The document provides a summary of global counters for various packet and system metrics collected over different time intervals. It shows counters related to packets, sessions, flows, applications, NAT, DFA, TCP, CTD, FPGA, AHO and other system aspects with metrics like packets transmitted, sessions installed, policy denials, fragmentations, predictions and more. The counters provide insights on system resource usage, traffic processing and drops across various components over time.

1. Global counters:
Elapsed time since last sampling: 521.351 seconds
name value rate severity category aspect
description
--------------------------------------------------------------------------------
pkt_sent 29265 56 info packet
pktproc Packets transmitted
pkt_outstanding 55631 106 info packet
pktproc Outstanding packet to be transmitted
pkt_alloc 41649 79 info packet
resource Packets allocated
pkt_swbuf_clone 4 0 info packet
pktproc Packets replicated using software buffer
session_allocated 3720 7 info session
resource Sessions allocated
session_freed 514 0 info session
resource Sessions freed
session_installed 3670 7 info session
resource Sessions installed
session_predict_dst 4 0 info session
resource Active dst predict sessions
flow_ipv6_disabled 108 0 drop flow parse
Packets dropped: IPv6 disabled on interface
flow_policy_deny 371 0 drop flow
session Session setup: denied by policy
flow_tcp_non_syn 609 1 info flow
session Non-SYN TCP packets without session match
flow_tcp_non_syn_drop 609 1 drop flow
session Packets dropped: non-SYN TCP without session match
flow_fwd_l3_mcast_drop 1357 2 drop flow
forward Packets dropped: no route for IP multicast
flow_fwd_l3_ttl_zero 15 0 drop flow
forward Packets dropped: IP TTL reaches zero
flow_fwd_zonechange 17922 34 drop flow
forward Packets dropped: forwarded to different zone
flow_fwd_mtu_exceeded 5 0 info flow
forward Packets lengths exceeded MTU
flow_ipfrag_recv 10 0 info flow ipfrag
IP fragments received
flow_ipfrag_free 5 0 info flow ipfrag
IP fragments freed after defragmentation
flow_ipfrag_merge 5 0 info flow ipfrag
IP defragmentation completed
flow_ipfrag_swbuf 5 0 info flow ipfrag
Software buffers allocated for reassembled IP packet
flow_ipfrag_frag 10 0 info flow ipfrag
IP fragments transmitted
flow_action_predict 5 0 info flow
pktproc Predict sessions created
flow_predict_session_dup 43 0 info flow
session Duplicate Predict Session installation attempts
flow_arp_pkt_rcv 402 0 info flow arp
ARP packets received
flow_arp_pkt_replied 37 0 info flow arp
ARP requests replied
flow_arp_pkt_learned 2 0 info flow arp
ARP entry learned
flow_arp_rcv_gratuitous 2 0 info flow arp
Gratuitous ARP packets received
flow_host_pkt_xmt 26366 50 info flow mgmt
Packets transmitted to control plane
flow_host_service_allow 1160 2 info flow mgmt
Device management session allowed

