sometimes cpu overloaded

[riccardo_romani]

hi all , how can i identify the process that cause pix 515's percent of cpu to increse from a normal 5% to 75% slowing down the connection ?

I have tried with sh cpu usage , sh proc but i cannot look at which process for a 5 minute every hour (more or less) block the firewall.

thks in advance

[sachin]

Check

"show conn" to see if any particular IP is sending traffic continously.

[riccardo_romani]

thks for answer , i already looked at this command but if i have understood well it shows the connection being established or already established but also if there isn't traffic that flood into so i could have for example 100 connection established with few traffic into them without give me the real traffic. what do you think about?

bye

[sachin]

If your PIX Firewall Version is 6.3(3) then perfmon command lets you monitor the PIX Firewall unit’s performance and "show perfmon"which gives you traffic idea like this

PERFMON STATS: Current Average

Xlates 0/s 0/s

Connections 79/s 0/s

TCP Conns 67/s 1/s

UDP Conns 11/s 2/s

URL Access 47/s 1/s

URL Server Req 0/s 0/s

TCP Fixup 1846/s 2/s

TCPIntercept 0/s 0/s

HTTP Fixup 1690/s 0/s

FTP Fixup 0/s 0/s

AAA Authen 0/s 0/s

AAA Author 0/s 0/s

AAA Account 0/s 0/s

and then you can use the "capture" command to capure the specific traffic .

HTH,

Sachin Jain