-
Cisco ASA Series Command Reference
-
About this Guide
-
Using the Command Line Interface
- A through B Commands
-
C Commands
-
cache -- clear compression
-
clear configure -- clear configure http
-
clear configure flow-export-- clear configure zonelabs-integrity
-
clear conn -- clear isakmp sa
-
clear local-host -- clear xlate
-
client-access-rule -- crl-configure
-
crypto ca authenticate -- crypto ipsec ikev1 transform-set mode transport
-
crypto isakmp disconnect-notify -- cxsc auth-proxy port
-
-
D through F Commands
-
database path -- debug cxsc
-
debug dap -- debug http-map
-
debug icmp -- debug ospfv3
-
debug parser cache -- debug xml
-
default -- dhcp-server
-
dhcpd address -- distribute-list out
-
dns domain-lookup -- dynamic-filter whitelist
-
eigrp log-neighbor-changes -- export webvpn webcontent
-
failover -- fallback
-
file-bookmarks -- functions
-
- G through I Commands
- J through L Commands
- M through O Commands
- P through R Commands
-
S Commands
-
same-security-traffic -- shape
-
show aaa kerberos -- show asdm sessions
-
show asp cluster counter -- show asp table vpn-context
-
show blocks -- show cpu
-
show crashinfo -- show curpriv
-
show ddns update interface -- show environment
-
show failover -- show ipsec stats traffic
-
show ipv6 access-list -- show ipv6
-
show isakmp ipsec-over-tcp stats -- show ospf virtual-links
-
show nac-policy -- show ospf virtual-links
-
show pager -- show route
-
show running-config -- show running-config ctl-provider
-
show running-config ddns -- show running-config isakmp
-
show running-config ipv6 router -- show running-config router
-
show running-config same-security-traffic -- show running-config xlate
-
show scansafe -- show switch vlan
-
show tcpstat -- show traffic
-
show uauth -- show xlate
-
shun -- snmp-server user
-
software-version -- storage-objects
-
subject-name -- sysopt radius ignore-secret
-
- T through Z Commands
-
Cisco IOS Commands for the ASASM
-
Feedback
Table Of Contents
show isakmp ipsec-over-tcp stats through show ospf virtual-links Commands
show isakmp ipsec-over-tcp stats
show logging flow-export-syslogs
show memory delayed-free-poisoner
show isakmp ipsec-over-tcp stats through show ospf virtual-links Commands
show isakmp ipsec-over-tcp stats
To display runtime statistics for IPsec over TCP, use the show isakmp ipsec-over tcp stats command in global configuration mode or privileged EXEC mode.
show isakmp ipsec-over-tcp stats
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The output from this command includes the following fields:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example, issued in global configuration mode, displays ISAKMP statistics:
hostname(config)# show isakmp ipsec-over-tcp statsGlobal IPsec over TCP Statistics--------------------------------Embryonic connections: 2Active connections: 132Previous connections: 146Inbound packets: 6000Inbound dropped packets: 30Outbound packets: 0Outbound dropped packets: 0RST packets: 260Received ACK heart-beat packets: 10Bad headers: 0Bad trailers: 0Timer failures: 0Checksum errors: 0Internal errors: 0hostname(config)#Related Commands
show isakmp sa
To display the IKE runtime SA database, use the show isakmp sa command in global configuration mode or privileged EXEC mode.
show isakmp sa [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The output from this command includes the following fields:
Detail not specified.
IKE Peer
Type
Dir
Rky
State
Encrypt
Hash
Auth
Lifetime
209.165.200.225
L2L
Init
No
MM_Active
3des
md5
preshrd
86400
Detail specified.
Examples
The following example, entered in global configuration mode, displays detailed information about the SA database:
hostname(config)# show isakmp sa detailIKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime1 209.165.200.225 User Resp No AM_Active 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime2 209.165.200.226 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime3 209.165.200.227 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime4 209.165.200.228 User Resp No AM_ACTIVE 3des SHA preshrd 86400hostname(config)#Related Commands
show isakmp stats
To display runtime statistics, use the show isakmp stats command in global configuration mode or privileged EXEC mode.
show isakmp stats
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
Each one of the counters maps to an associated cikePhase1GW counter. For details on each of these counters, refer to CISCO-IPSEC-FLOW-MONITOR-MIB.my.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
The output from this command includes the following fields:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example, issued in global configuration mode, displays ISAKMP statistics:
hostname(config)# show isakmp statsGlobal IKE StatisticsActive Tunnels: 132Previous Tunnels: 132In Octets: 195471In Packets: 1854In Drop Packets: 925In Notifys: 0In P2 Exchanges: 132In P2 Exchange Invalids: 0In P2 Exchange Rejects: 0In P2 Sa Delete Requests: 0Out Octets: 119029Out Packets: 796Out Drop Packets: 0Out Notifys: 264Out P2 Exchanges: 0Out P2 Exchange Invalids: 0Out P2 Exchange Rejects: 0Out P2 Sa Delete Requests: 0Initiator Tunnels: 0Initiator Fails: 0Responder Fails: 0System Capacity Fails: 0Auth Fails: 0Decrypt Fails: 0Hash Valid Fails: 0No Sa Fails: 0hostname(config)#Related Commands
show kernel
To display information that the Linux brctl utility provides that you can use for debugging, use the show kernel command in privileged EXEC mode.
show kernel [process | bridge | cgroup-controller | ifconfig | module ]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
8.0(2)
This command was introduced.
8.4(1)
The cgroup-controller keyword was added.
8.6(1)
The ifconfig, module, and bridge keywords were added.
Usage Guidelines
This command displays statistics for the various processes running on the kernel.
Examples
The following example displays output from the show kernel process command:
hostname# show kernel processPID PPID PRI NI VSIZE RSS WCHAN STAT RUNTIME COMMAND1 0 16 0 991232 268 3725684979 S 78 init2 1 34 19 0 0 3725694381 S 0 ksoftirqd/03 1 10 -5 0 0 3725736671 S 0 events/04 1 20 -5 0 0 3725736671 S 0 khelper5 1 20 -5 0 0 3725736671 S 0 kthread7 5 10 -5 0 0 3725736671 S 0 kblockd/08 5 20 -5 0 0 3726794334 S 0 kseriod66 5 20 0 0 0 3725811768 S 0 pdflush67 5 15 0 0 0 3725811768 S 0 pdflush68 1 15 0 0 0 3725824451 S 2 kswapd069 5 20 -5 0 0 3725736671 S 0 aio/0171 1 16 0 991232 80 3725684979 S 0 init172 171 19 0 983040 268 3725684979 S 0 rcS201 172 21 0 1351680 344 3725712932 S 0 lina_monitor202 201 16 0 1017602048 899932 3725716348 S 212 lina203 202 16 0 1017602048 899932 0 S 0 lina204 203 15 0 1017602048 899932 0 S 0 lina205 203 15 0 1017602048 899932 3725712932 S 6 lina206 203 25 0 1017602048 899932 0 R 13069390 linahostname#Table 51-1 shows each field description.
The following example displays output from the show kernel module command:
hostname# show kernel moduleModule Size Used by Tainted: Pcpp_base 861808 2kvm_intel 44104 8kvm 174304 1 kvm_intelmsrif 4180 0tscsync 3852 0The following example displays output for the show kernel ifconfig commands:
hostname# show kernel ifconfig
br0 Link encap:Ethernet HWaddr 42:9E:B8:6C:1F:23UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1RX packets:43 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:1708 (1.6 KiB) TX bytes:0 (0.0 B)br1 Link encap:Ethernet HWaddr 6A:03:EC:BA:89:26UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)lo Link encap:Local Loopbackinet addr:127.0.0.1 Mask:255.255.255.255UP LOOPBACK RUNNING MTU:16436 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)tap0 Link encap:Ethernet HWaddr 6A:0C:48:32:FE:F4inet addr:127.0.2.2 Bcast:127.255.255.255 Mask:255.0.0.0UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1RX packets:148 errors:0 dropped:0 overruns:0 frame:0TX packets:186 errors:0 dropped:13 overruns:0 carrier:0collisions:0 txqueuelen:500RX bytes:10320 (10.0 KiB) TX bytes:12452 (12.1 KiB)tap1 Link encap:Ethernet HWaddr 8E:E7:61:CF:E9:BDUP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1RX packets:259 errors:0 dropped:0 overruns:0 frame:0TX packets:187 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:500RX bytes:19368 (18.9 KiB) TX bytes:14638 (14.2 KiB)tap2 Link encap:Ethernet HWaddr 6A:03:EC:BA:89:26UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:500RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)tap3 Link encap:Ethernet HWaddr 42:9E:B8:6C:1F:23UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1RX packets:187 errors:0 dropped:0 overruns:0 frame:0TX packets:256 errors:0 dropped:3 overruns:0 carrier:0collisions:0 txqueuelen:500RX bytes:14638 (14.2 KiB) TX bytes:19202 (18.7 KiB)tap4 Link encap:Ethernet HWaddr 6A:5C:60:BC:9C:EDUP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:500RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)Related Commands
show kernel bridge
To display the Linux bridges, their member ports, and MAC addresses that have been learned at each port that you can use for debugging, use the show kernel bridge command in privileged EXEC mode.
show kernel bridge [mac-address bridge name]
Syntax Description
bridge name
Displays the bridge name.
mac-address
Displays the MAC address associated with each port.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command shows the Linux bridges, their member ports, and the MAC addresses that have been learned at each port (including remote MAC addresses) that you can use for debugging.
Examples
The following example displays output from the show kernel bridge command:
hostname# show kernel bridgebridge name bridge id STP enabled interfacesbr0 8000.0e3cd8a8909f no tap1tap3br1 8000.26d29f51a490 no tap2tap4tap5hostname#The following example displays output from the show kernel bridge mac-address command:
hostname# show kernel bridge mac-address br1port no mac addr is local? ageing timer1 00:21:d8:cb:dc:f7 no 12.933 00:22:bd:d8:7d:da no 12.932 26:d2:9f:51:a4:90 yes 0.001 4e:a4:e0:73:1f:ab yes 0.003 52:04:38:3d:79:c0 yes 0.00Related Commands
show lacp
To display EtherChannel LACP information such as traffic statistics, system identifier, and neighbor details, enter this command in privileged EXEC mode.
show lacp {[channel_group_number] {counters | internal | neighbor} | sys-id}
Syntax Description
Command Default
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show lacp sys-id command:
hostname# show lacp sys-id32768,001c.c4e5.cfeeThe following is sample output from the show lacp counters command:
hostname# show lacp countersLACPDUs Marker Marker Response LACPDUsPort Sent Recv Sent Recv Sent Recv Pkts Err---------------------------------------------------------------------Channel group: 1Gi3/1 736 728 0 0 0 0 0Gi3/2 739 730 0 0 0 0 0Gi3/3 739 732 0 0 0 0 0The following is sample output from the show lacp internal command:
hostname# show lacp internalFlags: S - Device is requesting Slow LACPDUsF - Device is requesting Fast LACPDUsA - Device is in Active mode P - Device is in Passive modeChannel group 1LACP port Admin Oper Port PortPort Flags State Priority Key Key Number State-----------------------------------------------------------------------------Gi3/1 SA bndl 32768 0x1 0x1 0x302 0x3dGi3/2 SA bndl 32768 0x1 0x1 0x303 0x3dGi3/3 SA bndl 32768 0x1 0x1 0x304 0x3dThe following is sample output from the show lacp neighbor command:
hostname# show lacp neighborFlags: S - Device is requesting Slow LACPDUsF - Device is requesting Fast LACPDUsA - Device is in Active mode P - Device is in Passive modeChannel group 1 neighborsPartner's information:Partner Partner LACP Partner Partner Partner Partner PartnerPort Flags State Port Priority Admin Key Oper Key Port Number Port State-----------------------------------------------------------------------------------Gi3/1 SA bndl 32768 0x0 0x1 0x306 0x3dGi3/2 SA bndl 32768 0x0 0x1 0x303 0x3dGi3/3 SA bndl 32768 0x0 0x1 0x302 0x3dRelated Commands
show lacp cluster
To show the cLACP system MAC and ID, use the show lacp cluster command in privileged EXEC mode.
show lacp cluster {system-mac | system-id}
Syntax Description
system-mac
Shows the system ID and whether it was auto-generated or entered manually.
system-id
Shows the system ID and priority.
