How to Measure CPS

If you use Panorama to manage your firewalls, use Device Monitoring to measure CPS coming into a firewall (
Panorama
Managed Devices
Health
All Devices
). Device Monitoring can also show you a 90-day trend line of CPU average and peak use to help you understand the typical available capacity of each firewall.
Run the operational CLI command
show session info
.
The operational CLI command
show counter interface
displays two times the actual CPS value. If you use this command, divide the CPS value by two to derive the real CPS value.
For setting appropriate DoS Protection profile thresholds, work with application teams to understand the normal and peak CPS to their servers and the maximum CPS those servers can support.
In addition, you can filter firewall Traffic logs and Threat logs for the destination IP addresses of the critical devices you want to protect to obtain normal and peak session activity information.
Use third-party tools such as Wireshark or NetFlow to collect and analyze network traffic.
Use scripts to automate CPS information collection and continuous monitoring, and to mine information from the logs.
Configure every Security policy rule on the firewall to
Log at Session End
. If you have no monitoring tools such as NetFlow or Wireshark, and cannot obtain or develop automated scripts,
Log at Session End
captures the number of connections at the session end. While this doesn’t provide CPS information, it does show you the number of sessions ending in the selected time duration and you can make an approximate calculation of the sessions per second from that information.