2. flow_host_service_deny 91 0 drop flow mgmt
Device management session denied
flow_host_vardata_rate_limit_ok 25151 48 info flow mgmt
Host vardata not sent: rate limit ok
appid_override 261 0 info appid
pktproc Application identified by override rule
appid_ident_by_icmp 264 0 info appid
pktproc Application identified by icmp type
appid_ident_by_dport_first 1695 3 info appid
pktproc Application identified by L4 dport first
appid_ident_by_dport 1 0 info appid
pktproc Application identified by L4 dport
appid_proc 113 0 info appid
pktproc The number of packets processed by Application identification
appid_use_dfa_1 68 0 info appid
pktproc The number of packets using the second DFA table
appid_unknown_max_pkts 1 0 info appid
pktproc The number of unknown applications caused by max. packets reached
appid_unknown_udp 1 0 info appid
pktproc The number of unknown UDP applications after app engine
appid_unknown_fini_empty 212 0 info appid
pktproc The number of unknown applications because of no data
nat_dynamic_port_xlat 2905 5 info nat
resource The total number of dynamic_ip_port NAT translate called
nat_dynamic_port_release 401 0 info nat
resource The total number of dynamic_ip_port NAT release called
dfa_dte_request_total 16806 32 info dfa
offload The total number of dfa match using dte
dfa_hte_in_cache_lookup 10269 19 info dfa
offload The total number of requests to an in cache HFA graph
dfa_hfa_lookup_too_many_matches 3 0 info dfa
resource too many matches in HFA looup
tcp_drop_packet 351 0 warn tcp
pktproc packets dropped because of failure in tcp reassembly
tcp_pkt_queued 4294967295 8238149 info tcp
resource The number of out of order packets queued in tcp
tcp_case_2 320 0 info tcp
pktproc tcp reassembly case 2
tcp_case_3 3 0 info tcp
pktproc tcp reassembly case 3
ctd_sml_exit 1 0 info ctd
pktproc The number of sessions with sml exit
ctd_sml_exit_detector_i 59 0 info ctd
pktproc The number of sessions with sml exit in detector i
ctd_stop_proc 1 0 info ctd
pktproc ctd stop proc
ctd_err_bypass 60 0 info ctd
pktproc ctd error bypass
ctd_run_pattern_match_failure 29 0 info ctd
pktproc Run pattern match failure
ctd_do_pattern_match 29 0 info ctd
pktproc do pattern match
ctd_sml_vm_run_impl_opcodeexit 61 0 info ctd
pktproc SML VM opcode exit
ctd_sml_vm_run_impl_immed8000 90 0 info ctd
pktproc SML VM immed8000
ctd_sml_vm_check_domain 3604 6 info ctd
pktproc sml vm check domain
ctd_sml_opcode_set_file_type 70 0 info ctd
pktproc sml opcode set file type
ctd_filter_decode_failure_zip 6 0 error ctd
pktproc Number of decode filter failure for zip
ctd_bloom_filter_nohit 7208 13 info ctd
pktproc The number of no match for virus bloom filter

3. ctd_fwd_dns_record 453 0 info ctd
pktproc DNS forward: number of dns records forwarded
fpga_request 16370 31 info fpga
offload The outstanding requests to FPGA
aho_fpga 16370 31 info aho
resource The total requests to FPGA for AHO
aho_too_many_matches 1 0 info aho
pktproc too many signature matches within one packet
aho_sw 224 0 info aho
pktproc The total usage of software for AHO
ctd_appid_reassign 48 0 info ctd
pktproc appid was changed
ctd_decoder_reassign 1 0 info ctd
pktproc decoder was changed
ctd_pkt_slowpath 16706 32 info ctd
pktproc Packets processed by slowpath
log_traffic_cnt 460 0 info log system
Number of traffic logs
url_db_request 23 0 info url
pktproc Number of URL database request
url_request_pkt_drop 105 0 drop url
pktproc The number of packets get dropped because of waiting for url category
request
zip_process_total 259 0 info zip
pktproc The total number of zip engine decompress process
zip_process_failure 6 0 info zip
pktproc The number of failures for zip decompress process
--------------------------------------------------------------------------------
Total counters shown: 74
--------------------------------------------------------------------------------
drowell@palo-gla-1> show counter global filter packet-filter yes delta yes
Global counters:
Elapsed time since last sampling: 10.440 seconds
name value rate severity category aspect
description
--------------------------------------------------------------------------------
pkt_sent 203 19 info packet
pktproc Packets transmitted
pkt_outstanding 204 19 info packet
pktproc Outstanding packet to be transmitted
pkt_alloc 140 13 info packet
resource Packets allocated
session_allocated 66 6 info session
resource Sessions allocated
session_freed 13 1 info session
resource Sessions freed
session_installed 63 6 info session
resource Sessions installed
flow_policy_deny 5 0 drop flow
session Session setup: denied by policy
flow_tcp_non_syn 15 1 info flow
session Non-SYN TCP packets without session match
flow_tcp_non_syn_drop 15 1 drop flow
session Packets dropped: non-SYN TCP without session match
flow_fwd_l3_mcast_drop 24 2 drop flow
forward Packets dropped: no route for IP multicast
flow_fwd_zonechange 370 35 drop flow
forward Packets dropped: forwarded to different zone
flow_predict_session_dup 3 0 info flow
session Duplicate Predict Session installation attempts
flow_host_pkt_xmt 1 0 info flow mgmt

