Question about ACE show Conn command (tcp duration)

Hello,
I was checking connections and noticed that I would see the initial connection, but after a short time the connection quits showing up in the counters and the “show conn” command. However the user is still up and working.
This is the command I used:
sho conn serverfarm STAGING-HTTPS detail
The output shows all the connection info from source to destination, and in the ESTABLISHED state.
However, after maybe 2~3 minutes, when I up arrow I don't see any connection info. The web page is still up. If I refresh the web page, I do see the connections come in.
Can someone kindly point me to a document or provide an answer on how long should the connection be stored before they are flushed?
Config profile:
4 real servers
HTTPS protocol
Leastconn for predictor
sticky based on src/dst IP
Thanks,
Raman

Raman,
If you would play with a sniffer capture, you could answer the question yourself.
If the browser loads a flash object or a java applet, once it is loaded, you can still work on the page but there is no data transfer.
with a sniffer tool you could see the browser closing the connections.
The default TCP idle timeout on ACE is 1 hour.
Gilles.

Similar Messages

Cisco ACE - "show conn" command queries

Hi all,
i have some queries regarding the "show conn" command in Cisco ACE.
Working Scenario:
VIP : 10.10.10.1
Server 1 : 10.10.20.1
Server 2 : 10.10.20.2
Client: 30.30.30.1
When a client 30.30.30.1 initiates a connection to the VIP on 10.10.10.1, the ACE load balances it to Server 1, 10.10.20.1. Looking at the "show conn" table, it shows that Server 1 is replying back to the Client 30.30.30.1 through the ACE.
Now, my question is when the ACE returns the traffic to the Client, should the Client be seeing the source IP coming from the VIP or Server 1? My understanding is that the Client should be seeing traffic returning from the VIP. But the show conn table does not seem to suggest so.
show conn table
conn-id    np dir proto vlan source                destination           state
----------+--+---+-----+----+---------------------+---------------------+------+
1768       1 in TCP   10   30.30.30.1:9221   10.10.10.1:80       ESTAB
41         1 out TCP   52    10.10.20.1:80    30.30.30.1:9221   CLOSED

Daniel,
The client is expecting a response from the VIP otherwise there would be an asymmetrical routing problem and conns will never complete.
The fact that you're seeing 30.30.30.1 as the destination address is just that the server is able to see client's IP address on the request, when your backend servers sends the reply back to the client this response is forced to go through the ACE, when the ACE looks at the packet it matches with a previously conn created on the flow table so it "NATs" the reply so now the source of the packet is the VIP and destination is 30.30.30.1.
This is a expected behavior as you're not using S-NAT on your network.
HTH.
Pablo

Right syntax of show conn command

Good day!
Please, help me with correct syntax of show conn command...
I need to show all active tcp connections from inside to outside on port 60565...
Thank you...!

Hi,
Well there are a lot of options.
Below is the basic command
show conn
You can use the below commands to get more detailed information
show conn long
show conn detail
You can show certain port connections with the command (with some added parameters)
show conn detail port 60565
Some variation of the below command might also be helpfull
show local-host
Use the "?" (question mark) after the "show local-host" to see what options you have. Same option naturally applies to any other command on the ASA in general.
I would also suggest checking out the ASA Command Reference when you are unclear of the purpose of a certain command. They are listed in alphabetic order
http://www.cisco.com/en/US/docs/security/asa/command-reference/cmdref.html
- Jouni

