Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

S191(and 192) causes dropped packets on 5.0.4

I have a 4215, running 5.0.4-S149. In an attempt to update it to S191 (and then later S192) I noticed that packets start getting dropped, inbound and outbound, while running at that signature level. Connectionless protocols seem to work ok. However connection oriented protocols (ssh, smtp) see dropped connections after about 10 seconds or so.

The sensor sits inline between my Checkpoint firewall and 2611XM router. There is no assymetric routing going on. I don't see any new signatures getting fired off in the event viewer, however I do see an increase in 1300 and 3109.

After reading the false positive statement from cs-mars on sig 3109, it states:

"This signature may cause false positive alarms if the sensor misses certain packets in a SMTP session. This may be caused by the sensor dropping packets due to performance reasons or asymetric routing patterns in the network being monitored."

I think the sensor isn't able to keep up with the traffic when I update to that signature level. I did notice that the memory utilization went from the 48% it normally sits at to around 75-80% when at S192.

Any ideas? Does anyone know how to see if the IDS is dropping packets?

1 REPLY
Community Member

Re: S191(and 192) causes dropped packets on 5.0.4

To check for dropped packets you can use the statistics with command:

show statistics virtual-sensor

With regards to the memory consumption I would encourage you to open a tac case to further troubleshoot this.

-jonathan

161
Views
0
Helpful
1
Replies
CreatePlease to create content