Phantom Connections on FWSM

Unanswered Question
Dec 29th, 2009

We have a transparent firewall context on a FWSM (code revision: 3.1(16).

Recently the number of tcp connections has been increasing to a point where it hits the limit defined in the static and new connections are denied. However a "show conn | inc x.x.x.148" doesn't show nearly the number of active connections the "show local-host" command might suggest.

A "clear local-host x.x.x.x" fixes the problem temporarily, but the problem resurfaces later (and on different hosts). Is there any way to see any more detail on these 11000+ connections?

xxx# sh local-host x.x.x.148 all

IPv4 local hosts:

local host: <x.x.x.148>, tcp conn(s)/limit = 11806/20000, embryonic(s)/limit = 4470/50 udp conn(s)/limit = 0/0

    Xlate(s):

        Global x.x.x.148 Local x.x.x.148

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Panos Kampanakis Tue, 12/29/2009 - 09:42

The fact that you have ~12K conns from one host, out of which !5K are embryonic could mean there there might be some infection.

you can use "sh conn np 1, "sh conn np 2" and "sh conn np 3" and pipe for that ip to see if that gives you more info.

I hope it helps.

PK

Actions

This Discussion