show security idp counters packet-log

Number of packets captured by the device by the IDP service.

Number of sessions that have performed packet capture since the capture facility was activated.

Number of sessions that are actively capturing packets at this time.

Number of packets that have been captured by active sessions.

Number of packet capture failures due to cloning error.

Number of objects containing log messages generated during packet capture that were not successfully transmitted to the host.

Number of objects containing captured packets that were not successfully transmitted to the host.

Number of sessions that could not initiate packet capture because the maximum number of sessions specified for the device were conducting captures at that time.

Number of packets not captured because the packet limit specified for this device was reached.

Number of packets not captured because the memory allocated for packet capture on this device was exceeded.

Number of times captured packet failures due to missing route details.

This counter is incremented each time RTCOM com create request is successful. This does not mean that the TCP + SSL handshake is complete, and connection is UP.

This counter is incremented each time RTCOM com create request is failed due to an invalid parameter.

This counter is incremented each time RTCOM com create request is failed due to lack of ports availability.

This counter is incremented each time RTCOM com create request is failed due to IDP plugin is not registered with RTCOM or registration was failed.

This counter is incremented each time IDP plugin receives an event CREATE DONE from RTCOM plugin. This event is basically received after the handshake was complete and connection is established to the host.

This counter is incremented each time IDP plugin receives an event PEER CLOSE from RTCOM plugin. This event is basically received if the SSL/TLS connection is closed by host due to some reason.

This counter is incremented each time IDP plugin receives an event CONN ABORT from RTCOM plugin. This event is basically received if the SSL/TLS connection is aborted due to some reason.

This counter is incremented each time IDP plugin receives an event DATA RCVD from RTCOM plugin. This event is basically received if some data is received on the established connection from the host.

This counter is incremented when the SSL/TLS connection is successful to the host. Basically, handshake is completed, and data can be send over the established connection.

This counter is incremented when SSL/TLS connection can not be established to the specified host even after 3 retries. Only 3 connection attempts are made to the configured host initially and on receiving CONN ABORT or PEER CLOSE event. If connection is no successful even after 3 attempts, no more further attempts are performed and this counter is incremented.

Number of SSL/TLS connections closed successfully. This counter is incremented only for such connections on which connection is up and gets closed later.

This counter is incremented each time RTCOM send is successful. For a single packet log, it will be incremented multiple time as packet log is send as a chunk of 1024 bytes.

This counter is incremented each time RTCOM send is failed.

This counter is incremented each time a new RTCOM context structure is created for a specific host ip, host port, source ip, LSYS identifier, SSL identifier combination.

This counter is incremented each time a RTCOM context structure is reused for a specific host IP, host port, source IP, LSYS identifier, SSL identifier combination. This happens when attacks are getting detected simultaneously on a specific LSYS across different sessions. All the packet logs corresponding to those different sessions are sent using same SSL/TLS connection.

This counter is incremented each time a RTCOM context structure is destroyed. This happens only when no session or no packet log is referring that context to send packet logs.

This counter is incremented each time a packet log is send successfully.

This counter is incremented each time a packet log is send failed.