If you suspect asymmetric traffic, you can view network statistics about the Web traffic that the Network Security appliance monitors. The flow counts shown in the show fume network stats command output are cumulative from the last FUME process restart. The FUME process restarts during the upgrade of software or security content.
Three of the command output rows show data about asymmetric traffic flows:
Flow Count―The total number of cumulative flows detected per minute and per second.
SYN Only Flow Count―The total number of SYN‑only flows and the per-minute and per-second rates at which the flows were detected.
Asym Count―The total number of non-SYN‑only asymmetric flows (true asymmetric flows) and the per-minute and per-second rates at which the flows were detected.
For detailed information about the show fume network stats command, see the CLI Command Reference.
Note
On SmartVision Mode sensors, which are Network Security appliances with SmartVision Mode licenses, FUME statistics are based on malware objects detected in Web traffic transferred over SMB protocols in the core of the network (workstation to workstation or workstation to data center).
To calculate the percentage of true asymmetric flows, divide the count of true asymmetric flows by the total flow count and multiply by 100.
Prerequisites
Admin, Operator, Monitor, or Analyst access to the Network Security appliance.
Log in to the appliance CLI and go to enable mode.
hostname > enable
View the network statistics about the Web traffic being monitored. Use the following command:
show fume network stats
The following example shows that statistics for 5686 flows have been captured. Of those flows, 639 were for asymmetric traffic: 427 SYN‑only flows and 212 true asymmetric (non-SYN‑only flows).
hostname # show fume network stats Time: Start: Wed Mar 7 16:48:01 2018 Capture: Sat Mar 10 18:07:16 2018 Elapsed: 4399m 15s Poll: 60s Statistics: Rate/sec Rate/sec Rate/min Count Total (avg) (curr) (curr) ===== ======= ======== ======== ======== Packet 132102 0.50 602.13 36128.00 Byte 97823056 370.61 614412.93 36864776.00 Gigabits 0 0.00 0.00 0.29 Flow Count 5686 0.02 26.25 1575.00 SYN Only Flow Count 427 0.00 0.89 0.00 Asym Count 212 0.00 1.39 137.00 Reassembly Gaps 0 0.00 0.00 0.00 Internal Drops 0 0.00 0.00 0.00
If SYN-only flow counts are included in the count of asymmetric flows, the percentage of asymmetric flows is 11.23% (639 ÷ 5686 × 100). If SYN-only flow counts are not included, the percentage of asymmetric flows is 3.73%. In most networks, 3.73% true asymmetric flows is within a normal range.