-
Cisco Security Appliance Command Reference, Version 8.0
-
About This Guide
-
Using the Command Line Interface
- A through B Commands
- C Commands
- D through F Commands
- G through I Commands
- J through L Commands
- M through O Commands
- P though R Commands
-
S Commands
-
same-security-traffic -- show asdm sessions
-
show asp drop -- show curpriv
-
show ddns -- show ipv6 traffic
-
show isakmp sa -- show route
-
show running-config -- show running-config isakmp
-
show running-config ldap -- show running-config webvpn auto-signon
-
show service-policy -- show xlate
-
shun -- sysopt radius ignore-secret
-
- T through Z Commands
-
Table Of Contents
show isakmp ipsec-over-tcp stats through show route Commands
show isakmp ipsec-over-tcp stats
show memory delayed-free-poisoner
show priority-queue statistics
show isakmp ipsec-over-tcp stats through show route Commands
show isakmp ipsec-over-tcp stats
To display runtime statistics for IPsec over TCP, use the show isakmp ipsec-over tcp stats command in global configuration mode or privileged EXEC mode.
show isakmp ipsec-over-tcp stats
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The output from this command includes the following fields:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example, issued in global configuration mode, displays ISAKMP statistics:
hostname(config)# show isakmp ipsec-over-tcp statsGlobal IPSec over TCP Statistics--------------------------------Embryonic connections: 2Active connections: 132Previous connections: 146Inbound packets: 6000Inbound dropped packets: 30Outbound packets: 0Outbound dropped packets: 0RST packets: 260Received ACK heart-beat packets: 10Bad headers: 0Bad trailers: 0Timer failures: 0Checksum errors: 0Internal errors: 0hostname(config)#Related Commands
show isakmp sa
To display the IKE runtime SA database, use the show isakmp sa command in global configuration mode or privileged EXEC mode.
show isakmp sa [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
7.0(1)
The show isakmp sa command was introduced.
7.2(1)
This command was deprecated. The show crypto isakmp sa command replaces it.
Usage Guidelines
The output from this command includes the following fields:
Detail not specified.
IKE Peer
Type
Dir
Rky
State
Encrypt
Hash
Auth
Lifetime
209.165.200.225
L2L
Init
No
MM_Active
3des
md5
preshrd
86400
Detail specified.
Examples
The following example, entered in global configuration mode, displays detailed information about the SA database:
hostname(config)# show isakmp sa detailIKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime1 209.165.200.225 User Resp No AM_Active 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime2 209.165.200.226 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime3 209.165.200.227 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime4 209.165.200.228 User Resp No AM_ACTIVE 3des SHA preshrd 86400hostname(config)#Related Commands
show isakmp stats
To display runtime statistics, use the show isakmp stats command in global configuration mode or privileged EXEC mode.
show isakmp stats
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
7.0(1)
The show isakmp stats command was introduced.
7.2(1)
This command was deprecated. The show crypto isakmp stats command replaces it.
Usage Guidelines
The output from this command includes the following fields:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example, issued in global configuration mode, displays ISAKMP statistics:
hostname(config)# show isakmp statsGlobal IKE StatisticsActive Tunnels: 132Previous Tunnels: 132In Octets: 195471In Packets: 1854In Drop Packets: 925In Notifys: 0In P2 Exchanges: 132In P2 Exchange Invalids: 0In P2 Exchange Rejects: 0In P2 Sa Delete Requests: 0Out Octets: 119029Out Packets: 796Out Drop Packets: 0Out Notifys: 264Out P2 Exchanges: 0Out P2 Exchange Invalids: 0Out P2 Exchange Rejects: 0Out P2 Sa Delete Requests: 0Initiator Tunnels: 0Initiator Fails: 0Responder Fails: 0System Capacity Fails: 0Auth Fails: 0Decrypt Fails: 0Hash Valid Fails: 0No Sa Fails: 0hostname(config)#Related Commands
show kernel process
To display the current status of the active kernel processes running on the security appliance, use the show kernel process command in privileged EXEC mode.
show kernel process
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Use the show kernel process command to troubleshoot issues with the kernel running on the security appliance.
The output from the show kernel process command is lined up in the console output.
Examples
The following example displays output from the show kernel process command:
hostname# show kernel processPID PPID PRI NI VSIZE RSS WCHAN STAT RUNTIME COMMAND1 0 16 0 991232 268 3725684979 S 78 init2 1 34 19 0 0 3725694381 S 0 ksoftirqd/03 1 10 -5 0 0 3725736671 S 0 events/04 1 20 -5 0 0 3725736671 S 0 khelper5 1 20 -5 0 0 3725736671 S 0 kthread7 5 10 -5 0 0 3725736671 S 0 kblockd/08 5 20 -5 0 0 3726794334 S 0 kseriod66 5 20 0 0 0 3725811768 S 0 pdflush67 5 15 0 0 0 3725811768 S 0 pdflush68 1 15 0 0 0 3725824451 S 2 kswapd069 5 20 -5 0 0 3725736671 S 0 aio/0171 1 16 0 991232 80 3725684979 S 0 init172 171 19 0 983040 268 3725684979 S 0 rcS201 172 21 0 1351680 344 3725712932 S 0 lina_monitor202 201 16 0 1017602048 899932 3725716348 S 212 lina203 202 16 0 1017602048 899932 0 S 0 lina204 203 15 0 1017602048 899932 0 S 0 lina205 203 15 0 1017602048 899932 3725712932 S 6 lina206 203 25 0 1017602048 899932 0 R 13069390 linahostname#Table 27-1shows each field description.
