Firewall connection metrics in SNMP MIB

snthl — Thu, 26 Oct 2023 11:48:43 GMT

What does the snmp mib object vsxCountersDropCount (.1.3.6.1.4.1.2620.1.16.23.2.1.3) show ? is it the Dropped packet count or dropped connection count ?

The Mib definition says,

vsxCountersDropCount OBJECT-TYPE
SYNTAX Counter64
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Virtual System's drops due to instance fully utilized"
::= { vsxCountersDropEntry 3 }

There is also another mib table object , fwFullyUtilizedDrops (.1.3.6.1.4.1.2620.1.1.25.26.0) . The Mib definition says,

fwFullyUtilizedDrops OBJECT-TYPE

SYNTAX Counter64

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"Total number of dropped packets due to instance being fully utilized"

::= { fwPolicyStat 26 }

Since the mib definition says , "total number of dropped packets" , I assume these are packet count and not connection drop count.

Can anyone help confirm if vsxCountersDropCount gives the "connection drop" count or the "packet drop count" ?

Also, if vsxCountersDropCount gives packet drop count , then this mib object gives same value as fwFullyUtilizedDrops ?

Thanks in advance.

Regards,

Senthil

Re: Firewall connection metrics in SNMP MIB

PhoneBoy — Thu, 26 Oct 2023 16:53:18 GMT

vsxCounterDropCount would give you the number of connections dropped (i.e. new TCP SYN).
fwFullyUtilizedDrops gives you the number of packets dropped as a result.

Re: Firewall connection metrics in SNMP MIB

snthl — Fri, 27 Oct 2023 08:08:21 GMT

Thanks a lot for confirming vsxCounterDropCount gives the connection drop count .

topic Re: Firewall connection metrics in SNMP MIB in Firewall and Security Management

Firewall connection metrics in SNMP MIB

Re: Firewall connection metrics in SNMP MIB

Re: Firewall connection metrics in SNMP MIB