Command Default
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Set the cLACP system ID and priority using the clacp system-mac command.
Examples
The following is sample output from the show lacp cluster system-mac command:
hostname(cfg-cluster)# show lacp cluster system-maclacp cluster system MAC is automatically generated: a300.010a.010a.The following is sample output from the show lacp cluster system-id command:
hostname(cfg-cluster)# show lacp cluster system-id5 ,a300.010a.010aRelated Commands
show local-host
To display the network states of local hosts, use the show local-host command in privileged EXEC mode.
show local-host | include interface [ip_address] [detail] [all][brief] [connection {tcp start[-end] | udp start[-end] | embryonic start[-end]}]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show local-host command lets you display the network states of local hosts. A local-host is created for any host that forwards traffic to, or through, the ASA.
This command lets you show the translation and connection slots for the local hosts. This command provides information for hosts that are configured with the nat 0 access-list command when normal translation and connection states may not apply.
This command also displays the connection limit values. If a connection limit is not set, the value displays as 0 and the limit is not applied.
For models with host limits, In routed mode, hosts on the inside (Work and Home zones) count towards the limit only when they communicate with the outside (Internet zone). Internet hosts are not counted towards the limit. Hosts that initiate traffic between Work and Home are also not counted towards the limit. The interface associated with the default route is considered to be the Internet interface. If there is no default route, hosts on all interfaces are counted toward the limit. In transparent mode, the interface with the lowest number of hosts is counted towards the host limit.
In the event of a SYN attack (with TCP intercept configured), the show local-host command output includes the number of intercepted connections in the usage count. This field typically displays only full open connections.
In the show local-host command output, the TCP embryonic count to host counter is used when a maximum embryonic limit (TCP intercept watermark) is configured for a host using a static connection. This counter shows the total embryonic connections to the host from other hosts. If this total exceeds the maximum configured limit, TCP intercept is applied to new connections to the host.
Examples
The following is sample output from the show local-host command:
hostname# show local-hostInterface inside: 0 active, 0 maximum active, 0 deniedInterface outside: 1 active, 2 maximum active, 0 deniedThe following is sample output from the show local-host command on an ASA with host limits:
hostname# show local-hostDetected interface 'outside' as the Internet interface. Host limit applies to all other interfaces.Current host count: 3, towards licensed host limit of: 50Interface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 0 active, 0 maximum active, 0 deniedThe following is sample output from the show local-host command on an ASA with host limits. But without a default route, the host limits apply to all interfaces. The default route interface might not be detected if the default route or the interface that the route uses is down.
hostname# show local-hostUnable to determine Internet interface from default route. Host limit applied to all interfaces.Current host count: 3, towards licensed host limit of: 50Interface c1in: 1 active, 1 maximum active, 0 deniedInterface c1out: 0 active, 0 maximum active, 0 deniedThe following is sample output from the show local-host command on an ASA with unlimited hosts:
hostname# show local-hostLicensed host limit: UnlimitedInterface c1in: 1 active, 1 maximum active, 0 deniedInterface c1out: 0 active, 0 maximum active, 0 deniedThe following examples show the network states of local hosts:
hostname# show local-host allInterface outside: 1 active, 2 maximum active, 0 deniedlocal host: <11.0.0.4>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464Interface inside: 1 active, 2 maximum active, 0 deniedlocal host: <17.3.8.2>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464Interface NP Identity Ifc: 2 active, 4 maximum active, 0 deniedlocal host: <11.0.0.3>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464local host: <17.3.8.1>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464hostname# show local-host 10.1.1.91Interface third: 0 active, 0 maximum active, 0 deniedInterface inside: 1 active, 1 maximum active, 0 deniedlocal host: <10.1.1.91>,TCP flow count/limit = 1/unlimitedTCP embryonic count to (from) host = 0 (0)TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedXlate:PAT Global 192.150.49.1(1024) Local 10.1.1.91(4984)Conn:TCP out 192.150.49.10:21 in 10.1.1.91:4984 idle 0:00:07 bytes 75 flags UI Interfaceoutside: 1 active, 1 maximum active, 0 deniedhostname# show local-host 10.1.1.91 detailInterface third: 0 active, 0 maximum active, 0 deniedInterface inside: 1 active, 1 maximum active, 0 deniedlocal host: <10.1.1.91>,TCP flow count/limit = 1/unlimitedTCP embryonic count to (from) host = 0 (0)TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedXlate:TCP PAT from inside:10.1.1.91/4984 to outside:192.150.49.1/1024 flags riConn:TCP outside:192.150.49.10/21 inside:10.1.1.91/4984 flags UI Interface outside: 1 active, 1 maximum active, 0 deniedThe following example shows all hosts who have at least four UDP connections and have between one to 10 TCP connections at the same time:hostname# show local-host connection udp 4 tcp 1-10Interface mng: 0 active, 3 maximum active, 0 deniedInterface INSIDE: 4 active, 5 maximum active, 0 deniedlocal host: <10.1.1.11>,TCP flow count/limit = 1/unlimited TCP embryonic count to host = 0 TCP intercept watermark = unlimited UDP flow count/limit = 4/unlimitedXlate:Global 192.168.1.24 Local 10.1.1.11 Conn: UDP out 192.168.1.10:80 in 10.1.1.11:1730 idle 0:00:21 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1729 idle 0:00:22 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1728 idle 0:00:23 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1727 idle 0:00:24 bytes 0 flags - TCP out 192.168.1.10:22 in 10.1.1.11:27337 idle 0:01:55 bytes 2641 flags UIO Interface OUTSIDE: 3 active, 5 maximum active, 0 deniedThe following example shows local-host addresses and connection counters using the brief option:
hostname# show local-host connection udp 2Interface mng: 0 active, 3 maximum active, 0 deniedInterface INSIDE: 4 active, 5 maximum active, 0 deniedlocal host: <10.1.1.11>,TCP flow count/limit = 1/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimited UDP flow count/limit = 4/unlimitedInterface OUTSIDE: 3 active, 5 maximum active, 0 deniedThe following examples shows the output when using the brief and connection options:
hostname# show local-host briefInterface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 1 active, 1 maximum active, 0 deniedInterface mgmt: 5 active, 6 maximum active, 0 deniedhostname# show local-host connectionInterface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 1 active, 1 maximum active, 0 deniedInterface mgmt: 5 active, 6 maximum active, 0 deniedRelated Commands
clear local-host
Releases network connections from local hosts displayed by the show local-host command.
nat
Associates a network with a pool of global IP addresses.
show logging
To show the logs in the buffer or other logging settings, use the show logging command in privileged EXEC mode.
show logging [message [syslog_id | all] | asdm | queue | setting]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command.
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
If the logging buffered command is in use, the show logging command without any keywords shows the current message buffer and the current settings.
The show logging queue command allows you to display the following:
•
•
•
•
Note
Examples
The following is sample output from the show logging command:
hostname(config)# show loggingSyslog logging: enabledFacility: 20Timestamp logging: enabledStandby logging:disabledDebug-trace logging: disabledConsole logging: level informational, 3962 messages loggedMonitor logging: disabledBuffer logging: disabledTrap logging: level informational, facility 20, 20549 messages loggedLogging to inside 10.2.5.3 tcp/50001 connectedPermit-hostdown stateHistory logging: disabledDevice ID: disabledMail logging: disabledASDM logging: disabled
Note
The following is sample output from the show logging command with a secure syslog server configured:
hostname(config)# logging host inside 10.0.0.1 TCP/1500 securehostname(config)# show loggingSyslog logging: disabledFacility:Timestamp logging: disabledDeny Conn when Queue Full: disabledConsole logging: level debugging, 135 messages loggedMonitor logging: disabledBuffer logging: disabledTrap logging: list show _syslog, facility, 20, 21 messages loggedLogging to inside 10.0.0.1 tcp/1500 SECUREHistory logging: disabledDevice ID: disabledMail logging: disabledASDM logging disabledThe following is sample output from the show logging queue command:
hostname(config)# show logging queueLogging Queue length limit: 512 msg(s)0 msg(s) discarded due to queue overflow0 msg(s) discarded due to memory allocation failureCurrent 0 msgs on queue, 0 msgs most on queueThe following is sample output from the show logging message all command:
hostname(config)# show logging message allsyslog 111111: default-level alerts (enabled)syslog 101001: default-level alerts (enabled)syslog 101002: default-level alerts (enabled)syslog 101003: default-level alerts (enabled)syslog 101004: default-level alerts (enabled)syslog 101005: default-level alerts (enabled)syslog 102001: default-level alerts (enabled)syslog 103001: default-level alerts (enabled)syslog 103002: default-level alerts (enabled)syslog 103003: default-level alerts (enabled)syslog 103004: default-level alerts (enabled)syslog 103005: default-level alerts (enabled)syslog 103011: default-level alerts (enabled)syslog 103012: default-level informational (enabled)Related Commands
show logging flow-export-syslogs
To display all of the syslog messages whose information is also captured by NetFlow and that will be affected by the logging flow-export-syslogs enable | disable commands, use the show logging flow-export-syslogs command in privileged EXEC mode.
show logging flow-export-syslogs
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
After you enter the logging flow-export syslogs disable command, make sure that you know which syslog messages have been disabled. The disabled syslog messages are as follows:
Examples
The following is sample output from the show logging flow-export-syslogs command, which lists the syslog messages that will be disabled:
hostname(config)# show logging flow-export-syslogsSyslog ID Type Status302013 Flow Created Enabled302015 Flow Created Enabled302017 Flow Created Enabled302020 Flow Created Enabled302014 Flow Deleted Enabled302016 Flow Deleted Enabled302018 Flow Deleted Enabled302021 Flow Deleted Enabled106015 Flow Denied Enabled106023 Flow Denied Enabled313001 Flow Denied Enabled313008 Flow Denied Enabled710003 Flow Denied Enabled106100 Flow Created/Denied EnabledRelated Commands
show logging rate-limit
To display disallowed syslog messages, use the show logging rate-limit command in privileged EXEC mode.
show logging rate-limit
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
After the information is cleared, nothing more displays until the hosts reestablish their connections.
Examples
The following example shows sample output from the show logging rate-limit command:
hostname(config)# show logging rate-limit%ASA-7-710005: TCP request discarded from 171.69.39.0/2678 to management:10.89.130.244/443%ASA-7-711002: Task ran for 27 msec, Process = ssm_mgmt_ifc_poll_thread, PC = 896fcac, Traceback =%ASA-7-711002: Task ran for 27 msec, Process = ssm_mgmt_ifc_poll_thread, PC = 896fcac, Traceback = 0x0807C0FA%ASA-6-106015: Deny TCP (no connection) from 171.69.39.0/2685 to 10.89.130.244/443 flags FIN PSH ACK on interface management%ASA-7-710005: TCP request discarded from 171.69.39.0/2685 to management:10.89.130.244/443%ASA-6-302013: Built inbound TCP connection 2116 for management:171.69.39.0/2689 (171.69.39.0/2689) to identity:10.89.130.244/443 (10.89.130.244/443)%ASA-6-725001: Starting SSL handshake with client management:171.69.39.0/2689 for TLSv1 session.%ASA-6-725003: SSL client management:171.69.39.0/2689 request to resume previous session.%ASA-6-725002: Device completed SSL handshake with client management:171.69.39.0/2689%ASA-6-605005: Login permitted from 171.69.39.0/2689 to management:10.89.130.244/https for user "enable_15"%ASA-5-111007: Begin configuration: 171.69.39.0 reading from http [POST]Related Commands
show mac-address-table
To show the MAC address table, use the show mac-address-table command in privileged EXEC mode.
show mac-address-table [interface_name | count | static]
Syntax Description
Defaults
If you do not specify an interface, all interface MAC address entries are shown.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show mac-address-table command:
hostname# show mac-address-tableinterface mac address type Time Left-----------------------------------------------------------------------outside 0009.7cbe.2100 static -inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table command for the inside interface:
hostname# show mac-address-table insideinterface mac address type Time Left-----------------------------------------------------------------------inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table count command:
hostname# show mac-address-table countStatic mac-address bridges (curr/max): 0/65535Dynamic mac-address bridges (curr/max): 103/65535Related Commands
show management-access
To display the name of the internal interface configured for management access, use the show management-access command in privileged EXEC mode.
show management-access
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The management-access command lets you define an internal management interface using the IP address of the firewall interface specified in mgmt_if. (The interface names are defined by the nameif command and displayed in quotes, " ", in the output of the show interface command.)