show local-host
To display the network states of local hosts, use the show local-host command in privileged EXEC mode.
show local-host [ip_address] [detail] [all][brief] [connection {tcp <start>[-<end>] | udp <start>[-<end>] | embryonic <start>[-<end>]}]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show local-host command lets you display the network states of local hosts. A local-host is created for any host that forwards traffic to, or through, the security appliance.
This command lets you show the translation and connection slots for the local hosts. This command provides information for hosts that are configured with the nat 0 access-list command when normal translation and connection states may not apply.
This command also displays the connection limit values. If a connection limit is not set, the value displays as 0 and the limit is not applied.
For models with host limits, In routed mode, hosts on the inside (Work and Home zones) count towards the limit only when they communicate with the outside (Internet zone). Internet hosts are not counted towards the limit. Hosts that initiate traffic between Work and Home are also not counted towards the limit. The interface associated with the default route is considered to be the Internet interface. If there is no default route, hosts on all interfaces are counted toward the limit. In transparent mode, the interface with the lowest number of hosts is counted towards the host limit.
In the event of a SYN attack (with TCP intercept configured), the show local-host command output includes the number of intercepted connections in the usage count. This field typically displays only full open connections.
In the show local-host command output, the TCP embryonic count to host counter is used when a maximum embryonic limit (TCP intercept watermark) is configured for a host using a static connection. This counter shows the total embryonic connections to the host from other hosts. If this total exceeds the maximum configured limit, TCP intercept is applied to new connections to the host.
Examples
The following sample output is displayed by the show local-host command:
hostname# show local-hostInterface inside: 0 active, 0 maximum active, 0 deniedInterface outside: 1 active, 2 maximum active, 0 deniedThe following sample output is displayed by the show local-host command on a security appliance with host limits:
hostname# show local-hostDetected interface 'outside' as the Internet interface. Host limit applies to all other interfaces.Current host count: 3, towards licensed host limit of: 50Interface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 0 active, 0 maximum active, 0 deniedThe following sample output is displayed by the show local-host command on a security appliance with host limits, but without a default route, the host limits apply to all interfaces. The default route interface might not be detected if the default route or the interface that the route uses is down.
hostname# show local-hostUnable to determine Internet interface from default route. Host limit applied to all interfaces.Current host count: 3, towards licensed host limit of: 50Interface c1in: 1 active, 1 maximum active, 0 deniedInterface c1out: 0 active, 0 maximum active, 0 deniedThe following sample output is displayed by the show local-host command on a security appliance with unlimited hosts:
hostname# show local-hostLicensed host limit: UnlimitedInterface c1in: 1 active, 1 maximum active, 0 deniedInterface c1out: 0 active, 0 maximum active, 0 deniedThe following examples show how to display the network states of local hosts:
hostname# show local-host allInterface outside: 1 active, 2 maximum active, 0 deniedlocal host: <11.0.0.4>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464Interface inside: 1 active, 2 maximum active, 0 deniedlocal host: <17.3.8.2>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464Interface NP Identity Ifc: 2 active, 4 maximum active, 0 deniedlocal host: <11.0.0.3>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464local host: <17.3.8.1>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464hostname# show local-host 10.1.1.91Interface third: 0 active, 0 maximum active, 0 deniedInterface inside: 1 active, 1 maximum active, 0 deniedlocal host: <10.1.1.91>,TCP flow count/limit = 1/unlimitedTCP embryonic count to (from) host = 0 (0)TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedXlate:PAT Global 192.150.49.1(1024) Local 10.1.1.91(4984)Conn:TCP out 192.150.49.10:21 in 10.1.1.91:4984 idle 0:00:07 bytes 75 flags UI Interfaceoutside: 1 active, 1 maximum active, 0 deniedhostname# show local-host 10.1.1.91 detailInterface third: 0 active, 0 maximum active, 0 deniedInterface inside: 1 active, 1 maximum active, 0 deniedlocal host: <10.1.1.91>,TCP flow count/limit = 1/unlimitedTCP embryonic count to (from) host = 0 (0)TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedXlate:TCP PAT from inside:10.1.1.91/4984 to outside:192.150.49.1/1024 flags riConn:TCP outside:192.150.49.10/21 inside:10.1.1.91/4984 flags UI Interface outside: 1 active, 1 maximum active, 0 deniedThe following example shows all hosts who have at least four udp connections and have between one to 10 tcp connections at the same time:hostname# show local-host connection udp 4 tcp 1-10Interface mng: 0 active, 3 maximum active, 0 deniedInterface INSIDE: 4 active, 5 maximum active, 0 deniedlocal host: <10.1.1.11>,TCP flow count/limit = 1/unlimited TCP embryonic count to host = 0 TCP intercept watermark = unlimited UDP flow count/limit = 4/unlimitedXlate:Global 192.168.1.24 Local 10.1.1.11 Conn: UDP out 192.168.1.10:80 in 10.1.1.11:1730 idle 0:00:21 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1729 idle 0:00:22 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1728 idle 0:00:23 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1727 idle 0:00:24 bytes 0 flags - TCP out 192.168.1.10:22 in 10.1.1.11:27337 idle 0:01:55 bytes 2641 flags UIO Interface OUTSIDE: 3 active, 5 maximum active, 0 deniedThe following example shows local-host addresses and connection counters using the brief option:
