-
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference, 4.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show debug -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config logging -- show running-config vpn-sessiondb
-
show service-policy -- show xlate
-
shun -- sysopt uauth allow-http-cache
-
- T through Z Commands
-
Feedback
Table Of Contents
show asp drop through show curpriv Commands
show asp table mac-address-table
show crypto accelerator statistics
show crypto ipsec fragmentation
show crypto protocol statistics
show asp drop through show curpriv Commands
show asp drop
To debug dropped packets or connections that take place in the control plane path, use the show asp drop command in privileged EXEC mode. This command only shows packet and flow drops for traffic that passes through the control plane path, including most inspected traffic, traffic destined directly to the FWSM, and all IPv6 traffic. Packets and flows that are processed and dropped in the FWSM hardware do not appear in the output.
show asp drop [flow drop_reason | frame drop_reason]
Syntax Description
flow
(Optional) Shows the dropped flows (connections).
frame
(Optional) Shows the dropped packets.
drop_reason
(Optional) Shows the flows or packets dropped by a particular process.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp drop command might help you troubleshoot a problem with the control plane. This information is used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Related Commands
clear asp drop
Clears drop statistics for the accelerated security path.
show conn
Shows information about connections.
show asp table arp
To debug the accelerated security path ARP tables, use the show asp table arp command in privileged EXEC mode.
show asp table arp [interface interface_name] [address ip_address [netmask mask]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show arp command shows the contents of the control plane, while the show asp table arp command shows the contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table arp command:
hostname# show asp table arpContext: single_vf, Interface: inside10.86.194.50 Active 000f.66ce.5d46 hits 010.86.194.1 Active 00b0.64ea.91a2 hits 63810.86.194.172 Active 0001.03cf.9e79 hits 010.86.194.204 Active 000f.66ce.5d3c hits 010.86.194.188 Active 000f.904b.80d7 hits 0Context: single_vf, Interface: identity:: Active 0000.0000.0000 hits 00.0.0.0 Active 0000.0000.0000 hits 50208Related Commands
show asp table classify
To debug the accelerated security path classifier tables, use the show asp table classify command in privileged EXEC mode. The classifier examines properties of incoming packets, such as protocol, and source and destination address, to match each packet to an appropriate classification rule. Each rule is labeled with a classification domain that determines what types of actions are performed, such as dropping a packet or allowing it through.
show asp table classify [crypto | domain domain_name | interface interface_name]
Syntax Description
domain domain_name
(Optional) Shows entries for a specific classifier domain. See "Usage Guidelines" for a list of domains.
interface interface_name
(Optional) Identifies a specific interface for which you want to view the classifier table.
crypto
(Optional) Shows the encrypt, decrypt, and ipsec tunnel flow domains only.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table classifier command shows the classifier contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Classifier domains include the following:
aaa-acctaaa-authaaa-useraccountingarpcapturecaptureconn-nailedconn-setctcpdecryptencryptestablishedfilter-activexfilter-ftpfilter-httpsfilter-javafilter-urlhostinspectinspect-ctiqbeinspect-dnsinspect-dns-idsinspect-ftpinspect-ftp-datainspect-gtpinspect-h323inspect-httpinspect-icmpinspect-icmp-errorinspect-ilsinspect-mgcpinspect-netbiosinspect-pptpinspect-rshinspect-rtspinspect-sipinspect-skinnyinspect-smtpinspect-snmpinspect-sqlnetinspect-sqlnet-plusinspect-sunrpcinspect-tftpinspect-xdmcpipsec-nattipsec-tunnel-flowipsec-userlimitslumac-permitmgmt-lockdownmgmt-tcp-interceptmulticastnatnat-exemptnat-exempt-reversenat-reversenullpermitpermit-ip-optionpermit-logpimppppuntpunt-l2punt-rootshuntcp-interceptExamples
The following is sample output from the show asp table classify command:
hostname# show asp table classifyInterface test:in id=0x36f3800, priority=10, domain=punt, deny=falsehits=0, user_data=0x0, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=0dst ip=10.86.194.60, mask=255.255.255.255, port=0in id=0x33d3508, priority=99, domain=inspect, deny=falsehits=0, user_data=0x0, use_real_addr, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=0dst ip=0.0.0.0, mask=0.0.0.0, port=0in id=0x33d3978, priority=99, domain=inspect, deny=falsehits=0, user_data=0x0, use_real_addr, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=53dst ip=0.0.0.0, mask=0.0.0.0, port=0...Related Commands
show asp table interfaces
To debug the accelerated security path interface tables, use the show asp table interfaces command in privileged EXEC mode.
show asp table interfaces
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table interfaces command shows the interface table contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table interfaces command:
hostname# show asp table interfaces** Flags: 0x0001-DHCP, 0x0002-VMAC, 0x0010-Ident Ifc, 0x0020-HDB Initd,0x0040-RPF EnabledSoft-np interface 'dmz' is upcontext single_vf, nicnum 0, mtu 1500vlan 300, Not shared, seclvl 500 packets input, 1 packets outputflags 0x20Soft-np interface 'foo' is downcontext single_vf, nicnum 2, mtu 1500vlan 301, Not shared, seclvl 00 packets input, 0 packets outputflags 0x20Soft-np interface 'outside' is downcontext single_vf, nicnum 1, mtu 1500vlan 302, Not shared, seclvl 500 packets input, 0 packets outputflags 0x20Soft-np interface 'inside' is upcontext single_vf, nicnum 0, mtu 1500vlan 303, Not shared, seclvl 100680277 packets input, 92501 packets outputflags 0x20...Related Commands
interface
Configures an interface and enters interface configuration mode.
show interface
Displays the runtime status and statistics of interfaces.
show asp table mac-address-table
To debug the accelerated security path MAC address tables, use the show asp table mac-address-table command in privileged EXEC mode.
show asp table mac-address-table [interface interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
•
Command History
Usage Guidelines
The show asp table mac-address-table command shows the MAC address table contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table mac-address-table command:
hostname# show asp table mac-address-tableinterface mac address flags--------------------------------------------------------inside1 0009.b74d.3800 Noneinside1 0007.e903.ad6e Noneinside1 0007.e950.2067 Noneinside1 0050.0499.3749 Noneinside1 0012.d96f.e200 Noneinside1 0001.02a7.f4ec Noneinside1 0001.032c.6477 Noneinside1 0004.5a2d.a1c8 Noneinside1 0003.4773.c87b Noneinside1 000d.88ef.5d1c Noneinside1 00c0.b766.adce Noneinside1 0050.5640.450d Noneinside1 0001.03cf.0431 None...Related Commands
show mac-address-table
Shows the MAC address table, including dynamic and static entries.
show asp table routing
To debug the accelerated security path routing tables, use the show asp table routing command in privileged EXEC mode. This command supports IPv4 and IPv6 addresses.
show asp table routing [input | output] [address ip_address [netmask mask] | interface interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table routing command shows the routing table contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table routing command:
hostname# show asp table routingin 255.255.255.255 255.255.255.255 identityin 224.0.0.9 255.255.255.255 identityin 10.86.194.60 255.255.255.255 identityin 10.86.195.255 255.255.255.255 identityin 10.86.194.0 255.255.255.255 identityin 209.165.202.159 255.255.255.255 identityin 209.165.202.255 255.255.255.255 identityin 209.165.201.30 255.255.255.255 identityin 209.165.201.0 255.255.255.255 identityin 10.86.194.0 255.255.254.0 insidein 224.0.0.0 240.0.0.0 identityin 0.0.0.0 0.0.0.0 insideout 255.255.255.255 255.255.255.255 fooout 224.0.0.0 240.0.0.0 fooout 255.255.255.255 255.255.255.255 testout 224.0.0.0 240.0.0.0 testout 255.255.255.255 255.255.255.255 insideout 10.86.194.0 255.255.254.0 insideout 224.0.0.0 240.0.0.0 insideout 0.0.0.0 0.0.0.0 via 10.86.194.1, insideout 0.0.0.0 0.0.0.0 via 0.0.0.0, identityout :: :: via 0.0.0.0, identityRelated Commands
show asp table vpn-context
To debug the accelerated security path VPN context tables, use the show asp table vpn-context command in privileged EXEC mode.
