strange asa connections

Thompso7540_2 · ‎11-09-2011

we have two ASA5520 running in FT on asa803-k8 code. I am seeing the below connections in 'show conn' , i have never seen this format before, what does the 0.0.0.0 mean with the real ip next to it in paranthesis? we have other connections that look normal

0.0.0.0(10.238.88.10):0 in 10.1.17.136:5060 idle 0:27:59 bytes 0 flags Ti

TCP out 0.0.0.0(10.238.88.10):0 in 10.1.17.136:5060 idle 0:27:59 bytes 0 flags Ti

TCP out 0.0.0.0(10.238.88.10):0 in 10.1.17.136:5060 idle 0:28:12 bytes 0 flags Ti

TCP out 0.0.0.0(10.238.88.10):0 in 10.1.17.136:5060 idle 0:28:35 bytes 0 flags Ti

TCP out 0.0.0.0(10.238.88.10):0 in 10.1.17.136:5060 idle 0:28:41 bytes 0 flags Ti

TCP out 0.0.0.0(10.238.88.10):0 in 10.1.17.136:5060 idle 0:28:44 bytes 0 flags Ti

TCP out 0.0.0.0(10.238.88.10):0 in 10.1.17.136:5060 idle 0:28:48 bytes 0 flags Ti

TCP out 0.0.0.0(10.238.88.10):0 in 10.1.17.136:5060 idle 0:28:49 bytes 0 flags Ti

thanks,

Bryan

Maykol Rojas · ‎11-10-2011

Those seems to be incomplete SIP connections. Reason of this? Unknown, I would recommend to put sniffers on the ASA as well on 10.1.17.136.

Mike

Thompso7540_2 · ‎11-11-2011

thanks Mike - i see they are incomplete frm the flags. ANy isea why it's this format? Is it because it's Sip?