Show policy-map interface | Question about QOS show command output

I hope this is the correct place for this question. If not, please let me know.
When I issue the show policy-map interface command (in this case on a 3845) there is some output I don't understand. I have included some output below and formatted the lines I am confused about as "computer code" which show up as red on my screen. A list of the individual lines i'm confused about is below, followed by those liens in the context of the show policy-map command's output.
Any help with this will be greatly appreciated. Thanks in advance.
5 minute offered rate 46000 bps, drop rate 0 bps
5 minute rate 10000 bps
bandwidth remaining 50% (768 kbps)
show policy-map interface
--- previous output omitted ---
GigabitEthernet0/0
Service-policy input: QoS_IN
class-map: Silver (match-any)
      164691299 packets, 23570752398 bytes
      5 minute offered rate 46000 bps, drop rate 0 bps
      Match: access-group name MAINFRAME
        4371992 packets, 2311242335 bytes
        5 minute rate 0 bps
      Match: access-group name KRONOS
        13334297 packets, 3051409140 bytes
        5 minute rate 5000 bps
      Match: access-group name EMAIL
        97652823 packets, 10323856470 bytes
        5 minute rate 10000 bps
      Match: access-group name VOIP-CONTROL
        20782858 packets, 1481676784 bytes
        5 minute rate 0 bps
      Match: access-group name LOGIXWEB
        0 packets, 0 bytes
        5 minute rate 0 bps
      Match: access-group name GRINDLOG
        0 packets, 0 bytes
        5 minute rate 0 bps
      Match: access-group name CITRIX
        46895 packets, 14669179 bytes
        5 minute rate 0 bps
      Match: access-group name CORP_WEB
        28502414 packets, 6387897396 bytes
        5 minute rate 4000 bps
      QoS Set
        dscp af31
          Packets marked 164691269
show policy-map interface s0/0/0:0
Serial0/0/0:0
Service-policy output: QoS_OUT
--- previous output omitted ---
    Class-map: Silver (match-any)
      86590227 packets, 12051546524 bytes
      5 minute offered rate 3000 bps, drop rate 0 bps
      Match: access-group name MAINFRAME
        7641084 packets, 2701232492 bytes
        5 minute rate 0 bps
      Match: access-group name KRONOS
        6975052 packets, 1555404656 bytes
        5 minute rate 0 bps
      Match: access-group name EMAIL
        58438150 packets, 5433636586 bytes
        5 minute rate 3000 bps
      Match: access-group name VOIP-CONTROL
        355083 packets, 41252455 bytes
        5 minute rate 0 bps
      Match: access-group name LOGIXWEB
        0 packets, 0 bytes
        5 minute rate 0 bps
      Match: access-group name GRINDLOG
        0 packets, 0 bytes
        5 minute rate 0 bps
      Match: access-group name CITRIX
        19 packets, 4967 bytes
        5 minute rate 0 bps
      Match: access-group name CORP_WEB
        13180836 packets, 2320015236 bytes
        5 minute rate 0 bps
      Queueing
      queue limit 64 packets
      (queue depth/total drops/no-buffer drops) 0/18156/0
      (pkts output/bytes output) 86421413/12004278837
      bandwidth remaining 50% (768 kbps)

this is my configuration
DGMGRL> show configuration
Configuration
Name: matrix
Enabled: YES
Protection Mode: MaxPerformance
Databases:
stdby1 - Primary database
stdby2 - Physical standby database
stdby3 - Physical standby database
Fast-Start Failover: DISABLED
Current status for "matrix":
SUCCESS
--- this is my first successful switchover -----
DGMGRL> switchover to stdby2
Performing switchover NOW, please wait...
New primary database "stdby2" is opening...
Operation requires shutdown of instance "stdby1" on database "stdby1"
Shutting down instance "stdby1"...
ORA-01109: database not open
Database dismounted.
ORACLE instance shut down.
Operation requires startup of instance "stdby1" on database "stdby1"
Starting instance "stdby1"...
ORACLE instance started.
Database mounted.
Switchover succeeded, new primary is "stdby2"
-------------------this is my second switchover -------------
DGMGRL> switchover to stdby1
Performing switchover NOW, please wait...
New primary database "stdby1" is opening...
Operation requires shutdown of instance "stdby2" on database "stdby2"
Shutting down instance "stdby2"...
ORA-01109: database not open
Database dismounted.
ORACLE instance shut down.
Operation requires startup of instance "stdby2" on database "stdby2"
Starting instance "stdby2"...
Unable to connect to database
ORA-12514: TNS:listener does not currently know of service requested in connect descriptor
Failed.
You are no longer connected to ORACLE
Please connect again.
Unable to start instance "stdby2"
You must start instance "stdby2" manually
Switchover succeeded, new primary is "stdby1"
DGMGRL>
Edited by: user6981287 on Jan 7, 2010 12:57 AM
Edited by: user6981287 on Jan 7, 2010 1:00 AM