show asp table vpn-context [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table vpn-context command shows the VPN context contents of the accelerated security path, which might help you troubleshoot a problem. See the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table vpn-context command:
hostname# show asp table vpn-contextVPN ID=0058070576, DECR+ESP, UP, pk=0000000000, rk=0000000000, gc=0VPN ID=0058193920, ENCR+ESP, UP, pk=0000000000, rk=0000000000, gc=0VPN ID=0058168568, DECR+ESP, UP, pk=0000299627, rk=0000000061, gc=2VPN ID=0058161168, ENCR+ESP, UP, pk=0000305043, rk=0000000061, gc=1VPN ID=0058153728, DECR+ESP, UP, pk=0000271432, rk=0000000061, gc=2VPN ID=0058150440, ENCR+ESP, UP, pk=0000285328, rk=0000000061, gc=1VPN ID=0058102088, DECR+ESP, UP, pk=0000268550, rk=0000000061, gc=2VPN ID=0058134088, ENCR+ESP, UP, pk=0000274673, rk=0000000061, gc=1VPN ID=0058103216, DECR+ESP, UP, pk=0000252854, rk=0000000061, gc=2...The following is sample output from the show asp table vpn-context detail command:
hostname# show asp table vpn-context detailVPN Ctx = 0058070576 [0x03761630]State = UPFlags = DECR+ESPSA = 0x037928F0SPI = 0xEA0F21F0Group = 0Pkts = 0Bad Pkts = 0Bad SPI = 0Spoof = 0Bad Crypto = 0Rekey Pkt = 0Rekey Call = 0VPN Ctx = 0058193920 [0x0377F800]State = UPFlags = ENCR+ESPSA = 0x037B4B70SPI = 0x900FDC32Group = 0Pkts = 0Bad Pkts = 0Bad SPI = 0Spoof = 0Bad Crypto = 0Rekey Pkt = 0Rekey Call = 0...Related Commands
show asr
To display the members of ASR groups, use the show asr command in privileged EXEC mode.
show asr {group_id | all}
Syntax Description
group_id
Displays the VLANs that are members of the specified ASR group. Valid values are 1 through 32.
all
Displays the membership for all 32 ASR groups.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
An ASR group can contain up to 8 members. A "0" (zero) in the output indicates an empty slot.
The show asr command provides the same output as the show np asr command.
Examples
The following is sample output from the show asr command. It limits the display to VLANs that are members of ASR group 1.
hostname# sh asr 1ASR Group | Vlan Entries in ASR Group (0 denotes empty slot)----------|----------------------------------------------------1 | 10 20 0 0 0 0 0 0The following is sample output from the show asr command. It displays VLAN membership for all possible ASR groups. In this example, only ASR group 1 has member VLANs.
hostname# sh asr allASR Group | Vlan Entries in ASR Group (0 denotes empty slot)----------|----------------------------------------------------1 | 10 20 0 0 0 0 0 02 | 0 0 0 0 0 0 0 03 | 0 0 0 0 0 0 0 04 | 0 0 0 0 0 0 0 05 | 0 0 0 0 0 0 0 06 | 0 0 0 0 0 0 0 07 | 0 0 0 0 0 0 0 08 | 0 0 0 0 0 0 0 09 | 0 0 0 0 0 0 0 010 | 0 0 0 0 0 0 0 011 | 0 0 0 0 0 0 0 012 | 0 0 0 0 0 0 0 013 | 0 0 0 0 0 0 0 014 | 0 0 0 0 0 0 0 015 | 0 0 0 0 0 0 0 016 | 0 0 0 0 0 0 0 017 | 0 0 0 0 0 0 0 018 | 0 0 0 0 0 0 0 019 | 0 0 0 0 0 0 0 020 | 0 0 0 0 0 0 0 021 | 0 0 0 0 0 0 0 022 | 0 0 0 0 0 0 0 023 | 0 0 0 0 0 0 0 024 | 0 0 0 0 0 0 0 025 | 0 0 0 0 0 0 0 026 | 0 0 0 0 0 0 0 027 | 0 0 0 0 0 0 0 028 | 0 0 0 0 0 0 0 029 | 0 0 0 0 0 0 0 030 | 0 0 0 0 0 0 0 031 | 0 0 0 0 0 0 0 032 | 0 0 0 0 0 0 0 0Related Commands
show auto-update
To view the Auto Update Server configfuration, use the show auto-update command in privileged EXEC mode.
show auto-update
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following is sample output from the show auto-update command:
hostname# show arp-inspectionPoll period: 1 minutes, retry count: 1, retry period: 5 minutesTimeout: noneDevice ID: host name [farscape]Related Commands
show blocks
To show the packet buffer utilization, use the show blocks command in privileged EXEC mode.
show blocks [{address hex | all | assigned | free | old | pool size [summary]} [diagnostics | dump | header | packet] | queue history [detail]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show blocks command helps you determine if the FWSM is overloaded. This command lists preallocated system buffer utilization. A full memory condition is not a problem as long as traffic is moving through the FWSM. You can use the show conn command to see if traffic is moving. If traffic is not moving and the memory is full, there may be a problem.
You can also view this information using SNMP.
The information shown in a security context includes the system-wide information as well as context-specific information about the blocks in use and the high water mark for block usage.
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show blocks command in single mode:
hostname# show blocksSIZE MAX LOW CNT4 1600 1598 159980 400 398 399256 3600 3540 35421550 4716 3177 318416384 10 10 102048 1000 1000 1000Table 3 shows each field description.
The following is sample output from the show blocks all command:
hostname# show blocks allClass 0, size 4Block allocd_by freed_by data size alloccnt dup_cnt oper location0x01799940 0x00000000 0x00101603 0 0 0 alloc not_specified0x01798e80 0x00000000 0x00101603 0 0 0 alloc not_specified0x017983c0 0x00000000 0x00101603 0 0 0 alloc not_specified...Found 1000 of 1000 blocksDisplaying 1000 of 1000 blocksTable 4 shows each field description.
The following is sample output from the show blocks command in a context:
hostname/contexta# show blocksSIZE MAX LOW CNT INUSE HIGH4 1600 1599 1599 0 080 400 400 400 0 0256 3600 3538 3540 0 11550 4616 3077 3085 0 0The following is sample output from the show blocks queue history command:
hostname# show blocks queue historyEach Summary for User and Queue_type is followed its top 5 individual queuesBlock Size: 4Summary for User "http", Queue "tcp_unp_c_in", Blocks 1595, Queues 1396Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcSummary for User "aaa", Queue "tcp_unp_c_in", Blocks 220, Queues 200Blk_cnt Q_cnt Last_Op Queue_Type User Context21 1 put contexta1 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcBlk_cnt Q_cnt Last_Op Queue_Type User Context200 1 alloc ip_rx tcp contexta108 1 get ip_rx udp contexta85 1 free fixup h323_ras contextb42 1 put fixup skinny contextbBlock Size: 1550Summary for User "http", Queue "tcp_unp_c_in", Blocks 1595, Queues 1000Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextc...The following is sample output from the show blocks queue history detail command:
hostname# show blocks queue history detailHistory buffer memory usage: 2136 bytes (default)Each Summary for User and Queue type is followed its top 5 individual queuesBlock Size: 4Summary for User "http", Queue_Type "tcp_unp_c_in", Blocks 1595, Queues 1396Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcFirst Block information for Block at 0x.....dup_count 0, flags 0x8000000, alloc_pc 0x43ea2a,start_addr 0xefb1074, read_addr 0xefb118c, write_addr 0xefb1193urgent_addr 0xefb118c, end_addr 0xefb17b20efb1150: 00 00 00 03 47 c5 61 c5 00 05 9a 38 76 80 a3 00 | ....G.a....8v...0efb1160: 00 0a 08 00 45 00 05 dc 9b c9 00 00 ff 06 f8 f3 | ....E...........0efb1170: 0a 07 0d 01 0a 07 00 50 00 17 cb 3d c7 e5 60 62 | .......P...=..`b0efb1180: 7e 73 55 82 50 18 10 00 45 ca 00 00 2d 2d 20 49 | ~sU.P...E...-- I0efb1190: 50 20 2d 2d 0d 0a 31 30 2e 37 2e 31 33 2e 31 09 | P --..10.7.13.1.0efb11a0: 3d 3d 3e 09 31 30 2e 37 2e 30 2e 38 30 0d 0a 0d | ==>.10.7.0.80...Summary for User "aaa", Queue "tcp_unp_c_in", Blocks 220, Queues 200Blk_cnt Q_cnt Last_Op Queue_Type User Context21 1 put contexta1 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcFirst Block information for Block at 0x.....dup_count 0, flags 0x8000000, alloc_pc 0x43ea2a,start_addr 0xefb1074, read_addr 0xefb118c, write_addr 0xefb1193urgent_addr 0xefb118c, end_addr 0xefb17b20efb1150: 00 00 00 03 47 c5 61 c5 00 05 9a 38 76 80 a3 00 | ....G.a....8v...0efb1160: 00 0a 08 00 45 00 05 dc 9b c9 00 00 ff 06 f8 f3 | ....E...........0efb1170: 0a 07 0d 01 0a 07 00 50 00 17 cb 3d c7 e5 60 62 | .......P...=..`b0efb1180: 7e 73 55 82 50 18 10 00 45 ca 00 00 2d 2d 20 49 | ~sU.P...E...-- I0efb1190: 50 20 2d 2d 0d 0a 31 30 2e 37 2e 31 33 2e 31 09 | P --..10.7.13.1.0efb11a0: 3d 3d 3e 09 31 30 2e 37 2e 30 2e 38 30 0d 0a 0d | ==>.10.7.0.80......total_count: total buffers in this classThe following is sample output from the show blocks pool summary command:
