Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

firewall hit counts

what does this "(hitcnt=*)" mean besides any rule in cisco firewall.

Also, i'm facing instances where even if the connection is initiated, i dont see anything coming on the firewall ( be it deny/permit/connection buildup). Routes & other factors are fine.

Please suggest.

Thanks!

1 ACCEPTED SOLUTION

Accepted Solutions
Community Member

firewall hit counts

An asterisk means that the rule has been merged with other rules and thus the hit count cannot be accurate.

Please see

http://www.cisco.com/en/US/docs/security/fwsm/fwsm40/configuration/guide/traffc_f.pdf

5 REPLIES
Cisco Employee

Re: firewall hit counts

Hi,

"hitcnt" shows which ACL entry is hit how many times

Actually these command provides a packet count or hitcounts

This can be used on firewall "show run access-list"

This can be used on IOS devices "show ip access-list"

examples:

access-list acl_inside_out permit tcp any any eq www (hitcnt=3074)

The above access-list tells that its has been hit 3074 times.

access-list acl_inside_out permit tcp any host X.X.X.X eq smtp (hitcnt=0)

The access-list shows no hits against it.

You may go through this link for better understanding.

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

HTH

JK

Pls rate helpful posts-

~Jatin Katyal
Community Member

Re: firewall hit counts

Thanks, my question was what does the * in hitcnt=* means? & about the logging thing.

Cisco Employee

Re: firewall hit counts

The "hit-cnt" is the number of times this flow was permitted or denied by this ACL entry in the configured time interval. The value is 1 when the security appliance generates the first syslog message for this flow.

The syslog is here http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4769049

I hope it makes sense.

PK

Community Member

Re: firewall hit counts

Thanks, am sorry if there is any confusion from my question here.My firewall just shows * symbol on certain rules, whereas other rules it shows hitcnt=0.

what difference does * & 0 indicate here. 0 appears when there is no connection covering this rule.

What is the case if only * appears?

Community Member

firewall hit counts

An asterisk means that the rule has been merged with other rules and thus the hit count cannot be accurate.

Please see

http://www.cisco.com/en/US/docs/security/fwsm/fwsm40/configuration/guide/traffc_f.pdf

4248
Views
6
Helpful
5
Replies
CreatePlease to create content