Examples
The following example shows how to configure a firewall interface named "inside" as the management access interface and display the result:
hostname(config)# management-access insidehostname(config)# show management-accessmanagement-access insideRelated Commands
show memory
To display a summary of the maximum physical memory and current free memory available to the operating system, use the show memory command in privileged EXEC mode.
[cluster exec] show memory [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show memory command lets you display a summary of the maximum physical memory and current free memory available to the operating system. Memory is allocated as needed.
You can also display the information from the show memory command using SNMP.
You can use the show memory detail output with the show memory binsize command to debug memory leaks.
The show memory detail command output can be broken down into three sections: Summary, DMA Memory, and HEAP Memory. The summary displays how the total memory is allocated. Memory that is not tied to DMA or reserved is considered the HEAP. The Free Memory value is the unused memory in the HEAP. The Allocated memory in use value is how much of the HEAP has been allocated. The breakdown of HEAP allocation is displayed later in the output. Reserved memory and DMA Reserved memory are used by different system processes and primarily VPN services.
Values displayed in the allocated memory statistics total (bytes) column do not reflect real values (MEMPOOL_GLOBAL_SHARED POOL STATS) in the show memory detail command output.
The output shows that the block of size 49,152 was allocated then returned to the free pool, and another block of size 131,072 was allocated. In this case, you would think that free memory decreased by 131,072-49,152=81,920 bytes, but it actually decreased by 100,000 bytes (see the Free memory line).
hostname# show memory detailMEMPOOL_GLOBAL_SHARED POOL STATS: MEMPOOL_GLOBAL_SHARED POOL STATS:Non-mmapped bytes allocated = 1862270976 Non-mmapped bytes allocated = 1862270976Number of free chunks = 99 Number of free chunks = 100Number of mmapped regions = 0 Number of mmapped regions = 0Mmapped bytes allocated = 0 Mmapped bytes allocated = 0Max memory footprint = 1862270976 Max memory footprint = 1862270976Keepcost = 1762019304 Keepcost = 1761869256Max contiguous free mem = 1762019304 Max contiguous free mem = 1761869256Allocated memory in use = 100133944 Allocated memory in use = 100233944Free memory = 1762137032 Free memory = 1762037032----- fragmented memory statistics ----- ----- fragmented memory statistics -----fragment size count total fragment size count total(bytes) (bytes) (bytes) (bytes)---------------- ---------- -------------- ---------------- ---------- --------------32768 1 33176 32768 1 3317649152 1 500481762019304 1 1762019304* 1761869256 1 1761869256*----- allocated memory statistics ----- ----- allocated memory statistics -----fragment size count total fragment size count total(bytes) (bytes) (bytes) (bytes)---------------- ---------- -------------- ---------------- ---------- --------------49152 10 491520 49152 9 44236865536 125 8192000 65536 125 819200098304 3 294912 98304 3 294912131072 18 2359296 131072 19 2490368The following output confirms that a block of size 150,000 was allocated, instead of 131,072:
hostname# show memory binsize 131072MEMPOOL_DMA pool bin stats:MEMPOOL_GLOBAL_SHARED pool bin stats:pc = 0x8eda524, size = 150000 , count = 1pc = 0x8f08054, size = 163904 , count = 1pc = 0x846e477, size = 139264 , count = 1pc = 0x8068691, size = 393216 , count = 3pc = 0x8eea09b, size = 131072 , count = 1pc = 0x88ca830, size = 141212 , count = 1pc = 0x9589e93, size = 593580 , count = 4pc = 0x9589bd2, size = 616004 , count = 4pc = 0x8f2e060, size = 327808 , count = 2pc = 0x8068284, size = 182000 , count = 10x8eda524 <logger_buffer_init_int+148 at syslog/main.c:403>The approximate number of total bytes shown in the show memory detail command output is by design. There are two reasons for this:
•
•
Examples
The following is sample output from the show memory command:
hostname# show memoryFree memory: 845044716 bytes (79%)Used memory: 228697108 bytes (21%)------------- ----------------Total memory: 1073741824 bytes (100%)The following is sample output from the show memory detail command:
hostname# show memory detailFree memory: 130546920 bytes (49%)Used memory: 137888536 bytes (51%)Allocated memory in use: 33030808 bytes (12%)Reserved memory: 65454208 bytes (24%)DMA Reserved memory: 39403520 bytes (15%)----------------------------------------------------Total memory: 268435456 bytes (100%)Dynamic Shared Objects(DSO): 0 bytesDMA memory:Unused memory: 3212128 bytes (8%)Crypto reserved memory: 2646136 bytes (7%)Crypto free: 1605536 bytes (4%)Crypto used: 1040600 bytes (3%)Block reserved memory: 33366816 bytes (85%)Block free: 31867488 bytes (81%)Block used: 1499328 bytes (4%)Used memory: 178440 bytes (0%)----------------------------------------------------Total memory: 39403520 bytes (100%)HEAP memory:Free memory: 130546920 bytes (80%)Used memory: 33030808 bytes (20%)Init used memory by library: 4218752 bytes (3%)Allocated memory: 28812056 bytes (18%)----------------------------------------------------Total memory: 163577728 bytes (100%)Least free memory: 122963528 bytes (75%)Most used memory: 40614200 bytes (25%)----- fragmented memory statistics -----fragment size count total(bytes) (bytes)---------------- ---------- --------------16 113 1808<More>The following is sample output from the show memory command on the ASA 5525 after enabling the jumbo-frame reservation command and issuing the write memory command and the reload command:
hostname# show memoryFree memory: 3008918624 bytes (70%)Used memory: 1286048672 bytes (30%)------------- ----------------------Total memory: 4294967296 bytes (100%)The following is sample output from the show memory command on the ASA 5525 without enabling the jumbo-frame reservation command:
hostname# show memoryFree memory: 3318156400 bytes (77%)Used memory: 976810896 bytes (23%)------------- ------------------Total memory: 4294967296 bytes (100%)The following is sample output from the show memory command on the ASA 5515 after enabling the jumbo-frame reservation command:
hostname# show memoryFree memory: 3276619472 bytes (76%)Used memory: 1018347824 bytes (24%)------------- ------------------Total memory: 4294967296 bytes (100%)The following is sample output from the show memory command on the ASA 5515 without enabling the jumbo-frame reservation command:
hostname# show memoryFree memory: 3481145472 bytes (81%)Used memory: 813821824 bytes (19%)------------- ------------------Total memory: 4294967296 bytes (100%)The following is sample output from the show memory command on the ASA 5585 after enabling the jumbo-frame reservation command:
hostname# show memoryFree memory: 8883297824 bytes (69%)Used memory: 4001604064 bytes (31%)------------- ------------------Total memory: 12884901888 bytes (100%)The following is sample output from the show memory command on the ASA 5585 without enabling the jumbo-frame reservation command:
hostname# show memoryFree memory: 9872205104 bytes (77%)Used memory: 3012696784 bytes (23%)------------- ------------------Total memory: 12884901888 bytes (100%)The following is sample output from the show memory command on the ASA 5520, which does not support the jumbo-frame command:
hostname# show memoryree memory: 206128232 bytes (38%)Used memory: 330742680 bytes (62%)------------- -----------------Total memory: 536870912 bytes (100%)The following is sample output from the show memory command on the ASA 5505, which does not support the jumbo-frame command:
hostname# show memoryFree memory: 48457848 bytes (18%)Used memory: 219977608 bytes (82%)------------- -----------------Total memory: 268435456 bytes (100%Related Commands
show memory api
To display the malloc stack APIs that are registered in the system , use the show memory api command in privileged EXEC mode.
show memory api
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
This command displays the malloc stack APIs that are registered in the system.
If any of the memory debugging features are turned on (that is, delay-free-poisoner, memory tracker, or memory profiler), their APIs appear in the show memory api command output.
Examples
This following is sample output from the show memory api command:
hostname# show memory apiResource Manager (0) ->Tracking (0) ->Delayed-free-poisoner (0) ->Core malloc package (0)Related Commands
show memory app-cache
To observe memory usage by application, use the show memory app-cache command in privileged EXEC mode.
show memory app-cache [threat-detection | host | flow | tcb | http | access-list] [detail]
Syntax Descriptionshow memory app-cache [threat-detection | host | flow | tcb | http | access-list] [detail]
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
8.0(1)
This command was introduced.
8.1(1)
The access-list and http options were added.
Usage Guidelines
This command enables you to observe memory usage by application.
Examples
The following is sample output from the show memory app-cache threat-detection command:
hostname(config)# show memory app-cache threat-detectionLIMIT COUNT ALLOC FAILED BYTES USEDTOTAL 1350 460 115167 0 130926168The following is sample output from the show memory app-cache threat-detection detail command:
hostname(config)# show memory app-cache threat-detection detailCACHE NAME LIMIT COUNT ALLOC FAILED BYTES USEDTD ACE stats 50 0 2 0 1936TD Host/Port counte 100 0 2 0 48TD Host/Port counte 100 0 2 0 48TD Host/Port counte 100 0 2 0 48TD Host/Port counte 100 0 2 0 48TD Host stats 50 50 16120 0 116515360TD Subnet stats 50 2 113 0 207016TD Host/Port counte 100 100 24618 0 3544992TD Host/Port counte 100 100 24618 0 3544992TD Host/Port counte 100 100 24618 0 3544992TD Host/Port counte 100 100 24618 0 3544992TD Host/Port counte 100 2 113 0 5424TD Host/Port counte 100 2 113 0 5424TD Host/Port counte 100 2 113 0 5424TD Host/Port counte 100 2 113 0 5424LIMIT COUNT ALLOC FAILED BYTES USEDTOTAL 1350 460 115167 0 130926168The following is sample output from the show memory app-cache host detail command:
hostname(config)# show memory app-cache host detailCACHE NAME LIMIT COUNT ALLOC FAILED BYTES USEDSNP Host Core 0 1000 1000 5116 0 961808SNP Host Core 1 1000 1000 4968 0 933984SNP Host Core 2 1000 1000 5413 0 1017644SNP Host Core 3 1000 1000 4573 0 859724LIMIT COUNT ALLOC FAILED BYTES USEDTOTAL 4000 4000 20070 0 3773160The following is sample output from the show memory app-cache flow detail command:
hostname(config)# show memory app-cache flow detailCACHE NAME LIMIT COUNT ALLOC FAILED BYTES USEDSNP Conn Core 0 1000 1000 893 0 639388SNP Conn Core 1 1000 948 980 0 701680SNP Conn Core 2 1000 1000 1175 0 841300SNP Conn Core 3 1000 1000 901 0 645116LIMIT COUNT ALLOC FAILED BYTES USEDTOTAL 4000 3948 3949 0 2827484The following is sample output from the show memory app-cache access-list detail command:
hostname(config)# show memory app-cache access-list detailCACHE NAME LIMIT COUNT ALLOC FAILED BYTES USEDNP ACL log c Core 0 1000 0 1 0 68NP ACL log c Core 1 1000 0 6 0 408NP ACL log c Core 2 1000 0 19 0 1292NP ACL log c Core 3 1000 0 0 0 0NP ACL log f Core 0 1000 0 0 0 0NP ACL log f Core 1 1000 0 0 0 0NP ACL log f Core 2 1000 0 0 0 0NP ACL log f Core 3 1000 0 0 0 0LIMIT COUNT ALLOC FAILED BYTES USEDTOTAL 8000 0 26 0 1768The following is sample output from the show memory app-cache http detail command:
hostname(config)# show memory app-cache http detailCACHE NAME LIMIT COUNT ALLOC FAILED BYTES USEDInspect HTTP Core 0 1000 0 0 0 0Inspect HTTP Core 1 1000 0 0 0 0Inspect HTTP Core 2 1000 0 0 0 0Inspect HTTP Core 3 1000 0 0 0 0HTTP Result Core 0 1000 0 0 0 0HTTP Result Core 1 1000 0 0 0 0HTTP Result Core 2 1000 0 0 0 0HTTP Result Core 3 1000 0 0 0 0LIMIT COUNT ALLOC FAILED BYTES USEDTOTAL 8000 0 0 0 0The following is sample output from the show memory app-cache tcb detail command:
hostname(config)# show memory app-cache tcb detailCACHE NAME LIMIT COUNT ALLOC FAILED BYTES USEDSNP TCB Core 0 1000 1000 968 0 197472SNP TCB Core 1 1000 1000 694 0 141576SNP TCB Core 2 1000 1000 1304 0 266016SNP TCB Core 3 1000 1000 1034 0 210936LIMIT COUNT ALLOC FAILED BYTES USEDTOTAL 4000 4000 4000 0 816000Related Commands
show memory binsize
To display summary information about the chunks allocated for a specific bin size, use the show memory binsize command in privileged EXEC mode.
show memory binsize size
Syntax Description
size
Displays chunks (memory blocks) of a specific bin size. The bin size is from the "fragment size" column of the show memory detail command output.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command has no usage guidelines.
