https://community.cisco.com/t5/network-security/viewing-zbpf-drops/m-p/1053152#M895944 <HTML><HEAD></HEAD><BODY><P>At the end of your policy add </P><P></P><P>class class-default</P><P> drop log</P></BODY></HTML> Thu, 25 Sep 2008 11:19:37 GMT Gerald Vogt 2008-09-25T11:19:37Z https://community.cisco.com/t5/network-security/viewing-zbpf-drops/m-p/1053151#M895942 <P>"show policy-map type inspect zone-pair sessions" ..does a great job of showing me currently active sessions in the inspection rules. What if I want to see what traffic is currently being dropped by the class default drop? How could I view what traffic is being prevented by the ZBPF?</P><P></P><P> Class-map: class-default (match-any)</P><P> Match: any</P><P> Drop (default action)</P><P> 22386 packets, 1473397 bytes</P><P></P><P></P><P></P> Mon, 11 Mar 2019 13:49:05 GMT https://community.cisco.com/t5/network-security/viewing-zbpf-drops/m-p/1053151#M895942 mmedwid 2019-03-11T13:49:05Z https://community.cisco.com/t5/network-security/viewing-zbpf-drops/m-p/1053152#M895944 <HTML><HEAD></HEAD><BODY><P>At the end of your policy add </P><P></P><P>class class-default</P><P> drop log</P></BODY></HTML> Thu, 25 Sep 2008 11:19:37 GMT https://community.cisco.com/t5/network-security/viewing-zbpf-drops/m-p/1053152#M895944 Gerald Vogt 2008-09-25T11:19:37Z https://community.cisco.com/t5/network-security/viewing-zbpf-drops/m-p/1053153#M895946 <HTML><HEAD></HEAD><BODY><P>Hi Michael,</P><P></P><P>Another handy tool to use when troubleshooting ZBFW is the 'ip inspect log drop' command. When this is enabled, a syslog message will be generated for packets that are dropped due to a firewall rule. The syslogs are usually pretty good about specifying a reason why the traffic was dropped as well.</P><P></P><P>Hope that helps.</P><P></P><P>-Mike</P></BODY></HTML> Thu, 25 Sep 2008 15:32:02 GMT https://community.cisco.com/t5/network-security/viewing-zbpf-drops/m-p/1053153#M895946 robertson.michael 2008-09-25T15:32:02Z