topic How to see heavy connection on SND in Firewall and Security Management

How to see heavy connection on SND

Kosin_Usuwanthi — Mon, 25 Jan 2021 12:31:54 GMT

I found only some core CPU on SND alway high usage and need to know what IP address consume this core.

Can I see the connection detail like command "fw ctl multik print_heavy_conn" for firewall instance.

Thank you

Re: How to see heavy connection on SND

Timothy_Hall — Mon, 25 Jan 2021 14:00:01 GMT

Not exactly, but you can use the fwaccel conns command to see all connections being tracked by the SND/IRQ cores. The "Inst" column will show which SND/IRQ instance each connection is associated with. The command fw ctl multik gconn can also be helpful for figuring out which CPU connections are located on as well.

The "Top Connections" screens of cpview are only available for Firewall Worker instances. You can try poking around under Advanced...SecureXL in cpview but the information you are seeking does not appear to be readily available.

There is a known issue that causes severe SND/IRQ CPU imbalances, does this apply to you: sk165853: High CPU usage on one CPU core when the number of Remote Access users is high

Imbalanced SND CPUs can also be caused by Multi-Queue balancing issues and not necessarily be due to elephant flows, see sections 4.1.4 and 4.1.5 of this relatively new SK: sk167553: Performance Investigation Procedure - How To

Re: How to see heavy connection on SND

Kosin_Usuwanthi — Tue, 26 Jan 2021 02:09:30 GMT

Thank you @Timothy_Hall

I have no use vpn on the gateway but I think my issue like this sk161072.

Not sure the algorithm about multi-queue for balance packet to cpu same with "CoreXL Dynamic Dispatcher".

My gateway is version R80.40 Hotfix 89.