Examples
The following example displays summary information about a chunk allocated to a bin size of 500:
hostname# show memory binsize 500pc = 0x00b33657, size = 460 , count = 1Related Commands
show memory delayed-free-poisoner
To display a summary of the memory delayed-free-poisoner queue usage, use the show memory delayed-free-poisoner command in privileged EXEC mode.
show memory delayed-free-poisoner
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Use the clear memory delayed-free-poisoner command to clear the queue and statistics.
Examples
This following is sample output from the show memory delayed-free-poisoner command:
hostname# show memory delayed-free-poisonerdelayed-free-poisoner statistics:3335600: memory held in queue6095: current queue count0: elements dequeued3: frees ignored by size1530: frees ignored by locking27: successful validate runs0: aborted validate runs01:09:36: local time of last validateTable 51-2 describes the significant fields in the show memory delayed-free-poisoner command output.
Related Commands
show memory profile
To display information about the memory usage (profiling) of the ASA, use the show memory profile command in privileged EXEC mode.
show memory profile [peak] [detail | collated | status]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
Use the show memory profile command to troubleshoot memory usage level and memory leaks. You can still see the profile buffer contents even if profiling has been stopped. Starting profiling clears the buffer automatically.
Note
Examples
The following is sample output from the show memory profile command:
hostname# show memory profileRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004Total = 0The output of the show memory profile detail command is divided into six data columns and one header column, at the far left. The address of the memory bucket corresponding to the first data column is given at the header column (the hexidecimal number). The data itself is the number of bytes that is held by the text/code that falls in the bucket address. A period (.) in the data column means no memory is held by the text at this bucket. Other columns in the row correspond to the bucket address that is greater than the increment amount from the previous column. For example, the address bucket of the first data column in the first row is 0x001069e0. The address bucket of the second data column in the first row is 0x001069e4 and so on. Normally the header column address is the next bucket address; that is, the address of the last data column of the previous row plus the increment. All rows without any usage are suppressed. More than one such contiguous row can be suppressed, indicated with three periods at the header column (...).
The following is sample output from the show memory profile detail command:
hostname# show memory profile detailRange: start = 0x00100020, end = 0x00e006e0, increment = 00000004Total = 48941152...0x001069e0 . 24462 . . . ....0x00106d88 . 1865870 . . . ....0x0010adf0 . 7788 . . . ....0x00113640 . . . . 433152 ....0x00116790 2480 . . . . .<snip>The following is sample output from the show memory profile collated command:
hostname# show memory profile collatedRange: start = 0x00100020, end = 0x00e006e0, increment = 00000004Total = 4894115224462 0x001069e41865870 0x00106d8c7788 0x0010adf4433152 0x001136502480 0x00116790<More>The following is sample output from the show memory profile peak command, which shows the peak capture buffer:
hostname# show memory profile peakRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004 Total = 102400The following is sample output from the show memory profile peak detail command, which shows the peak capture buffer and the number of bytes that is held by the text/code that falls in the corresponding bucket address:
hostname# show memory profile peak detailRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004Total = 102400...0x00404c8c . . 102400 . . .The following is sample output from the show memory profile status command, which shows the current state of memory profiling and the peak capture buffer:
hostname# show memory profile statusInUse profiling: ONPeak profiling: OFFMemory used by profile buffers: 11518860 bytesProfile:0x00100020-0x00bfc3a8(00000004)Related Commands
show memory top-usage
To display the top number of allocated fragment sizes from the show memory detail command, use the show memory top-usage command in privileged EXEC mode.
show memory top-usage [num]
Syntax Description
Defaults
The default for num is 10.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Use the show memory top-usage command to display the top number of allocated fragment sizes from the show memory detail command.
This command does not use clustering and does not need to be disabled when clustering is enabled.
Examples
The following is sample output from the show memory top-usage command:
hostname# show memory top-usage 3MEMPOOL_DMA pool binsize allocated byte totals:----- allocated memory statistics -----fragment size count total(bytes) (bytes)---------------- ---------- --------------1572864 9 1415577612582912 1 125829126291456 1 6291456----- Binsize PC top usage -----Binsize: 1572864 total (bytes): 14155776pc = 0x805a870, size = 16422399 , count = 9Binsize: 12582912 total (bytes): 12582912pc = 0x805a870, size = 12960071 , count = 1Binsize: 6291456 total (bytes): 6291456pc = 0x9828a6c, size = 7962695 , count = 1MEMPOOL_GLOBAL_SHARED pool binsize allocated byte totals:----- allocated memory statistics -----fragment size count total(bytes) (bytes)---------------- ---------- --------------12582912 1 125829122097152 6 1258291265536 181 11862016----- Binsize PC top usage -----Binsize: 12582912 total (bytes): 12582912pc = 0x8249763, size = 37748736 , count = 1Binsize: 2097152 total (bytes): 12582912pc = 0x8a7ebfb, size = 2560064 , count = 1pc = 0x8aa4413, size = 2240064 , count = 1pc = 0x8a9bb13, size = 2240064 , count = 1pc = 0x8a80542, size = 2097152 , count = 1pc = 0x97e7172, size = 2097287 , count = 1pc = 0x8996463, size = 2272832 , count = 1Binsize: 65536 total (bytes): 11862016pc = 0x913db2b, size = 11635232 , count = 161pc = 0x91421eb, size = 138688 , count = 2pc = 0x97e7172, size = 339740 , count = 4pc = 0x97e7433, size = 197229 , count = 3pc = 0x82c3412, size = 65536 , count = 1pc = 0x8190e09, size = 155648 , count = 2pc = 0x8190af6, size = 77824 , count = 1pc = 0x93016a1, size = 65536 , count = 1pc = 0x89f1a40, size = 65536 , count = 1pc = 0x9131140, size = 163968 , count = 2pc = 0x8ee56c8, size = 66048 , count = 1pc = 0x8056a01, size = 66528 , count = 1pc = 0x80569e5, size = 66528 , count = 1Related Commands
show memory tracking
To display currently allocated memory tracked by the tool, use the show memory tracking command in privileged EXEC mode.
show memory tracking [address | dump | detail]
Syntax Description
address
(Optional) Shows memory tracking by address.
detail
(Optional) Shows the internal memory tracking state.
dump
(Optional) Shows the memory tracking address.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
Use the show memory tracking command to show currently allocated memory tracked by the tool.
Examples
The following is sample output from the show memory tracking command:
hostname# show memory trackingmemory tracking by caller:17 bytes from 1 allocates by 0x080c50c237 bytes from 1 allocates by 0x080c50f657 bytes from 1 allocates by 0x080c512520481 bytes from 1 allocates by 0x080c5154The following is sample output from the show memory tracking address command:
hostname# show memory tracking addressmemory tracking by caller:17 bytes from 1 allocates by 0x080c50c237 bytes from 1 allocates by 0x080c50f657 bytes from 1 allocates by 0x080c512520481 bytes from 1 allocates by 0x080c5154memory tracking by address:37 byte region @ 0xa893ae80 allocated by 0x080c50f657 byte region @ 0xa893aed0 allocated by 0x080c512520481 byte region @ 0xa8d7cc50 allocated by 0x080c515417 byte region @ 0xa8a6f370 allocated by 0x080c50c2The following is sample output from the show memory tracking dump command:
hostname# show memory tracking dumpTracking data for the 57 byte region at 0xa893aed0:Timestamp: 05:59:36.309 UTC Sun Jul 29 2007Traceback:0x080c51250x080b36950x0873f6060x087405730x080ab5300x080ac7880x080ad1410x0805df8fDumping 57 bytes of the 57 byte region:a893aed0: 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c | ................a893aee0: 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c | ................a893aef0: 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c | ................a893af00: 0c 0c 0c 0c 0c 0c 0c 0c 0c | .........Related Commands
show memory webvpn
To generate memory usage statistics for WebVPN, use the show memory webvpn command in privileged EXEC mode.
show memory webvpn [allobjects | blocks | dumpstate [cache | disk0 | disk1 | flash | ftp | system | tftp] | pools | profile [clear | dump | start | stop] | usedobjects {{begin | exclude | grep | include} line line}]
Syntax Description
Defaults
No default behavior or value.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Webvpn configuration
•
—
•
—
—
Command History
Examples
The following is sample output from the show memory webvpn allobjects command:
hostname#show memory webvpn allobjectsArena 0x36b14f8 of 4094744 bytes (61 blocks of size 66048), maximum 134195200130100456 free bytes (97%; 1969 blocks, zone 0)Arena is dynamically allocated, not contiguousFeatures: GroupMgmt: SET, MemDebugLog: unsetPool 0xd719a78 ("cp_entries" => "pool for class cpool entries") (next 0xd6d91d8)Size: 66040 (1% of current, 0% of limit)Object frame size: 32Load related limits: 70/50/30Callbacks: !init/!prep/!f2ca/!dstr/!dumpBlocks in use:Block 0xd719ac0..0xd729cb8 (size 66040), pool "cp_entries"Watermarks { 0xd7098f8 <= 0xd70bb60 <= 0xd719a60 } = 57088 readyBlock size 66040 not equal to arena block 66048 (realigned-to-8)Used objects: 0Top allocated count: 275Objects dump:0. Object 0xd70bb50: FREED (by "jvclass_pool_free")Related Commands
show memory-caller address
To display the address ranges configured on the ASA, use the show memory-caller address command in privileged EXEC mode.
show memory-caller address
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
You must first configure an address ranges with the memory caller-address command before you can display them with the show memory-caller address command.
Examples
The following examples show how to configure the address ranges with the memory caller-address command, and the resulting output of the show memory-caller address command:hostname# memory caller-address 0x00109d5c 0x00109e08hostname# memory caller-address 0x009b0ef0 0x009b0f14hostname# memory caller-address 0x00cf211c 0x00cf4464hostname# show memory-caller addressMove down stack frame for the addresses:pc = 0x00109d5c-0x00109e08pc = 0x009b0ef0-0x009b0f14pc = 0x00cf211c-0x00cf4464If address ranges are not configured before entering the show memory-caller address command, no addresses display:
hostname# show memory-caller addressMove down stack frame for the addresses:Related Commands
show mfib
To display MFIB in terms of forwarding entries and interfaces, use the show mfib command in user EXEC or privileged EXEC mode.
show mfib [group [source]] [verbose] [cluster]
Syntax Description
Defaults
Without the optional arguments, information for all groups is shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
7.0(1)
This command was introduced.
