Negative connection value meaning?

[Machi Ma]

Hello,

Could you please advise what is meaning of negative current connection value when run 'show service-policy'

Like below

----

 Class-map: Incoming
      Set connection policy: per-client-max 2000
        current embryonic conns 1801, current conns -130420, drop 2667854

-----

Thanks in advance.

[Rahul Govindan]

This is most likely a cosmetic issue with the ASA logging the counters incorrectly. There have been some bugs in the past (8.2 versions) where this was seen. I feel you may most likely be hitting the following bug opened for the 9.1 version with no fix in place yet:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCun37690/?reffering_site=dumpcr

[Machi Ma]

Thanks. I also find some related discussion regarding this bug.  However it looks still did not fixed ? as I using 9.6(2) already

[Rahul Govindan]

Yeah, the bug status looks terminated and no releases out with a fix. My guess would be that 9.6 also has the same issue is it has not been fixed before. Since it is cosmetic and rarely seen in customer environments, might take a while before a fix comes out.