hostname# show blocks pool 1550 summaryClass 3, size 1550=================================================total_count=1531 miss_count=0Alloc_pc valid_cnt invalid_cnt0x3b0a18 00000256 000000000x01ad0760 0x01acfe00 0x01acf4a0 0x01aceb40 00000000 0x000000000x3a8f6b 00001275 000000120x05006aa0 0x05006140 0x050057e0 0x05004520 000000000x00000000=================================================total_count=9716 miss_count=0Freed_pc valid_cnt invalid_cnt0x9a81f3 00000104 000000070x05006140 0x05000380 0x04fffa20 0x04ffde00 00000000 0x000000000x9a0326 00000053 000000330x05006aa0 0x050057e0 0x05004e80 0x05003260 00000000 0x000000000x4605a2 00000005 000000000x04ff5ac0 0x01e8e2e0 0x01e2eac0 0x01e17d20 00000000 0x00000000...=================================================total_count=1531 miss_count=0Queue valid_cnt invalid_cnt0x3b0a18 00000256 00000000 Invalid Bad qtype0x01ad0760 0x01acfe00 0x01acf4a0 0x01aceb40 00000000 0x000000000x3a8f6b 00001275 00000000 Invalid Bad qtype0x05006aa0 0x05006140 0x050057e0 0x05004520 000000000x00000000=================================================free_cnt=8185 fails=0 actual_free=8185 hash_miss=003a8d3e0 03a8b7c0 03a7fc40 03a6ff20 03a6f5c0 03a6ec60 kao-f1#Table 5 shows each field description.
Related Commands
blocks
Increases the memory assigned to block diagnostics
clear blocks
Clears the system buffer statistics.
show conn
Shows active connections.
show boot device (IOS)
To view the default boot partition, use the show boot device command.
show boot device [mod_num]
Syntax Description
mod_num
(Optional) Specifies the module number. Use the show module command to view installed modules and their numbers.
Defaults
The default boot partition is cf:4.
Command Modes
Privileged EXEC.
Command History
Examples
The following is sample output from the show boot device command that shows the boot partitions for each installed FWSM on Cisco IOS software:
Router# show boot device[mod:1 ]:[mod:2 ]:[mod:3 ]:[mod:4 ]: cf:4[mod:5 ]: cf:4[mod:6 ]:[mod:7 ]: cf:4[mod:8 ]:[mod:9 ]:Related Commands
boot device (IOS)
Sets the default boot partition.
show module (IOS)
Shows all installed modules.
show capture
To display the capture configuration when no options are specified, use the show capture command.
show capture [capture_name] [access-list access_list_name] [count number] [decode] [detail] [dump] [packet-number number]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: privileged mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
Usage Guidelines
If you specify the capture_name, then the capture buffer contents for that capture are displayed.
The dump keyword does not display MAC information in the hexadecimal dump.
The decoded output of the packets depend on the protocol of the packet. In Table 25-4, the bracketed output is displayed when you specify the detail keyword.
Examples
This example shows how to display the capture configuration:
hostname(config)# show capturecapture arp ethernet-type arp interface outsidecapture http access-list http packet-length 74 interface insideThis example shows how to display the packets that are captured by an ARP capture:
hostname(config)# show capture arp2 packets captured19:12:23.478429 arp who-has 171.69.38.89 tell 171.69.38.1019:12:26.784294 arp who-has 171.69.38.89 tell 171.69.38.102 packets shownRelated Commands
show checkheaps
To show the checkheaps statistics, use the show checkheaps command in privileged EXEC mode. Checkheaps is a periodic process that verifies the sanity of the heap memory buffers (dynamic memory is allocated from the system heap memory region) and the integrity of the code region.
show checkheaps
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show checkheaps command:
hostname# show checkheapsCheckheaps stats from buffer validation runs--------------------------------------------Time elapsed since last run : 42 secsDuration of last run : 0 millisecsNumber of buffers created : 8082Number of buffers allocated : 7808Number of buffers free : 274Total memory in use : 43570344 bytesTotal memory in free buffers : 87000 bytesTotal number of runs : 310Related Commands
show checksum
To display the configuration checksum, use the show checksum command in privileged EXEC mode.
show checksum
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
Command History
Usage Guidelines
The show checksum command allows you to display four groups of hexadecimal numbers that act as a digital summary of the configuration contents. This checksum is calculated only when you store the configuration in Flash memory.
If a dot (".") appears before the checksum in the show config or show checksum command output, the output indicates a normal configuration load or write mode indicator (when loading from or writing to the FWSM Flash partition). The "." shows that the FWSM is preoccupied with the operation but is not "hung up." This message is similar to a "system processing, please wait" message.
Examples
This example shows how to display the configuration or the checksum:
hostname(config)# show checksumCryptochecksum: 1a2833c0 129ac70b 1a88df85 650dbb81show chunkstat
To display the chunk statistics, use the show chunkstat command in privileged EXEC mode.
show chunkstat
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following example shows how to display the chunk statistics:
hostname# show chunkstatGlobal chunk statistics: created 181, destroyed 34, siblings created 94, siblings destroyed 34Per-chunk statistics: siblings created 0, siblings trimmed 0Dump of chunk at 01edb4cc, name "Managed Chunk Queue Elements", data start @ 01edbd24, end @ 01eddc54next: 01eddc8c, next_sibling: 00000000, prev_sibling: 00000000flags 00000001maximum chunk elt's: 499, elt size: 16, index first free 498# chunks in use: 1, HWM of total used: 1, alignment: 0Per-chunk statistics: siblings created 0, siblings trimmed 0Dump of chunk at 01eddc8c, name "Registry Function List", data start @ 01eddea4, end @ 01ede348next: 01ede37c, next_sibling: 00000000, prev_sibling: 00000000flags 00000001maximum chunk elt's: 99, elt size: 12, index first free 42# chunks in use: 57, HWM of total used: 57, alignment: 0Related Commands
show counters
Displays the protocol stack counters.
show cpu
Displays the CPU utilization information.
show class
To show the contexts assigned to a class, use the show class command in privileged EXEC mode.
show class name
Syntax Description
name
Specifies the name as a string up to 20 characters long. To show the default class, enter default for the name.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
N/A
N/A
—
—
•
Command History
Examples
The following is sample output from the show class default command:
hostname# show class defaultClass Name Members ID Flagsdefault All 1 0001Related Commands
show conn
To display the connection state for the designated connection type, use the show conn command in privileged EXEC mode. This command supports IPv4 and IPv6 addresses.
show conn [all | count] [state state_type] | [{{foreign | local} ip [-ip2] netmask mask}] | [long | detail] | [{{lport | fport} port1} [-port2]] | [protocol {tcp | udp}]
Syntax Description
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
1.1(1)
This command was introduced.
3.2(1)
The b state for TCP state bypass and X state for xlate bypass were added.
Usage Guidelines
The show conn command displays the number of active TCP connections, and provides information about connections of various types. Use the show conn all command to see the entire table of connections.
Note
The connection types that you can specify using the show conn state command are defined in Table 7. When specifying multiple connection types, use commas without spaces to separate the keywords.
When you use the detail option, the system displays information about the translation type and interface information using the connection flags defined in Table 8.
