Overview
Describes MACsec SecY statistics, which track operational metrics for packet processing, encryption, and decryption, helping administrators identify issues in secure network communications.
The MACsec SecY statistics are operational metrics that
-
monitor the performance of the MAC Security (MACsec) Secure Channel (SecY) component,
-
provide detailed visibility into packet and octet processing activities, and
-
help identify encryption or decryption issues in secure network communication.
MACsec SecY statistics track the behavior of encrypted traffic, including packet processing, encryption, decryption, and error conditions. They serve as diagnostic indicators that allow network administrators to confirm proper MACsec operation and troubleshoot encrypted traffic flows.
Key aspects of SecY statistics include:
-
Interface statistics: Track untagged packets, packets without MACsec tags, packets with invalid tags, unknown Secure Channel Identifiers (SCI), and counts of validated or decrypted octets.
-
Secure Channel (SC) statistics: Include transmit (TxSC) and receive (RxSC) data, such as packets protected, encrypted, dropped for being too long, and octet encryption or decryption counts.
-
Secure Association (SA) statistics: Provide detailed per-SA data for both transmit and receive directions, including packets protected, encrypted, and the next packet number (NextPN).
These statistics can be accessed using CLI commands such as show macsec secy stats on supported controllers or interfaces, and through SNMP queries using the IEEE8021-SECY-MIB.
Network administrators rely on these statistics to ensure that MACsec encryption is functioning correctly and to detect anomalies in encrypted traffic.
Administrators can query MACsec SecY statistics using the following methods:
-
CLI – for real-time interface and controller-level statistics
-
SNMP MIB – for remote monitoring and integration with network management systems