hostname# show local-host connection udp 2Interface mng: 0 active, 3 maximum active, 0 deniedInterface INSIDE: 4 active, 5 maximum active, 0 deniedlocal host: <10.1.1.11>,TCP flow count/limit = 1/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimited UDP flow count/limit = 4/unlimitedInterface OUTSIDE: 3 active, 5 maximum active, 0 deniedThe following examples shows the output when using the brief and connection syntax:
hostname#show local-host briefInterface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 1 active, 1 maximum active, 0 deniedInterface mgmt: 5 active, 6 maximum active, 0 deniedhostname# show local-host connectionInterface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 1 active, 1 maximum active, 0 deniedInterface mgmt: 5 active, 6 maximum active, 0 deniedRelated Commands
clear local-host
Releases network connections from local hosts displayed by the show local-host command.
nat
Associates a network with a pool of global IP addresses.
show logging
To show the logs in the buffer or other logging settings, use the show logging command in privileged EXEC mode.
show logging [message [syslog_id | all] | asdm | queue | setting]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0
This command was introduced.
8.0(2)
Indicates whether a syslog server is configured to use an SSL/TLS connection.
Usage Guidelines
If the logging buffered command is in use, the show logging command without any keywords shows the current message buffer and the current settings.
The show logging queue command allows you to display the following:
•
•
•
Note
Examples
The following example shows the output from the show logging command:
hostname(config)# show loggingSyslog logging: enabledTimestamp logging: disabledConsole logging: disabledMonitor logging: disabledBuffer logging: level debugging, 37 messages loggedTrap logging: disabled305001: Portmapped translation built for gaddr 209.165.201.5/0 laddr 192.168.1.2/256...The following example shows the output from the show logging command with a secure syslog server configured:
hostname(config)# logging host inside 10.0.0.1 TCP/1500 securehostname(config)# show loggingSyslog logging: disabledFacility:Timestamp logging: disabledDeny Conn when Queue Full: disabledConsole logging: level debugging, 135 messages loggedMonitor logging: disabledBuffer logging: disabledTrap logging: list show _syslog, facility, 20, 21 messages loggedLogging to inside 10.0.0.1 tcp/1500 SECUREHistory logging: disabledDevice ID: disabledMail logging: disabledASDM logging disabledThe following example shows the output from the show logging message all command:
hostname(config)# show logging message allsyslog 111111: default-level alerts (enabled)syslog 101001: default-level alerts (enabled)syslog 101002: default-level alerts (enabled)syslog 101003: default-level alerts (enabled)syslog 101004: default-level alerts (enabled)syslog 101005: default-level alerts (enabled)syslog 102001: default-level alerts (enabled)syslog 103001: default-level alerts (enabled)syslog 103002: default-level alerts (enabled)syslog 103003: default-level alerts (enabled)syslog 103004: default-level alerts (enabled)syslog 103005: default-level alerts (enabled)syslog 103011: default-level alerts (enabled)syslog 103012: default-level informational (enabled)Related Commands
show logging rate-limit
To display the disallowed system log messages to the original set, use the show logging rate-limit command in privileged EXEC mode.
show logging rate-limit
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
After the information is cleared, nothing more displays until the hosts reestablish their connections.
Examples
This example shows how to display the disallowed system log messages:
hostname(config)# show logging rate-limitRelated Commands
show mac-address-table
To show the MAC address table, use the show mac-address-table command in privileged EXEC mode.
show mac-address-table [interface_name | count | static]
Syntax Description
Defaults
If you do not specify an interface, all interface MAC address entries are shown.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show mac-address-table command:
hostname# show mac-address-tableinterface mac address type Time Left-----------------------------------------------------------------------outside 0009.7cbe.2100 static -inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table command for the inside interface:
hostname# show mac-address-table insideinterface mac address type Time Left-----------------------------------------------------------------------inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table count command:
hostname# show mac-address-table countStatic mac-address bridges (curr/max): 0/65535Dynamic mac-address bridges (curr/max): 103/65535Related Commands