Table 25-6 Connection Flags
a
awaiting outside ACK to SYN
A
awaiting inside ACK to SYN
b
State bypass
B
initial SYN from outside
C
Computer Telephony Interface Quick Buffer Encoding (CTIQBE) media connection
d
dump
D
UDP DNS
E
outside back connection
f
inside FIN
F
outside FIN
g
Media Gateway Control Protocol (MGCP) connection
G
connection is part of a group1
h
H.225
H
H.323
i
incomplete TCP or UDP connection
I
inbound data
j
GTP data
J
GTP control
k
Skinny Client Control Protocol (SCCP) media connection
K
GTP t3-response
m
SIP media connection
M
SMTP data
n
GUP
N
Supervisor-based acceleration connection
O
outbound data
p
PISA connection
P
inside back connection
q
SQL*Net data
r
inside acknowledged FIN
R
outside acknowledged FIN for TCP connection
R
UDP SunRPC2
s
awaiting outside SYN
S
awaiting inside SYN
t
SIP transient connection3
T
SIP connection4
U
up
X
xlate creation bypassed
W
WAAS session
1 The G flag indicates the connection is part of a group. It is set by the GRE and FTP Strict inspections to designate the control connection and all its associated secondary connections. If the control connection terminates, then all associated secondary connections are also terminated.
2 Because each row of show conn command output represents one connection (TCP or UDP ), there will be only one R flag per row.
3 For UDP connections, the value t indicates that it will timeout after one minute.
4 For UDP connections, the value T indicates that the connection will timeout according to the value specified using the timeout sip command.
Note
A single connection is created for multiple DNS sessions, as long as they are between the same two hosts, and the sessions have the same 5-tuple (source/destination IP address, source/destination port, and protocol). DNS identification is tracked by app_id, and the idle timer for each app_id runs independently.
Because the app_id expires independently, a legitimate DNS response can only pass through the FWSM within a limited period of time and there is no resource build-up. However, when you enter the show conn command, you will see the idle timer of a DNS connection being reset by a new DNS session. This is due to the nature of the shared DNS connection and is by design.
Note
Examples
When specifying multiple connection types, use commas without spaces to separate the keywords. The following is sample output including RPC, H.323, and SIP connection information in the Up state from the show conn command:
hostname# show conn state up,rpc,h323,sipThe following is sample output that shows a TCP session connection from inside host 10.1.1.15 to the outside Telnet server at 192.168.49.10. Because there is no B flag, the connection is initiated from the inside. The "U", "I", and "O" flags denote that the connection is active and has received inbound and outbound data.
hostname# show conn2 in use, 2 most usedTCP out 192.168.49.10:23 in 10.1.1.15:1026 idle 0:00:22Bytes 1774 flags UIOUDP out 192.168.49.10:31649 in 10.1.1.15:1028 idle 0:00:14flags D-The following sample output that shows a UDP connection from outside host 192.168.49.10 to inside host 10.1.1.15. The D flag denotes that this is a DNS connection. The number 1028 is the DNS ID over the connection.
hostname(config)# show conn detail2 in use, 2 most usedFlags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,B - initial SYN from outside, b - State bypass, C - CTIQBE media,D - DNS, d - dump, E - outside back connection, F - outside FIN,f - inside FIN, G - group, g - MGCP, H - H.323, h - H.225.0,I - inbound data, i - incomplete, J - GTP, j - GTP data, k - Skinny media,M - SMTP data, m - SIP media, n - GUP, O - outbound data,P - inside back connection, q - SQL*Net data, R - outside acknowledged FIN,R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,s - awaiting outside SYN, T - SIP, t - SIP transient, U - upX - xlate creation bypassedTCP outside:192.168.49.10/23 inside:10.1.1.15/1026 flags UIOUDP outside:192.168.49.10/31649 inside:10.1.1.15/1028 flags dDThe following is sample output from a GRE session connection (PROT:47) from host 172.16.2.1 to host 172.16.112.2. Because it is a non TCP connection, it is unidirectional and there are no flags.
hostname# show conn2 in use, 2 most usedNetwork Processor 1 connectionsPROT:47 out 172.16.112.2 in 172.16.2.1 idle 0:00:08Bytes 18The following is sample output from the show conn all command:
hostname# show conn all6 in use, 6 most usedTCP out 209.165.201.1:80 in 10.3.3.4:1404 idle 0:00:00 Bytes 11391TCP out 209.165.201.1:80 in 10.3.3.4:1405 idle 0:00:00 Bytes 3709TCP out 209.165.201.1:80 in 10.3.3.4:1406 idle 0:00:01 Bytes 2685TCP out 209.165.201.1:80 in 10.3.3.4:1407 idle 0:00:01 Bytes 2683TCP out 209.165.201.1:80 in 10.3.3.4:1403 idle 0:00:00 Bytes 15199TCP out 209.165.201.1:80 in 10.3.3.4:1408 idle 0:00:00 Bytes 2688UDP out 209.165.201.7:24 in 10.3.3.4:1402 idle 0:01:30UDP out 209.165.201.7:23 in 10.3.3.4:1397 idle 0:01:30UDP out 209.165.201.7:22 in 10.3.3.4:1395 idle 0:01:30In this example, host 10.3.3.4 on the inside has accessed a website at 209.165.201.1. The global address on the outside interface is 209.165.201.7.
The following is sample output from the show conn detail command:
hostname# show conn detail0 in use, 26152 most usedFlags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,B - initial SYN from outside, b - State bypass, C - CTIQBE media,D - DNS, d - dump, E - outside back connection, F - outside FIN,f - inside FIN, G - group, g - MGCP, H - H.323, h - H.225.0,I - inbound data, i - incomplete, J - GTP, j - GTP data, k - Skinny media,M - SMTP data, m - SIP media, n - GUP, O - outbound data,P - inside back connection, q - SQL*Net data, R - outside acknowledged FIN,R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,s - awaiting outside SYN, T - SIP, t - SIP transient, U - upX - xlate creation bypassedNetwork Processor 1 connectionsRelated Commands
show console-output
To display the currently captured console output, use the show console-output command in privileged EXEC mode. The FWSM automatically captures output destined for the internal console port. Do not use the internal console port unless you are advised to do so by Cisco TAC. This command allows you to view console output on your Telnet or SSH session.
show console-output
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
·
Command History
Usage Guidelines
Information that displays only on a console port includes output from the perfmon command, startup messages, and some debug messages. The console buffer is a maximum of 1 K, and is not user configurable.
Examples
The following example shows the message that displays when there is no console output:
hostname# show console-outputSorry, there are no messages to displayRelated Commands
show context
To show context information including allocated interfaces and the configuration file URL, the number of contexts configured, or from the system execution space, a list of all contexts, use the show context command in privileged EXEC mode.
show context [name | detail | count]
Syntax Description
Defaults
In the system execution space, the FWSM displays all contexts if you do not specify a name.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show context command. The following sample display shows three contexts:
Context Name Class Interfaces Mode URL*admin default Vlan100,101 Routed disk:/admin.cfgcontexta Gold Vlan200,201 Transparent disk:/contexta.cfgcontextb Silver Vlan300,301 Routed disk:/contextb.cfgTotal active Security Contexts: 3Table 25-7 shows each field description.
The following is sample output from the show context detail command:
hostname# show context detailContext "admin", has been created, but initial ACL rules not completeConfig URL: disk:/admin.cfgReal Interfaces: Vlan100Mapped Interfaces: Vlan100Class: default, Flags: 0x00000013, ID: 1Context "ctx", has been created, but initial ACL rules not completeConfig URL: disk:/ctx.cfgReal Interfaces: Vlan10,20,30Mapped Interfaces: int1, int2, int3Class: default, Flags: 0x00000011, ID: 2Context "system", is a system resourceConfig URL: startup-configReal Interfaces:Mapped Interfaces: Vlan100,10,20,30Class: default, Flags: 0x00000019, ID: 257Context "null", is a system resourceConfig URL: ... null ...Real Interfaces:Mapped Interfaces:Class: default, Flags: 0x00000009, ID: 258Table 25-8 shows each field description.
The following is sample output from the show context count command:
hostname# show context countTotal active contexts: 2Related Commands
show counters
To display the protocol stack counters, use the show counters command in privileged EXEC mode.
show counters [all | context context-name | summary | top n ] [detail] [protocol protocol_name[:counter_name]] [threshold n]
Syntax Description
Defaults
For multiple context mode, the default context is summary, which shows counters for every context. For single mode, the context name is ignored and the output shows the "context" as "single_vf."