Question about HDs showing in Disk Utility

Recently i did a restore, erasing the Macintosh HD and reinstalling Yosemite. After that i noticed the HDs were listed a little differently in Disk Utility. The main hard drive name, blue selected in the pic below, used to always say the actual hard drive name (Toshiba 750GB....). However now i noticed both say Macintosh HD. There doesn't seem to be any problems, but just something little i noticed and was unsure about. I recall it was listed the usual way in the disk utility when i was erasing the hd and reinstalling the os - with the toshiba hd name on top..
Is this an issue - is there something that needs to be done? Or how could i revert it back to the way it used to be? When i did the restore i didn't seem to allow you to change the name of the actual HD.
Thanks.

This sounds like you either have a faulty SATA cable or it is improperly connected internally. You will not be able to boot via recovery if the drive itself is not showing up, as recovery is just a partition that is seperate from your boot volume on the same drive. So, are you referring to your boot volume, or the whole drive? How are connecting the drive externally?
Open terminal and enter the following command. Post the output in your reply:
diskutil list | open -f -a textedit

Question about ACE-4710-BAS-2PAK bundle

Hello,
I want to order ACE-4710-BAS-2PAK bundle (2 Units of ACE 4710 Hardware-1Gbps-1K SSL-100MbpsComp-5VC- 5) and then separate two units of this bundle.
I couldn't get any information about separation possibility, therefore âsome howâ i need to ensure that 2 units of ACE-4710-BAS-2PAK will be able to work separate.
Could you please provide me some suggestion about this issue.
Any advise are welcome.

yes, these units can work alone.
The pak is just a sale operation.
The HW is still the same.
G.

Question about "Convert ID3 Tags" command

I just used "Convert ID3 Tag" to convert all the songs in a library to ID3v2.4. When it was done, abotu half the album art had been killed. I have a backup, so nothing is lost, but I did not expect this to happen. My questions: (1) Is this expected behavior or a bug?, and (2) Any ideas why some album art survived and some did not?

Thank you! I actually managed to figure it out myself before you replied.
For anyone else out there who might be interested:
Change the import settings in iTunes > Preferences > General, to Apple Lossless Encoder. Then you can select the files/albums you want to convert, and click on the Advanced menu while holding down the Options/Alt-key, and click "Create Apple Lossless Version". I found that it doesn't actually convert the existing WAV-files, but creates an Apple Lossless copy of every single file, so I had to spend some time weeding out the WAV-files afterwards. This is a one-time effort, though, as every CD will be imported as Apple Lossless from now on.
Better still, solved my problem with the album artwork!

Few questions about sql2008 functions and commands

hello,
I am learning sql2008 implementation and maintenance,I am just 2 weeks bussy.there is some questions in my mind wich I can't answer it.
1-when I can use USE MASTER statement
2-can a database for example (test) have many and unlimmited file groups?
3-what is the diferrence between file and filegroup! is the term of file means tables in filegroup?
4-with boundary points does mean the data type when creating partition function!
5`what is diferrence between full text index and index,where you have to use the index and wher you have to use full text index?
6-each filegroup must have one partition or one partition can have many filegroups in partition scheme!
7-do you have to partition every scheme or not! where do you have to partition a scheme and where not?
8-can you give a little example with switch operator!
9-again do you have to partition every table and index in the real world or not!
thanks
johan
h.david

