Juniper ScreenOS防火牆查看某個IP或某個Port或某個Mac會話數

 ScreenOS版本:  

ISG2000-> get system | in "Software Version"
Software Version: 5.4.0r6.0, Type: Firewall+*** 

IP/Port/Mac又可細分爲源IP、目的IP、源Port、目的Port、源Mac和目的Mac,命令如下:

ISG2000-> get session ?
>                    redirect output
|                    match output
<return>
dst-ip               destination ip address
dst-mac              destination mac address
dst-port             destination port number or range
hardware             show hardware sessions only
id                   show sessions with id
ike-nat              show ike-nat ALG info
protocol             protocol number or range
rm                   show sessions for resource management
service              show sessions with service type
src-ip               source ip address
src-mac              source mac address
src-port             source port number or range
tunnel               show tunnel sessions
vsd-id               get vsd-id specified sessions

下面是查看源IP爲10.244.148.231的所有會話總數

ISG2000-> get session src-ip 10.244.148.231
alloc 39986/max 524288, alloc failed 241404, mcast alloc 0, di alloc failed 0
total reserved 0, free sessions in shared pool 484302
slot 2: hw0 alloc 39884/max 1048575 
Total 29340 sessions according filtering criteria.
id 138/s0*,vsys 0,flag 04200400/0000/0003,policy 5,time 2202, dip 0 module 0
 if 23(nspflag 800801):10.244.148.231/44295->10.243.211.40/161,17,00005e00010a,sess token 24,vlan 0,tun 0,vsd 0,route 35
 if 64(nspflag 800800):10.244.150.49/44295<-10.243.211.40/161,17,00005e000133,sess token 6,vlan 0,tun 0,vsd 0,route 21

下面是查看目的Port爲161的所有會話總數:

ISG2000-> get session dst-port 161
alloc 40045/max 524288, alloc failed 241404, mcast alloc 0, di alloc failed 0
total reserved 0, free sessions in shared pool 484243
slot 2: hw0 alloc 39942/max 1048575 
Total 38375 sessions according filtering criteria.
id 138/s0*,vsys 0,flag 04200400/0000/0003,policy 5,time 2201, dip 0 module 0
 if 23(nspflag 800801):10.244.148.231/44295->10.243.211.40/161,17,00005e00010a,sess token 24,vlan 0,tun 0,vsd 0,route 35
 if 64(nspflag 800800):10.244.150.49/44295<-10.243.211.40/161,17,00005e000133,sess token 6,vlan 0,tun 0,vsd 0,route 21

下面是查看目的Mac爲00005e00010a的所有會話總數:

ISG2000-> get session src-mac 00005e00010a 
alloc 39913/max 524288, alloc failed 241404, mcast alloc 0, di alloc failed 0
total reserved 0, free sessions in shared pool 484375
slot 2: hw0 alloc 39838/max 1048575 
Total 39015 sessions according filtering criteria.
id 138/s0*,vsys 0,flag 04200400/0000/0003,policy 5,time 2142, dip 0 module 0
 if 23(nspflag 800801):10.244.148.231/44295->10.243.211.40/161,17,00005e00010a,sess token 24,vlan 0,tun 0,vsd 0,route 35
 if 64(nspflag 800800):10.244.150.49/44295<-10.243.211.40/161,17,00005e000133,sess token 6,vlan 0,tun 0,vsd 0,route 21

Juniper ScreenOS防火牆清除某個IP或某個Port或某個Mac會話數的方法就是把get關鍵字換成clear。

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章