To display the service policy statistics, use the
show
service-policy
command in privileged EXEC mode.
show service-policy
[
global | interface
intf
][
csc | cxsc | inspect
inspection
[
arguments
]
| ips | police | priority | set connection
[
details
]
| sfr | shape | user-statistics
]
show service-policy
[
global | interface
intf
][
flow
protocol
{
host
src_host | src_ip src_mask
}[
eq
src_port
]{
host
dest_host | dest_ip dest_mask
}[
eq
dest_port
][
icmp_number | icmp_control_message
]]
Syntax Description
|
csc
|
(Optional) Shows detailed information about policies that include the
csc
command.
|
|
cxsc
|
(Optional) Shows detailed information about policies that include the
cxsc
command.
|
|
dest_ip
dest_mask
|
For the
flow
keyword, the destination IP address and netmask of the traffic flow.
|
|
details
|
(Optional) For the
set
connection
keyword, displays per-client connection information, if a per-client connection limit is enabled.
|
|
eq
dest_port
|
(Optional) For the
flow
keyword, equals the destination port for the flow.
|
|
eq
src_port
|
(Optional) For the
flow
keyword, equals the source port for the flow.
|
|
flow
protocol
|
(Optional) Shows policies that match a particular flow identified by the 5-tuple (protocol, source IP address, source port,
destination IP address, destination port). You can use this command to check that your service policy configuration will provide
the services you want for specific connections.
Because the flow is described as a 5-tuple, not all policies are supported. See the following supported policy matches:
|
|
global
|
(Optional) Limits output to the global policy.
|
|
host
dest_host
|
For the
flow
keyword, the host destination IP address of the traffic flow.
|
|
host
src_host
|
For the
flow
keyword, the host source IP address of the traffic flow.
|
|
icmp_control_message
|
(Optional) For the
flow
keyword when you specify ICMP as the protocol, specifies an ICMP control message of the traffic flow.
|
|
icmp_number
|
(Optional) For the
flow
keyword when you specify ICMP as the protocol, specifies the ICMP protocol number of the traffic flow.
|
|
inspect
inspection
[arguments
]
|
(Optional) Shows detailed information about policies that include an
inspect
command. Not all
inspect
commands are supported for detailed output. To see all inspections, use the
show
service-policy
command without any arguments. The arguments available for each inspection vary; see the CLI help for more information.
|
|
interface
intf
|
(Optional) Displays policies applied to the interface specified by the
intf
argument, where
intf
is the interface name given by the
nameif
command.
|
|
ips
|
(Optional) Shows detailed information about policies that include the
ips
command.
|
|
police
|
(Optional) Shows detailed information about policies that include the
police
command.
|
|
priority
|
(Optional) Shows detailed information about policies that include the
priority
command.
|
|
set
connection
|
(Optional) Shows detailed information about policies that include the
set
connection
command.
|
|
sfr
|
(Optional) Shows detailed information about policies that include the
sfr
command.
|
|
shape
|
(Optional) Shows detailed information about policies that include the
shape
command.
|
|
src_ip
src_mask
|
For the
flow
keyword, the source IP address and netmask used in the traffic flow.
|
|
user-statistics
|
(Optional) Shows detailed information about policies that include the
user-statistics
command. This command displays user statistics for the Identify Firewall, including sent packet count, sent drop count, received
packet count, and send drop count for selected users.
|
Command Default
If you do not specify any arguments, this command shows all global and interface policies.
Command Modes
The following table shows the modes in which you can enter the command:
|
Command Mode
|
Firewall Mode
|
Security Context
|
|
Routed
|
Transparent
|
Single
|
Multiple
|
|
Context
|
System
|
|
Privileged EXEC
|
|
|
|
|
—
|
Command History
|
Release
|
Modification
|
|
7.0(1)
|
This command was added.
|
|
7.1(1)
|
The
csc
keyword was added.
|
|
7.2(4)/8.0(4)
|
The
shape
keyword was added.
|
|
8.4(2)
|
Support for the
user-statistics
keyword for the Identity Firewall was added.
|
|
8.4(4.1)
|
Support for the
cxsc
keyword for the ASA CX module was added.
|
|
9.2(1)
|
Support for the
sfr
keyword for the ASA FirePOWER module was added.
|
|
9.5(2)
|
The
inspect
sctp
and
inspect
diameter
keywords were added.
|
|
9.6(2)
|
The
inspect
stun
and
inspect
m3ua
{
drops
|
endpoint
ip_address
} keywords were added.
|
|
9.7(1)
|
The
inspect
m3ua
session
and
inspect
gtp
pdpmcb
teid
teid
keywords were added. In addition, the limitation for showing rules was increased from 64 per class map to 128.
|
|
9.10(1)
|
The
detail
keyword was added to inspect dns. The detailed information provides more information about Cisco Umbrella.
|
Usage Guidelines
The number of embryonic connections displayed in the
show
service-policy
command output indicates the current number of embryonic connections to an interface for traffic matching that defined by
the
class-map
command. The “embryonic-conn-max” field shows the maximum embryonic limit configured for the traffic class using the Modular
Policy Framework. If the current embryonic connections displayed equals or exceeds the maximum, TCP intercept is applied to
new TCP connections that match the traffic type defined by the
class-map
command.
