Identify Sessions That Use an Excessive Percentage of the Packet Buffer

View firewall resource usage, top sessions, and session details. Execute the following operational command in the CLI (sample output from the command follows):

admin@PA-7050> show running resource-monitor ingress-backlogs
-- SLOT:s1, DP:dp1 -- 
USAGE - ATOMIC: 92%  TOTAL: 93%
TOP SESSIONS:
SESS-ID      PCT   GRP-ID   COUNT
6            92%   1        156
                   7        1732
SESSION DETAILS
SESS-ID PROTO SZONE SRC         SPORT  DST       DPORT  IGR-IF    EGR-IF       APP
6      6     trust 192.168.2.35 55653  10.1.8.89 80  ethernet1/21 ethernet1/22 undecided

The command displays a maximum of the top five sessions that each use 2% or more of the packet buffer.

The sample output above indicates that Session 6 is using 92% of the packet buffer with TCP packets (protocol 6) coming from source IP address 192.168.2.35.

SESS-ID
—Indicates the global session ID that is used in all other
show session
commands. The global session ID is unique within the firewall.
GRP-ID
—Indicates an internal stage of processing packets.
COUNT
—Indicates how many packets are in that GRP-ID for that session.
APP
—Indicates the App-ID extracted from the Session information, which can help you determine whether the traffic is legitimate. For example, if packets use a common TCP or UDP port but the CLI output indicates an APP of
undecided
, the packets are possibly attack traffic. The APP is
undecided
when Application IP Decoders cannot get enough information to determine the application. An APP of
unknown
indicates that Application IP Decoders cannot determine the application; a session of
unknown
APP that uses a high percentage of the packet buffer is also suspicious.

To restrict the display output:

On a PA-7000 Series platform, you can limit output to a slot, a dataplane, or both. For example:

admin@PA-7050> 
show
running resource-monitor ingress-backlogs slot s1
admin@PA-7050> show running resource-monitor ingress-backlogs slot
s1 dp dp1

On a PA-5000 Series platform, you can limit output to a dataplane. For example:

admin@PA-5060> 
show
running resource-monitor ingress-backlogs dp dp1

Use the command output to determine whether the source at the source IP address using a high percentage of the packet buffer is sending legitimate or attack traffic.

In the sample output above, a single-session attack is likely occurring. A single session (Session ID 6) is using 92% of the packet buffer for Slot 1, DP 1, and the application at that point is

undecided

.

If you determine a single user is sending an attack and the traffic is not offloaded, you can Use the CLI to End a Single Attacking Session. At a minimum, you can Configure DoS Protection Against Flooding of New Sessions.
On a hardware platform that has a field-programmable gate array (FPGA), the firewall offloads traffic to the FPGA when possible to increase performance. If the traffic is offloaded to hardware, clearing the session does not help because then it is the software that must handle the barrage of packets. You should instead Discard a Session Without a Commit.

To see whether a session is offloaded or not, use the

show session id

<session-id>

operational command in the CLI as shown in the following example. The

layer7 processing

value indicates

completed

for sessions offloaded or

enabled

for sessions not offloaded.