The default count threshold is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following example shows how to display all counters:
hostname# show counters allProtocol Counter Value ContextIOS_IPC IN_PKTS 2 adminIOS_IPC OUT_PKTS 2 adminIOS_IPC IN_PKTS 15 customeraIOS_IPC OUT_PKTS 6 customeraThe following example shows how to display a summary of counters:
hostname# show countersProtocol Counter Value ContextNPCP IN_PKTS 7195 SummaryNPCP OUT_PKTS 7603 SummaryIOS_IPC IN_PKTS 869 SummaryIOS_IPC OUT_PKTS 865 SummaryIP IN_PKTS 380 SummaryIP OUT_PKTS 411 SummaryIP TO_ARP 105 SummaryIP TO_UDP 9 SummaryUDP IN_PKTS 9 SummaryUDP DROP_NO_APP 9 SummaryFIXUP IN_PKTS 202 SummaryThe following example shows how to display counters for a context:
hostname# show counters context adminProtocol Counter Value ContextIOS_IPC IN_PKTS 4 adminIOS_IPC OUT_PKTS 4 adminRelated Commands
clear counters
Clears the protocol stack counters.
show counters description
Shows a list of protocol counters.
show counters description
To display the protocol stack counter descriptions, use the show counters description command in privileged EXEC mode.
show counters description
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show counters description command:
hostname# show counters descriptionProtocol Counter DescriptionNPCP IN_PKTS Packets from network processorsNPCP OUT_PKTS Packets to network processorsNPCP DROP_LIMIT1 Gigamac packets dropped due to IP protocol queue limiterNPCP DROP_LIMIT2 Gigamac packets dropped due to ARP protocol queue limiterNPCP DROP_LIMIT3 Gigamac packets dropped due to Fixup queue limiter...Related Commands
clear counters
Clears the protocol stack counters.
show counters
Shows the protocol stack counters.
show cpu
To display the CPU utilization information, use the show cpu usage command in privileged EXEC mode.
show cpu [usage]
From the system configuration in multiple context mode:
show cpu [usage] [context {all | context_name}]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The cpu usage is computed using an approximation of the load every five seconds, and by further feeding this approximation into two, following moving averages.
You can use the show cpu command to find process related loads (that is, activity on behalf of items listed by the output of the show process command in both single mode and from the system configuration in multiple context mode).
Further, you can request, when in multiple context mode, a breakdown of the process related load to CPU consumed by any configured contexts by changing to each context and entering the show cpu command or by entering the show cpu context variant of this command.
While process related load is rounded to the nearest whole number, context related loads include one additional decimal digit of precision. For example, entering show cpu from the system context produces a different number than from entering the show cpu context system command. The former is an approximate summary of everything in show cpu context all, and the latter is only a portion of that summary.
Examples
The following example shows how to display the CPU utilization:
hostname# show cpu usageCPU utilization for 5 seconds = 18%; 1 minute: 18%; 5 minutes: 18%This example shows how to display the CPU utilization for the system context in multiple mode:
hostname# show cpu context systemCPU utilization for 5 seconds = 9.1%; 1 minute: 9.2%; 5 minutes: 9.1%The following shows how to display the CPU utilization for all contexts:
hostname# show cpu usage context all5 sec 1 min 5 min Context Name9.1% 9.2% 9.1% system0.0% 0.0% 0.0% admin5.0% 5.0% 5.0% one4.2% 4.3% 4.2% twoThis example shows how to display the CPU utilization for a context named "one":
hostname/one# show cpu usageCPU utilization for 5 seconds = 5.0%; 1 minute: 5.0%; 5 minutes: 5.0%Related Commands
show cpu threshold
To display the CPU usage information when the configured rising threshold is reached and remains for the configured monitoring interval period, use the show cpu threshold command in privileged EXEC mode.
show cpu threshold
Syntax Description
This command has no keywords and no arguments.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The CPU usage threshold is computed using an approximation of the load for the configured monitoring period, and then by feeding this approximation into two moving averages.
Examples
The following example shows how to display the CPU usage threshold:
hostname# show cpu thresholdCPU utilization RisingThresholdValue = 60%; RisingThresholdPeriod = 300secsRelated Commands
show crashinfo
To display the contents of the crash file stored in Flash memory, enter the show crashinfo command in privileged EXEC mode.
show crashinfo [save]
Syntax Description
save
(Optional) Displays if the FWSM is configured to save crash information to Flash memory or not.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
If the crash file is from a test crash (generated from the crashinfo test command), the first string of the crash file is ": Saved_Test_Crash" and the last string is ": End_Test_Crash". If the crash file is from a real crash, the first string of the crash file is ": Saved_Crash" and the last string is ": End_Crash". (This includes crashes from use of the crashinfo force page-fault or crashinfo force watchdog commands).
If there is no crash data saved in flash, or if the crash data has been cleared by entering the clear crashinfo command, the show crashinfo command displays an error message.
Examples
The following example shows how to display the current crash information configuration:
hostname# show crashinfo savecrashinfo save enableThe following example shows the output for a crash file test. (However, this test does not actually crash the FWSM. It provides a simulated example file.)
hostname(config)# crashinfo testhostname(config)# exithostname# show crashinfo: Saved_Test_CrashThread Name: ci/console (Old pc 0x001a6ff5 ebp 0x00e88920)Traceback:0: 003231431: 0032321b2: 0010885c3: 0010763c4: 001078db5: 001035856: 00000000vector 0x000000ff (user defined)edi 0x004f20c4esi 0x00000000ebp 0x00e88c20esp 0x00e88bd8ebx 0x00000001edx 0x00000074ecx 0x00322f8beax 0x00322f8berror code n/aeip 0x0010318ccs 0x00000008eflags 0x00000000CR2 0x00000000Stack dump: base:0x00e8511c size:16384, active:14760x00e89118: 0x004f1bb40x00e89114: 0x001078b40x00e89110-0x00e8910c: 0x000000000x00e89108-0x00e890ec: 0x123456780x00e890e8: 0x004f1bb40x00e890e4: 0x001035850x00e890e0: 0x00e8910c0x00e890dc-0x00e890cc: 0x123456780x00e890c8: 0x000000000x00e890c4-0x00e890bc: 0x123456780x00e890b8: 0x004f1bb40x00e890b4: 0x001078db0x00e890b0: 0x00e890e00x00e890ac-0x00e890a8: 0x123456780x00e890a4: 0x001179b30x00e890a0: 0x00e890b00x00e8909c-0x00e89064: 0x123456780x00e89060: 0x123456000x00e8905c: 0x202329700x00e89058: 0x616d2d650x00e89054: 0x740020230x00e89050: 0x296769660x00e8904c: 0x6e6f63280x00e89048: 0x316365730x00e89044: 0x7069636f0x00e89040: 0x647869700x00e8903c-0x00e88e50: 0x000000000x00e88e4c: 0x000a74730x00e88e48: 0x6574206f0x00e88e44: 0x666e69680x00e88e40: 0x736172630x00e88e3c-0x00e88e38: 0x000000000x00e88e34: 0x123456000x00e88e30-0x00e88dfc: 