topic Re: Monitoring Load on IDS in Network Security

Monitoring Load on IDS

jahangeer_abdul — Sun, 10 Mar 2019 10:32:10 GMT

Hi.

At present I am monitoring the traffic that flows on the Inside Int of my firewall. I need to sniff the traffic on the other INT as well. before doing that activity I wanted to know my IDS-4235 would take the load or not.

kindly help me to know how to measure the current load on the IDS.

Re: Monitoring Load on IDS

suschoud — Thu, 29 Mar 2007 19:39:48 GMT

Hi ,

You can run the following command :

show version

Application Partition:

Cisco Systems Intrusion Detection Sensor, Version 4.1(4)S91

OS Version 2.4.18-5smpbigphys-4215

Platform: IDS-4215

Sensor up-time is 51 days.

Using 444817408 out of 459202560 bytes of available memory (96% usage)

Using 4.3G out of 17G bytes of available disk space (27% usage)

this could give you memory status as well as disk status.

hth

Re: Monitoring Load on IDS

mhellman — Thu, 29 Mar 2007 20:23:16 GMT

You might also take a look at the following:

show statistics host

It gives you a little more detail.

Re: Monitoring Load on IDS

jahangeer_abdul — Fri, 30 Mar 2007 05:10:57 GMT

Thanks buddy. Your reply was very helpful. could you give me any material for the commands which we are using under service user.

Re: Monitoring Load on IDS

scothrel — Fri, 30 Mar 2007 13:21:34 GMT

"show version

Application Partition:

Cisco Systems Intrusion Detection Sensor, Version 4.1(4)S91

OS Version 2.4.18-5smpbigphys-4215

Platform: IDS-4215

Sensor up-time is 51 days.

Using 444817408 out of 459202560 bytes of available memory (96% usage) "

The memory statistics referenced above cannot be trusted(this is a known issue) as they don't tell all of the story. They are the same statistics returned by the "top" command, which has an issue with free vs. available memory. The former only tracks memory thats not been allocated and doesn't take into account memory that is dirty but available. A more reliable way to determine memory availability for 4.1 and 5.X versions is to run the "top" command (requires service account) and track the sum of the "free" and "cache" categories.

As of IPS 6, this trick is no longer meaningful, as we preallocate all the memory that the inspection subsystem will use and the memory statistics are pretty much static.

Re: Monitoring Load on IDS

jahangeer_abdul — Fri, 30 Mar 2007 15:29:30 GMT

Hi,

Thanks for your valuable reply. I got clear Idea of the Memory Usage. It's it any way to get the memory usage for particular time period (say for month or week).

The present memory status is,

Mem: 899924K av, 890200K used, 9724K free. Will it increase If the switch passes more traffic? Is it advisable to sniff more traffic with this load?

Kinldy give your valuable suggestion.

Jahangeer A