4. Packets transmitted to control plane
appid_override 9 0 info appid
pktproc Application identified by override rule
appid_ident_by_icmp 2 0 info appid
pktproc Application identified by icmp type
appid_ident_by_dport_first 2 0 info appid
pktproc Application identified by L4 dport first
appid_unknown_fini_empty 10 0 info appid
pktproc The number of unknown applications because of no data
nat_dynamic_port_xlat 63 6 info nat
resource The total number of dynamic_ip_port NAT translate called
nat_dynamic_port_release 10 0 info nat
resource The total number of dynamic_ip_port NAT release called
dfa_dte_request_total 140 13 info dfa
offload The total number of dfa match using dte
dfa_hte_in_cache_lookup 23 2 info dfa
offload The total number of requests to an in cache HFA graph
ctd_sml_vm_check_domain 4 0 info ctd
pktproc sml vm check domain
ctd_bloom_filter_nohit 8 0 info ctd
pktproc The number of no match for virus bloom filter
fpga_request 138 13 info fpga
offload The outstanding requests to FPGA
aho_fpga 138 13 info aho
resource The total requests to FPGA for AHO
ctd_pkt_slowpath 140 13 info ctd
pktproc Packets processed by slowpath
log_traffic_cnt 10 0 info log system
Number of traffic logs
--------------------------------------------------------------------------------
Total counters shown: 27
--------------------------------------------------------------------------------
drowell@palo-gla-1> show counter global filter packet-filter yes delta yes
Global counters:
Elapsed time since last sampling: 4.230 seconds
name value rate severity category aspect
description
--------------------------------------------------------------------------------
pkt_sent 115 27 info packet
pktproc Packets transmitted
pkt_outstanding 115 27 info packet
pktproc Outstanding packet to be transmitted
pkt_alloc 91 21 info packet
resource Packets allocated
session_allocated 37 8 info session
resource Sessions allocated
session_freed 1 0 info session
resource Sessions freed
session_installed 36 8 info session
resource Sessions installed
flow_tcp_non_syn 6 1 info flow
session Non-SYN TCP packets without session match
flow_tcp_non_syn_drop 6 1 drop flow
session Packets dropped: non-SYN TCP without session match
flow_fwd_l3_mcast_drop 10 2 drop flow
forward Packets dropped: no route for IP multicast
flow_fwd_zonechange 238 56 drop flow
forward Packets dropped: forwarded to different zone
flow_predict_session_dup 1 0 info flow
session Duplicate Predict Session installation attempts
flow_arp_pkt_rcv 10 2 info flow arp

5. ARP packets received
appid_override 3 0 info appid
pktproc Application identified by override rule
nat_dynamic_port_xlat 36 8 info nat
resource The total number of dynamic_ip_port NAT translate called
dfa_dte_request_total 91 21 info dfa
offload The total number of dfa match using dte
dfa_hte_in_cache_lookup 9 2 info dfa
offload The total number of requests to an in cache HFA graph
tcp_drop_packet 1 0 warn tcp
pktproc packets dropped because of failure in tcp reassembly
ctd_sml_vm_check_domain 1 0 info ctd
pktproc sml vm check domain
ctd_bloom_filter_nohit 2 0 info ctd
pktproc The number of no match for virus bloom filter
fpga_request 91 21 info fpga
offload The outstanding requests to FPGA
aho_fpga 91 21 info aho
resource The total requests to FPGA for AHO
ctd_pkt_slowpath 91 21 info ctd
pktproc Packets processed by slowpath
--------------------------------------------------------------------------------
Total counters shown: 22
--------------------------------------------------------------------------------
drowell@palo-gla-1> show counter global filter packet-filter yes delta yes
Global counters:
Elapsed time since last sampling: 28.690 seconds
name value rate severity category aspect
description
--------------------------------------------------------------------------------
pkt_sent 680 23 info packet
pktproc Packets transmitted
pkt_outstanding 729 25 info packet
pktproc Outstanding packet to be transmitted
pkt_alloc 602 20 info packet
resource Packets allocated
session_allocated 191 6 info session
resource Sessions allocated
session_freed 19 0 info session
resource Sessions freed
session_installed 188 6 info session
resource Sessions installed
flow_policy_deny 14 0 drop flow
session Session setup: denied by policy
flow_tcp_non_syn 47 1 info flow
session Non-SYN TCP packets without session match
flow_tcp_non_syn_drop 47 1 drop flow
session Packets dropped: non-SYN TCP without session match
flow_fwd_l3_mcast_drop 70 2 drop flow
forward Packets dropped: no route for IP multicast
flow_fwd_zonechange 1211 42 drop flow
forward Packets dropped: forwarded to different zone
flow_predict_session_dup 3 0 info flow
session Duplicate Predict Session installation attempts
flow_arp_pkt_rcv 9 0 info flow arp
ARP packets received
flow_arp_pkt_replied 1 0 info flow arp
ARP requests replied
flow_host_pkt_xmt 49 1 info flow mgmt
Packets transmitted to control plane
flow_host_service_allow 48 1 info flow mgmt