0x000000000x00e88df8: 0x003167610x00e88df4: 0x747061000x00e88df0: 0x123456000x00e88dec-0x00e88ddc: 0x000000000x00e88dd8: 0x000000700x00e88dd4: 0x616d2d650x00e88dd0: 0x74756f000x00e88dcc: 0x000000000x00e88dc8: 0x00e88e400x00e88dc4: 0x004f20c40x00e88dc0: 0x123456000x00e88dbc: 0x000000000x00e88db8: 0x000000350x00e88db4: 0x315f656c0x00e88db0: 0x62616e650x00e88dac: 0x0030fcf00x00e88da8: 0x3011111f0x00e88da4: 0x004df43c0x00e88da0: 0x0053fef00x00e88d9c: 0x004f1bb40x00e88d98: 0x123456000x00e88d94: 0x000000000x00e88d90: 0x000000350x00e88d8c: 0x315f656c0x00e88d88: 0x62616e650x00e88d84: 0x000000000x00e88d80: 0x004f20c40x00e88d7c: 0x000000010x00e88d78: 0x013456780x00e88d74: 0x00f538540x00e88d70: 0x00f7f7540x00e88d6c: 0x00e88db00x00e88d68: 0x00e88d7b0x00e88d64: 0x00f538740x00e88d60: 0x00e890400x00e88d5c-0x00e88d54: 0x123456780x00e88d50-0x00e88d4c: 0x000000000x00e88d48: 0x004f1bb40x00e88d44: 0x00e88d7c0x00e88d40: 0x00e88e400x00e88d3c: 0x00f538740x00e88d38: 0x004f1bb40x00e88d34: 0x0010763c0x00e88d30: 0x00e890b00x00e88d2c: 0x00e88db00x00e88d28: 0x00e88d880x00e88d24: 0x0010761a0x00e88d20: 0x00e890b00x00e88d1c: 0x00e88e400x00e88d18: 0x00f538740x00e88d14: 0x0010166d0x00e88d10: 0x0000000e0x00e88d0c: 0x00f538740x00e88d08: 0x00f538540x00e88d04: 0x0048b3010x00e88d00: 0x00e88d300x00e88cfc: 0x0000000e0x00e88cf8: 0x00f538540x00e88cf4: 0x0048a4010x00e88cf0: 0x00f538540x00e88cec: 0x00f538740x00e88ce8: 0x0000000e0x00e88ce4: 0x0048a64b0x00e88ce0: 0x0000000e0x00e88cdc: 0x00f538740x00e88cd8: 0x00f7f96c0x00e88cd4: 0x0048b4f80x00e88cd0: 0x00e88d000x00e88ccc: 0x0000000f0x00e88cc8: 0x00f7f96c0x00e88cc4-0x00e88cc0: 0x0000000e0x00e88cbc: 0x00e890400x00e88cb8: 0x000000000x00e88cb4: 0x00f5387e0x00e88cb0: 0x00f538740x00e88cac: 0x000000020x00e88ca8: 0x000000010x00e88ca4: 0x000000090x00e88ca0-0x00e88c9c: 0x000000010x00e88c98: 0x00e88cb00x00e88c94: 0x004f20c40x00e88c90: 0x0000003a0x00e88c8c: 0x000000000x00e88c88: 0x0000000a0x00e88c84: 0x00489f3a0x00e88c80: 0x00e88d880x00e88c7c: 0x00e88e400x00e88c78: 0x00e88d7c0x00e88c74: 0x001087ed0x00e88c70: 0x000000010x00e88c6c: 0x00e88cb00x00e88c68: 0x000000020x00e88c64: 0x0010885c0x00e88c60: 0x00e88d300x00e88c5c: 0x007273340x00e88c58: 0xa0ffffff0x00e88c54: 0x00e88cb00x00e88c50: 0x000000010x00e88c4c: 0x00e88cb00x00e88c48: 0x000000020x00e88c44: 0x0032321b0x00e88c40: 0x00e88c600x00e88c3c: 0x00e88c7f0x00e88c38: 0x00e88c5c0x00e88c34: 0x004b1ad50x00e88c30: 0x00e88c600x00e88c2c: 0x00e88e400x00e88c28: 0xa0ffffff0x00e88c24: 0x003231430x00e88c20: 0x00e88c400x00e88c1c: 0x000000000x00e88c18: 0x000000080x00e88c14: 0x0010318c0x00e88c10-0x00e88c0c: 0x00322f8b0x00e88c08: 0x000000740x00e88c04: 0x000000010x00e88c00: 0x00e88bd80x00e88bfc: 0x00e88c200x00e88bf8: 0x000000000x00e88bf4: 0x004f20c40x00e88bf0: 0x000000ff0x00e88bec: 0x00322f870x00e88be8: 0x00f5387e0x00e88be4: 0x003230210x00e88be0: 0x00e88c100x00e88bdc: 0x004f20c40x00e88bd8: 0x00000000 *0x00e88bd4: 0x004eabb00x00e88bd0: 0x000000010x00e88bcc: 0x00f5387e0x00e88bc8-0x00e88bc4: 0x000000000x00e88bc0: 0x000000080x00e88bbc: 0x0010318c0x00e88bb8-0x00e88bb4: 0x00322f8b0x00e88bb0: 0x000000740x00e88bac: 0x000000010x00e88ba8: 0x00e88bd80x00e88ba4: 0x00e88c200x00e88ba0: 0x000000000x00e88b9c: 0x004f20c40x00e88b98: 0x000000ff0x00e88b94: 0x001031f20x00e88b90: 0x00e88c200x00e88b8c: 0xffffffff0x00e88b88: 0x00e88cb00x00e88b84: 0x003200320x00e88b80: 0x373031330x00e88b7c: 0x312f65740x00e88b78: 0x6972772f0x00e88b74: 0x342f76650x00e88b70: 0x647366660x00e88b6c: 0x000200000x00e88b68: 0x000000100x00e88b64: 0x000000010x00e88b60: 0x123456cd0x00e88b5c: 0x000000000x00e88b58: 0x00000008Cisco XXX Firewall Version X.XCisco XXX Device Manager Version X.XCompiled on Fri 15-Nov-04 14:35 by roothostname up 10 days 0 hoursHardware: XXX-XXX, 64 MB RAM, CPU Pentium 200 MHzFlash i28F640J5 @ 0x300, 16MBBIOS Flash AT29C257 @ 0xfffd8000, 32KB0: ethernet0: address is 0003.e300.73fd, irq 101: ethernet1: address is 0003.e300.73fe, irq 72: ethernet2: address is 00d0.b7c8.139e, irq 9Licensed Features:Failover: DisabledVPN-DES: EnabledVPN-3DES-AES: DisabledMaximum Interfaces: 3Cut-through Proxy: EnabledGuards: EnabledURL-filtering: EnabledInside Hosts: UnlimitedThroughput: UnlimitedIKE peers: UnlimitedThis XXX has a Restricted (R) license.Serial Number: 480430455 (0x1ca2c977)Running Activation Key: 0xc2e94182 0xc21d8206 0x15353200 0x633f6734Configuration last modified by enable_15 at 13:49:42.148 UTC Wed Nov 20 2004------------------ show clock ------------------15:34:28.129 UTC Sun Nov 24 2004------------------ show memory ------------------Free memory: 50444824 bytesUsed memory: 16664040 bytes------------- ----------------Total memory: 67108864 bytes------------------ show conn count ------------------0 in use, 0 most used------------------ show xlate count ------------------0 in use, 0 most used------------------ show blocks ------------------SIZE MAX LOW CNT4 1600 1600 160080 400 400 400256 500 499 5001550 1188 795 927------------------ show interface ------------------interface ethernet0 "outside" is up, line protocol is upHardware is i82559 ethernet, address is 0003.e300.73fdIP address 172.23.59.232, subnet mask 255.255.0.0MTU 1500 bytes, BW 10000 Kbit half duplex6139 packets input, 830375 bytes, 0 no bufferReceived 5990 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort90 packets output, 6160 bytes, 0 underruns0 output errors, 13 collisions, 0 interface resets0 babbles, 0 late collisions, 47 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (5/128) software (0/2)output queue (curr/max blocks): hardware (0/1) software (0/1)interface ethernet1 "inside" is up, line protocol is downHardware is i82559 ethernet, address is 0003.e300.73feIP address 10.1.1.1, subnet mask 255.255.255.0MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort1 packets output, 60 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred1 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/0)output queue (curr/max blocks): hardware (0/1) software (0/1)interface ethernet2 "intf2" is administratively down, line protocol is downHardware is i82559 ethernet, address is 00d0.b7c8.139eIP address 127.0.0.1, subnet mask 255.255.255.255MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)------------------ show cpu usage ------------------CPU utilization for 5 seconds = 0%; 1 minute: 0%; 5 minutes: 0%------------------ show process ------------------PC SP STATE Runtime SBASE Stack ProcessHsi 001e3329 00763e7c 0053e5c8 0 00762ef4 3784/4096 arp_timerLsi 001e80e9 00807074 0053e5c8 0 008060fc 3792/4096 FragDBGCLwe 00117e3a 009dc2e4 00541d18 0 009db46c 3704/4096 dbgtraceLwe 003cee95 009de464 00537718 0 009dc51c 8008/8192 LoggerHwe 003d2d18 009e155c 005379c8 0 009df5e4 8008/8192 tcp_fastHwe 003d2c91 009e360c 005379c8 0 009e1694 8008/8192 tcp_slowLsi 002ec97d 00b1a464 0053e5c8 0 00b194dc 3928/4096 xlate cleanLsi 002ec88b 00b1b504 0053e5c8 0 00b1a58c 3888/4096 uxlate cleanMrd 002e3a17 00c8f8d4 0053e600 0 00c8d93c 7908/8192 tcp_intercept_timesLsi 00423dd5 00d3a22c 0053e5c8 0 00d392a4 3900/4096 route_processHsi 002d59fc 00d3b2bc 0053e5c8 0 00d3a354 3780/4096 PIX Garbage CollecrHwe 0020e301 00d5957c 0053e5c8 0 00d55614 16048/16384 isakmp_time_keeprLsi 