Thankds Robert,
As a followup, the virtual sensor doesn't show any traffic as being dropped but the analysis engine does. Does that mean traffic is getting dropped or just not inspected?
Here is the output I'm seeing:
# show stat virtual-sensor
Virtual Sensor Statistics
Statistics for Virtual Sensor vs0
Name of current Signature-Defintion instance = sig0
Name of current Event-Action-Rules instance = rules0
List of interfaces monitored by this virtual sensor = GigabitEthernet0/0 subinterface 1,GigabitEthernet0/0 subinterface 2,GigabitEthernet0/1 subinterface 1,GigabitEthernet0/1 subinterface 2
General Statistics for this Virtual Sensor
Number of seconds since a reset of the statistics = 461178
MemoryAlloPercent = 26
MemoryUsedPercent = 26
MemoryMaxCapacity = 1350000
MemoryMaxHighUsed = 423936
MemoryCurrentAllo = 361524
MemoryCurrentUsed = 357402
Inspection Load Percentage = 0
Total packets processed since reset = 8717680
Total IP packets processed since reset = 7569923
Total IPv4 packets processed since reset = 7569923
Total IPv6 packets processed since reset = 0
Total IPv6 AH packets processed since reset = 0
Total IPv6 ESP packets processed since reset = 0
Total IPv6 Fragment packets processed since reset = 0
Total IPv6 Routing Header packets processed since reset = 0
Total IPv6 ICMP packets processed since reset = 0
Total packets that were not IP processed since reset = 1147757
Total TCP packets processed since reset = 4938204
Total UDP packets processed since reset = 2611735
Total ICMP packets processed since reset = 19984
Total packets that were not TCP, UDP, or ICMP processed since reset = 0
Total ARP packets processed since reset = 68589
Total ISL encapsulated packets processed since reset = 0
Total 802.1q encapsulated packets processed since reset = 8717680
Total GRE Packets processed since reset = 0
Total GRE Fragment Packets processed since reset = 0
Total GRE Packets skipped since reset = 0
Total packets with bad IP checksums processed since reset = 0
Total packets with bad layer 4 checksums processed since reset = 72
Total number of bytes processed since reset = 2337873147
The rate of packets per second since reset = 18
The rate of bytes per second since reset = 5069
The average bytes per packet since reset = 268
Denied Address Information
Number of Active Denied Attackers = 0
Number of Denied Attackers Inserted = 0
Number of Denied Attacker Victim Pairs Inserted = 0
Number of Denied Attacker Service Pairs Inserted = 0
Number of Denied Attackers Total Hits = 0
Number of times max-denied-attackers limited creation of new entry = 0
Number of exec Clear commands during uptime = 0
Denied Attackers and hit count for each.
Denied Attackers with percent denied and hit count for each.
The Signature Database Statistics.
The Number of each type of node active in the system
Total nodes active = 53
TCP nodes keyed on both IP addresses and both ports = 6
UDP nodes keyed on both IP addresses and both ports = 4
IP nodes keyed on both IP addresses = 7
The number of each type of node inserted since reset
Total nodes inserted = 204068
TCP nodes keyed on both IP addresses and both ports = 4542
UDP nodes keyed on both IP addresses and both ports = 52903
IP nodes keyed on both IP addresses = 38632
The rate of nodes per second for each time since reset
Nodes per second = 0
TCP nodes keyed on both IP addresses and both ports per second = 0
UDP nodes keyed on both IP addresses and both ports per second = 0
IP nodes keyed on both IP addresses per second = 0
The number of root nodes forced to expire because of memory constraints
TCP nodes keyed on both IP addresses and both ports = 23
Packets dropped because they would exceed Database insertion rate limits = 0
Fragment Reassembly Unit Statistics for this Virtual Sensor
Number of fragments currently in FRU = 0
Number of datagrams currently in FRU = 0
Number of fragments received since reset = 144
Number of fragments forwarded since reset = 144
Number of fragments dropped since last reset = 0
Number of fragments modified since last reset = 0
Number of complete datagrams reassembled since last reset = 72
Fragments hitting too many fragments condition since last reset = 0
Number of overlapping fragments since last reset = 0
Number of Datagrams too big since last reset = 0
Number of overwriting fragments since last reset = 0
Number of Inital fragment missing since last reset = 0
Fragments hitting the max partial dgrams limit since last reset = 0
Fragments too small since last reset = 0
Too many fragments per dgram limit since last reset = 0
Number of datagram reassembly timeout since last reset = 0
Too many fragments claiming to be the last since last reset = 0
Fragments with bad fragment flags since last reset = 0
TCP Normalizer stage statistics
Packets Input = 4938202
Packets Modified = 0
Dropped packets from queue = 0
Dropped packets due to deny-connection = 0
Duplicate Packets = 0
Current Streams = 6
Current Streams Closed = 0
Current Streams Closing = 0
Current Streams Embryonic = 0
Current Streams Established = 0
Current Streams Denied = 0
Total SendAck Limited Packets = 0
Total SendAck Limited Streams = 0
Total SendAck Packets Sent = 0
Statistics for the TCP Stream Reassembly Unit
Current Statistics for the TCP Stream Reassembly Unit
TCP streams currently in the embryonic state = 0
TCP streams currently in the established state = 0
