Average Traffic of FMC to FTD communications - port 8305

[Travis-Fleming]

Hey, just curious what others show as an average amount of data passed over port 8305 (appliance communications) between their FMC and average FTD in the field in an hour? Is this traffic mostly event logs when no deployments are in progress going from the FTD to the FMC?

We are finding our remote locations roughly have an average of 820 MB of data shown with our SolarWinds netflow data to traverse from a single FTD to our FMC in an hour. To me, that seems high? It's as if we have another staff member their browsing the internet all day long.

If there is a way to reduce that number we would be curious to those suggestions as well. We disabled inline inspection and thought maybe having half the events would reduce the number, but it did not.

[Marvin Rhoads]

I haven't measured it myself but remember FMC will also be pushing the Security Intelligence feed updates it is receiving from Cisco to the managed devices so that they have a current set of IP addresses and URLs for that feature.

[Travis-Fleming]

So you're not surprised by the 820MB average traffic in an hour and that's normal for fmc to ftd traffic you think? Between event logs, security intelligence feeds, etc being transferred (not configuration deployments).

[Marvin Rhoads · Accepted solution]

The updates can add up. Below is a listing from my lab FTDv showing the files for the various SI feeds. Add up all the sizes for the most recent ones (dated 3 February) and you get 643 MB. By default they update every 2 hours but it can be set lower (like every 20 minutes). That's not including any event logs.