002d377c 00d7292c 0053e5c8 0 00d719a4 3928/4096 perfmonHwe 0020bd07 00d9c12c 0050bb90 0 00d9b1c4 3944/4096 IPSecMwe 00205e25 00d9e1ec 0053e5c8 0 00d9c274 7860/8192 IPsec timer handlerHwe 003864e3 00db26bc 00557920 0 00db0764 6904/8192 qos_metric_daemonMwe 00255a65 00dc9244 0053e5c8 0 00dc8adc 1436/2048 IP BackgroundLwe 002e450e 00e7bb94 00552c30 0 00e7ad1c 3704/4096 pix/traceLwe 002e471e 00e7cc44 00553368 0 00e7bdcc 3704/4096 pix/tconsoleHwe 001e5368 00e7ed44 00730674 0 00e7ce9c 7228/8192 pix/intf0Hwe 001e5368 00e80e14 007305d4 0 00e7ef6c 7228/8192 pix/intf1Hwe 001e5368 00e82ee4 00730534 2470 00e8103c 4892/8192 pix/intf2H* 001a6ff5 0009ff2c 0053e5b0 4820 00e8511c 12860/16384 ci/consoleCsi 002dd8ab 00e8a124 0053e5c8 0 00e891cc 3396/4096 update_cpu_usageHwe 002cb4d1 00f2bfbc 0051e360 0 00f2a134 7692/8192 uauth_inHwe 003d17d1 00f2e0bc 00828cf0 0 00f2c1e4 7896/8192 uauth_threadHwe 003e71d4 00f2f20c 00537d20 0 00f2e294 3960/4096 udp_timerHsi 001db3ca 00f30fc4 0053e5c8 0 00f3004c 3784/4096 557mcfixCrd 001db37f 00f32084 0053ea40 508286220 00f310fc 3688/4096 557pollLsi 001db435 00f33124 0053e5c8 0 00f321ac 3700/4096 557timerHwe 001e5398 00f441dc 008121e0 0 00f43294 3912/4096 fover_ip0Cwe 001dcdad 00f4523c 00872b48 120 00f44344 3528/4096 ip/0:0Hwe 001e5398 00f4633c 008121bc 10 00f453f4 3532/4096 icmp0Hwe 001e5398 00f47404 00812198 0 00f464cc 3896/4096 udp_thread/0Hwe 001e5398 00f4849c 00812174 0 00f475a4 3456/4096 tcp_thread/0Hwe 001e5398 00f495bc 00812150 0 00f48674 3912/4096 fover_ip1Cwe 001dcdad 00f4a61c 008ea850 0 00f49724 3832/4096 ip/1:1Hwe 001e5398 00f4b71c 0081212c 0 00f4a7d4 3912/4096 icmp1Hwe 001e5398 00f4c7e4 00812108 0 00f4b8ac 3896/4096 udp_thread/1Hwe 001e5398 00f4d87c 008120e4 0 00f4c984 3832/4096 tcp_thread/1Hwe 001e5398 00f4e99c 008120c0 0 00f4da54 3912/4096 fover_ip2Cwe 001e542d 00f4fa6c 00730534 0 00f4eb04 3944/4096 ip/2:2Hwe 001e5398 00f50afc 0081209c 0 00f4fbb4 3912/4096 icmp2Hwe 001e5398 00f51bc4 00812078 0 00f50c8c 3896/4096 udp_thread/2Hwe 001e5398 00f52c5c 00812054 0 00f51d64 3832/4096 tcp_thread/2Hwe 003d1a65 00f78284 008140f8 0 00f77fdc 300/1024 listen/http1Mwe 0035cafa 00f7a63c 0053e5c8 0 00f786c4 7640/8192 Crypto CA------------------ show failover ------------------No license for Failover------------------ show traffic ------------------outside:received (in 865565.090 secs):6139 packets 830375 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):90 packets 6160 bytes0 pkts/sec 0 bytes/secinside:received (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):1 packets 60 bytes0 pkts/sec 0 bytes/secintf2:received (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sec------------------ show perfmon ------------------PERFMON STATS: Current AverageXlates 0/s 0/sConnections 0/s 0/sTCP Conns 0/s 0/sUDP Conns 0/s 0/sURL Access 0/s 0/sURL Server Req 0/s 0/sTCP Fixup 0/s 0/sTCPIntercept 0/s 0/sHTTP Fixup 0/s 0/sFTP Fixup 0/s 0/sAAA Authen 0/s 0/sAAA Author 0/s 0/sAAA Account 0/s 0/s: End_Test_CrashRelated Commands
show crypto accelerator statistics
To display the global and accelerator-specific statistics from the hardware crypto accelerator MIB, use the show crypto accelerator statistics command in global configuration or privileged EXEC mode.
show crypto accelerator statistics
Syntax Description
This command has no keywords or variables.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example entered in global configuration mode, displays global crypto accelerator statistics:
hostname # show crypto accelerator statisticsCrypto Accelerator Status-------------------------[Capacity]Supports hardware crypto: TrueSupports modular hardware crypto: FalseMax accelerators: 1Max crypto throughput: 100 MbpsMax crypto connections: 750[Global Statistics]Number of active accelerators: 1Number of non-operational accelerators: 0Input packets: 700Input bytes: 753488Output packets: 700Output error packets: 0Output bytes: 767496[Accelerator 0]Status: ActiveSoftware crypto engineSlot: 0Active time: 167 secondsTotal crypto transforms: 7Total dropped packets: 0[Input statistics]Input packets: 0Input bytes: 0Input hashed packets: 0Input hashed bytes: 0Decrypted packets: 0Decrypted bytes: 0[Output statistics]Output packets: 0Output bad packets: 0Output bytes: 0Output hashed packets: 0Output hashed bytes: 0Encrypted packets: 0Encrypted bytes: 0[Diffie-Hellman statistics]Keys generated: 0Secret keys derived: 0[RSA statistics]Keys generated: 0Signatures: 0Verifications: 0Encrypted packets: 0Encrypted bytes: 0Decrypted packets: 0Decrypted bytes: 0[DSA statistics]Keys generated: 0Signatures: 0Verifications: 0[SSL statistics]Outbound records: 0Inbound records: 0[RNG statistics]Random number requests: 98Random number request failures: 0[Accelerator 1]Status: ActiveEncryption hardware device : Cisco ASA-55x0 on-board accelerator(revision 0x0)Boot microcode : CNlite-MC-Boot-Cisco-1.2SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03IPSec microcode : CNlite-MC-IPSECm-MAIN-2.03Slot: 1Active time: 170 secondsTotal crypto transforms: 1534Total dropped packets: 0[Input statistics]Input packets: 700Input bytes: 753544Input hashed packets: 700Input hashed bytes: 736400Decrypted packets: 700Decrypted bytes: 719944[Output statistics]Output packets: 700Output bad packets: 0Output bytes: 767552Output hashed packets: 700Output hashed bytes: 744800Encrypted packets: 700Encrypted bytes: 728352[Diffie-Hellman statistics]Keys generated: 97Secret keys derived: 1[RSA statistics]Keys generated: 0Signatures: 0Verifications: 0Encrypted packets: 0Encrypted bytes: 0Decrypted packets: 0Decrypted bytes: 0[DSA statistics]Keys generated: 0Signatures: 0Verifications: 0[SSL statistics]Outbound records: 0Inbound records: 0[RNG statistics]Random number requests: 1Random number request failures: 0hostname #Related Commands
show crypto ca certificates
To display the certificates associated with a specific trustpoint or to display all the certificates installed on the system, use the show crypto ca certificates command in privileged EXEC mode.
show crypto ca certificates [trustpointname]
Syntax Description
trustpointname
(Optional) Specifies the name of a trustpoint. If you do not specify a name, this command displays all certificates installed on the system.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following example entered in global configuration mode, displays a CA certificate for a trustpoint named tp1:
hostname# show crypto ca certificates tp1CA CertificateStatus: AvailableCertificate Serial Number 2957A3FF296EF854FD0D6732FE25B45Certificate Usage: SignatureIssuer:CN = ms-root-sha-06-2004OU = rootouO = ciscoL = franklinST - massachusettsC = USEA = a@b.conSubject:CN = ms-root-sha-06-2004OU = rootouO = ciscoL = franklinST = massachusettsC = USEA = a@b.comCRL Distribution Pointldap://w2kadvancedsrv/CertEnroll/ms-root-sha-06-2004.crlValidity Date:start date: 14:11:40 UTC Jun 26 2004end date: 14:01:30 UTC Jun 4 2022Associated Trustpoints: tp2 tp1hostname#Related Commands
show crypto ca crls
To display all cached CRLs or to display all CRLs cached for a specified trustpoint, use the show crypto ca crls command in privileged EXEC mode.