9.0(1)
The cluster keyword was added. Applies to the ASA 5580 and 5585-X only.
Examples
The following is sample output from the show mfib command:
hostname# show mfib 224.0.2.39Entry Flags: C - Directly Connected, S - Signal, IA - Inherit A flag,AR - Activity Required, D - DropForwarding counts: Pkt Count/Pkts per second/Avg Pkt Size/Kbits per secondOther counts: Total/RPF failed/Other dropsInterface flags: A - Accept, F - Forward, NS - Negate SignallingIC - Internal Copy, NP - Not platform switchedSP - Signal PresentInterface Counts: FS Pkt Count/PS Pkt Count(*,224.0.1.39) Flags: S KForwarding: 0/0/0/0, Other: 0/0/0Related Commands
show mfib verbose
Displays detail information about the forwarding entries and interfaces.
show mfib active
To display active multicast sources, use the show mfib active command in user EXEC or privileged EXEC mode.
show mfib [group] active [kbps]
Syntax Description
group
(Optional) IP address of the multicast group.
kbps
(Optional) Limits the display to multicast streams that are greater-than or equal to this value.
This command has no arguments or keywords.
Defaults
The default value for kbps is 4. If a group is not specified, all groups are shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The output for the show mfib active command displays either positive or negative numbers for the rate PPS. The ASA displays negative numbers when RPF packets fail or when the router observes RPF packets with an interfaces out (OIF) list. This type of activity may indicate a multicast routing problem.
Examples
The following is sample output from the show mfib active command:
hostname# show mfib activeActive IP Multicast Sources - sending >= 4 kbpsGroup: 224.2.127.254, (sdr.cisco.com)Source: 192.168.28.69 (mbone.ipd.anl.gov)Rate: 1 pps/4 kbps(1sec), 4 kbps(last 1 secs), 4 kbps(life avg)Group: 224.2.201.241, ACM 97Source: 192.168.52.160 (webcast3-e1.acm97.interop.net)Rate: 9 pps/93 kbps(1sec), 145 kbps(last 20 secs), 85 kbps(life avg)Group: 224.2.207.215, ACM 97Source: 192.168.52.160 (webcast3-e1.acm97.interop.net)Rate: 3 pps/31 kbps(1sec), 63 kbps(last 19 secs), 65 kbps(life avg)Related Commands
show mfib count
To display MFIB route and packet count data, use the show mfib count command in user EXEC or privileged EXEC mode.
show mfib [group [source]] count
Syntax Description
group
(Optional) IP address of the multicast group.
source
(Optional) IP address of the multicast route source. This is a unicast IP address in four-part dotted-decimal notation.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command displays packet drop statistics.
Examples
The following sample output from the show mfib count command:
hostname# show mfib countMFIB global counters are :* Packets [no input idb] : 0* Packets [failed route lookup] : 0* Packets [Failed idb lookup] : 0* Packets [Mcast disabled on input I/F] : 0Related Commands
clear mfib counters
Clears MFIB router packet counters.
show mroute count
Displays multicast route counters.
show mfib interface
To display packet statistics for interfaces that are related to the MFIB process, use the show mfib interface command in user EXEC or privileged EXEC mode.
show mfib interface [interface]
Syntax Description
Defaults
Information for all MFIB interfaces is shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following example is sample output from the show mfib interface command:
hostname# show mfib interfaceIP Multicast Forwarding (MFIB) status:Configuration Status: enabledOperational Status: runningMFIB interface status CEF-based output[configured,available]Ethernet0 up [ no, no]Ethernet1 up [ no, no]Ethernet2 up [ no, no]Related Commands
show mfib
Displays MFIB information in terms of forwarding entries and interfaces.
show mfib reserved
To display reserved groups, use the show mfib reserved command in user EXEC or privileged EXEC mode.
show mfib reserved [count | verbose | active [kpbs]]
Syntax Description
Defaults
The default value for kbps is 4.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command displays MFIB entries in the range 224.0.0.0 through 224.0.0.225.
Examples
The following is sample output from the show mfib reserved command:
hostname# command exampleEntry Flags: C - Directly Connected, S - Signal, IA - Inherit A flag,AR - Activity Required, D - Drop Forwarding Counts: Pkt Count/Pkts per second/Avg Pkt Size/Kbits per second Other counts: Total/RPF failed/Other drops Interface Flags: A - Accept, F - Forward, NS - Negate SignallingIC - Internal Copy, NP - Not platform switchedSP - Signal PresentInterface Counts: FS Pkt Count/PS Pkt Count(*,224.0.0.0/4) Flags: C KForwarding: 0/0/0/0, Other: 0/0/0(*,224.0.0.0/24) Flags: KForwarding: 0/0/0/0, Other: 0/0/0(*,224.0.0.1) Flags:Forwarding: 0/0/0/0, Other: 0/0/0outside Flags: ICdmz Flags: ICinside Flags: ICRelated Commands
show mfib status
To display the general MFIB configuration and operational status, use the show mfib status command in user EXEC or privileged EXEC mode.
show mfib status
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show mfib status command:
hostname# show mfib statusIP Multicast Forwarding (MFIB) status:Configuration Status: enabledOperational Status: runningRelated Commands
show mfib
Displays MFIB information in terms of forwarding entries and interfaces.
show mfib summary
To display summary information about the number of MFIB entries and interfaces, use the show mfib summary command in user EXEC or privileged EXEC mode.
show mfib summary
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show mfib summary command:
hostname# show mfib summaryIPv6 MFIB summary:54 total entries [1 (S,G), 7 (*,G), 46 (*,G/m)]17 total MFIB interfacesRelated Commands
show mfib verbose
To display detail information about the forwarding entries and interfaces, use the show mfib verbose command in user EXEC or privileged EXEC mode.
show mfib verbose
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show mfib verbose command:
hostname# show mfib verboseEntry Flags: C - Directly Connected, S - Signal, IA - Inherit A flag,AR - Activity Required, D - DropForwarding counts: Pkt Count/Pkts per second/Avg Pkt Size/Kbits per secondOther counts: Total/RPF failed/Other dropsInterface flags: A - Accept, F - Forward, NS - Negate SignallingIC - Internal Copy, NP - Not platform switchedSP - Signal PresentInterface Counts: FS Pkt Count/PS Pkt Count(*,224.0.1.39) Flags: S KForwarding: 0/0/0/0, Other: 0/0/0(*,224.0.1.40) Flags: S KForwarding: 0/0/0/0, Other: 0/0/0(*,224.0.0.0/8) Flags: KForwarding: 0/0/0/0, Other: 0/0/0Related Commands
show mfib
Displays MFIB information in terms of forwarding entries and interfaces.
show mfib summary
Displays summary information about the number of MFIB entries and interfaces.
show mgcp
To display MGCP configuration and session information, use the show mgcp command in privileged EXEC mode.
show mgcp {commands | sessions} [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show mgcp commands command lists the number of MGCP commands in the command queue. The show mgcp sessions command lists the number of existing MGCP sessions. The detail option includes additional information about each command (or session) in the output.
Examples
The following are examples of the show mgcp command options:
hostname# show mgcp commands1 in use, 1 most used, 200 maximum allowedCRCX, gateway IP: host-pc-2, transaction ID: 2052, idle: 0:00:07hostname#hostname# show mgcp commands detail1 in use, 1 most used, 200 maximum allowedCRCX, idle: 0:00:10Gateway IP | host-pc-2Transaction ID 2052Endpoint name | aaln/1Call ID | 9876543210abcdefConnection ID |Media IP | 192.168.5.7Media port | 6058hostname#hostname# show mgcp sessions1 in use, 1 most usedGateway IP host-pc-2, connection ID 6789af54c9, active 0:00:11hostname#hostname# show mgcp sessions detail1 in use, 1 most usedSession active 0:00:14Gateway IP | host-pc-2Call ID | 9876543210abcdefConnection ID | 6789af54c9Endpoint name | aaln/1Media lcl port 6166Media rmt IP | 192.168.5.7Media rmt port 6058hostname#Related Commands
show mmp
To display information about existing MMP sessions, use the show mmp command in privileged EXEC mode.
show mmp [address]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following example shows the use of the show mmp command to display information about existing MMP sessions:
hostname#show mmp 10.0.0.42MMP session:: inside:10.0.0.42/5443 outside:172.23.62.204/2442session-id=71AD3EB1-7BE8-42E0-8DC3-E96E41D4ADD5data:: rx-bytes=1258, tx-bytes=1258Related Commands
debug mmp
Displays inspect MMP events.
inspect mmp
Configures the MMP inspection engine.
show debug mmp
Displays current debug settings for the MMP inspection module.
show mode
To show the security context mode for the running software image and for any image in Flash memory, use the show mode command in privileged EXEC mode.
show mode
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show mode command. The following example shows the current mode and the mode for the non-running image "image.bin":
hostname# show mode flash:/image.binFirewall mode: multipleThe mode can be multiple or single.
Related Commands
context
Creates a security context in the system configuration and enters context configuration mode.
mode
Sets the context mode to single or multiple.
show module
To show information about a module installed on the ASA, use the show module command in user EXEC mode.
show module [id | all] [details | recover | log [console]]]
Syntax Description
Defaults
By default, information for all modules is shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
1 The show module recover command is only available in the system execution space.
Command History
Usage Guidelines
This command shows information about the modules installed in the ASA. The ASA itself also appears as a module in the display (in slot 0).
Examples
The following is sample output from the show module command. Module 0 is the base device; module 1 is a CSC SSM.
hostname# show moduleMod Card Type Model Serial No.--- -------------------------------------------- ------------------ -----------0 ASA 5520 Adaptive Security Appliance ASA5520 P30000000341 ASA 5500 Series Security Services Module-20 ASA-SSM-20 0Mod MAC Address Range Hw Version Fw Version Sw Version--- --------------------------------- ------------ ------------ ---------------0 000b.fcf8.c30d to 000b.fcf8.c311 1.0 1.0(10)0 7.1(0)51 000b.fcf8.012c to 000b.fcf8.012c 1.0 1.0(10)0 CSC SSM 5.0 (Build#1187)Mod SSM Application Name SSM Application Version--- ------------------------------ --------------------------1 CSC SSM scan services are not1 CSC SSM 5.0 (Build#1187)Mod Status Data Plane Status Compatibility--- ------------------ --------------------- -------------0 Up Sys Not Applicable1 Up UpTable 26-3 describes each field listed in the output.
The output of the show module details command varies according to which module is installed. For example, output for the CSC SSM includes fields about components of the CSC SSM software.
The following is generic sample output from the show module 1 details command:
hostname# show module 1 detailsGetting details from the Service Module, please wait...ASA 5500 Series Security Services Module-20Model: ASA-SSM-20Hardware version: V1.0Serial Number: 12345678Firmware version: 1.0(7)2Software version: 4.1(1.1)S47(0.1)MAC Address Range: 000b.fcf8.0156 to 000b.fcf8.0156Data plane Status: UpStatus: UpMgmt IP addr: 10.89.147.13Mgmt web ports: 443Mgmt TLS enabled: trueTable 26-4 describes each field listed in the output.
