RE: [fw-wiz] Cisco acls
From: Luke Butcher (Luke.Butcher_at_alphawest.com.au)
To: "Scott Stursa" <email@example.com> Date: Wed, 30 Mar 2005 08:29:19 +1000
From: Scott Stursa
Sent: Friday, 25 March 2005 4:54 AM
>> On Tue, 15 Mar 2005, Luke Butcher wrote:
>> Not sure about a lint checker and router ACLs unfortunately don't
show a hit count like PIX ones.
> Yes they do.
> The only place I've seen "missed" hits are on switches doing VLAN
switching. Although the initial handshake will
> generate hits, once it goes into switching mode the ACL will never see
the packets. The difference is clear if you
> have an ACL which begins with "permit tcp any any established"; on a
non-switched interface this line will show the > greatest number of hits
in the ACL, on a switched one it will show the lowest.
Sorry I meant in the way a PIX displays 'hitcnt=' right next to the line
when you do a show access-list. This makes it very easy to tell what
lines are being used and which ones aren't.
firewall-wizards mailing list