Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CSS11501 FCBs exhausted?

Hi Friend,

I am facing UDP flows problem.

When I enable flow-enable for DNS server use command "flow-state 53 udp flow-enable", after 2-3 hours the DNS service was not work well.Can not resolve some record from DNS server intermittently.

CSS11501(debug)# flow statistics

Flow Manager Statistics - Slot 1, Subslot 1:

Cur High Avg

UDP Flows per second 2 69 4

TCP Flows per second 15 218 12

Total Flows per second 17 218 17

Hits per second 8 155 5

Number of Allocated Flows (non-purged) 54755

Number of Free Flows 10781

Number of Allocated fast-path FCBs 54755

Number of Free fast-path FCBs 76317

Number of Flow Drops 0

Max Number of Flow Control Blocks 537165

Accumulated Port Flow Statistics:

Current Number of Active Flows 54821

Total Flow Accounting Reports received 224156652

Total Out of Sequence Packet Received 0

Total Spoof Queue Mis-Hits 0

FM TCP Flows Timed Out 91

FM UDP Flows Timed Out 391

FP TCP Flows Timed Out 271490

FP UDP Flows Timed Out 1428226

Port CE Active Total Acct TCP UDP

-------------------------------------------------------------------------

#e1 200088 181 95050270 95079876 177 5

#e8 2000cf 2 16 14 2 0

#e5 20010c 54390 127820300 127771568 340 54050

#e2 200149 0 0 0 0 0

#e3 20018a 248 1286582 1305194 208 40

Aggregate Flow Manager Statistics:

Cur High Avg

UDP Flows per second 2 69 4

TCP Flows per second 15 218 12

Total Flows per second 17 218 17

“flow active-list” print out the active flows are 56k.

Total active flows are 55954

How many flows can CSS11501 support, is 64K? For the “flow statistics” out put how may resource remain?

When I use show flows 0.0.0.0 can not display all flows, is there any other command can show all output?

Capture packet found CSS send out ICMP port unreachable, only pick up abnormal packet.

DNS client 10.10.3.109-----CSS VIP 218.x.x.245-----DNS server 201.x.x.110

The DNS flow is:

1. DNS server 10.10.3.109 (act as DNS client) query "hotmail.co.uk" //Capture on 10.10.3.109

405 15:57:17.872454 10.10.3.109 42497 201.x.x.110 53 DNS Standard query A hotmail.co.uk 73

2. DNS server 201.x.x.110 receive query. Source port MAPed from 42497 to 62351 by CSS.//Capture on 201.x.x.110.

368 15:57:17.872005 218.x.x.245 62351 201.x.x.110 53 DNS Standard query A hotmail.co.uk 73

3. DNS server 201.x.x.110 response "no such name"

369 15:57:17.872215 201.x.x.110 53 218.x.x.245 62351 DNS Standard query response, No such name 137

4. CSS response ICMP port unreachable.?

370 15:57:17.905217 218.x.x.245 53 201.x.x.110 62351 ICMP Destination unreachable (Port unreachable) 126

5. CSS forward response to DNS server 10.10.3.109, don't map the port from 62351 to 42497?

406 15:57:17.905258 201.x.x.110 53 10.10.3.109 62351 DNS Standard query response, No such name 137

6. DNS server reply ICMP Port unreachable.

407 15:57:17.905315 10.10.3.109 53 201.x.x.110 62351 ICMP Destination unreachable (Port unreachable) 126

Did the CSS clear the flow, or not availabe flows cause this port mismatch?

This flows seem not exceed default idle time, I don't know why reclaimed.

Best wishes,

Thanks

Jeffery

6 REPLIES
Cisco Employee

Re: CSS11501 FCBs exhausted?

You have 54755 active flows.

Number of Allocated fast-path FCBs 54755

And no flow drops, so you haven't reach the FCB limit which is :

Max Number of Flow Control Blocks 537165

Gilles.

New Member

Re: CSS11501 FCBs exhausted?

Gilles,

I am very glad you reply.

Is there any way I can show all active flows?

Using show flows 0.0.0.0 only show 200 prefixes. I want to check the flows during CSS response ICMP Port unreachable.

Do you have idea about CSS response ICMP port unreachable?

Thanks.

Jeffrey

New Member

Re: CSS11501 FCBs exhausted?

Hi,

One more question, I diable the flows for UDP 53, but the flows still exist. How can I clear flows? Like the command clear xlate on pix.

Flow Manager Statistics - Slot 1, Subslot 1:

Cur High Avg

UDP Flows per second 0 69 0

TCP Flows per second 15 218 8

Total Flows per second 15 218 9

Hits per second 6 155 3

Number of Allocated Flows (non-purged) 55790

Number of Free Flows 9746

Number of Allocated fast-path FCBs 55790

Number of Free fast-path FCBs 75282

Number of Flow Drops 0

Max Number of Flow Control Blocks 537165

Accumulated Port Flow Statistics:

Current Number of Active Flows 55856

Total Flow Accounting Reports received 224931418

Total Out of Sequence Packet Received 0

Total Spoof Queue Mis-Hits 0

FM TCP Flows Timed Out 91

FM UDP Flows Timed Out 391

FP TCP Flows Timed Out 272679

FP UDP Flows Timed Out 1443575

Thanks

Jeffrey

Re: CSS11501 FCBs exhausted?