6. Device management session allowed
flow_host_service_deny 8 0 drop flow mgmt
Device management session denied
appid_override 19 0 info appid
pktproc Application identified by override rule
appid_ident_by_icmp 18 0 info appid
pktproc Application identified by icmp type
appid_ident_by_dport_first 54 1 info appid pktpro
appid_unknown_fini_empty 11 0 info appid pktpro
nat_dynamic_port_xlat 141 4 info nat resour
nat_dynamic_port_release 16 0 info nat resour
dfa_dte_request_total 603 21 info dfa offloa
dfa_hte_in_cache_lookup 155 5 info dfa offloa
tcp_drop_packet 4 0 warn tcp pktpro
ctd_sml_exit_detector_i 1 0 info ctd pktpro
ctd_err_bypass 1 0 info ctd pktpro
ctd_run_pattern_match_failure 1 0 info ctd pktpro
ctd_do_pattern_match 1 0 info ctd pktpro
ctd_sml_vm_run_impl_opcodeexit 1 0 info ctd pktpro
ctd_sml_vm_check_domain 59 2 info ctd pktpro
ctd_bloom_filter_nohit 118 4 info ctd pktpro
ctd_fwd_dns_record 45 1 info ctd pktpro
fpga_request 598 20 info fpga offloa
aho_fpga 598 20 info aho resour
ctd_pkt_slowpath 603 21 info ctd pktpro
log_traffic_cnt 16 0 info log system
--------------------------------------------------------------------------------
Total counters shown: 38
--------------------------------------------------------------------------------
drowell@palo-gla-1> ping 8.8.8.8
Invalid syntax.
drowell@palo-gla-1> ping host 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
25 packets transmitted, 0 received, 100% packet loss, time 24016ms
drowell@palo-gla-1> ping host 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
8 packets transmitted, 0 received, 100% packet loss, time 7006ms
drowell@palo-gla-1> ping host 8.8.5.5
PING 8.8.5.5 (8.8.5.5) 56(84) bytes of data.
^C^[[A^C
--- 8.8.5.5 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2003ms
drowell@palo-gla-1> ping
+ bypass-routing Bypass routing table, use specified interface
+ count Number of requests to send (1..2000000000 packets)
+ do-not-fragment Don't fragment echo request packets (IPv4)
+ inet6 Force to IPv6 destination
+ interval Delay between requests (seconds)
+ no-resolve Don't attempt to print addresses symbolically
+ pattern Hexadecimal fill pattern
+ size Size of request packets (0..65468 bytes)
+ source Source address of echo request
+ tos IP type-of-service value (0..255)
+ ttl IP time-to-live value (IPv6 hop-limit value) (0..255 hops)
+ verbose Display detailed output

7. * host Hostname or IP address of remote host
drowell@palo-gla-1> ping host 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=42 time=102 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=42 time=102 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 102.308/102.341/102.374/0.033 ms
drowell@palo-gla-1> show counter global filter packet-filter yes delta yes
Global counters:
Elapsed time since last sampling: 108.305 seconds
name value rate severity category aspect
description
--------------------------------------------------------------------------------
pkt_sent 8796 81 info packet
pktproc Packets transmitted
pkt_outstanding 8969 82 info packet
pktproc Outstanding packet to be transmitted
pkt_alloc 2874 26 info packet
resource Packets allocated
session_allocated 742 6 info session
resource Sessions allocated
session_freed 96 0 info session
resource Sessions freed
session_installed 723 6 info session
resource Sessions installed
session_predict_dst 1 0 info session
resource Active dst predict sessions
flow_policy_deny 30 0 drop flow
session Session setup: denied by policy
flow_tcp_non_syn 78 0 info flow
session Non-SYN TCP packets without session match
flow_tcp_non_syn_drop 78 0 drop flow
session Packets dropped: non-SYN TCP without session match
flow_fwd_l3_mcast_drop 264 2 drop flow
forward Packets dropped: no route for IP multicast
flow_fwd_l3_ttl_zero 12 0 drop flow
forward Packets dropped: IP TTL reaches zero
flow_fwd_zonechange 3213 29 drop flow
forward Packets dropped: forwarded to different zone
flow_action_predict 2 0 info flow
pktproc Predict sessions created
flow_predict_session_dup 17 0 info flow
session Duplicate Predict Session installation attempts
flow_arp_pkt_rcv 17 0 info flow arp
ARP packets received
flow_arp_pkt_replied 3 0 info flow arp
ARP requests replied
flow_host_pkt_xmt 173 1 info flow mgmt
Packets transmitted to control plane
flow_host_service_allow 165 1 info flow mgmt
Device management session allowed
flow_host_service_deny 12 0 drop flow mgmt
Device management session denied
appid_override 126 1 info appid
pktproc Application identified by override rule
appid_ident_by_icmp 73 0 info appid
pktproc Application identified by icmp type
appid_ident_by_dport_first 176 1 info appid
pktproc Application identified by L4 dport first