admin@ftdv-2:/var/sf/iprep_download$ ls -al | grep Feb
drwxr-xr-x  5 www  www     4096 Feb  5 02:47 .
drwxr-xr-x 70 root root    4096 Feb  1 18:03 ..
-rw-r--r--  1 root root       0 Feb  1 18:02 .zones
-rw-r--r--  1 root root  154573 Feb  3 17:00 032ba433-c295-11e4-a919-d4ae5275a468
-rw-r--r--  1 root root      37 Feb  3 17:00 1b117672-7453-478c-be31-b72e89ca1acb
-rw-r--r--  1 root root   92827 Feb  3 17:00 23f2a124-8278-4c03-8c9d-d28fe08b5e98
-rw-r--r--  1 root root   92827 Feb  3 17:03 23f2a124-8278-4c03-8c9d-d28fe08b5e98.blf
-rw-r--r--  1 root root      50 Feb  3 17:00 2CCDA18E-DDFF-4F5C-AF9A-F009852183F4
-rw-r--r--  1 root root   15963 Feb  3 17:00 2b15cb6f-a3fc-4e0e-a342-ccc5e5803263
-rw-r--r--  1 root root   15963 Feb  3 12:02 2b15cb6f-a3fc-4e0e-a342-ccc5e5803263.blf
-rw-r--r--  1 root root      37 Feb  3 17:00 30f9e69c-d64c-479c-821d-0e4edab8217a
-rw-r--r--  1 root root      31 Feb  3 17:00 3e2af68e-5fc8-4b1c-b5bc-b4e7cab598ba
-rw-r--r--  1 root root  122502 Feb  3 17:00 5a0b6d6b-e2c3-436f-b4a1-48248b330a26
-rw-r--r--  1 root root  122502 Feb  3 17:03 5a0b6d6b-e2c3-436f-b4a1-48248b330a26.blf
-rw-r--r--  1 root root      32 Feb  3 17:00 5f8148f1-e5e4-427a-aa3b-ee1c2745c350
-rw-r--r--  1 root root     361 Feb  3 17:00 60f4e2ab-d96c-44a0-bd38-830252b63f46
-rw-r--r--  1 root root     361 Feb  3 16:03 60f4e2ab-d96c-44a0-bd38-830252b63f46.blf
-rw-r--r--  1 root root      31 Feb  3 17:00 6ba968f4-7a25-4793-a2c8-7cc77f1ff437
-rw-r--r--  1 root root      37 Feb  3 17:00 A27C6AAE-8E52-4174-A81A-47C59FECC092
-rw-r--r--  1 root root      17 Feb  3 17:03 IPRVersion.dat
-rw-r--r--  1 root root 2561431 Feb  3 17:00 Sourcefire_Intelligence_Feed
-rw-r--r--  1 root root   16013 Feb  3 17:00 abdc925f-4f85-4504-90a7-c891979ac517
-rw-r--r--  1 root root      30 Feb  3 17:00 b1df3aa8-2841-4c88-8e64-bfaacec7fedd
-rw-r--r--  1 root root    1594 Feb  3 17:00 d7d996a6-6b92-4a56-8f10-e8506e431ca5
-rw-r--r--  1 root root    1594 Feb  3 12:02 d7d996a6-6b92-4a56-8f10-e8506e431ca5.blf
drwxr-xr-x  2 www  www     4096 Feb  3 17:03 peers
-rw-r--r--  1 root root    4847 Feb  3 17:00 rep_dd.yaml
drwxr-xr-x  2 www  www     4096 Feb  5 02:10 tmp
-rw-r--r--  1 root root      38 Feb  1 18:02 zone.info
admin@ftdv-2:/var/sf/iprep_download$ cd ..
admin@ftdv-2:/var/sf$ cd sidns_download/
admin@ftdv-2:/var/sf/sidns_download$ ls -al | grep Feb
drwxrwxr-x  5 www  detection      4096 Feb  3 17:00 .
drwxr-xr-x 70 root root           4096 Feb  1 18:03 ..
-rw-r--r--  1 root root         760310 Feb  3 17:00 032ba433-c295-11e4-a919-d4ae5275b77b
-rw-r--r--  1 root root         760310 Feb  2 17:01 032ba433-c295-11e4-a919-d4ae5275b77b.lf
-rw-r--r--  1 root root             53 Feb  3 17:00 1b117672-7453-478c-be31-b72e89ca2dde
-rw-r--r--  1 root root        1445613 Feb  3 17:00 23f2a124-8278-4c03-8c9d-d28fe08b71ab
-rw-r--r--  1 root root        1445613 Feb  3 05:02 23f2a124-8278-4c03-8c9d-d28fe08b71ab.lf
-rw-r--r--  1 root root           4135 Feb  3 17:00 2CCDA18E-DDFF-4F5C-AF9A-F00985219707
-rw-r--r--  1 root root             56 Feb  3 17:00 2b15cb6f-a3fc-4e0e-a342-ccc5e5804576
-rw-r--r--  1 root root             53 Feb  3 17:00 30f9e69c-d64c-479c-821d-0e4edab8348d
-rw-r--r--  1 root root             86 Feb  3 17:00 3e2af68e-5fc8-4b1c-b5bc-b4e7cab5abcd
-rw-r--r--  1 root root            136 Feb  3 17:00 5a0b6d6b-e2c3-436f-b4a1-48248b331d39
-rw-r--r--  1 root root             48 Feb  3 17:00 5f8148f1-e5e4-427a-aa3b-ee1c2745d663
-rw-r--r--  1 root root        7403473 Feb  3 17:00 60f4e2ab-d96c-44a0-bd38-830252b65259
-rw-r--r--  1 root root        7403473 Feb  2 17:01 60f4e2ab-d96c-44a0-bd38-830252b65259.lf
-rw-r--r--  1 root root             77 Feb  1 18:02 663da2e4-32f4-44d2-ad1f-8d6182720d32.lf
-rw-r--r--  1 root root            135 Feb  3 17:00 6ba968f4-7a25-4793-a2c8-7cc77f1f1074
-rw-r--r--  1 root root             53 Feb  3 17:00 A27C6AAE-8E52-4174-A81A-47C59FECd3a5
