【Paloalto】"SHOW SYSTEM STATISTICS" と "SHOW SESSION INFO" の違い

■DIFFERENCE IN PACKET RATE AND THROUGHPUT VALUES SEEN IN SHOW SESSION INFO" AND "SHOW SYSTEM STATISTICS""
-----
Created On 09/26/18 13:50 PM - Last Updated 02/07/19 23:47 PM

Resolution
When looking at the output from the commands "show session info" and "show system statistics session", 
the throughput values and the packet rate values might different. 

The command "show system statistics session" displays the aggregated packet rate and throughput values 
for all dataplanes and slots on the firewall. The command "show session info" displays a single dataplane's packet rate and throughput at a time. 

If using the command "set system setting target-dp none", the numbers displayed are from DP0 only. 
This can contribute to a big difference of values when comparing the two commands.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClsDCAS

★確認
----
admin@PA-5260(active-primary)> show system setting target-dp

None  <<<<!!!


admin@PA-5260(active-primary)> show session info

target-dp:　　　　　　\*.*　<<<<noneの証
\--------------------------------------------------------------------------------
Number of sessions supported:                    33000000
Number of allocated sessions:                    0
Number of active TCP sessions:                   0
Number of active UDP sessions:                   0
Number of active ICMP sessions:                  0
Number of active GTPc sessions:                  0
Number of active GTPu sessions:                  0
Number of pending GTPu sessions:                 0
Number of active BCAST sessions:                 0
Number of active MCAST sessions:                 0
Number of active predict sessions:               0
Number of active SCTP sessions:                  0
Number of active SCTP associations:              0
Session table utilization:                       0%
Number of sessions created since bootup:         21
Packet rate:                                     2/s
Throughput:                                      0 kbps
New connection establish rate:                   0 cps
\--------------------------------------------------------------------------------
Session timeout
  TCP default timeout:                           3600 secs
  TCP session timeout before SYN-ACK received:      5 secs
  TCP session timeout before 3-way handshaking:    10 secs
  TCP half-closed session timeout:                120 secs
  TCP session timeout in TIME_WAIT:                15 secs
  TCP session delayed ack timeout:                250 millisecs
  TCP session timeout for unverified RST:          30 secs
  UDP default timeout:                             30 secs
  ICMP default timeout:                             6 secs
  SCTP default timeout:                          3600 secs
  SCTP timeout before INIT-ACK received:            5 secs
  SCTP timeout before COOKIE received:             60 secs
  SCTP timeout before SHUTDOWN received:           60 secs
  other IP default timeout:                        30 secs
  Captive Portal session timeout:                  30 secs
  Session timeout in discard state:
    TCP: 90 secs, UDP: 60 secs, SCTP: 30 secs, other IP protocols: 60 secs
\--------------------------------------------------------------------------------
Session accelerated aging:                       True
  Accelerated aging threshold:                   80% of utilization
  Scaling factor:                                2 X
\--------------------------------------------------------------------------------
Session setup
  TCP - reject non-SYN first packet:             True
  Hardware session offloading:                   True
  Hardware UDP session offloading:               True
  IPv6 firewalling:                              True
  Strict TCP/IP checksum:                        True
  Strict TCP RST sequence:                       True
  Reject TCP small initial window:               False
  Reject TCP SYN with different seq/options:     True
  ICMP Unreachable Packet Rate:                  200 pps
\--------------------------------------------------------------------------------
Application trickling scan parameters:
  Timeout to determine application trickling:    10 secs
  Resource utilization threshold to start scan:  80%
  Scan scaling factor over regular aging:        8
\--------------------------------------------------------------------------------
Session behavior when resource limit is reached: drop
\--------------------------------------------------------------------------------
Pcap token bucket rate                         : 10485760
\--------------------------------------------------------------------------------
Max pending queued mcast packets per session   : 0
\--------------------------------------------------------------------------------


★変更してみよう
----
admin@PA-5260(active-primary)> set system setting target-dp
  none     none
  s1dp0    s1dp0
  s1dp1    s1dp1
  s1dp2    s1dp2
  <value>  target dp for operational commands


> admin@PA-5260(active-primary)> set system setting target-dp s1dp2

Session target dp changed to s1dp2



admin@PA-5260(active-primary)> show session info

target-dp:                                       s1.dp2   <<<<ここに表示される
\--------------------------------------------------------------------------------
Number of sessions supported:                    11000000
Number of allocated sessions:                    0
Number of active TCP sessions:                   0
Number of active UDP sessions:                   0
Number of active ICMP sessions:                  0
Number of active GTPc sessions:                  0
Number of active GTPu sessions:                  0
Number of pending GTPu sessions:                 0
Number of active BCAST sessions:                 0
Number of active MCAST sessions:                 0
Number of active predict sessions:               0
Number of active SCTP sessions:                  0
Number of active SCTP associations:              0
Session table utilization:                       0%
Number of sessions created since bootup:         6
Packet rate:                                     0/s
Throughput:                                      0 kbps
New connection establish rate:                   0 cps
\--------------------------------------------------------------------------------
Session timeout
  TCP default timeout:                           3600 secs
  TCP session timeout before SYN-ACK received:      5 secs
  TCP session timeout before 3-way handshaking:    10 secs
  TCP half-closed session timeout:                120 secs
  TCP session timeout in TIME_WAIT:                15 secs
  TCP session delayed ack timeout:                250 millisecs
  TCP session timeout for unverified RST:          30 secs
  UDP default timeout:                             30 secs
  ICMP default timeout:                             6 secs
  SCTP default timeout:                          3600 secs
  SCTP timeout before INIT-ACK received:            5 secs
  SCTP timeout before COOKIE received:             60 secs
  SCTP timeout before SHUTDOWN received:           60 secs
  other IP default timeout:                        30 secs
  Captive Portal session timeout:                  30 secs
  Session timeout in discard state:
    TCP: 90 secs, UDP: 60 secs, SCTP: 30 secs, other IP protocols: 60 secs
\--------------------------------------------------------------------------------
Session accelerated aging:                       True
  Accelerated aging threshold:                   80% of utilization
  Scaling factor:                                2 X
\--------------------------------------------------------------------------------
Session setup
  TCP - reject non-SYN first packet:             True
  Hardware session offloading:                   True
  Hardware UDP session offloading:               True
  IPv6 firewalling:                              True
  Strict TCP/IP checksum:                        True
  Strict TCP RST sequence:                       True
  Reject TCP small initial window:               False
  Reject TCP SYN with different seq/options:     True
  ICMP Unreachable Packet Rate:                  200 pps
\--------------------------------------------------------------------------------
Application trickling scan parameters:
  Timeout to determine application trickling:    10 secs
  Resource utilization threshold to start scan:  80%
  Scan scaling factor over regular aging:        8
\--------------------------------------------------------------------------------
Session behavior when resource limit is reached: drop
\--------------------------------------------------------------------------------
Pcap token bucket rate                         : 10485760
\--------------------------------------------------------------------------------
Max pending queued mcast packets per session   : 0
\--------------------------------------------------------------------------------