cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1044
Views
15
Helpful
7
Replies
Beginner

ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 50% or more

The IPS40 is showing missed packets yet the Inspection Load remains at 0.

Two questions.

1. What would cause Missed Packets and is there a "best" method to troubleshot the situation?

2. Why does the Inspection Load remain at 0?

vs0 is currently assigned to PortChannel0/0 (Backplane interface)

Thanks,

Kevin

Everyone's tags (6)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 50% o

Theres a known bug in 7.1.6 that causes this.

CSCud36621

Rebooting the sensor will fix it for a period of time. Fix is scheduled in 7.1.7

Bookmark it, we can blow it up later.

View solution in original post

7 REPLIES 7
Highlighted

ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 50% o

Hello Kevin,

Importan to let you know that for missed packets the IPS count packets being dropped byL2errors and oversupscription.

Based on the load being on 0 I would say it would make sense to think about L2 errors, is there a way you could doble check the layer 2 connectivity between them.

Regards,

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Highlighted
Beginner

ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 50% o

The IPS and Firewall are connected through PortChannel0/0. Not sure how you can check L2 connectivity on a backplane connection. Any ideas?

Highlighted

ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 50% o

Hello Kevin,

What version are you running

Also share the following:

show stat virt

show int

Also over the show tech look the following :

exec: cat /proc/net/cisco/cids-shared.info

And let me know the free buffer percentage you see there

Regards,

Remember to rate all of the helpful posts

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Highlighted
Beginner

Re: ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 5

jcarvaja,

Attached is the information you requested. Let me know if you need anything else. Thanks for your help!

Kevin

Highlighted

Re: ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 5

Hello Kevin,

On the show tech I do not see the missed packet percentage on 50 % or any other value than 0

Can you double check that please

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Highlighted
Beginner

ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 50% o

jcarvaja,

Having just witnessed another indication form the Sensor Health gadget that packets were being missed, I again ran the commands you suggested with a result of 0 missed packets in the output. Is it possible the Sensor Health gadget is reporting false indications?

Thanks,

Kevin

Highlighted
Beginner

ASA5585-SSP-IPS40 Inspection Load 0 with Missed Packets at 50% o

Theres a known bug in 7.1.6 that causes this.

CSCud36621

Rebooting the sensor will fix it for a period of time. Fix is scheduled in 7.1.7

Bookmark it, we can blow it up later.

View solution in original post