McAfee M4050 Troubleshooting Guide - Page 32

McAfee® Network Security Platform 6.0 Troubleshooting Network Security Platform 1 Click Options > Dashboard > New to open the Create New Dashboard dialog. 2 Enter a name for the new dashboard in the Dashboard Dialog. 3 Click Assign Monitor to view the Assign Monitor Dialog. 4 Select the Assign an existing Monitor radio button. 5 Select Default Monitors against Category (these are the default choices). 6 Select Sensor Performance against Type to view the choice of Monitors for Sensor Performance in the Monitor choices box. 7 Select Statistics - Flows and click OK. 8 Select the Sensor for which you wish to view flow statistics. 9 Click Refresh to view the flow statistics for the selected Sensor. 10 Follow a similar procedure and select other Monitors for Sensor Performance to view the relevant Sensor Statistics. List of Monitors for Sensor Statistics  Sensor Flow Statistics: Statistical view of the TCP and UDP flow data processed by a Network Security Sensor. Checking your flow rates can help you determine if your Sensor is processing traffic normally, while also providing you with a view of statistics such as the maximum number of flows supported as well as the number of active TCP and UDP flows.  IP Spoofing Statistics: Statistics on the number of IP spoofing attacks detected by McAfee Network Security Platform. Statistics are displayed per direction.  Packet Drop Statistics: Packet drop rate on a Sensor. The statistics is displayed on a per Sensor basis. The statistics includes the count of number of packets dropped by Sensor due to set rate limiting on the Sensor and sanity check failures.  Port Packet Drop Statistics: Packet drop rate on a port.  Rate Limiting Statistics: Rate limiting statistics provides the estimated number of packets dropped/bytes dropped by the Network Security Sensor. You can view rate limiting statistics for each Sensor (per port), listed in the resource tree of Manager Checking Sensor failover status To ensure that two Sensors comprising a failover pair are communicating via their interconnection cable, go to each Sensor's CLI and type show failover-status. Failover should display as enabled (YES), and the peer Sensor should display as UP. Cabling failover through a network device Do not cable the heartbeat connection through an external network device. To keep overhead low and throughput high, the Sensors do not include layer 2 or 3 headers on the packets they pass over the heartbeat connection, and they pass data larger than the standard Ethernet maximum frame size (1518 bytes). If you attempt to place a network device, such as a switch or router, between the heartbeat ports, the heartbeat connection will fail. 23