Hi,
Let me try to answer your questions:
You need to use USE MASTER whenever you need to do some work in the MASTER database and the database context is not that.
Yes, a database can have many filegroups. Please check this article:
http://msdn.microsoft.com/en-us/library/ms179316.aspx
Please check this article:
http://msdn.microsoft.com/en-us/library/ms179316.aspx
As per BOL:
boundary_value is a constant expression that can reference variables. This includes user-defined type variables, or functions and user-defined functions. It cannot reference Transact-SQL expressions.
boundary_value must either match or be implicitly convertible to the data type supplied in
input_parameter_type, and cannot be truncated during implicit conversion in a way that the size and scale of the value does not match that of its corresponding
input_parameter_type. For more details check
http://msdn.microsoft.com/en-us/library/ms187802.aspx
For simplicity: Full-Text index is used to search in a LOB/text data in a column, index is used to speed up your queries. Please check these articles:
http://msdn.microsoft.com/en-us/library/ms142571.aspx,
http://msdn.microsoft.com/en-us/library/ms189271.aspx
As per BOL: When you create a partition scheme, you define the filegroups where the table partitions are mapped, based on the parameters of the partition function. You must specify enough filegroups to hold the number of partitions. You can specify that
all partitions map to a different filegroup, that some partitions map to a single filegroup, or that all partitions map to a single filegroup. You can also specify additional, "unassigned" filegroups in the event you want to add more partitions later. For
more info, please check
http://msdn.microsoft.com/en-us/library/ms188730.aspx
8. Please read the concept of partitioning here:
http://msdn.microsoft.com/en-us/library/ms190199.aspx and for SWITCH operator, please check the sliding window example at here:
http://msdn.microsoft.com/en-us/library/aa964122(SQL.90).aspx
9. It depends :) but you always will have at least 1 partition!
I hope it helps.
J.
There are 10 type of people. Those who understand binary and those who do not.

Question about [b]jar[/b] command

I have a java class that has an inner class. When I compile I get two .class files that includes the .class file for the inner class.
Now I run a jar command to jar those two classes as below:
jar -cvf *.class
Notice that I skipped mentioning the jar file name. What happens now is that my inner class' .class file contents are modified.
Is this a bug with the jar utility or an expected behavior ?

If you do this in a UNIX shell, the wild card is expanded by the shell before the jar command is executed. This means that jar will use the file that happens to be the first in the list of files that *.class expands to, as its output file. The class file generated for your inner class probably is the first file in the list, and is thus overwritten by jar.
On platforms where the shell don't do this expansion, I would guess that the Java VM (used by the jar command, which is actually a Java program) probably simulates the UNIX effect by expanding the command line before passing it as arguments to the main method of the Java program being run.

A question about the create object command

Hi, I met some problems when created type and view:
In sqlplus,
1) I first create a address_ty:
create or replace type address_ty as object
(street varchar2(50),
city varchar2(25),
state char(2),
zip number);
type created
2) Then I created a person_ty;
create type person_ty as object
(name varchar2(25),
address address_ty);
type created
3) create the table customer;
create or replace table customer
(customer_id number,
person person_ty);
table created
4) create the view based on the customer table;
create view customer_0v(customer_id, person) as
select customer_id,
person_ty(name,
address_ty(street,city,state,zip))
from customer;
***There is a error message :
error at line 4: address_ty(street,city,state,zip))
invalid column name.
I think it should work but ...
5) Another question is could I insert into table customer values like this:
insert into customer values
(123,'SIGMUND','47 HAFFNER RD','LEWISTON','NJ',22222);
It does not work in my pc and give a erro message like ' too many valuesj'.
But some of books said it works.
Thanks for any help !
echo
null

Why does not the Object itself implement the interface
CloneableBecause then every object would be cloneable.

Question about ACE

I have real web-server with folders : /1/index.html, /2/index.html, /3/index.html
I need to balance virtual service:
If I try to connect URL: http://server/index.html, then ACE balance among
http://real_server/1/index.html,
http://real_server/2/index.html,
http://real_server/3/index.htm
How can I configure ACE ?

No yet, If I connect to http://server/index.html then balance to real services among http://real_server/1/index.html, http://real_server/2/index.html, http://real_server/3/index.html.
URL http://real_server/index.html is not exist.