8. appid_proc 94 0 info appid
pktproc The number of packets processed by Application identification
appid_use_dfa_1 15 0 info appid
pktproc The number of packets using the second DFA table
appid_unknown_fini_empty 54 0 info appid
pktproc The number of unknown applications because of no data
nat_dynamic_port_xlat 592 5 info nat
resource The total number of dynamic_ip_port NAT translate called
nat_dynamic_port_release 68 0 info nat
resource The total number of dynamic_ip_port NAT release called
dfa_dte_request_total 3033 28 info dfa
offload The total number of dfa match using dte
dfa_hte_in_cache_lookup 1466 13 info dfa
offload The total number of requests to an in cache HFA graph
tcp_drop_packet 25 0 warn tcp
pktproc packets dropped because of failure in tcp reassembly
tcp_case_2 2 0 info tcp
pktproc tcp reassembly case 2
ctd_sml_exit 1 0 info ctd
pktproc The number of sessions with sml exit
ctd_sml_exit_detector_i 56 0 info ctd
pktproc The number of sessions with sml exit in detector i
appid_bypass_no_ctd 74 0 info appid
pktproc appid bypass due to no ctd
ctd_stop_proc 3 0 info ctd
pktproc ctd stop proc
ctd_err_bypass 57 0 info ctd
pktproc ctd error bypass
ctd_run_pattern_match_failure 4 0 info ctd
pktproc Run pattern match failure
ctd_do_pattern_match 4 0 info ctd
pktproc do pattern match
ctd_sml_vm_run_impl_opcodeexit 57 0 info ctd
pktproc SML VM opcode exit
ctd_sml_vm_run_impl_immed8000 2 0 info ctd
pktproc SML VM immed8000
ctd_sml_vm_check_domain 262 2 info ctd
pktproc sml vm check domain
ctd_sml_opcode_set_file_type 2 0 info ctd
pktproc sml opcode set file type
ctd_bloom_filter_nohit 524 4 info ctd
pktproc The number of no match for virus bloom filter
ctd_fwd_dns_record 93 0 info ctd
pktproc DNS forward: number of dns records forwarded
fpga_request 2844 26 info fpga
offload The outstanding requests to FPGA
aho_fpga 2844 26 info aho
resource The total requests to FPGA for AHO
aho_too_many_matches 6 0 info aho
pktproc too many signature matches within one packet
aho_sw 12 0 info aho
pktproc The total usage of software for AHO
ctd_appid_reassign 37 0 info ctd
pktproc appid was changed
ctd_decoder_reassign 3 0 info ctd
pktproc decoder was changed
ctd_pkt_slowpath 2923 26 info ctd
pktproc Packets processed by slowpath
log_traffic_cnt 68 0 info log system
Number of traffic logs
proxy_url_request_pkt_drop 8 0 drop proxy
pktproc The number of packets get dropped because of waiting for url category
request in ssl proxy
url_db_request 6 0 info url

9. pktproc Number of URL database request
url_request_timeout 1 0 info url
pktproc The url category request is timedout
url_request_pkt_drop 8 0 drop url
pktproc The number of packets get dropped because of waiting for url category
request
--------------------------------------------------------------------------------
Total counters shown: 57
--------------------------------------------------------------------------------
drowell@palo-gla-1>

10. pktproc Number of URL database request
url_request_timeout 1 0 info url
pktproc The url category request is timedout
url_request_pkt_drop 8 0 drop url
pktproc The number of packets get dropped because of waiting for url category
request
--------------------------------------------------------------------------------
Total counters shown: 57
--------------------------------------------------------------------------------
drowell@palo-gla-1>