topic Re: Cisco ASA "show conn" command in Network Security

Cisco ASA "show conn" command

umeshunited — Fri, 21 Feb 2020 15:30:44 GMT

Hi All,

I have output of "show conn" command as below. How do I check which one is the originator of the traffic ?

TCP LAN_Users 10.149.10.11:50707 Mgmt 10.32.11.100:443, idle 0:00:03, bytes 1752, flags UIOB

Re: Cisco ASA "show conn" command

Mohammed al Baqari — Wed, 14 Mar 2018 07:13:06 GMT

Traffic initiated from mgmt to lan

Re: Cisco ASA "show conn" command

umeshunited — Wed, 14 Mar 2018 08:59:53 GMT

@Mohammed al Baqari wrote:
Traffic initiated from mgmt to lan

Hi Mohammed,

How to identify which interface originated traffic ?

From Flags ? or Port numbers ?

Re: Cisco ASA "show conn" command

Octavian Szolga — Wed, 14 Mar 2018 15:35:52 GMT

Hi,

My guess it that it's lan to mgmt. Look at the ports.

If there are some ports for which you can't tell, search for the B flag (initial SYN from outside) and you'll get your answer (lower to higher if exists, higher to lower if missing).

Thanks,
Octavian

Re: Cisco ASA "show conn" command

Florin Barhala — Thu, 15 Mar 2018 07:25:25 GMT

I also looked into this and I find it's a matter of reading flags, still I didn't find an easy way to read it.

Does it exist (this easy way) or it's a matter of experts with hundred of conn reading connections already on their belt?

Re: Cisco ASA "show conn" command

ameen.ahmed — Thu, 29 Jul 2021 02:35:43 GMT

Sorry to say, this answer is wrong.

The traffic is from LAN to Management. Most of the time, the destination ports will be well-known ports and source ports will be random generated.

Thank you.