show crypto ca crls [trustpointname]
Syntax Description
trustpointname
(Optional) Specifies the name of a trustpoint. If you do not specify a name, this command displays all CRLs cached on the system.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following example entered in global configuration mode, displays a CRL for a trustpoint named tp1:
hostname# show crypto ca crls tp1CRL Issuer Name:cn=ms-sub1-ca-5-2004,ou=Franklin DevTest,o=CiscoSystems,l=Franklin,st=MA,c=US,ea=user@cisco.comLastUpdate: 19:45:53 UTC Dec 24 2004NextUpdate: 08:05:53 UTC Jan 1 2005Retrieved from CRL Distribution Point:http://win2k-ad2.frk-ms-pki.cisco.com/CertEnroll/ms-sub1-ca-5-2004.crlAssociated Trustpoints: tp1Related Commands
show crypto ipsec df-bit
To display the IPSec DF-bit policy for IPSec packets for a specified interface, use the show crypto ipsec df-bit command in global configuration mode and privileged EXEC mode.
show crypto ipsec df-bit interface
Syntax Description
interface
Specifies an interface name.
token
Indicates a token-based server for user authentication is used.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
1.1(1)
This command was introduced.
3.1(1)
This command was changed from show crypto ipsec.
Examples
The following example displays the IPSec DF-bit policy for interface named inside:
hostname(config)# show crypto ipsec df-bit insidedf-bit inside copyhostname(config)#Related Commands
show crypto ipsec fragmentation
To display the fragmentation policy for IPSec packets, use the show crypto ipsec fragmentation command in global configuration or privileged EXEC modes.
show crypto ipsec fragmentation interface
Syntax Description
interface
Specifies an interface name.
token
Indicates a token-based server for user authentication is used.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
1.1(1)
This command was introduced.
3.1(1)
This command was changed from show crypto ipsec.
Examples
The following example, entered in global configuration mode, displays the IPSec fragmentation policy for an interface named inside:
hostname(config)# show crypto ipsec fragmentation insidefragmentation inside before-encryptionhostname(config)#Related Commands
show crypto key mypubkey
To display key pairs of the indicated type, use the show crypto key mypubkey command in privileged EXEC mode.
show crypto key mypubkey {rsa | dsa}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following example entered in global configuration mode, displays RSA key pairs:
hostname(config)# show crypto key mypubkey rsa...Related Commands
crypto key generate dsa
Generates DSA key pairs.
crypto key generate rsa
Generates RSA key pairs.
crypto key zeroize
Removes all key pairs of the indicated type.
show crypto protocol statistics
To display the protocol-specific statistics in the crypto accelerator MIB, use the show crypto protocol statistics command in global configuration or privileged EXEC mode.
show crypto protocol statistics protocol
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following examples entered in global configuration mode, display crypto accelerator statistics for specified protocols:
hostname #show crypto protocol statistics ikev1[IKEv1 statistics]Encrypt packet requests: 39Encapsulate packet requests: 39Decrypt packet requests: 35Decapsulate packet requests: 35HMAC calculation requests: 84SA creation requests: 1SA rekey requests: 3SA deletion requests: 2Next phase key allocation requests: 2Random number generation requests: 0Failed requests: 0hostname #show crypto protocol statistics ipsec[IPsec statistics]Encrypt packet requests: 700Encapsulate packet requests: 700Decrypt packet requests: 700Decapsulate packet requests: 700HMAC calculation requests: 1400SA creation requests: 2SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0hostname #show crypto protocol statistics ssl[SSL statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0hostname #show crypto protocol statistics other[Other statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 99Failed requests: 0hostname #show crypto protocol statistics all[IKEv1 statistics]Encrypt packet requests: 46Encapsulate packet requests: 46Decrypt packet requests: 40Decapsulate packet requests: 40HMAC calculation requests: 91SA creation requests: 1SA rekey requests: 3SA deletion requests: 3Next phase key allocation requests: 2Random number generation requests: 0Failed requests: 0[IKEv2 statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[IPsec statistics]Encrypt packet requests: 700Encapsulate packet requests: 700Decrypt packet requests: 700Decapsulate packet requests: 700HMAC calculation requests: 1400SA creation requests: 2SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[SSL statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[SSH statistics are not supported][SRTP statistics are not supported][Other statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 99Failed requests: 0hostname#Related Commands
show ctiqbe
To display information about CTIQBE sessions established across the FWSM, use the show ctiqbe command in privileged EXEC mode.
show ctiqbe
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show ctiqbe command displays information of CTIQBE sessions established across the FWSM. Along with debug ctiqbe and show local-host, this command is used for troubleshooting CTIQBE inspection engine issues.
Note
Examples
The following is sample output from the show ctiqbe command under the following conditions. There is only one active CTIQBE session setup across the FWSM. It is established between an internal CTI device (for example, a Cisco IP SoftPhone) at local address 10.0.0.99 and an external Cisco CallManager at 172.29.1.77, where TCP port 2748 is the Cisco CallManager. The heartbeat interval for the session is 120 seconds.
hostname# show ctiqbeTotal: 1LOCAL FOREIGN STATE HEARTBEAT---------------------------------------------------------------1 10.0.0.99/1117 172.29.1.77/2748 1 120RTP/RTCP: PAT xlates: mapped to 172.29.1.99(1028 1029)MEDIA: Device ID 27 Call ID 0Foreign 172.29.1.99 (1028 1029)Local 172.29.1.88 (26822 26823)----------------------------------------------The CTI device has already registered with the CallManager. The device internal address and RTP listening port is PATed to 172.29.1.99 UDP port 1028. Its RTCP listening port is PATed to UDP 1029.
The line beginning with
6 in use, 6 most usedappears only if an internal CTI device has registered with an external CallManager and the CTI device address and ports are PATed to that external interface. This line does not appear if the CallManager is located on an internal interface, or if the internal CTI device address and ports are NATed to the same external interface that is used by the CallManager.The output indicates a call has been established between this CTI device and another phone at 172.29.1.88. The RTP and RTCP listening ports of the other phone are UDP 26822 and 26823. The other phone locates on the same interface as the CallManager because the FWSM does not maintain a CTIQBE session record associated with the second phone and CallManager. The active call leg on the CTI device side can be identified with Device ID 27 and Call ID 0.
The following is the xlate information for these CTIBQE connections:
hostname# show xlate debug3 in use, 3 most usedFlags: D | DNS, d | dump, I | identity, i | inside, n | no random,| o | outside, r | portmap, s | staticTCP PAT from inside:10.0.0.99/1117 to outside:172.29.1.99/1025 flags ri idle 0:00:22 timeout 0:00:30UDP PAT from inside:10.0.0.99/16908 to outside:172.29.1.99/1028 flags ri idle 0:00:00 timeout 0:04:10UDP PAT from inside:10.0.0.99/16909 to outside:172.29.1.99/1029 flags ri idle 0:00:23 timeout 0:04:10Related Commands
show curpriv
To display the current user privileges, use the show curpriv command:
show curpriv
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Privileged EXEC
•
•
—
—
•
Unprivileged
•
•
—
—
•
Command History
Usage Guidelines
The show curpriv command displays the current privilege level. Lower privilege level numbers indicate lower privilege levels.
Examples
These examples show output from the show curpriv command when a user named enable_15 is at different privilege levels. The username indicates the name that the user entered when the user logged in, P_PRIV indicates that the user has entered the enable command, and P_CONF indicates that the user has entered the config terminal command.
hostname(config)# show curprivUsername : enable_15Current privilege level : 15Current Mode/s : P_PRIV P_CONFhostname(config)# exithostname(config)# show curprivUsername : enable_15Current privilege level : 15Current Mode/s : P_PRIVhostname(config)# exithostname(config)# show curprivUsername : enable_1Current privilege level : 1Current Mode/s : P_UNPRhostname(config)#Related Commands
clear configure privilege
Remove privilege command statements from the configuration.
show running-config privilege
Display privilege levels for commands.
