Clearing hitcnt?

[pixboy]

OK, so this should be a simple one (I hope). How do you clear the "hitcnt" (hit count) numbers that show up in the Pix? We have a 520UR running 5.2.1 and we're trying to track down a large amount of traffic that's coming through the firewall and clogging up the works. A co-worker of mine resorted to resetting the Pix to clear the numbers, but that tends to result in downtime, so that's not a good option.

When you do a sh conduit w.x.y.z (yes, we're still using conduits -- that's not the issue right now!), it shows the conduits configured for w.x.y.z and the number of hits for each one. I need to reset the number of hits for each to zero.

I've tried searching this forum, Cisco's site and Google for the answers, but if it's out there, it's just too well buried.

Thanks!

 

[dx1]

clear access-list "access-list name" counters

 

[pixboy]

Since we don't use access-lists on our Pix, would this work:

clear conduit (whatever the rest of the conduit line is) counters

????

 

[yizhar]

HI.

Seems to me that you need either:

A network monitor (sniffer) to capture and analyze the traffic.

Or - logging to syslog server with level 6, and using software/scripts to parse the syslog messages.

Each option will need to support the high ammount of traffic. The syslog server option can scale well because it captures only sessions and not each byte. (But you will need some disk space...)

You should also use the command:
show conn
To monitor the current sessions.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[pixboy]

We're using various network monitors to capture packets. The Pix's hitcnt figures can be useful in figuring out where to start monitoring. The only way we'd been able to reset those counters was to reboot the Pix, which isn't a pleasant option.

 

[elhefe]

well, i don't think that this post is very actual! but just in case someone else needs a answer:

if you work with access-lists, you can clear the hitount by entering "clear access-list aclname counters"