New Member

Solved

Help identify significant increase in connections

Forum|Forum|4 years ago
March 30, 2022
5 replies
4042 views

Hi all,

I'm seeing every few minutes the number of sessions moving through my FortiGate spike from a few thousand, to tens of thousands, and back.

How would I best identify the source of these connections?

FortiGate

Best answer by vponmuniraj

Hi Christoph_Berthoud,

You can check the output for 'diag sys session stat'.

More info here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Session-counter-information/ta-p/197839?externalID=FD40600 / https://community.fortinet.com/t5/FortiGate/Technical-Tip-Meaning-of-the-counter-fields-in-diagnose-sys/ta-p/192305

Regards,

hrahuman_FTNT

Staff & Editor

Hi,

It seems to be you have very old FortiGate models. May I know the firmware images of the FortiGate ? We need to check that FortiView is supported in those images.

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/560153/enabling-fortiview

https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/433781/fortiview-monitors-and-widgets

-Habeeb

Christoph_BerthoudAuthor

New Member

FortiOS 6.4.7 on a 500E model

hrahuman_FTNT

Staff & Editor

Hi,

Then you can follow the FortiView to identify the session details.

https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/433781/fortiview-monitors-and-widgets

vponmunirajAnswer

Staff

Hi Christoph_Berthoud,

You can check the output for 'diag sys session stat'.

More info here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Session-counter-information/ta-p/197839?externalID=FD40600 / https://community.fortinet.com/t5/FortiGate/Technical-Tip-Meaning-of-the-counter-fields-in-diagnose-sys/ta-p/192305

Regards,

Christoph_BerthoudAuthor

New Member

Thanks, narrowed it down to a monitoring agent firing thousands of DNS (UDP/53) requests off every 5 minutes.

Sign up

Login with SSO

Login to the community

Login with SSO