HI Jeffery,

You can clear ICMP, TCP, and UDP connections by using the clear conn command in Exec mode. The syntax of this command is as follows:

clear conn [all | flow {icmp | tcp | udp} | rserver]

The keywords are as follows:

•all-(Optional) Clears all connections to and through the ACE in the current context.

•flow {icmp | tcp | udp}-(Optional) Clears all connections of the specified flow type: ICMP, TCP, or UDP.

•rserver-(Optional) Clears all connections for the specified real server.

For example, to clear all TCP connections in the current context, enter:

host1/C1# clear conn flow tcp

-------

You can clear IP statistics by using the clear ip statistics command in Exec mode. This command clears all statistics associated with IP normalization, fragmentation, and reassembly in the current context. The syntax of this command is as follows:

clear ip statistics

For example, to clear IP statistics in the current context, enter:

host1/C1# clear ip statistics

----

If you configured redundancy, you need to explicitly clear IP, TCP,UDP statistics on both the active and the standby ACEs. Clearing statistics on the active appliance alone will leave the standby appliance's statistics at the old values.

----

You can clear TCP statistics by using the clear tcp statistics command in Exec mode. This command clears all statistics associated with TCP connections and normalization in the current context. The syntax of this command is as follows:

clear tcp statistics

For example, to clear TCP statistics in the current context, enter:

host1/C1# clear tcp statistics

---

You can clear UDP statistics by using the clear udp statistics command in Exec mode. This command clears all statistics associated with UDP connections in the current context. The syntax of this command is as follows:

clear udp statistics

For example, to clear UDP statistics in the current context, enter:

host1/C1# clear udp statistics

---

You can clear IP fragmentation and reassembly statistics by using the clear interface command in Exec mode. The syntax of this command is as follows:

clear interface [vlan vlan_id]

For the optional vlan_id argument, enter the unique identifier of an existing interface as an integer from 2 to 4094. If you omit the vlan keyword and vlan_id argument, you can clear fragmentation and reassembly statistics for all interfaces in the context.

For example, to clear IP fragmentation and reassembly statistics for all interfaces in the C1 context, enter:

host1/C1# clear interface

---

You can clear all connection statistics in the current context by using the clear stats conn command in Exec mode. The syntax of this command is as follows:

clear stats conn

For example, to clear all connection statistics in the Admin context, enter:

host1/Admin# clear stats conn

---

Thanks and regards,

Sachin Garg

Senior Specialist Security

HCL Comnet Ltd.

http://www.hclcomnet.co.in

A-10, Sector 3, Noida- 201301

INDIA

Mob: +91-9911757733

Email: sachinga@hcl.in

New Member

Re: CSS11501 FCBs exhausted?

Hi Sachin Garg,

Thanks.^_^

But seem the command don't exist in CSS11501 platform.

CSS11501# clear ?

archive Clear an archive file

arp Clear an ARP table or file

log Clear a log file

running-config Clear the running-config

script Clear a script file

ssl Clear SSL Acceleration data

startup-config Clear the startup configuration

startup-errors Clear the startup configuration errors file

statistics Clear interface statistics

Re: CSS11501 FCBs exhausted?

HI Jeffer,

I am sorry as i have not seen and suggested the commands for the cisco ACE.

you can use

flow active-list

for showing flows.

use following url for know more about flows:

http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_qanda_item09186a00801cb75b.shtml

---

you can use following command but i dont know whether they solve your problem or not:

To clear a service statistics counter for all CSS services associated with a content rule, use the zero command. To clear a service statistics counter for a specific service in the content rule, use the zero command and identify the name of the service. In this case, only the counter for the specified service is set to zero.

The reset statistics appear as 0 in the show service display.

You can issue the following zero commands from content mode:

•zero total-connections - Set the Total Connections counter to zero for all services associated with the specified content rule

•zero total-reused-connections - Set the Total Reused Conns. counter to zero for all services associated with the specified content rule

•zero state-transitions - Set the State Transitions counter to zero for all services associated with the specified content rule

You can issue the following zero commands from content mode:

•zero total-connections service service_name - Set the Total Connections counter to zero for only the specified service associated with the content rule

•zero total-reused-connections service service_name - Set the Total Reused Conns. counter to zero for only the specified service associated with the content rule

•zero state-transitions service service_name - Set the State Transitions counter to zero for only the specified service associated with the content rule

For example, to clear a counter for all services associated with the specified content rule, enter:

(config-owner-content[rule1])# zero total-connections

For example, to clear a counter for a specific service in a content rule, enter:

(config-owner-content[rule1])# zero total-connections service

serv1

---

The counters are per owner and per rule. To clear all counters, issue the zero all command at the config-owner[foo.com])# prompt. To clear counters for a rule, enter into the configuration mode for the rule and then issue the zero all command.

----

337
Views
0
Helpful
6
Replies
CreatePlease login to create content