Amount of transmitted traffic in Application Control Accounting logs is much higher than the amount of transmitted traffic reported by the relevant outbound interface

Support Center > Search Results > SecureKnowledge Details

Technical Level

Solution ID	sk103071
Technical Level
Product	Application Control
Version	R77 (EOL), R77.10 (EOL), R77.20
Platform / Model	All
Date Created	22-Oct-2014
Last Modified	21-Dec-2015

Symptoms

Amount of transmitted traffic in Application Control Accounting logs is much higher than the amount of transmitted traffic reported by the relevant outbound interface (e.g., 'TX' counter in the output of 'ifconfig -a' command).

Example:

Output of 'ifconfig -a' command shows the following for the outbound interface:

eth2        Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX 
            inet addr:X.X.X.X  Bcast:X.X.X.X  Mask:X.X.X.X
            UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
            RX packets:406047717 errors:0 dropped:0 overruns:0 frame:0
            TX packets:439460127 errors:0 dropped:0 overruns:0 carrier:0
            collisions:0 txqueuelen:1000 
            RX bytes:2188689588 (2.0 GiB)  TX bytes:1561253394 (1.4 GiB)
            Interrupt:201 Memory:fe6e0000-fe700000

SmartEvent (if enabled) shows the following in the list of events for an application (click on 'Details' tab - refer to 'Traffic' section):
Transferred Data: 52 KB (8 GB sent, 39 KB received)
SmartEvent (if enabled) shows the following in the list of events for an application:
'Sent Bytes' column repeatedly shows the value of 4294967295.

Cause

Incomplete traffic data verification in Application Control Accounting logs.

Solution

Note: To view this solution you need to Sign In .