Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Sensor Statistics ?

Under CSPM-Event viewer,

when you ask the sensor statistics, it returns a window with various counters about ip apckets, tcp packets.... there is also one counter named DLPI drop....

1°) Does anybody can tell me what is this counters ?

2°) How can check if my IDS is dropping packets ???

6 REPLIES
New Member

Re: Sensor Statistics ?

I have seen similar results with dropping packets on a 40 mbps Internet connection. What is the size of your network? Speed? Number of users? Also in the counter, what are your "Number of TCP streams"? What sensors are you using 4220/4230?

New Member

Re: Sensor Statistics ?

Sensor is 4230

Speed: 70Mb/s

Number of TCP: Don't know...

Does DPLI drops means the sensor cannot follow the load ?

Cisco Employee

Re: Sensor Statistics ?

DLPI drops is the total number of packets that your system has been unable to process for the entire duration that it has been up. You can not infer anything more than that from this number unless you are certain that no more than 4,000,000,000 have been processed during this time. If this is the case you can use the DLPI Drops/IP Packets to get a rough idea as to the percentage of traffic that is being missed.

As was mentioned by our friend from the House of Representatives there are other factors besides the absolute bandwidth that affect the perfromance of the sensor. We have recently provided an engineering build that has resolved his problems and are working towards releasing this perfromance enhancement in the 3.1 release.

Please contact kasper@cisco.com for more info on this.

New Member

Re: Sensor Statistics ?

While on the topic of sensor statistics...

How can I obtain statistics from my two (2) 4230 sensors? The option is grayed out in the Event Viewer. As is "Block List", "Connection Status", and "Network Device". "Services", is the only item enabled.

New Member

Re: Sensor Statistics ?

In the menu bar ? Have you tried a right-clik on each item (IDS) ?

New Member

Re: Sensor Statistics ?

Yes.

The Statistics are only available IMMEDIATELY after a signature update. 17 to 18, 18 to 19, etc. If I shut down the CSPM console (from the actual CSPM server), and re-launch the application, all the options are grayed out. I've seen this happen with 3 different upgrades to signature revisions.

I've got a TAC case open, but wanted to see if anyone else has been experiencing the same problem.

112
Views
0
Helpful
6
Replies