Skip to main content
fangfang
fangfang
New Member
May 8, 2020
Solved

Where to find the ssl inspection statictics?

  • May 8, 2020
  • 3 replies
  • 4312 views

Hi All:

I'm using 81E and did some https traffic, and saw re-signed ca from captured packets. And I wanna know which command can find the ssl inspection statistics. I got one, but I'm not sure what stand for "C" and "T". Is "C" for current? what's for "T"?:

FGT81ETK19002696 # diag ips ssl sta ------------------ SSL configuration -------------------- Bypass:                    false Session resumption:        true -------------------- SSL statistics --------------------- SSL transactions: C/T/E/S   SSL v3:  0/0/0/0   TLS 1.0: 0/0/0/0   TLS 1.1: 0/0/0/0   TLS 1.2: 3312629/3335323/0/0

    Best answer by darwin_FTNT

    C - completed transactions, e.g., ssl server replied end of session

    T - number of transactions, e.g., ssl hello message started

    E - exempted transactions from ssl, e.g., addr, whitelist, ip geography, fqdn

    S - PTS (protected the server) mode

    3 replies

    darwin_FTNT
    Staff
    darwin_FTNTAnswer
    Staff
    May 30, 2020

    C - completed transactions, e.g., ssl server replied end of session

    T - number of transactions, e.g., ssl hello message started

    E - exempted transactions from ssl, e.g., addr, whitelist, ip geography, fqdn

    S - PTS (protected the server) mode

    fangfang
    fangfangAuthor
    New Member
    June 5, 2020

    Thanks for your reply. PS: do you know where to find the dpissl connection counter? For examples, https access to https://www.google.com from lan to wan and it's supposed there's one dpissl connection. Where can I find the counter?

     

    Thanks

    darwin_FTNT
    Staff
    darwin_FTNT
    Staff
    June 5, 2020

    Can try 'diag ips ssl status':

    Packet Modes: 

     Dry run:                   0    --> ssl inspection mode is read-only  Inline:                      0    --> ssl inspection mode is active, read/write traffic  Dynamic to dry:        0    --> switch to read only mode  Dynamic to inline:      0    --> switch to read/write mode  Inline offload:            0    --> ssl inspection detached from inspection

     

    The above stats is for flow-based utm mode which is done by ipsengine daemon. For proxy-based utm mode, check 'diag wad stats' output, which is done by wad daemon. By default, utm profiles are flow-based in latest firmware.

     

    Terms & ConditionsAccessibility statement