When you make service policy changes to the configuration, all new
connections use the new service policy. Existing connections continue to use the policy that was configured at the time of
the connection establishment.
show
command output will not include data about the old connections. For example, if you remove a QoS service policy from an interface,
then re-add a modified version, then the
show
service-policy
command only displays QoS counters associated with new connections that match the new service policy; existing connections
on the old policy no longer show in the command output. To ensure that all connections use the new policy, you need to disconnect
the current connections so they can reconnect using the new policy. See the
clear
conn
or
clear
local-host
commands.
Note
|
For an
inspect
icmp
and
inspect
icmp
error
policies, the packet counts only include the echo request and reply packets.
|
Examples
The following is sample output from the
show
service-policy
global
command:
ciscoasa# show service-policy global
Global policy:
Service-policy: inbound_policy
Class-map: ftp-port
Inspect: ftp strict inbound_ftp, packet 0, drop 0, reset-drop 0
The following is sample output from the
show
service-policy
priority
command:
ciscoasa# show service-policy priority
Interface outside:
Global policy:
Service-policy: sa_global_fw_policy
Interface outside:
Service-policy: ramap
Class-map: clientmap
Priority:
Interface outside: aggregate drop 0, aggregate transmit 5207048
Class-map: udpmap
Priority:
Interface outside: aggregate drop 0, aggregate transmit 5207048
Class-map: cmap
The following is sample output from the
show
service-policy
flow
command:
ciscoasa# show service-policy flow udp host 209.165.200.229 host 209.165.202.158 eq 5060
Global policy:
Service-policy: f1_global_fw_policy
Class-map: inspection_default
Match: default-inspection-traffic
Action:
Input flow: inspect sip
Interface outside:
Service-policy: test
Class-map: test
Match: access-list test
Access rule: permit ip 209.165.200.229 255.255.255.224 209.165.202.158 255.255.255.224
Action:
Input flow: ids inline
Input flow: set connection conn-max 10 embryonic-conn-max 20
The following is sample output from the
show
service-policy
inspect
http
command. This example shows the statistics of each match command in a match-any class map.
ciscoasa# show service-policy inspect http
Global policy:
Service-policy: global_policy
Class-map: inspection_default
Inspect: http http, packet 1916, drop 0, reset-drop 0
protocol violations
packet 0
class http_any (match-any)
Match: request method get, 638 packets
Match: request method put, 10 packets
Match: request method post, 0 packets
Match: request method connect, 0 packets
log, packet 648
For devices that have multiple CPU cores, there is a counter for lock failure. The locking mechanism is used to protect shared
data structures and variables, because they can be used by multiple cores.When the core fails to acquire a lock, it tries
to get the lock again. The lock fail counter increments for each failed attempt.
ciscoasa# show service-policy
Global policy:
Service-policy: global_policy
Class-map: inspection_default
...
Inspect: esmtp _default_esmtp_map, packet 96716502, lock fail 7, drop 25,
reset-drop 0
Inspect: sqlnet, packet 2526511491, lock fail 21, drop 2362, reset-drop 0
The following is sample output from the
show
service-policy
inspect
waas
command. This example shows the waas statistics.
ciscoasa# show service-policy inspect waas
Global policy:
Service-policy: global_policy
Class-map: WAAS
Inspect: waas, packet 12, drop 0, reset-drop 0
SYN with WAAS option 4
SYN-ACK with WAAS option 4
Confirmed WAAS connections 4
Invalid ACKs seen on WAAS connections 0
Data exceeding window size on WAAS connections 0
The following command shows the statistics for GTP inspection. The output is explained in Table 12-1.
