topic Re: PIX TCP connection flags in Network Security

PIX TCP connection flags

mhussein — Fri, 21 Feb 2020 05:48:41 GMT

Does anyone know how to interpret the output of "show conn" command, specifically the "flags"?

Here is an example:

SNIFF# sho conn local 192.168.120.189 net 255.255.255.255

TCP out 192.168.225.30:80 in 192.168.120.189:1510 idle 0:00:02 Bytes 375 flags U

TCP out 192.168.225.31:80 in 192.168.120.189:1499 idle 0:00:50 Bytes 1011 flags

UIO

TCP out 192.168.225.30:80 in 192.168.120.189:1515 idle 0:00:01 Bytes 1917 flags

UfFrIO

I'd appreciate any feedback on this.

Thanks.

Mustafa Hussein

Comark, Inc.

Re: PIX TCP connection flags

mmellet — Thu, 05 Jul 2001 21:58:24 GMT

Here’s the breakdown. d=Dump, clean up connection. f=FIN seen in inbound packet. F=FIN seen in outbound packet. H=HTTP get in a UDP connection, H can also mean H.323. I Data in. J=Java applets are not permitted on connection. m=SMTP data. O=Data out. q= SQL*Net data fixup. R=Remote Procedure Call (RPC). r=In use. U=Connection is up. I think some other flags may show up but they are specifically for Cisco engineering if requested during trouble-shooting.

Re: PIX TCP connection flags

millerv — Fri, 06 Jul 2001 17:29:20 GMT

Where did you find this stuff? (its great!)

Re: PIX TCP connection flags

subaa — Tue, 24 Jul 2001 15:43:23 GMT

Unfortunatelly CCO does not give any information on the flags. You can find some of them only in the documentation of 4.4. It seems they are not important any more.. 🙂

Once I opened a case for some connections flags, and got almost all of them:

| Flag | Description

| U | up

| f | inside FIN

| F | outside FIN

| r | inside acknowledged FIN

| R | outside acknowledged FIN

| s | awaiting outside SYN

| S | awaiting inside SYN

| M | SMTP data

| H | HTTP get (not used)

| | SIP connection

| | SKINNY (not used)

| I | inbound data

| O | outbound data

| q | SQL*Net data

| n | nailed connection (no supported)

| d | dump

| P | inside back connection

| E | outside back connection

| G | group

| p | replicated (unused)

| a | awaiting outside ACK to SYN

| A | awaiting inside ACK to SYN

| B | initial SYN from outside

| R | RPC

| H | H.323

| | SIP connection

| | SIP media connection

| | SIP trans connection

| D | DNS

Best,

Attila

Re: PIX TCP connection flags

millerv — Wed, 25 Jul 2001 21:13:03 GMT

many thanks, this goes in the bag of tricks