The following is sample output from the show module 1 recover command:
hostname# show module 1 recoverModule 1 recover parameters. . .Boot Recovery Image: YesImage URL: tftp://10.21.18.1/ids-oldimgPort IP Address: 10.1.2.10Port Mask : 255.255.255.0Gateway IP Address: 10.1.2.254The following is sample output from the show module 1 details command when an SSC is installed:
hostname# show module 1 detailsGetting details from the Service Module, please wait...ASA 5505 Security Services CardModel: ASA-SSCHardware version: 0.1Serial Number: JAB11370240Firmware version: 1.0(14)3Software version: 6.2(1)E2MAC Address Range: 001d.45c2.e832 to 001d.45c2.e832App. Name: IPSApp. Status: UpApp. Status Desc:App. Version: 6.2(1)E2Data plane Status: UpStatus: UpMgmt IP Addr: 209.165.201.29Mgmt Network Mask: 255.255.224.0Mgmt Gateway: 209.165.201.30Mgmt Access List: 209.165.201.31/32209.165.202.158/32209.165.200.254/24Mgmt Vlan: 20The following is sample output from the show module 1 details command when an IPS SSP is installed in an ASA 5585-X:
hostname# show module 1 detailsGetting details from the Service Module, please wait...ASA 5500 Series Security Services Module-20Model: ASA-SSM-20Hardware version: V1.0Serial Number: 12345678Firmware version: 1.0(7)2Software version: 4.1(1.1)S47(0.1)MAC Address Range: 000b.fcf8.0156 to 000b.fcf8.0156Data plane Status: UpStatus: UpMgmt IP addr: 10.89.147.13Mgmt web ports: 443Mgmt TLS enabled: trueThe following is sample output from the show module ips command when the IPS software is installed in an ASA 5525-X:
hostname# show module ipsMod Card Type Model Serial No.--- -------------------------------------------- ------------------ -----------0 ASA 5525 Adaptive Security Appliance ASA5525 FCH1445V00M1 IPS 5525 Intrusion Protection System IPS5525 FCH1445V00MMod MAC Address Range Hw Version Fw Version Sw Version--- --------------------------------- ------------ ------------ ---------------0 588d.0990.8928 to 588d.0990.8931 1.0 8.6(1)1 588d.0990.8926 to 588d.0990.8926 N/A N/A 7.2(1)Mod SSM Application Name Status SSM Application Version--- ------------------------------ ---------------- --------------------------1 IPS Up 7.2(1)Mod Status Data Plane Status Compatibility--- ------------------ --------------------- -------------0 Up Sys Not Applicable1 Up UpThe following is sample output from the show module ips command when the IPS software installed in an ASA 5525-X has been licensed:
hostname# show module ipsMod Card Type Model Serial No.--- -------------------------------------------- ------------------ -----------1 IPS 5525 Intrusion Protection System IPS5525 FCH1504V03PMod MAC Address Range Hw Version Fw Version Sw Version--- --------------------------------- ------------ ------------ ---------------1 503d.e59c.6f89 to 503d.e59c.6f89 N/A N/A 7.2(1)Mod SSM Application Name Status SSM Application Version--- ------------------------------ ---------------- ---------------- ----------1 IPS Up 7.2(1)Mod Status Data Plane Status Compatibility--- ------------------ --------------------- -------------1 Up UpMod License Name License Status Time Remaining--- ----------------- --------------- ---------------1 IPS Module Enabled 7 daysThe following is sample output from the show module all command when a CXSC SSP is installed in an ASA 5585-X:
hostname# show module allMod Card Type Model Serial No.--- -------------------------------------------- ------------------ -----------0 ASA 5585-X Security Services Processor-10 wi ASA5585-SSP-10 JAF1504CBRM1 ASA 5585-X CXSC Security Services Processor-1 ASA5585-SSP-IPS10 JAF1510BLSEMod MAC Address Range Hw Version Fw Version Sw Version--- --------------------------------- ------------ ------------ ---------------0 5475.d05b.1d54 to 5475.d05b.1d5f 1.0 2.0(7)0 100.7(14)131 5475.d05b.248c to 5475.d05b.2497 1.0 0.0(0)0 1.0Mod SSM Application Name Status SSM Application Version--- ------------------------------ ---------------- --------------------------1 CXSC Security Module Up 1.0Mod Status Data Plane Status Compatibility--- ------------------ --------------------- -------------0 Up Sys Not Applicable1 Up UpThe following is sample output from the show module 1 details command when a CXSC SSP is installed in an ASA 5585-X:
hostname# show module 1 detailsGetting details from the Service Module, please wait...ASA 5500 Series Security Services Module-20Model: ASA5585-S10C10-K8Hardware version: 1.0Serial Number: 123456789Firmware version: 1.0(9)0Software version: CXSC Security Module Version 1.0App. name: CXSC Security ModuleApp. version: Version 1.0Data plane Status: UpStatus: UpHTTP Service: UpActivated: YesMgmt IP addr: 100.0.1.4Mgmt web port: 8443Related Commands
show monitor-interface
To display information about the interfaces monitored for failover, use the show monitor-interface command in privileged EXEC mode.
show monitor-interface
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0(1)
This command was introduced.
8.2(2)
This command was modified. The output includes IPv6 addresses.
Usage Guidelines
Because an interface can have more than one IPv6 address configured on it, only the link-local address is displayed in the show monitor-interface command. If both IPv4 and IPv6 addresses are configured on an interface, both addresses appear in the output. If there is no IPv4 address configured on the interface, the IPv4 address in the output appears as 0.0.0.0. If there is no IPv6 address configured on an interface, the address is simply omitted from the output.
Monitored failover interfaces can have the following status:
•
•
•
•
•
•
•
Examples
The following is sample output from the show monitor-interface command:
hostname# show monitor-interfaceThis host: Primary - ActiveInterface outside (10.86.94.88): Normal (Waiting)Interface management (192.168.1.1): Normal (Waiting)Interface failif (0.0.0.0/fe80::223:4ff:fe77:fed): Normal (Waiting)Other host: Secondary - FailedInterface outside (0.0.0.0): Unknown (Waiting)Interface management (0.0.0.0): Unknown (Waiting)Interface failif (0.0.0.0): Unknown (Waiting)Related Commands
show mrib client
To display information about the MRIB client connections, use the show mrib client command in user EXEC or privileged EXEC mode.
show mrib client [filter] [name client_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The filter option is used to display the route and interface level flag changes that various MRIB clients have registered. This command option also shows what flags are owned by the MRIB clients.
Examples
The following sample output from the show mrib client command using the filter keyword:
hostname# show mrib client filterMFWD:0 (connection id 0)interest filter:entry attributes: S C IA Dinterface attributes: F A IC NS DP SPgroups:include 0.0.0.0/0interfaces:include Allownership filter:groups:include 0.0.0.0/0interfaces:include Alligmp:77964 (connection id 1)ownership filter:interface attributes: II ID LI LDgroups:include 0.0.0.0/0interfaces:include Allpim:49287 (connection id 5)interest filter:entry attributes: Einterface attributes: SP II ID LI LDgroups:include 0.0.0.0/0interfaces:include Allownership filter:entry attributes: L S C IA Dinterface attributes: F A IC NS DPgroups:include 0.0.0.0/0interfaces:include AllRelated Commands
show mrib route
To display entries in the MRIB table, use the show mrib route command in user EXEC or privileged EXEC mode.
show mrib route [[source | *] [group[/prefix-length]]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The MFIB table maintains a subset of entries and flags updated from MRIB. The flags determine the forwarding and signaling behavior according to a set of forwarding rules for multicast packets.
In addition to the list of interfaces and flags, each route entry shows various counters. Byte count is the number of total bytes forwarded. Packet count is the number of packets received for this entry. The show mfib count command displays global counters independent of the routes.
Examples
The following is sample output from the show mrib route command:
hostname# show mrib routeIP Multicast Routing Information BaseEntry flags: L - Domain-Local Source, E - External Source to the Domain,C - Directly-Connected Check, S - Signal, IA - Inherit Accept, D - DropInterface flags: F - Forward, A - Accept, IC - Internal Copy,NS - Negate Signal, DP - Don't Preserve, SP - Signal Present,II - Internal Interest, ID - Internal Disinterest, LI - Local Interest,LD - Local Disinterest(*,224.0.0.0/4) RPF nbr: 10.11.1.20 Flags: L CDecapstunnel0 Flags: NS(*,224.0.0.0/24) Flags: D(*,224.0.1.39) Flags: S(*,224.0.1.40) Flags: SPOS0/3/0/0 Flags: II LI(*,238.1.1.1) RPF nbr: 10.11.1.20 Flags: CPOS0/3/0/0 Flags: F NS LIDecapstunnel0 Flags: A(*,239.1.1.1) RPF nbr: 10.11.1.20 Flags: CPOS0/3/0/0 Flags: F NSDecapstunnel0 Flags: ARelated Commands
show mfib count
Displays route and packet count data for the MFIB table.
show mrib route summary
Displays a summary of the MRIB table entries.
show mroute
To display the IPv4 multicast routing table, use the show mroute command in privileged EXEC mode.
show mroute [group [source] | reserved] [active [rate] | count | pruned | summary]
Syntax Description
Defaults
If not specified, the rate argument defaults to 4 kbps.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The show mroute command displays the contents of the multicast routing table. The ASA populates the multicast routing table by creating (S,G) and (*,G) entries based on PIM protocol messages, IGMP reports, and traffic. The asterisk (*) refers to all source addresses, the "S" refers to a single source address, and the "G" is the destination multicast group address. In creating (S, G) entries, the software uses the best path to that destination group found in the unicast routing table (through RPF).
To view the mroute commands in the running configuration, use the show running-config mroute command.
Examples
The following is sample output from the show mroute command:
hostname(config)# show mrouteMulticast Routing TableFlags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group,C - Connected, L - Local, I - Received Source Specific Host Report,P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set,J - Join SPTTimers: Uptime/ExpiresInterface state: Interface, State(*, 239.1.1.40), 08:07:24/never, RP 0.0.0.0, flags: DPCIncoming interface: NullRPF nbr: 0.0.0.0Outgoing interface list:inside, Null, 08:05:45/nevertftp, Null, 08:07:24/never(*, 239.2.2.1), 08:07:44/never, RP 140.0.0.70, flags: SCJIncoming interface: outsideRPF nbr: 140.0.0.70Outgoing interface list:inside, Forward, 08:07:44/neverThe following fields are shown in the show mroute output:
•
–
–
–
–
–
–
–
–
–
–
–
–
For (S, G) entries, indicates that the entry was created because the SPT-Threshold for the group was exceeded. When the J - Join SPT flag is set for (S, G) entries, the ASA monitors the traffic rate on the source tree and attempts to switch back to the shared tree for this source if the traffic rate on the source tree falls below the SPT-Threshold of the group for more than 1 minute.
Note
If the default SPT-Threshold value of 0 kbps is used for the group, the J - Join SPT flag is always set on (*, G) entries and is never cleared. When the default SPT-Threshold value is used, the ASA immediately switches to the shortest path source tree when traffic from a new source is received.
•
•
–
–
•
•
•
•
•
Related Commands
show nac-policy
To show the NAC policy usage statistics and the assignment of NAC policies to group policies, use the show nac-policy command in privileged EXEC mode.
show nac-policy [nac-policy-name]
Syntax Description
Defaults
If you do not specify a name, the CLI lists all NAC policy names along with their respective statistics.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
The following example shows the data for the NAC policies named framework1 and framework2:
asa2(config)# show nac-policynac-policy framework1 nac-frameworkapplied session count = 0applied group-policy count = 2group-policy list: GroupPolicy2 GroupPolicy1nac-policy framework2 nac-framework is not in use.The first line of each NAC policy indicates its name and type (nac-framework). The CLI shows the text "is not in use" next to the policy type if the policy is not assigned to any group policies. Otherwise, the CLI displays the usage data for the group policy. Table 51-5 explains the fields in the show nac-policy command.
Related Commands
show nameif
To view the interface name set using the nameif command, use the show nameif command in privileged EXEC mode.
show nameif [physical_interface[.subinterface] | mapped_name]
Syntax Description
Defaults
If you do not specify an interface, the ASA shows all interface names.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
In multiple context mode, if you mapped the interface ID in the allocate-interface command, you can only specify the mapped name in a context. The output for this command shows only the mapped name in the Interface column.
Examples
The following is sample output from the show nameif command:
hostname# show nameifInterface Name SecurityGigabitEthernet0/0 outside 0GigabitEthernet0/1 inside 100GigabitEthernet0/2 test2 50Related Commands
show nat
To display statistics of NAT policies, use the show nat command in privileged EXEC mode.
show nat [interface name] [ip_addr mask | {object | object-group} name] [translated [interface name] [ip_addr mask | {object | object-group} name]] [detail] [divert-table [ipv6] [interface name]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
8.3(1)
This command was introduced.
