current embryonic conns 1801, current conns -130420, drop 2667854

-----

Thanks in advance.

This is most likely a

Rahul Govindan — Mon, 06 Feb 2017 04:05:56 GMT

This is most likely a cosmetic issue with the ASA logging the counters incorrectly. There have been some bugs in the past (8.2 versions) where this was seen. I feel you may most likely be hitting the following bug opened for the 9.1 version with no fix in place yet:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCun37690/?reffering_site=dumpcr

Thanks. I also find some

Machi Ma — Mon, 06 Feb 2017 04:10:06 GMT

Thanks. I also find some related discussion regarding this bug. However it looks still did not fixed ? as I using 9.6(2) already

Yeah, the bug status looks

Rahul Govindan — Mon, 06 Feb 2017 04:18:38 GMT

Yeah, the bug status looks terminated and no releases out with a fix. My guess would be that 9.6 also has the same issue is it has not been fixed before. Since it is cosmetic and rarely seen in customer environments, might take a while before a fix comes out.