show interfaces flow-statistics

Traffic statistics

Local statistics

Transit statistics

Flow input statistics

Flow output statistics

Flow error statistics

Address spoofing

The packet was dropped when the screen module detected address spoofing.

Syn-attack protection

The packet was dropped because of SYN attack protection or SYN cookie protection.

Authentication failed

The packet was dropped because the IPsec Encapsulating Security Payload (ESP) or Authentication Header (AH) authentication failed.

No SA for incoming SPI

The packet was dropped because the incoming IPsec packet's security parameter index (SPI) does not match any known SPI.

Security association not active

The packet was dropped because an IPsec packet was received for an inactive SA.

Incoming NAT errors

The source NAT rule search failed, an invalid source NAT binding was found, or the NAT allocation failed.

Multiple incoming NAT

Sometimes packets are looped through the system more than once; if source NAT is specified more than once, the packet will be dropped.

Multiple user authentications

Sometimes packets are looped through the system more than once. Each time a packet passes through the system, that packet must be permitted by a policy. If the packet matches more than one policy that specifies user authentication, then it will be dropped.

User authentication errors

Packet was dropped because policy requires authentication; however:

• Only Telnet, FTP, and HTTP traffic can be authenticated.

• The corresponding authentication entry could not be found, if web-auth is specified.

• The maximum number of authenticated sessions per user was exceeded.

No one interested in self packets

This counter is incremented for one of the following reasons:

• The outbound interface is a self interface, but the packet is not marked as a to-self packet and the destination address is in a source NAT pool.

• No service is interested in the to-self packet

• When a zone has ident-reset service enabled, the TCP RST to IDENT request for port 113 is sent back and this counter is incremented.

No minor session

The packet was dropped because no minor sessions are available and a minor session was requested. Minor sessions are allocated for storing additional TCP state information.

No more sessions

The packet was dropped because there were no more free sessions available.

No route present

The packet was dropped because a valid route was not available to forward the packet.

For new sessions, the counter is incremented for one of the following reasons:

• No valid route was found to forward the packet.

• A discard or reject route was found.

• The route could not be added due to lack of memory.

• The reverse path forwarding check failed for an incoming multicast packet.

For existing sessions, the prior route was changed or deleted, or a more specific route was added. The session is rerouted, and this reroute could fail because:

• A new route could not be found; either the previous route was removed, or the route was changed to discard or reject.

• Multiple packets may concurrently force rerouting to occur, and only one packet can successfully complete the rerouting process. Other packets will be dropped.

• The route table was locked for updates by the Routing Engine. Packets that match a new session are retried, whereas packets that match an existing session are not.

No tunnel found

The packet was dropped because a valid tunnel could not be found

No session for a gate

This counter is incremented when a packet is destined for an ALG, and the ALG decides to drop this packet.

No zone or NULL zone binding

The packet was dropped because its incoming interface was not bound to any zone.

Policy denied

The error counter is incremented for one of the following reasons:

• Source and/or destination NAT has occurred and policy says to drop the packet.

• Policy specifies user authentication, which failed.

• Policy was configured to deny this packet.

TCP sequence number out of window

A TCP packet with a sequence number failed the TCP sequence number check that was received.

No parent for a gate

-

Invalid zone received packet

-

No NAT gate

-