Active Acquire

The number of pending requests to initiate an Internet Key Exchange (IKE) negotiation in order to establish a security association (SA) between IPSec peers. The Active Acquire statistic includes the outstanding request and the number of any queued requests. Under a heavy load, the number of active acquires is 1 plus the number of requests that are queued by IKE for processing.

Active Receive

The number of IKE messages received that are queued for processing.

Acquire Failures

The total number of acquire outbound requests that have failed since the IPSec service was last started. Acquires are requests to establish SAs between IPSec peers.

Receive Failures

The total number of errors that have occurred during the process of receiving IKE messages since the IPSec service was last started.

Send Failures

The total number of errors that have occurred during the process of sending IKE messages since the IPSec service was last started. The number of Send Failures typically increases for computers that establish SAs over temporary network connections, such as dial-up connections, virtual private network tunnels, and wireless connections.

Acquire Heap Size

The number of entries in the acquire heap. The acquire heap stores successful acquires. Acquires are outbound requests to establish SAs between IPSec peers.

Receive Heap Size

The number of entries in the IKE receive buffers. The receive buffers store incoming IKE messages.

Authentication Failures

The total number of identity authentication (Kerberos, certificate, and preshared key) failures that have occurred during main mode negotiation since the IPSec service was last started. If you are having difficulty communicating securely, attempt the communication and determine whether the number of Authentication Failures increases. If it does, check your authentication settings for either an unmatched authentication method or an incorrect authentication method configuration (for example, the use of preshared keys that do not match).

Negotiation Failures

The total number of negotiation failures that have occurred during main mode or quick mode negotiation since the IPSec service was last started. If you are having difficulty communicating securely, attempt the communication and determine whether the number of Negotiation Failures increases. If it does, check your authentication and security method settings for an unmatched authentication method, an incorrect authentication method configuration (for example, the use of preshared keys that do not match), or unmatched security methods or settings.

Invalid Cookies Received

The total number of cookies that could not be matched with an active main mode SA since the IPSec service was last started. A cookie is a value contained in a received IKE message that is used to help identify the corresponding main mode SA.

Total Acquire

The total number of requests that have been submitted to IKE since the IPSec service was last started to establish an SA. This number includes acquires that result in soft SAs.

Total Get SPI

The total number of requests that have been submitted by IKE to the IPSec driver to obtain a unique Security Parameters Index (SPI) since the IPSec service was last started. The SPI matches inbound packets with SAs.

Key Additions

The total number of outbound quick mode SAs that have been added by IKE to the IPSec driver since the IPSec service was last started.

Key Updates

The total number of inbound quick mode SAs that have been added by IKE to the IPSec driver since the IPSec service was last started.

Get SPI Failures

The total number of failed requests that have been submitted by IKE to the IPSec driver to obtain a unique SPI since the IPSec service was last started.

Key Addition Failures

The total number of failed outbound quick mode SA addition requests that have been submitted by IKE to the IPSec driver since the IPSec service was last started.

Key Update Failures

The total number of failed inbound quick mode SA addition requests that have been submitted by IKE to the IPSec driver since the IPSec service was last started.

ISADB List Size

The number of main mode state entries. This number includes successfully negotiated main modes, main mode negotiations in progress, and main mode negotiations that failed or expired and have not yet been deleted.

Connection List Size

The number of quick mode negotiations that are in progress.

IKE Main Mode

The total number of successful SAs that have been created during main mode negotiations since the IPSec service was last started.

IKE Quick Mode

The total number of successful SAs that have been created during quick mode negotiations since the IPSec service was last started.

Soft Associations

The total number of SAs formed with computers that have not responded to main mode negotiation attempts since the IPSec service was last started. Although these computers did not respond to main mode negotiation attempts, IPSec policy allowed communications with the computers. Soft SAs are not secured by IPSec.

Invalid Packets Received

The total number of invalid IKE messages that have been received since the IPSec service was last started. This number includes IKE messages with invalid header fields, incorrect payload lengths, and incorrect values for the responder cookie. Invalid IKE messages are commonly caused by retransmitted IKE messages or an unmatched preshared key between the IPSec peers.

Active Security Associations

The number of active quick mode SAs.

Offloaded Security Associations

The number of active quick mode SAs offloaded to hardware. Certain network adapters can accelerate IPSec processing by performing hardware offload of IPSec cryptographic functions.

Pending Key Operations

The number of IPSec key exchange operations that are in progress but are not yet completed.

Key Additions

The total number of keys for quick mode SA negotiations that have been successfully added since the computer was last started.

Key Deletions

The total number of keys for quick mode SAs that have been successfully deleted since the computer was last started.

Rekeys

The total number of successful rekey operations for quick mode SAs since the computer was last started.

Active Tunnels

The number of active IPSec tunnels.

Bad SPI Packets

The total number of packets for which the SPI has been incorrect since the computer was last started. If the SPI is incorrect, it might mean that the inbound SA has expired and a packet using the old SPI has recently arrived. This number is likely to increase if rekey intervals are short and there are a large number of SAs. A large number of packets with bad SPIs that are received within a short amount of time might indicate a packet spoofing attack.

Packets Not Decrypted

The total number of packets that could not be decrypted since the computer was last started. A packet might not be decrypted if it fails a validation check.

Packets Not Authenticated

The total number of packets for which data could not be verified (for which the integrity hash verification failed) since the computer was last started. Increases in this number might indicate an IPSec packet spoofing or modification attack or packet corruption by network devices.

Packets With Replay Detection

The total number of packets that have contained an invalid sequence number since the computer was last started. Increases in this number might indicate a network problem or replay attack.

Confidential Bytes Sent

The total number of bytes that have been sent using the Encapsulating Security Payload (ESP) protocol (excluding non-encrypted ESP) since the computer was last started.

Confidential Bytes Received

The total number of bytes that have been received using the ESP protocol (excluding non-encrypted ESP) since the computer was last started.

Authenticated Bytes Sent

The total number of authenticated bytes that have been sent using the Authentication Header (AH) protocol or the ESP protocol since the computer was last started.

Authenticated Bytes Received

The total number of authenticated bytes that have been received using the AH protocol or the ESP protocol since the computer was last started.

Transport Bytes Sent

The total number of bytes that have been sent using IPSec transport mode since the computer was last started.

Transport Bytes Received

The total number of bytes that have been received using IPSec transport mode since the computer was last started.

Bytes Sent in Tunnels

The total number of bytes that have been sent using IPSec tunnel mode since the computer was last started.

Bytes Received in Tunnels

The total number of bytes that have been received using IPSec tunnel mode since the computer was last started.

Offloaded Bytes Sent

The total number of bytes that have been sent using IPSec hardware offload since the computer was last started.

Offloaded Bytes Received

The total number of bytes that have been received using IPSec hardware offload since the computer was last started.