Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

S191(and 192) causes dropped packets on 5.0.4

I have a 4215, running 5.0.4-S149. In an attempt to update it to S191 (and then later S192) I noticed that packets start getting dropped, inbound and outbound, while running at that signature level. Connectionless protocols seem to work ok. However connection oriented protocols (ssh, smtp) see dropped connections after about 10 seconds or so.

The sensor sits inline between my Checkpoint firewall and 2611XM router. There is no assymetric routing going on. I don't see any new signatures getting fired off in the event viewer, however I do see an increase in 1300 and 3109.

After reading the false positive statement from cs-mars on sig 3109, it states:

"This signature may cause false positive alarms if the sensor misses certain packets in a SMTP session. This may be caused by the sensor dropping packets due to performance reasons or asymetric routing patterns in the network being monitored."

I think the sensor isn't able to keep up with the traffic when I update to that signature level. I did notice that the memory utilization went from the 48% it normally sits at to around 75-80% when at S192.

Any ideas? Does anyone know how to see if the IDS is dropping packets?

1 REPLY
New Member

Re: S191(and 192) causes dropped packets on 5.0.4

To check for dropped packets you can use the statistics with command:

show statistics virtual-sensor

With regards to the memory consumption I would encourage you to open a tac case to further troubleshoot this.

-jonathan

118
Views
0
Helpful
1
Replies