ACE Sticky Connections, Show Conn Output and Show serverfarm

Hi Community,
I'm deploying a Cisco ACE module and I have some questions about sticky connections and about the output of the show conn command and show serverfarm command.
I have the follwoing configuration:
rserver host srv_1 ip address 10.4.11.14 inservicerserver host srv_2 ip address 10.4.11.18 inserviceserverfarm host farm_144 rserver srv_1 144    weight 1    inservice rserver srv_2 144    weight 3    inservice
sticky ip-netmask 255.255.255.255 address source st_host144
timeout 10080
serverfarm farm_144
class-map match-all vip_144
2 match virtual-address 10.4.11.208 tcp eq 143
policy-map type loadbalance first-match lb_144
class class-default
policy-map multi-match policy_vip_webcache
class vip_webcache_144
    loadbalance vip inservice
    loadbalance policy lb_144
    loadbalance vip icmp-reply active
    nat dynamic 411 vlan 411
We can assume that service policy was applied at the interface vlan. So, let's go to the questions:
1- If sticky is enabled the output command "show conn" should show just one entry by ip address?
The real output is:
DC01-ACE-01-PRIMARY-SW1/context_servidores# show conn | inc :143333046     1 in TCP   411 10.2.158.87:3616      10.4.11.208:143       ESTAB 286390     3 in TCP   411 10.2.158.87:3562      10.4.11.208:143       ESTAB310233     1 in TCP   411 10.1.5.87:3424        10.4.11.208:143       ESTAB
Look that the ip address 10.2.158.87 is shown 2 times. In same times, the same ip address is shown 4 times to the same VIP and the same port. Is it a normal behavior?
2- According to the configuration, the srv_2 has weight 3 and srv_1 has weigth 1, but the output of show serverfarm show somethin strange:
DC01-ACE-01-PRIMARY-SW1/context_servidores# show serverfarm farm_144 serverfarm     : farm_144, type: HOST total rservers : 2 state          : ACTIVE DWS state      : DISABLED ---------------------------------                                                ----------connections-----------       real                  weight state        current    total      failures    ---+---------------------+------+------------+----------+----------+---------   rserver: srv_1       10.4.11.14:144        1   OPERATIONAL     11         386        0   rserver: srv_2       10.4.11.18:144        3   OPERATIONAL     35         66         0
We can see that the weight is working good, but the total of connections is higher at srv_1 than srv_2. Why?
Somebody can help me to understand better this problem of if its a normal behavior?
Thanks in advance!!

Hi Gaurav,
About question 1, I got some informations too. It's perfectly normal the client open 2 or more connections at the same time. The client's application is the responsable. We removed the ACE and put the client directly to the server and the result of the total connections opened was the same.
About question 2, I made some "clears" on the serverfarm, the sticky database and after that, the numbers were more real.
DC01-ACE-02-SECONDARY-SW1/context_servidores# sh serverfarm farm_webcache_144
serverfarm     : farm_webcache_144, type: HOST
total rservers : 2
state          : ACTIVE
DWS state      : DISABLED
                                                ----------connections-----------
       real                  weight state        current    total      failures
   ---+---------------------+------+------------+----------+----------+---------
   rserver: srv_webcache_1
       10.4.11.14:144        1   OPERATIONAL     1025       15499      4436
   rserver: srv_webcache_2
       10.4.11.18:144        2   OPERATIONAL     1794       33471      471
DC01-ACE-02-SECONDARY-SW1/context_servidores#
Anyway thank you very much for your feedback.
Plínio Monteiro

Clarification on the SHOW TOP command

Does anyone know much about the Show Top command? I am trying to get specs on the bandwidth utilization of a port. When
I do the Top command it tells me a percent of utilization. However it looks to be too low. I verified the util using a traffic generator test set and it has results of almost double the util. that the Top command stated. So my thoughts are that if the port is set for 100/Full then the Top stats for Util show only half Dux. Is this so??? I think that I need to double the Top results for util and that will be the true Util for the port. Can anyone verify this????

you are kind of correct, that it will look like a half duplex utilization because process actually bundles the TX AND rx into the same counter and it also looks at the full duplex bandwidth when calculating the % utilization. So a GE port is really 2000Mbps full-duplex. so, from the traffic generator you are sending at line rate of 1 Gig, the TOP will see that as 50% utilization. Does that make sense. This is how I understand it.