firewall(config)# show service-policy inspect gtp statistics
GPRS GTP Statistics:
version_not_support 0 msg_too_short 0
unknown_msg 0 unexpected_sig_msg 0
unexpected_data_msg 0 ie_duplicated 0
mandatory_ie_missing 0 mandatory_ie_incorrect 0
optional_ie_incorrect 0 ie_unknown 0
ie_out_of_order 0 ie_unexpected 0
total_forwarded 67 total_dropped 1
signalling_msg_dropped 1 data_msg_dropped 0
signalling_msg_forwarded 67 data_msg_forwarded 0
total created_pdp 33 total deleted_pdp 32
total created_pdpmcb 31 total deleted_pdpmcb 30
total dup_sig_mcbinfo 0 total dup_data_mcbinfo 0
no_new_sgw_sig_mcbinfo 0 no_new_sgw_data_mcbinfo 0
pdp_non_existent 1
Table 1. GPRS GTP Statistics
|
Column Heading
|
Description
|
|
version_not_support
|
Displays packets with an unsupported GTP version field.
|
|
msg_too_short
|
Displays packets less than 8 bytes in length.
|
|
unknown_msg
|
Displays unknown type messages.
|
|
unexpected_sig_msg
|
Displays unexpected signaling messages.
|
|
unexpected_data_msg
|
Displays unexpected data messages.
|
|
mandatory_ie_missing
|
Displays messages missing a mandatory Information Element (IE).
|
|
mandatory_ie_incorrect
|
Displays messages with an incorrectly formatted mandatory Information Element (IE).
|
|
optional_ie_incorrect
|
Displays messages with an invalid optional Information Element (IE).
|
|
ie_unknown
|
Displays messages with an unknown Information Element (IE).
|
|
ie_out_of_order
|
Displays messages with out-of-sequence Information Elements (IEs).
|
|
ie_unexpected
|
Displays messages with an unexpected Information Element (IE).
|
|
ie_duplicated
|
Displays messages with a duplicated Information Element (IE).
|
|
optional_ie_incorrect
|
Displays messages with an incorrectly formatted optional Information Element (IE).
|
|
total_dropped
|
Displays the total messages dropped.
|
|
signalling_msg_dropped
|
Displays the signaling messages dropped.
|
|
data_msg_dropped
|
Displays the data messages dropped.
|
|
total_forwarded
|
Displays the total messages forwarded.
|
|
signalling_msg_forwarded
|
Displays the signaling messages forwarded.
|
|
data_msg_forwarded
|
Displays the data messages forwarded.
|
|
total created_pdp
|
Displays the total Packet Data Protocol (PDP) or bearer contexts created.
|
|
total deleted_pdp
|
Displays the total Packet Data Protocol (PDP) or bearer contexts deleted.
|
|
total created_pdpmcb
total deleted_pdpmcb
total dup_sig_mcbinfo
total dup_data_mcbinfo
no_new_sgw_sig_mcbinfo
no_new_sgw_data_mcbinfo
|
These fields relate to the use of PDP master control blocks, which is an implementation feature. These counters are used
by Cisco Technical Support for troubleshooting and are not of direct interest to end users.
|
|
pdp_non_existent
|
Displays the messages received for a non-existent PDP context.
|
Examples
The following command displays information about the PDP contexts:
ciscoasa# show service-policy inspect gtp pdp-context
1 in use, 32 most used
Version TID MS Addr SGSN Addr Idle Timeout APN
v2 2692026893437055 10.0.0.1 10.0.0.11 0:00:11 0:04:00 gprs.example.com
Starting with ASA 9.6.2, GTP PDP context information is shown one per line instead of in a table. This makes it easier to
read when using IPv6 addresses.
ciscoasa# show service-policy inspect gtp pdp-context
4 in use, 5 most used
Version v1, TID 050542012151705f, MS Addr 2005:a00::250:56ff:fe96:eec,
SGSN Addr 10.0.203.22, Idle 0:52:01, Timeout 3:00:00, APN ssenoauth146
Version v2, TID 0505420121517056, MS Addr 100.100.100.102,
SGW Addr 10.0.203.24, Idle 0:00:05, Timeout 3:00:00, APN ssenoauth146
Version v2, TID 0505420121517057, MS Addr 100.100.100.103,
SGW Addr 10.0.203.25, Idle 0:00:04, Timeout 3:00:00, APN ssenoauth146
Version v2, TID 0505420121517055, MS Addr 100.100.100.101,
SGW Addr 10.0.203.23, Idle 0:00:06, Timeout 3:00:00, APN ssenoauth146
Table 12-2 describes the output from the
show
service-policy
inspect
gtp
pdp-context
command.
Table 2. PDP Contexts
|
Column Heading
|
Description
|
|
Version
|
Displays the version of GTP.
|
|
TID
|
Displays the tunnel identifier.
|
|
MS Addr
|
Displays the mobile station address.
|
|
SGSN Addr
SGW Addr
|
Displays the serving gateway service node (SGSN) or serving gateway (SGW).
|
|
Idle
|
Displays the time for which the PDP or bearer context has not been in use.
|
|
APN
|
Displays the access point name.
|
Feedback