I would like to ask you couple of questions regarding WAE optimization.
We are experiencing really high number of auto-discovery flows and as a result also TFO overload alarms on the box. We have also applied new classifier to pass-through particular traffic flows. I've checked the troubleshooting guide and found out following:
Another useful counter is the Current Active Auto-discovery Flows, which displays flows that have not been fully set up to become optimized flows or pass-through flows. To become fully set up, the connection must see the SYN, SYN ACK, ACK handshake, which is useful to note when dealing with an overload condition. The Current Active Pass-Through Flows counter shows connections that the device has determined to be pass-through or where the device did not see the SYN, SYN ACK, ACK setup.
First, I thought that our classifier is wrong but after reading this it looks like that WAE has to see full syn/syn ack/ack handshake to determine if this flow is going to be optimized or pass-throuh. If there is not a full handshake, this connection will act as auto-discovery and WAE does not check it against our classifier. Is my interpretation correct ? Is there any way how can I check if our classifier is matching any traffic flows?