-rw-r--r--  1 root root      425345566 Feb  3 05:00 Cisco_DNS_Intelligence_Feed
-rw-r--r--  1 root root             17 Feb  3 05:02 IPRVersion.dat
-rw-r--r--  1 root root        1026920 Feb  3 17:00 abdc925f-4f85-4504-90a7-c891979ad82a
-rw-r--r--  1 root root        1026920 Feb  2 17:01 abdc925f-4f85-4504-90a7-c891979ad82a.lf
-rw-r--r--  1 root root       19958235 Feb  3 17:00 b1df3aa8-2841-4c88-8e64-bfaacec7111f
-rw-r--r--  1 root root       19958235 Feb  2 17:01 b1df3aa8-2841-4c88-8e64-bfaacec7111f.lf
-rw-r--r--  1 root root        3354900 Feb  3 17:00 d7d996a6-6b92-4a56-8f10-e8506e432fb8
-rw-r--r--  1 root root        3354900 Feb  3 05:02 d7d996a6-6b92-4a56-8f10-e8506e432fb8.lf
-rw-r--r--  1 root root             74 Feb  1 18:02 ded9848d-3580-4ca1-9d3c-04113549f129.lf
-rw-rw-r--  1 root root           1921 Feb  3 05:02 dm_dns1.acl
-rw-r--r--  1 root root            884 Feb  1 18:02 dns.rules
drwxr-xr-x  2 www  www            4096 Feb  3 05:02 peers
-rw-r--r--  1 root root           4847 Feb  3 05:00 rep_dd.yaml
drwxr-xr-x  2 www  www            4096 Feb  5 02:10 tmp
admin@ftdv-2:/var/sf/sidns_download$ cd ..
admin@ftdv-2:/var/sf$ cd siurl_download/
admin@ftdv-2:/var/sf/siurl_download$ ls -al | grep Feb
drwxrwxr-x  6 www  detection     4096 Feb  3 17:00 .
drwxr-xr-x 70 root root          4096 Feb  1 18:03 ..
-rw-r--r--  1 root root             1 Feb  1 18:02 .zones
-rw-r--r--  1 root root        953475 Feb  3 17:00 032ba433-c295-11e4-a919-d4ae5275d599
-rw-r--r--  1 root root        953475 Feb  2 17:01 032ba433-c295-11e4-a919-d4ae5275d599.lf
-rw-r--r--  1 root root            53 Feb  3 17:00 1b117672-7453-478c-be31-b72e89ca4bfc
-rw-r--r--  1 root root      66297568 Feb  3 17:00 23f2a124-8278-4c03-8c9d-d28fe08b8fc9
-rw-r--r--  1 root root      66297568 Feb  3 05:02 23f2a124-8278-4c03-8c9d-d28fe08b8fc9.lf
-rw-r--r--  1 root root          4830 Feb  3 17:00 2CCDA18E-DDFF-4F5C-AF9A-F0098521b525
-rw-r--r--  1 root root         16175 Feb  3 17:00 2b15cb6f-a3fc-4e0e-a342-ccc5e5806394
-rw-r--r--  1 root root         16175 Feb  2 17:01 2b15cb6f-a3fc-4e0e-a342-ccc5e5806394.lf
-rw-r--r--  1 root root            53 Feb  3 17:00 30f9e69c-d64c-479c-821d-0e4edab852ab
-rw-r--r--  1 root root           217 Feb  3 17:00 3e2af68e-5fc8-4b1c-b5bc-b4e7cab5c9eb
-rw-r--r--  1 root root        120342 Feb  3 17:00 5a0b6d6b-e2c3-436f-b4a1-48248b333b57
-rw-r--r--  1 root root        120342 Feb  3 05:02 5a0b6d6b-e2c3-436f-b4a1-48248b333b57.lf
-rw-r--r--  1 root root            48 Feb  3 17:00 5f8148f1-e5e4-427a-aa3b-ee1c2745f481
-rw-r--r--  1 root root       7425206 Feb  3 17:00 60f4e2ab-d96c-44a0-bd38-830252b67077
-rw-r--r--  1 root root       7425206 Feb  3 05:02 60f4e2ab-d96c-44a0-bd38-830252b67077.lf
-rw-r--r--  1 root root           135 Feb  3 17:00 6ba968f4-7a25-4793-a2c8-7cc77f1f1256
-rw-r--r--  1 root root           102 Feb  3 17:00 A27C6AAE-8E52-4174-A81A-47C59FECf1c3
-rw-r--r--  1 root root            17 Feb  3 05:02 IPRVersion.dat
-rw-r--r--  1 root root       1047387 Feb  3 17:00 abdc925f-4f85-4504-90a7-c891979af648
-rw-r--r--  1 root root       1047387 Feb  2 17:01 abdc925f-4f85-4504-90a7-c891979af648.lf
-rw-r--r--  1 root root      19958235 Feb  3 17:00 b1df3aa8-2841-4c88-8e64-bfaacec71300
-rw-r--r--  1 root root      19958235 Feb  2 17:01 b1df3aa8-2841-4c88-8e64-bfaacec71300.lf
-rw-r--r--  1 root root       3359631 Feb  3 17:00 d7d996a6-6b92-4a56-8f10-e8506e434dd6
-rw-r--r--  1 root root       3359631 Feb  3 05:02 d7d996a6-6b92-4a56-8f10-e8506e434dd6.lf
-rw-rw-r--  1 root root          1825 Feb  3 05:02 dm_url1.acl
drwxr-xr-x  2 www  www           4096 Feb  3 05:02 peers
-rw-rw-r--  1 root root            38 Feb  1 18:02 url.rules
admin@ftdv-2:/var/sf/siurl_download$

[Travis-Fleming]

Thank that helps. Looking at a solarwinds report I can see in the last 24 hours, 143.5 GB of traffic on our network was due to FMC port 8305 traffic to our 8 FTD locations. We are adding two more in the next month.