9.0(1)
This command now supports IPv6 traffic, as well as translations between IPv4 and IPv6.
Usage Guidelines
Use the show nat command to show runtime representation of the NAT policy. Use the detail optional keyword to expand the object and view the object values. Use the additional selector fields to limit the show nat command output.
Examples
The following is sample output from the show nat command:
hostname# show natManual NAT Policies (Section 1)1 (any) to (any) source dynamic S S' destination static D' Dtranslate_hits = 0, untranslate_hits = 0Auto NAT Policies (Section 2)1 (inside) to (outside) source dynamic A 2.2.2.2translate_hits = 0, untranslate_hits = 0Manual NAT Policies (Section 3)1 (any) to (any) source dynamic C C' destination static B' B service R R'translate_hits = 0, untranslate_hits = 0hostname# show nat detailManual NAT Policies (Section 1)1 (any) to (any) source dynamic S S' destination static D' Dtranslate_hits = 0, untranslate_hits = 0Source - Real: 1.1.1.2/32, Mapped: 2.2.2.3/32Destination - Real: 10.10.10.0/24, Mapped: 20.20.20.0/24Auto NAT Policies (Section 2)1 (inside) to (outside) source dynamic A 2.2.2.2translate_hits = 0, untranslate_hits = 0Source - Real: 1.1.1.1/32, Mapped: 2.2.2.2/32Manual NAT Policies (Section 3)1 (any) to (any) source dynamic C C' destination static B' B service R R'translate_hits = 0, untranslate_hits = 0Source - Real: 11.11.11.10-11.11.11.11, Mapped: 192.168.10.10/32Destination - Real: 192.168.1.0/24, Mapped: 10.75.1.0/24Service - Real: tcp source eq 10 destination eq ftp-data , Mapped: tcp source eq100 destination eq 200The following is sample output from the show nat detail command between IPv6 and IPv4:
hostname# show nat detail1 (in) to (outside) source dynamic inside_nw outside_map destination static inside_map anytranslate_hits = 0, untranslate_hits = 0Source - Origin: 2001::/96, Translated: 192.168.102.200-192.168.102.210Destination - Origin: 2001::/96, Translated: 0.0.0.0/0The following is sample output from the show nat divert ipv6 command:
hostname# show nat divert ipv6Divert Tableid=0xcb9ea518, domain=divert-routetype=static, hits=0, flags=0x21, protocol=0src ip/id=2001::/ffff:ffff:ffff:ffff:ffff:ffff::, port=0-0dst ip/id=2001::/ffff:ffff:ffff:ffff:ffff:ffff::, port=0-0input_ifc=in, output_ifc=outsideid=0xcf24d4b8, domain=divert-routetype=static, hits=0, flags=0x20, protocol=0src ip/id=::/::, port=0-0dst ip/id=2222::/ffff:ffff:ffff:ffff:ffff:ffff::, port=0-0input_ifc=in, output_ifc=mgmtRelated Commands
clear nat counters
Clears NAT policy counters.
nat
Identifies addresses on one interface that are translated to mapped addresses on another interface.
show nat pool
To display statistics of NAT pool usage, use the show nat pool command in privileged EXEC mode.
show nat pool
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
A NAT pool is created for each mapped protocol/IP address/port range, where the port ranges are 1-511, 512-1023, and 1024-65535 by default. If you use the flat keyword for a PAT pool in the nat command, you will see fewer, larger ranges.
Each NAT pool exists for at least 10 minutes after the last usage. The 10 minute hold-down timer is canceled if you clear the translations with clear xlate.
Examples
The following is sample output for the NAT pools created by a dynamic PAT rule shown by the show running-config object network command.
hostname(config)# show running-config object networkobject network myhosthost 10.10.10.10nat (pppoe2,inside) dynamic 10.76.11.25hostname# show nat poolTCP inside, address 10.76.11.25, range 1-511, allocated 0TCP inside, address 10.76.11.25, range 512-1023, allocated 0TCP inside, address 10.76.11.25, range 1024-65535, allocated 1The following is sample output from the show nat pool command showing use of the PAT pool flat option. Without the include-reserve keyword, two ranges are shown; the lower range is used when a source port below 1024 is mapped to the same port.
hostname# show nat poolICMP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-65535, allocated 2TCP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-1024, allocated 0TCP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1024-65535, allocated 2UDP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-1024, allocated 0UDP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1024-65535, allocated 2The following is sample output from the show nat pool command showing use of the PAT pool flat include-reserve options.
hostname# show nat poolICMP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-65535, allocated 2TCP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-65535, allocated 2UDP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-65535, allocated 2The following is sample output from the show nat pool command showing use of the PAT pool extended flat include-reserve options. The important items are the parenthetical addresses. These are the destination addresses used to extend PAT.
ICMP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-65535, allocated 0ICMP PAT pool outside:dynamic-pat, address 172.16.2.200(172.16.2.99), range 1-65535, allocated 2TCP PAT pool outside:dynamic-pat, address 172.16.2.200(172.16.2.100), range 1-65535, allocated 1UDP PAT pool outside:dynamic-pat, address 172.16.2.200(172.16.2.100), range 1-65535, allocated 1TCP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-65535, allocated 0ICMP PAT pool outside:dynamic-pat, address 172.16.2.200(172.16.2.100), range 1-65535, allocated 1TCP PAT pool outside:dynamic-pat, address 172.16.2.200(172.16.2.99), range 1-65535, allocated 2UDP PAT pool outside:dynamic-pat, address 172.16.2.200, range 1-65535, allocated 0Related Commands
nat
Identifies addresses on one interface that are translated to mapped addresses on another interface.
show nat
Displays NAT policy statistics.
show ntp associations
To view NTP association information, use the show ntp associations command in user EXEC mode.
show ntp associations [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
—
•
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show ntp associations command:
hostname> show ntp associationsaddress ref clock st when poll reach delay offset disp~172.31.32.2 172.31.32.1 5 29 1024 377 4.2 -8.59 1.6+~192.168.13.33 192.168.1.111 3 69 128 377 4.1 3.48 2.3*~192.168.13.57 192.168.1.111 3 32 128 377 7.9 11.18 3.6* master (synced), # master (unsynced), + selected, - candidate, ~ configuredTable 51-6 shows each field description.
The following is sample output from the show ntp associations detail command:
hostname> show ntp associations detail172.23.56.249 configured, our_master, sane, valid, stratum 4ref ID 172.23.56.225, time c0212639.2ecfc9e0 (20:19:05.182 UTC Fri Feb 22 2002)our mode client, peer mode server, our poll intvl 128, peer poll intvl 128root delay 38.04 msec, root disp 9.55, reach 177, sync dist 156.021delay 4.47 msec, offset -0.2403 msec, dispersion 125.21precision 2**19, version 3org time c02128a9.731f127b (20:29:29.449 UTC Fri Feb 22 2002)rcv time c02128a9.73c1954b (20:29:29.452 UTC Fri Feb 22 2002)xmt time c02128a9.6b3f729e (20:29:29.418 UTC Fri Feb 22 2002)filtdelay = 4.47 4.58 4.97 5.63 4.79 5.52 5.87 0.00filtoffset = -0.24 -0.36 -0.37 0.30 -0.17 0.57 -0.74 0.00filterror = 0.02 0.99 1.71 2.69 3.66 4.64 5.62 16000.0Table 51-7 shows each field description.
Related Commands
show ntp status
To show the status of each NTP association, use the show ntp status command in user EXEC mode.
show ntp status
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
—
•
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show ntp status command:
hostname> show ntp statusClock is synchronized, stratum 5, reference is 172.23.56.249nominal freq is 99.9984 Hz, actual freq is 100.0266 Hz, precision is 2**6reference time is c02128a9.73c1954b (20:29:29.452 UTC Fri Feb 22 2002)clock offset is -0.2403 msec, root delay is 42.51 msecroot dispersion is 135.01 msec, peer dispersion is 125.21 msecTable 51-8 shows each field description.
Related Commands
show object-group
To display object group information and the relevant hit count if the object group is of the network object-group type, use the show object-group command in privileged EXEC mode.
show object-group [protocol | service | icmp-type | id object-group name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
A routine attempt to show object groups also shows the object hit count if the object group is of the network object-group type. Hit counts do not display for service, protocol, and icmp-type object groups.
Examples
The following is sample output from the show object-group command and shows information about the network object group named "Anet":
hostname# show object-group id AnetObject-group network Anet (hitcnt=10)Description OBJ SEARCH ALG APPLIEDnetwork-object 1.1.1.0 255.255.255.0 (hitcnt=4)network-object 2.2.2.0 255.255.255.0 (hitcnt=6)The following is sample output from the show object-group command and shows information about a service group:
hostname (config)# show object-group serviceobject-group service B-Serobjdescription its a service groupservice-object tcp eq bgpobject-group protocol C-grp-protoprotocol-object ospfThe following is sample output from the show object-group command and shows information about a protocol:
hostname (config)# show object-group protocolobject-group protocol C-grp-protoprotocol-object ospfRelated Commands
clear object-group
Clears the network objects hit count for a given object group.
show access list
Shows all access lists, relevant expanded access list entries, and hit counts.
show ospf
To display the general information about the OSPF routing processes, use the show ospf command in privileged EXEC mode.
show ospf [pid [area_id]]
Syntax Description
area_id
(Optional) ID of the area that is associated with the OSPF address range.
pid
(Optional) The ID of the OSPF process.
Defaults
Lists all OSPF processes if no pid is specified.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
If the pid is included, only information for the specified routing process is included.
Examples
The following is sample output from the show ospf command, showing how to display general information about a specific OSPF routing process:
hostname# show ospf 5Routing Process "ospf 5" with ID 127.0.0.1 and Domain ID 0.0.0.5Supports only single TOS(TOS0) routesSupports opaque LSASPF schedule delay 5 secs, Hold time between two SPFs 10 secsMinimum LSA interval 5 secs. Minimum LSA arrival 1 secsNumber of external LSA 0. Checksum Sum 0x 0Number of opaque AS LSA 0. Checksum Sum 0x 0Number of DCbitless external and opaque AS LSA 0Number of DoNotAge external and opaque AS LSA 0Number of areas in this router is 0. 0 normal 0 stub 0 nssaExternal flood list length 0The following is sample output from the show ospf command, showing how to display general information about all OSPF routing processes:
hostname# show ospfRouting Process "ospf 5" with ID 127.0.0.1 and Domain ID 0.0.0.5Supports only single TOS(TOS0) routesSupports opaque LSASPF schedule delay 5 secs, Hold time between two SPFs 10 secsMinimum LSA interval 5 secs. Minimum LSA arrival 1 secsNumber of external LSA 0. Checksum Sum 0x 0Number of opaque AS LSA 0. Checksum Sum 0x 0Number of DCbitless external and opaque AS LSA 0Number of DoNotAge external and opaque AS LSA 0Number of areas in this router is 0. 0 normal 0 stub 0 nssaExternal flood list length 0Routing Process "ospf 12" with ID 172.23.59.232 and Domain ID 0.0.0.12Supports only single TOS(TOS0) routesSupports opaque LSASPF schedule delay 5 secs, Hold time between two SPFs 10 secsMinimum LSA interval 5 secs. Minimum LSA arrival 1 secsNumber of external LSA 0. Checksum Sum 0x 0Number of opaque AS LSA 0. Checksum Sum 0x 0Number of DCbitless external and opaque AS LSA 0Number of DoNotAge external and opaque AS LSA 0Number of areas in this router is 0. 0 normal 0 stub 0 nssaExternal flood list length 0Related Commands
show ospf border-routers
To display the internal OSPF routing table entries to ABRs and ASBRs, use the show ospf border-routers command in privileged EXEC mode.
show ospf border-routers
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following is sample output from the show ospf border-routers command:
hostname# show ospf border-routersOSPF Process 109 internal Routing TableCodes: i - Intra-area route, I - Inter-area routei 192.168.97.53 [10] via 192.168.1.53, fifth, ABR, Area 0, SPF 20i 192.168.103.51 [10] via 192.168.96.51, outside, ASBR, Area 192.168.12.0, SPF 14i 192.168.103.52 [10] via 192.168.96.51, outside, ABR/ASBR, Area 192.168.12.0, SPF 14Related Commands
show ospf database
To display the information contained in the OSPF topological database on the ASA, use the show ospf database command in privileged EXEC mode.
show ospf [pid [area_id]] database [router | network | summary | asbr-summary | external | nssa-external] [lsid] [internal] [self-originate | adv-router addr]
show ospf [pid [area_id]] database database-summary
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The OSPF routing-related show commands are available in privileged mode on the ASA. You do not need to be in an OSPF configuration mode to use the OSPF-related show commands.
