03-19-2004 01:41 AM
Hi,
does anyone know, how to interprete the timestamp of
"Time last frame was seen = <time>"
in "flow display <flows identifier>.
This value seems to be an absolut timestamp, but I don´t know how could I find out the real time.
In the example the value is "42629":
Time last frame was seen = 42629
What what does this value means.
complete output:
css01-23(debug)# flow active-list
-------- -------------- ----- -------------- ----- -- -------- -------- --------
Flow ID Src IP SPort Dst IP DPort Pr IgrsPort EgrsPort Flow flg
-------- -------------- ----- -------------- ----- -- -------- -------- --------
04010064 172.29.148.171 389 172.29.27.133 52440 6 01203240 00201940 822a2a00
04010923 172.29.148.171 389 172.29.27.133 56537 6 01203240 00201940 822a2a00
css01-23(debug)# show clock
Date: 03-19-2004
Time: 10:20:17
TimeZone: mez: +01:+00:+00
css01-23(debug)#
css01-23(debug)# flow display 0x04010064
Flow found on SP on Slot 2, Subslot 1
Detailed information for FlowId: 0x04010064, FpId: 0x844A5A40:
Ingress port = 0x01203240 Egress port = 0x00201940
State of this flow ( flow flags ) = 0x822a2a00 0x00
Partner flow id = 0x400ff8e
FCB flags = 0x00000419
Route Id = 0x8a63ac90
Host Id = 0x8a6d1480
Total number of SYNs received for this flow = 0
WCC cookie stat for this flow = 0
Protocol is TCP
IP: Source = 172.29.148.171-389 Dest = 172.29.27.133-52440
NAT IP: Source = 172.29.149.147-389 Dest = 172.29.27.133-52440
NAT tcp seq num delta used in L5 spoofing = 0x00000000
Time last frame was seen = 42629
Flow statistics bytesIn = 0 framesIn = 0
Src macaddr = 00-0b-fd-be-c6-7d Dest macaddr = 00-01-f4-16-e5-e6
Out of sequence discards = 0
Session Redundancy State: Active
Previous Flow ID: 0x0
Local Flow ID: 0x4010064
css01-23(debug)# show clock
Date: 03-19-2004
Time: 10:24:54
TimeZone: mez: +01:+00:+00
css01-23(debug)# flow display 0x04010064
Flow found on SP on Slot 2, Subslot 1
Detailed information for FlowId: 0x04010064, FpId: 0x844A5A40:
Ingress port = 0x01203240 Egress port = 0x00201940
State of this flow ( flow flags ) = 0x822a2a00 0x00
Partner flow id = 0x400ff8e
FCB flags = 0x00000419
Route Id = 0x8a63ac90
Host Id = 0x8a6d1480
Total number of SYNs received for this flow = 0
WCC cookie stat for this flow = 0
Protocol is TCP
IP: Source = 172.29.148.171-389 Dest = 172.29.27.133-52440
NAT IP: Source = 172.29.149.147-389 Dest = 172.29.27.133-52440
NAT tcp seq num delta used in L5 spoofing = 0x00000000
Time last frame was seen = 42629
Flow statistics bytesIn = 0 framesIn = 0
Src macaddr = 00-0b-fd-be-c6-7d Dest macaddr = 00-01-f4-16-e5-e6
Out of sequence discards = 0
Session Redundancy State: Active
Previous Flow ID: 0x0
Local Flow ID: 0x4010064
regards
sascha
Solved! Go to Solution.
03-22-2004 06:37 AM
ok.
From the code.
CurSecs: 315164:145 means 315164sec and 145 msec.
Last activity means the time when a packet was seen last time in sec.
The time is a value in seconds since boot.
So you should do CurSecs - last activity to have the
idle time.
Gilles.
03-19-2004 04:46 AM
Sascha is this a 1st gen or 2nd gen CSS ?
If 2nd gen, you should actually use a different command.
'flow-agent show active_fcbs'
then
'flow-agent show fcb_details 0x
With the 2nf gen, you can poll the flow-agent that is responsible to do the fastswitching.
It will give you better info then the old command which gives only information seen at software level.
Regards,
Gilles.
03-22-2004 04:58 AM
Hi Gilles,
thanks for feedback, the cmd works:
css01-23(debug)# flow-agent show active_fcbs
-------- -------------- ----- -------------- ----- -- -------- ------- --------
Flow ID Src IP SPort Dst IP DPort Pr slot sub spt dpt Flow flg
-------- -------------- ----- -------------- ----- -- -------- ------- --------
83d4cb60 172.29.148.168 81 172.19.28.165 2015 6 2 1 1 1 00000099
83e31160 172.29.148.168 81 172.26.54.87 1963 6 2 1 1 1 00000099
83a2f3a0 172.29.148.171 389 172.29.148.170 16034 6 2 1 1 1 00000119
--Cancelled---
css01-23(debug)# flow-agent show fcb_details 0x8394a140
css01-23(debug)#
Fcb Details for FCB: 0x8394A140
SRC: 172.29.148.171-389 NAT: 172.29.149.146-389
DST: 172.29.148.170-15970 NAT: 172.29.97.219-14786
DMAC: 00-01-f4-16-e5-e6 SMAC: 00-0b-fd-be-c6-7d
IP Hdr ChkD: 12776 TCP/UDP Hdr ChkD: 13960
TCP SequenceD: 0 Task CE: 0
BytesIn: 246 Frames In: 4
Dest VLAN: 101 Src/Dst Ports: 0/0
Slot/SubSlot: 2/1 SmbQ/PrcSwP: 32/1
Time Stamp / Time Out Info:
CurSecs: 314997:428, started: 150399:756 last activity: 150399
May timeout due to inactivity: No , inactiveTimeout: 0
FCB Flags: 0x0119
0x0001 - Natting In Use
0x0000 - NOT L5 Aware
0x0000 - Non-Spoofed
0x0008 - IP/TCP Flow
0x0010 - Remote - Egress port
0x0100 - In LL List
0x0000 - Server-side
FCB FlaFlags: 0x8040
0x0040 - Is a static FCB
0x8000 - Handled an ACK
how could I interprete the following line of the Time Stamps ?
Time Stamp / Time Out Info:
CurSecs: 315164:145, started: 150399:756 last activity: 150399
my goal is to find a parameter to see how long the session is inactive !
regards
sascha
03-22-2004 06:37 AM
ok.
From the code.
CurSecs: 315164:145 means 315164sec and 145 msec.
Last activity means the time when a packet was seen last time in sec.
The time is a value in seconds since boot.
So you should do CurSecs - last activity to have the
idle time.
Gilles.
03-23-2004 01:13 AM
that looks fine.
thanks
sascha
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide