Flags

[prashantrecon]

Hi

Can anyone provide me the details regarding flags when excuted show local-host command.

I am geeting flags as UfFRIO and some times UB.

Does it indicate malicious traffic.

[Julio Carvajal]

Hello Prashant,

Lets start with the easy one UB: witch means U: Up B: Innitial syn from outside

          -This means the connection has been built and was innitiated from the outside

UfFRIO: U: Up f: fin from the inside F: Fin from the outside R:Outside ack FIN, I: Inbound O:Outbound

          -This means a connection builthas been closed successfully ( We can see the FIN packets being exchanged on                    both  directions)

This does not indicate this is malicious traffic, you will need to check the IPs involved and if the traffic they were sending or exchanging is permitted by your security policy. As you can see the connection was innitiated from the outside, so besides analizing that you are ok.

Rate all the helpful posts!!

Regards,

Julio

[ajay chauhan]

I agree with Julio.

Anytype of connection which is passing has got some kind of flag. Suspcting malicious traffic something that you can also check based on number on connections based on source/destination/ports/flags.

However you can see this link might help you to understand how these flags work.

https://supportforums.cisco.com/docs/DOC-21701

Thanks

Ajay

[prashantrecon]

Thankyou,

But sometimes when i tired to access server from remote side.

Server is not accessible and when i excuted the command show connection notting will be displayed under falags.

What is reason ? Tunnel is up when checked.

[ajay chauhan]

It can be attempt for connection and when you run sh conn there is nothing . To investigate this you should setup packet capture to know more in details what is happening.

Thanks

Ajay

[Julio Carvajal]

Hello Prashant,

You will need to analize the logs and check if the traffic is reaching the ASA, because if you do not see any entri on the

show conn that will means 1- ASA is dropping the connection 2-ASA is not receiving the traffic.

But on the 2 particular entries you have provided what Ajay and I have said is basically what is happening.

You can check Ajay document for a more detailed explanation on this.

Do rate helpful posts!!

Julio

Kind regards.!

[Julio Carvajal]

Hello Prashant,

If you have any other question just let us know! We would be more than glad to help otherwise please mark the question as answered so future users having the same problems or questions can learn from here.

Regards,

Julio