Help identify significant increase in connections

[Christoph_Berthoud]

Hi all, 

I'm seeing every few minutes the number of sessions moving through my FortiGate spike from a few thousand, to tens of thousands, and back.

How would I best identify the source of these connections?

[hrahuman_FTNT]

Hi,

It seems to be you have very old FortiGate models. May I know the firmware images of the FortiGate ? We need to check that FortiView is supported in those images.

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/560153/enabling-fortiview

https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/433781/fortiview-monitors-an...

-Habeeb

[Christoph_Berthoud]

FortiOS 6.4.7 on a 500E model

[hrahuman_FTNT]

Hi,

Then you can follow the FortiView to identify the session details.

https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/433781/fortiview-monitors-an...

[vponmuniraj · Accepted solution]

Hi Christoph_Berthoud,

You can check the output for 'diag sys session stat'.

More info here https://community.fortinet.com/t5/FortiGate/Technical-Tip-Session-counter-information/ta-p/197839?ex...  /  https://community.fortinet.com/t5/FortiGate/Technical-Tip-Meaning-of-the-counter-fields-in-diagnose-...

 Regards,

[Christoph_Berthoud]

Thanks, narrowed it down to a monitoring agent firing thousands of DNS (UDP/53) requests off every 5 minutes.