TCP streams currently in the closing state = 0
TCP streams currently in the system = 0
TCP Packets currently queued for reassembly = 0
Cumulative Statistics for the TCP Stream Reassembly Unit since reset
TCP streams that have been tracked since last reset = 0
TCP streams that had a gap in the sequence jumped = 0
TCP streams that was abandoned due to a gap in the sequence = 0
TCP packets that arrived out of sequence order for their stream = 0
TCP packets that arrived out of state order for their stream = 0
The rate of TCP connections tracked per second since reset = 0
SigEvent Preliminary Stage Statistics
Number of Alerts received = 518
Number of Alerts Consumed by AlertInterval = 518
Number of Alerts Consumed by Event Count = 0
Number of FireOnce First Alerts = 0
Number of FireOnce Intermediate Alerts = 0
Number of Summary First Alerts = 0
Number of Summary Intermediate Alerts = 0
Number of Regular Summary Final Alerts = 0
Number of Global Summary Final Alerts = 0
Number of Active SigEventDataNodes = 0
Number of Alerts Output for further processing = 0
Per-Signature SigEvent count since reset
Sig 3653.0 = 518
SigEvent Action Override Stage Statistics
Number of Alerts received to Action Override Processor = 0
Number Of Meta Components Input = 0
Number of Alerts where an override was applied = 0
Actions Added
deny-attacker-inline = 0
deny-attacker-victim-pair-inline = 0
deny-attacker-service-pair-inline = 0
deny-connection-inline = 0
deny-packet-inline = 0
modify-packet-inline = 0
log-attacker-packets = 0
log-pair-packets = 0
log-victim-packets = 0
produce-alert = 0
produce-verbose-alert = 0
request-block-connection = 0
request-block-host = 0
request-snmp-trap = 0
reset-tcp-connection = 0
request-rate-limit = 0
SigEvent Action Filter Stage Statistics
Number of Alerts received to Action Filter Processor = 0
Number of Alerts where an action was filtered = 0
Number of Filter Line matches = 0
Number of Filter Line matches causing decreased DenyPercentage = 0
Actions Filtered
deny-attacker-inline = 0
deny-attacker-victim-pair-inline = 0
deny-attacker-service-pair-inline = 0
deny-connection-inline = 0
deny-packet-inline = 0
modify-packet-inline = 0
log-attacker-packets = 0
log-pair-packets = 0
log-victim-packets = 0
produce-alert = 0
produce-verbose-alert = 0
request-block-connection = 0
request-block-host = 0
request-snmp-trap = 0
reset-tcp-connection = 0
request-rate-limit = 0
Filter Hit Counts
SigEvent Action Handling Stage Statistics.
Number of Alerts received to Action Handling Processor = 0
Number of Alerts where produceAlert was forced = 0
Number of Alerts where produceAlert was off = 0
Number of Alerts using Auto One Way Reset = 0
Actions Performed
deny-attacker-inline = 0
deny-attacker-victim-pair-inline = 0
deny-attacker-service-pair-inline = 0
deny-connection-inline = 0
deny-packet-inline = 0
modify-packet-inline = 0
log-attacker-packets = 0
log-pair-packets = 0
log-victim-packets = 0
produce-alert = 0
produce-verbose-alert = 0
request-block-connection = 0
request-block-host = 0
request-snmp-trap = 0
reset-tcp-connection = 0
request-rate-limit = 0
Deny Actions Requested in Promiscuous Mode
deny-packet not performed = 0
deny-connection not performed = 0
deny-attacker not performed = 0
deny-attacker-victim-pair not performed = 0
deny-attacker-service-pair not performed = 0
modify-packet not performed = 0
Number of Alerts where deny-connection was forced for deny-packet action = 0
Number of Alerts where deny-packet was forced for non-TCP deny-connection action = 0
Anomaly Detection Statistics
Number of Received Packets:
TCP = 4938202
UDP = 2611591
Other = 19984
TOTAL = 7569777
Number of Overrun Packets:
TCP = 0
UDP = 0
Other = 0
TOTAL = 0
Number of Ignored Packets = 0
Number of Events = 28822
Number of Recurrent Events:
TCP = 2
UDP = 60078
Other = 0
TOTAL = 60080
Number of Worms = 0
Number of Scanners = 0
Number of Scanners Under Worm = 0
Internal Zone
Number of Events:
TCP = 0
UDP = 0
Other = 0
TOTAL = 0
Number of Overrun Events:
TCP = 0
UDP = 0
Other = 0
TOTAL = 0
External Zone
Number of Events:
TCP = 1
UDP = 28405
Other = 4
TOTAL = 28410
Number of Overrun Events:
TCP = 0
UDP = 0
Other = 0
TOTAL = 0
Illegal Zone
Number of Events:
TCP = 0
UDP = 412
Other = 0
TOTAL = 0
Number of Overrun Events:
TCP = 0
UDP = 0
Other = 0
TOTAL = 0
Global Utilization Percentage
Unestablished Connections DB
TCP = 0
UDP = 0
Other = 0
Recurrent Events DB
TCP = 0
UDP = 0
Other = 0
Scanners DB
TCP = 0
UDP = 0
Other = 0
# show stat analysis-engine
Analysis Engine Statistics
Number of seconds since service started = 461274
The rate of TCP connections tracked per second = 0
The rate of packets per second = 18
The rate of bytes per second = 5070
Receiver Statistics
Total number of packets processed since reset = 8720201
Total number of IP packets processed since reset = 7572202
Transmitter Statistics
Total number of packets transmitted = 8720129
Total number of packets denied = 92114
Total number of packets reset = 0
Fragment Reassembly Unit Statistics
Number of fragments currently in FRU = 0
Number of datagrams currently in FRU = 0
TCP Stream Reassembly Unit Statistics
TCP streams currently in the embryonic state = 0
TCP streams currently in the established state = 0
TCP streams currently in the closing state = 0
TCP streams currently in the system = 0
TCP Packets currently queued for reassembly = 0
The Signature Database Statistics.