Show conn info via snmp

Hi,
Does the ASA have an SNMP OID which will provide information like the show conn command ?

2 years later, how's LLDP support via SNMP?
If Cisco does not support LLDP via SNMP, please remove the wrong information from
http://tools.cisco.com/ITDIT/MIBS/MainServlet?ReleaseSel=2514&PlatformSel=231&fsSel=705
Stop lying!

CBWFQ: Question about the output of "show policy-map interface" command

Hi everyone,
I have a question about the output of "show policy-map interface" command.
The following is the output of this command and lower side of the output shows
(total queued/total drops/no-buffer drops) 0/342/0
If the packets drop occur due to the situation of no enough buffer,
"no-buffer drops" counted up. But "no-buffer drops" has not been counted up.
The "no-buffer drops" is 0 (zero) but "total drops" are counted as 342.
I guess there are other factors except "no-buffer drops" to add "total drops".
But I can not find any information about "other factors".
So I would like to know the "other factors" added to "total drops".
reserch-3725#sh policy-map interface fastethernet0/1
FastEthernet0/1
Service-policy output: shaping
Class-map: kdpc (match-all)
146956873 packets, 115209221595 bytes
5 minute offered rate 156000 bps, drop rate 0 bps
Match: access-group name YOKOHAMA_to_CHINO
Traffic Shaping
Target/Average Byte Sustain Excess Interval Increment
Rate Limit bits/int bits/int (ms) (bytes)
9360000/9360000 58500 234000 234000 25 29250
Adapt Queue Packets Bytes Packets Bytes Shaping
Active Depth Delayed Delayed Active
- 0 146956724 3539850811 2960247 3851843541 no
Class-map: class-default (match-any)
552458414 packets, 249687580329 bytes
5 minute offered rate 242000 bps, drop rate 0 bps
Match: any
Traffic Shaping
Target/Average Byte Sustain Excess Interval Increment
Rate Limit bits/int bits/int (ms) (bytes)
3072000/3072000 19200 76800 76800 25 9600
Adapt Queue Packets Bytes Packets Bytes Shaping
Active Depth Delayed Delayed Active
- 0 552453209 573909865 30358216 2926188156 no
Service-policy : policy1
Class-map: dlsw (match-all)
979578 packets, 264843255 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name acl-dlsw
Queueing
Output Queue: Conversation 137
Bandwidth 128 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 20922/17371500
(depth/total drops/no-buffer drops) 0/0/0
Class-map: telnet (match-all)
29938 packets, 1806058 bytes
5 minute offered rate 0 bps, drop rate 0 bps
Match: access-group name acl-telnet
Queueing
Output Queue: Conversation 138
Bandwidth 64 (kbps) Max Threshold 64 (packets)
(pkts matched/bytes matched) 639/38900
(depth/total drops/no-buffer drops) 0/0/0
Class-map: class-default (match-any)
551448911 packets, 249420939729 bytes
5 minute offered rate 242000 bps, drop rate 0 bps
Match: any
Queueing
Flow Based Fair Queueing
Maximum Number of Hashed Queues 128
(total queued/total drops/no-buffer drops) 0/342/0
Your information would be appreciated.

Details infomatiuon regarding show policy-map interface
http://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a008010dd6a.shtml
http://www.cisco.com/en/US/tech/tk543/tk760/technologies_tech_note09186a0080108e2d.shtml
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/qos_r/qos_s2g.htm#wp1146884

Question about ACE show Conn command (tcp duration)

Similar Messages

Maybe you are looking for