Examples
The following is sample output from the show ospf database command:
hostname# show ospf databaseOSPF Router with ID(192.168.1.11) (Process ID 1)Router Link States(Area 0)Link ID ADV Router Age Seq# Checksum Link count192.168.1.8 192.168.1.8 1381 0x8000010D 0xEF60 2192.168.1.11 192.168.1.11 1460 0x800002FE 0xEB3D 4192.168.1.12 192.168.1.12 2027 0x80000090 0x875D 3192.168.1.27 192.168.1.27 1323 0x800001D6 0x12CC 3Net Link States(Area 0)Link ID ADV Router Age Seq# Checksum172.16.1.27 192.168.1.27 1323 0x8000005B 0xA8EE172.17.1.11 192.168.1.11 1461 0x8000005B 0x7ACType-10 Opaque Link Area Link States (Area 0)Link ID ADV Router Age Seq# Checksum Opaque ID10.0.0.0 192.168.1.11 1461 0x800002C8 0x8483 010.0.0.0 192.168.1.12 2027 0x80000080 0xF858 010.0.0.0 192.168.1.27 1323 0x800001BC 0x919B 010.0.0.1 192.168.1.11 1461 0x8000005E 0x5B43 1The following is sample output from the show ospf database asbr-summary command:
hostname# show ospf database asbr-summaryOSPF Router with ID(192.168.239.66) (Process ID 300)Summary ASB Link States(Area 0.0.0.0)Routing Bit Set on this LSALS age: 1463Options: (No TOS-capability)LS Type: Summary Links(AS Boundary Router)Link State ID: 172.16.245.1 (AS Boundary Router address)Advertising Router: 172.16.241.5LS Seq Number: 80000072Checksum: 0x3548Length: 28Network Mask: 0.0.0.0TOS: 0 Metric: 1The following is sample output from the show ospf database router command:
hostname# show ospf database routerOSPF Router with id(192.168.239.66) (Process ID 300)Router Link States(Area 0.0.0.0)Routing Bit Set on this LSALS age: 1176Options: (No TOS-capability)LS Type: Router LinksLink State ID: 10.187.21.6Advertising Router: 10.187.21.6LS Seq Number: 80002CF6Checksum: 0x73B7Length: 120AS Boundary RouterNumber of Links: 8Link connected to: another Router (point-to-point)(link ID) Neighboring Router ID: 10.187.21.5(Link Data) Router Interface address: 10.187.21.6Number of TOS metrics: 0TOS 0 Metrics: 2The following is sample output from the show ospf database network command:
hostname# show ospf database networkOSPF Router with id(192.168.239.66) (Process ID 300)Displaying Net Link States(Area 0.0.0.0)LS age: 1367Options: (No TOS-capability)LS Type: Network LinksLink State ID: 10.187.1.3 (address of Designated Router)Advertising Router: 192.168.239.66LS Seq Number: 800000E7Checksum: 0x1229Length: 52Network Mask: 255.255.255.0Attached Router: 192.168.239.66Attached Router: 10.187.241.5Attached Router: 10.187.1.1Attached Router: 10.187.54.5Attached Router: 10.187.1.5The following is sample output from the show ospf database summary command:
hostname# show ospf database summaryOSPF Router with id(192.168.239.66) (Process ID 300)Displaying Summary Net Link States(Area 0.0.0.0)LS age: 1401Options: (No TOS-capability)LS Type: Summary Links(Network)Link State ID: 10.187.240.0 (summary Network Number)Advertising Router: 10.187.241.5LS Seq Number: 80000072Checksum: 0x84FFLength: 28Network Mask: 255.255.255.0 TOS: 0 Metric: 1The following is sample output from the show ospf database external command:
hostname# show ospf database externalOSPF Router with id(192.168.239.66) (Autonomous system 300)Displaying AS External Link StatesLS age: 280Options: (No TOS-capability)LS Type: AS External LinkLink State ID: 172.16.0.0 (External Network Number)Advertising Router: 10.187.70.6LS Seq Number: 80000AFDChecksum: 0xC3ALength: 36Network Mask: 255.255.0.0Metric Type: 2 (Larger than any link state path)TOS: 0Metric: 1Forward Address: 0.0.0.0External Route Tag: 0Related Commands
show ospf flood-list
To display a list of OSPF LSAs waiting to be flooded over an interface, use the show ospf flood-list command in privileged EXEC mode.
show ospf flood-list interface_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The OSPF routing-related show commands are available in privileged mode on the ASA. You do not need to be in an OSPF configuration mode to use the OSPF-related show commands.
Examples
The following is sample output from the show ospf flood-list command:
hostname# show ospf flood-list outsideInterface outside, Queue length 20Link state flooding due in 12 msecType LS ID ADV RTR Seq NO Age Checksum5 10.2.195.0 192.168.0.163 0x80000009 0 0xFB615 10.1.192.0 192.168.0.163 0x80000009 0 0x29385 10.2.194.0 192.168.0.163 0x80000009 0 0x7575 10.1.193.0 192.168.0.163 0x80000009 0 0x1E425 10.2.193.0 192.168.0.163 0x80000009 0 0x124D5 10.1.194.0 192.168.0.163 0x80000009 0 0x134CRelated Commands
show ospf interface
To display the OSPF-related interface information, use the show ospf interface command in privileged EXEC mode.
show ospf interface [interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
When used without the interface_name argument, the OSPF information for all interfaces is shown.
Examples
The following is sample output from the show ospf interface command:
hostname# show ospf interface insideinside is up, line protocol is upInternet Address 192.168.254.202, Mask 255.255.255.0, Area 0.0.0.0AS 201, Router ID 192.77.99.1, Network Type BROADCAST, Cost: 10Transmit Delay is 1 sec, State OTHER, Priority 1Designated Router id 192.168.254.10, Interface address 192.168.254.10Backup Designated router id 192.168.254.28, Interface addr 192.168.254.28Timer intervals configured, Hello 10, Dead 60, Wait 40, Retransmit 5Hello due in 0:00:05Neighbor Count is 8, Adjacent neighbor count is 2Adjacent with neighbor 192.168.254.28 (Backup Designated Router)Adjacent with neighbor 192.168.254.10 (Designated Router)Related Commands
show ospf neighbor
To display the OSPF-neighbor information on a per-interface basis, use the show ospf neighbor command in privileged EXEC mode.
show ospf neighbor [detail | interface_name [nbr_router_id]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following is sample output from the show ospf neighbor command. It shows how to display the OSPF-neighbor information on a per-interface basis.
hostname# show ospf neighbor outsideNeighbor 192.168.5.2, interface address 10.225.200.28In the area 0 via interface outsideNeighbor priority is 1, State is FULL, 6 state changesDR is 10.225.200.28 BDR is 10.225.200.30Options is 0x42Dead timer due in 00:00:36Neighbor is up for 00:09:46Index 1/1, retransmission queue length 0, number of retransmission 1First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)Last retransmission scan length is 1, maximum is 1Last retransmission scan time is 0 msec, maximum is 0 msecRelated Commands
neighbor
Configures OSPF routers interconnecting to non-broadcast networks.
router ospf
Enables OSPF routing and configures global OSPF routing parameters.
show ospf request-list
To display a list of all LSAs that are requested by a router, use the show ospf request-list command in privileged EXEC mode.
show ospf request-list nbr_router_id interface_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following is sample output from the show ospf request-list command:
hostname# show ospf request-list 192.168.1.12 insideOSPF Router with ID (192.168.1.11) (Process ID 1)Neighbor 192.168.1.12, interface inside address 172.16.1.12Type LS ID ADV RTR Seq NO Age Checksum1 192.168.1.12 192.168.1.12 0x8000020D 8 0x6572Related Commands
show ospf retransmission-list
To display a list of all LSAs waiting to be resent, use the show ospf retransmission-list command in privileged EXEC mode.
show ospf retransmission-list nbr_router_id interface_name
Syntax Description
interface_name
Name of the interface for which to display neighbor information.
nbr_router_id
Router ID of the neighbor router.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The OSPF routing-related show commands are available in privileged mode on the ASA. You do not need to be in an OSPF configuration mode to use the OSPF-related show commands.
The nbr_router_id argument displays the list of all LSAs that are waiting to be resent for this neighbor.
The interface_name argument displays the list of all LSAs that are waiting to be resent for this interface.
Examples
The following is sample output from the show ospf retransmission-list command, where the nbr_router_id argument is 192.168.1.11 and the if_name argument is outside:
hostname# show ospf retransmission-list 192.168.1.11 outsideOSPF Router with ID (192.168.1.12) (Process ID 1)Neighbor 192.168.1.11, interface outside address 172.16.1.11Link state retransmission due in 3764 msec, Queue length 2Type LS ID ADV RTR Seq NO Age Checksum1 192.168.1.12 192.168.1.12 0x80000210 0 0xB196Related Commands
show ospf request-list
Displays a list of all LSAs that are requested by a router.
show ospf summary-address
To display a list of all summary address redistribution information that is configured under an OSPF process, use the show ospf summary-address command in privileged EXEC mode.
show ospf summary-address
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following shows sample output from the show ospf summary-address command. It shows how to display a list of all summary address redistribution information before a summary address has been configured for an OSPF process with the ID of 5.
hostname# show ospf 5 summary-addressOSPF Process 2, Summary-address10.2.0.0/255.255.0.0 Metric -1, Type 0, Tag 010.2.0.0/255.255.0.0 Metric -1, Type 0, Tag 10Related Commands
show ospf traffic
To display a list of different types of packets that have been processed (sent or received) by a particular OSPF instance, use the show ospf traffic command in privileged EXEC mode. With this command, you can get a snapshot of the different types of OSPF packets that are being being processed without enabling debugging. If there are two OSPF instances configured, the show ospf traffic command displays the statistics for both instances with the process ID of each instance. You can also display the statistics for a single instance by using the show ospf process_id traffic command.
show ospf traffic
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
With this command, you can get a snapshot of the different types of OSPF packets that are being being processed without enabling debugging. If there are two OSPF instances configured, the show ospf traffic command displays the statistics for both instances with the process ID of each instance. You can also display the statistics for a single instance by using the show ospf process_id traffic command.
Examples
The following shows sample output from the show ospf traffic command.
hostname# show ospf trafficOSPF statistics (Process ID 70):Rcvd: 244 total, 0 checksum errors234 hello, 4 database desc, 1 link state req3 link state updates, 2 link state acksSent: 485 total472 hello, 7 database desc, 1 link state req3 link state updates, 2 link state acksRelated Commands
show ospf virtual-links
Displays the parameters and the current state of OSPF virtual links.
show ospf virtual-links
To display the parameters and the current state of OSPF virtual links, use the show ospf virtual-links command in privileged EXEC mode.
show ospf virtual-links
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following is sample output from the show ospf virtual-links command:
hostname# show ospf virtual-linksVirtual Link to router 192.168.101.2 is upTransit area 0.0.0.1, via interface Ethernet0, Cost of using 10Transmit Delay is 1 sec, State POINT_TO_POINTTimer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5Hello due in 0:00:08Adjacency State FULLRelated Commands