Total nodes active = 54
TCP nodes keyed on both IP addresses and both ports = 6
UDP nodes keyed on both IP addresses and both ports = 4
IP nodes keyed on both IP addresses = 8
Statistics for Signature Events
Number of SigEvents since reset = 518
Statistics for Actions executed on a SigEvent
Number of Alerts written to the IdsEventStore = 0
Inspection Stats
Inspector active call create delete createPct callPct loadPct
AtomicAdvanced 1 7572058 1 0 0 86 70
Fixed 0 64858 59108 59108 0 0 0
MSRPC_TCP 0 13186 4534 4534 0 0 0
MultiString 5 227151 2470 2465 0 2 15
ServiceDnsUdp 1 2612529 1 0 0 29 0
ServiceGeneric 1 2617063 4535 4534 0 30 1
ServiceNtp 8 5225058 106250 106242 1 59 0
ServiceP2PTCP 0 7623 4534 4534 0 0 0
ServiceRpcUDP 1 2612529 1 0 0 29 0
ServiceRpcTCP 6 2058130 1449 1443 0 23 0
ServiceSnmp 1 2612529 1 0 0 29 0
ServiceTNS 0 5983 5983 5983 0 0 0
String 6 336435 3419 3413 0 3 9
SweepICMP 2 19994 2285 2283 0 0 0
SweepTCP 5 9879066 47 42 0 113 0
SweepOtherTcp 2 4939533 22 20 0 56 1
GlobalCorrelationStats
SwVersion = 7.0(8)E4
SigVersion = 664.0
DatabaseRecordCount = 4307585
DatabaseVersion = 1347048367
RuleVersion = 1346963166
ReputationFilterVersion = 1347048700
AlertsWithHit = 0
AlertsWithMiss = 0
AlertsWithModifiedRiskRating = 0
AlertsWithGlobalCorrelationDenyAttacker = 0
AlertsWithGlobalCorrelationDenyPacket = 0
AlertsWithGlobalCorrelationOtherAction = 0
AlertsWithAuditRepDenies = 0
ReputationForcedAlerts = 0
EventStoreInsertTotal = 0
EventStoreInsertWithHit = 0
EventStoreInsertWithMiss = 0
EventStoreDenyFromGlobalCorrelation = 0
EventStoreDenyFromOverride = 0
EventStoreDenyFromOverlap = 0
EventStoreDenyFromOther = 0
ReputationFilterDataSize = 453
ReputationFilterPacketsInput = 7571702
ReputationFilterRuleMatch = 0
DenyFilterHitsNormal = 0
DenyFilterHitsGlobalCorrelation = 0
SimulatedReputationFilterPacketsInput = 0
SimulatedReputationFilterRuleMatch = 0
SimulatedDenyFilterInsert = 0
SimulatedDenyFilterPacketsInput = 0
SimulatedDenyFilterRuleMatch = 0
TcpDeniesDueToGlobalCorrelation = 0
TcpDeniesDueToOverride = 0
TcpDeniesDueToOverlap = 0
TcpDeniesDueToOther = 0
SimulatedTcpDeniesDueToGlobalCorrelation = 0
SimulatedTcpDeniesDueToOverride = 0
SimulatedTcpDeniesDueToOverlap = 0
SimulatedTcpDeniesDueToOther = 0
LateStageDenyDueToGlobalCorrelation = 0
LateStageDenyDueToOverride = 0
LateStageDenyDueToOverlap = 0
LateStageDenyDueToOther = 0
SimulatedLateStageDenyDueToGlobalCorrelation = 0
SimulatedLateStageDenyDueToOverride = 0
SimulatedLateStageDenyDueToOverlap = 0
SimulatedLateStageDenyDueToOther = 0
AlertHistogram
RiskHistogramEarlyStage
RiskHistogramLateStage
ConfigAggressiveMode = 2
ConfigAuditMode = 1
MaliciousSiteDenyHitCounts
MaliciousSiteDenyHitCountsAUDIT
With Robert Albach
