What is my current traffic load ? - Cisco ASA

[secureIT]

This would be a mostly talked question, would like to conclude from a Cisco TAC.

How to calculate the current traffic load Mbps from the traffic logs.

1. clear traffic

2. show traffic

3. Go to Aggregated traffic section

I am sharing a sample output of show traffic's aggregated traffic part. This is what Cisco has given to me.

outside:
received (in 1484667.510 secs):
4077564 packets
618023679 bytes
2 pkts/sec
2 bytes/sec
transmitted (in 1484667.510 secs):
2172356 packets
963769412 bytes
1 pkts/sec
1 bytes/sec
1 minute input rate 0 pkts/sec, 37 bytes/sec ========>
1 minute output rate 0 pkts/sec, 23 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 1 pkts/sec, 81 bytes/sec
5 minute output rate 0 pkts/sec, 21 bytes/sec
5 minute drop rate, 0 pkts/sec
inside:
received (in 1484667.520 secs):
19101880871 packets
12625268422549 bytes
12001 pkts/sec
8503001 bytes/sec
transmitted (in 1484667.520 secs):
16431951396 packets
3435034578949 bytes
11001 pkts/sec
2313001 bytes/sec
1 minute input rate 27439 pkts/sec, 15383961 bytes/sec =======>
1 minute output rate 21300 pkts/sec, 4667382 bytes/sec
1 minute drop rate, 101 pkts/sec
5 minute input rate 25730 pkts/sec, 15314045 bytes/sec
5 minute output rate 21158 pkts/sec, 4500224 bytes/sec
5 minute drop rate, 104 pkts/sec
mpls:
received (in 1484667.530 secs):
15259172003 packets
3214724950823 bytes
10000 pkts/sec
2165002 bytes/sec
transmitted (in 1484667.530 secs):
19009068244 packets
12604682959155 bytes
12002 pkts/sec
8489000 bytes/sec
1 minute input rate 19663 pkts/sec, 4361218 bytes/sec =======>
1 minute output rate 27335 pkts/sec, 15351179 bytes/sec
1 minute drop rate, 116 pkts/sec
5 minute input rate 19480 pkts/sec, 4185393 bytes/sec
5 minute output rate 25620 pkts/sec, 15282139 bytes/sec
5 minute drop rate, 127 pkts/sec
management:
received (in 1484667.570 secs):
0 packets
0 bytes
0 pkts/sec
0 bytes/sec
transmitted (in 1484667.570 secs):
0 packets
0 bytes
0 pkts/sec
0 bytes/sec
1 minute input rate 0 pkts/sec, 0 bytes/sec ======>
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 0 bytes/sec
5 minute output rate 0 pkts/sec, 0 bytes/sec
5 minute drop rate, 0 pkts/sec
failover:
received (in 1484667.580 secs):
2353995 packets
285942762 bytes
1 pkts/sec
1 bytes/sec
transmitted (in 1484667.580 secs):
571847627 packets
663488750456 bytes
0 pkts/sec
446002 bytes/sec
1 minute input rate 1 pkts/sec, 196 bytes/sec ==============>
1 minute output rate 790 pkts/sec, 922326 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 1 pkts/sec, 192 bytes/sec
5 minute output rate 812 pkts/sec, 947639 bytes/sec
5 minute drop rate, 0 pkts/sec

Steps :-

1. Collect output from the command “show traffic” bellow data from the show traffic (pink color highlighted values above)

outside:
...
1 minute input rate 0 pkts/sec, 37 bytes/sec
...
inside:
...
1 minute input rate 27439 pkts/sec, 15383961 bytes/sec
...
mpls:
...
1 minute input rate 19663 pkts/sec, 4361218 bytes/sec
...
management:
...
1 minute input rate 0 pkts/sec, 0 bytes/sec
...
failover:
...
1 minute input rate 1 pkts/sec, 196 bytes/sec

2. Sum up input rate pkts/sec and calculate total number of packets received on ASA box (Blue color highlighted values above)
Total number of packets received on ASA box: 0 + 27439 + 19663 +0 + 1 = 47103

3. Sum up bytes/sec and calculate average packet size:
37 + 15383961 + 4361218 + 0 +196 = 19745412
Average packet size: 19745412/47103 = 419

4. Calculate throughput going to the box (calculation with packet size of 1500)
Throughput going to the box (calculation with packet size of 1500): 47103* 1500 * 8 / 1024 / 1024 = 539 Mb/s

5. Calculate Actual throughput
Actual throughput: 47103*419*8/1024/1024 = 150 Mb/s

Here which value to be noted ????????????

Kindly suggest.

[Pulkit Saxena · Accepted solution]

Hi,

The below document should help in understanding the unit to be used along with the value :

https://supportforums.cisco.com/document/13122441/throughput-calculation-cisco-asa

-

Pulkit

[secureIT]

Hi Pulkit,

Thanks. Today Cisco had a webinar session wherein they said "You will have to add either TX or RX. Just Sum of each  interface ( (bytes/packet)  * 8 ) should give you the current throughput."

So do we need to add or consider either TX or RX.?? Kindly re-confirm on this again and update us.

regards

Rajesh

[Pulkit Saxena · Accepted solution]

Rajesh,

We need to add both and I confirm that, and I hope you agree since it is not possible to have just one.

Since there is a certain possibility that Received might be nothing but transmitted might be a lot, for example sending traffic to syslog server.

Hope this helps.

-

Pulkit

Please rate helpful posts.

[secureIT]

I Agree... I Wonder Why TAC Engr and Webinar Guy said wrong info.

Thanks for the update.