topic Re: CLI command output in Network Security https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918433#M5629 Ok, so the command "show threat-detection statistics top host" will provide information on top source IP addresses.<BR /><BR />HTH Tue, 03 Sep 2019 19:43:15 GMT Rob Ingram 2019-09-03T19:43:15Z CLI command output https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918368#M5625 <P>Hi,&nbsp;</P><P>&nbsp;</P><P>I have seen this output but Im not really sure which CLI command is for the ASA to check some sort of top talkers&nbsp;</P><P>&nbsp;</P><P>what is the CLI command?</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 21 Feb 2020 17:27:17 GMT https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918368#M5625 Kn1ghtR1d3rOfD00m 2020-02-21T17:27:17Z Re: CLI command output https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918372#M5626 Hi,<BR />I would guess that is the output from the command "show threat-detection statistics top port-protocol". You could also use "show local-host connection tcp|udp X" to determine the local-hosts with a specific "X" number of tcp or udp connections, which may be helpful.<BR /><BR />HTH Tue, 03 Sep 2019 18:15:42 GMT https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918372#M5626 Rob Ingram 2019-09-03T18:15:42Z Re: CLI command output https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918373#M5627 thanks for the info,<BR />not really sure, in the ouput I shared, there are source IPs, not sure why the guy did not want to share the CLI command <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> selflish<BR />I have tested now and the first command gives this<BR /><BR />Top Name Id Average(eps) Current(eps) Trigger Total events<BR />20-min Sent attack:<BR />20-min Recv attack:<BR />01 Port-8191-65535 308 226 57384 185361<BR />02 SYSLOG 514 25 30 27625 15283<BR />03 HTTP-Alternat 8080 19 21 33397 11491<BR />04 LDAP 389 17 19 43070 10770<BR />05 NetBIOS-Name 137 5 14 5159 3331<BR />06 HTTPS 443 4 2 891 2939<BR />07 DNS 53 3 2 1198 1839<BR />08 NetBIOS-Datag 138 1 1 2 1056<BR />09 Port-4438 4438 1 1 0 778<BR />10 Kerberos-auto 88 1 1 5 688<BR />1-hour Sent byte:<BR />01 HTTP-Alternat 8080 5235993 5363390 0 18849575605<BR />02 HTTPS 443 4564908 4641885 0 16433669917<BR />03 HTTP 80 3380638 3865723 0 12170298533<BR />04 Port-8191-65535 2251454 2058040 0 8105234478<BR />05 EGP * 8 1413754 1386479 0 5089514576<BR />06 MS-DS/SMB 445 513860 353554<BR /><BR /><BR />and the second command gives me this<BR /><BR />Top Name Id Average(eps) Current(eps) Trigger Total events<BR />20-min Sent attack:<BR />20-min Recv attack:<BR />01 Port-8191-65535 310 289 57382 186210<BR />02 SYSLOG 514 25 28 27624 15016<BR />03 HTTP-Alternat 8080 19 16 33397 11517<BR />04 LDAP 389 17 14 43070 10750<BR />05 HTTPS 443 5 4 891 3528<BR />06 NetBIOS-Name 137 5 3 5159 3071<BR />07 DNS 53 3 4 1198 1848<BR />08 NetBIOS-Datag 138 1 1 2 1060<BR />09 HTTP 80 1 3 11 817<BR />10 Port-4438 4438 1 0 0 725<BR />1-hour Sent byte:<BR />01 HTTP-Alternat 8080 5235993 5363390 0 18849575605<BR />02 HTTPS 443 4564908 4641885 0 16433669917<BR />03 HTTP 80 3380638 3865723 0 12170298533<BR />04 Port-8191-65535 2251454 2058040 0 8105234478<BR />05 EGP * 8 1413810 1418093 0 5089716136<BR />06 MS-DS/SMB 445 513860 353554 0 1849898740<BR />07 LDAP 389 200988 154814 0 723557647<BR />08 Port-4001 4001 160531 135467 0 577914419<BR />09 DNS 53 38978 38616 0 140322645<BR />10 Port-5246 5246 14915 12851 0 53694288<BR />1-hour Sent pkts:<BR />01 HTTP-Alternat 8080 7849 8013 0 28259482<BR />02 HTTPS 443 5524 5444 0 19887648<BR />03 Port-8191-65535 2913 2786 0<BR /><BR /><BR />any ideas? Tue, 03 Sep 2019 18:21:54 GMT https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918373#M5627 Kn1ghtR1d3rOfD00m 2019-09-03T18:21:54Z Re: CLI command output https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918433#M5629 Ok, so the command "show threat-detection statistics top host" will provide information on top source IP addresses.<BR /><BR />HTH Tue, 03 Sep 2019 19:43:15 GMT https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918433#M5629 Rob Ingram 2019-09-03T19:43:15Z Re: CLI command output https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918449#M5631 thanks, that was it,<BR /><BR />yes, not sure why I used sensitive help <span class="lia-unicode-emoji" title=":confused_face:">😕</span> think Im burned with a lot of GUI,<BR /><BR />thanks so much for your help, Tue, 03 Sep 2019 20:00:49 GMT https://community.cisco.com/t5/network-security/cli-command-output/m-p/3918449#M5631 Kn1ghtR1d3rOfD00m 2019-09-03T20:00:49Z