«

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I am having a problem with a 3620 and session creation rate. This has been
happening about weekly, and a reload of the router fixes it. But that is a
bit drastic. There is a public dns/ntp server on the network, and 'show ip
inspect sessions' shows about 130 dns sessions open, and about 24 ntp
sessions in half open state.

show ip inspect stat

Interfaces configured for inspection 3
Session creations since subsystem startup or last reset 1227665
Current session counts (estab/half-open/terminating) [164:26:0]
Maxever session counts (estab/half-open/terminating) [362:47:4]
Last session created 00:00:00
Last statistic reset never
Last session creation rate 1607
Last half-open session total 26
Half-open session count or session creation rate exceeded

When it gets into this state, new outbound tcp connections from internal
machines hang, so web browsing and outbound email slows to a crawl. Not
all outbound tcp connections timeout, but many of them do.

ip inspect alert-off
ip inspect max-incomplete high 2000
ip inspect max-incomplete low 800
ip inspect one-minute high 2000
ip inspect one-minute low 800

Is there a command to reset the ip inspect subsystem? Should those
high/low limits above be raised to the 5-8K range?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFEGZFxL6j7milTFsERAodxAJ9UxRRxR3u5wRsMG2qcHI J3qMZJSgCfep6n
JQDhbJ5H7TkFCRqg6E5yMMs=
=LP2B
-----END PGP SIGNATURE-----

Try

show ip inspect stat reset


This SHOULD be a clear command. If you have a Cisco support contract
open a case and requested that it be changed.

see the following URL for some procedures and other commands

http://www.cisco.com/en/US/products/...8009464d.shtml


BTW why is there so many NTP session. Do you not have a NTP server
inside your network ?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, 16 Mar 2006 08:36:13 -0800, Merv wrote:

> Try
> show ip inspect stat reset


> This SHOULD be a clear command. If you have a Cisco support contract open
> a case and requested that it be changed.

Thanks!


> see the following URL for some procedures and other commands

> http://www.cisco.com/en/US/products/...tem09186a00800
> 9464d.shtml

Ah, it seems that I need

ip inspect one-minute high 4000
ip inspect one-minute low 3000


> BTW why is there so many NTP session. Do you not have a NTP server inside
> your network ?

Yes, but it is a public stratum 2 server, with many external clients.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFEGhGmL6j7milTFsERAhnQAJ4zRmpoLjwNctNm8Uk9A/8xKqEEEgCfYVih
l/k8C5EF/E6OMD4CVz0rgBs=
=3Tfq
-----END PGP SIGNATURE-----