fw ctl multik print_heavy_conn

Description

Shows the table with Heavy Connections (that consume the most CPU resources) in the CoreXL Dynamic Dispatcher.

For more information about the CoreXL Dynamic Dispatcher, see sk105261.

CoreXL suspects that a connection is "heavy" if it meets these conditions:

• Security Gateway detected the suspected connection during the last 24 hours
• The suspected connection lasts more than 10 seconds
• CoreXL FW instance that processes this connection causes a CPU load of over 60%
• The suspected connection utilizes more than 50% of the total work the applicable CoreXL FW instance does

The output table shows this information about the Heavy Connections:

• Source IP address
• Source Port
• Destination IP address
• Destination Port
• Protocol Number
• CoreXL FW instance ID that processes this connection
• CoreXL FW instance load on the CPU
• Connection's relative load on the CoreXL FW instance

Notes:

• This command shows the suspected heavy connections even if they are already closed.
• In the CPview utility, go to CPU > Top-Connections > InstancesX-Y > InstanceZ. Refer to the Top Connections section.

Syntax

fw [-d] ctl multik print_heavy_conn

Parameters

Parameter	Description
-d	Runs the command in debug mode. Use only if you troubleshoot the command itself.

Example

[Expert@MyGW:0]# fw ctl multik print_heavy_conn Source: 192.168.20.31; SPort: 51006; Dest: 172.30.40.55; DPort: 80; IPP: 6; Instance 1; Instance Load 61%; Connection instance load 100% Source: 192.168.20.31; SPort: 50994; Dest: 172.30.40.55; DPort: 80; IPP: 6; Instance 1; Instance Load 61%; Connection instance load 100% Source: 192.168.20.31; SPort: 50992; Dest: 172.30.40.55; DPort: 80; IPP: 6; Instance 1; Instance Load 61%; Connection instance load 100% [Expert@MyGW:0]#