Hi all, I have a few questions:
1. I was wondering when we see the following message on syslog, does it mean that TCP 3 way handshake has been completed or does it mean only SYN flag has been sent to the destination (192.168.1.1)?
%ASA-6-302013: Built inbound TCP connection 101 for outside:172.16.1.1/1337 to inside:192.168.1.1/23 (192.168.1.1/23)
2. In packet capture below, normally we’ll know that data has been transferred by looking at PUSH & ACK flag (P & ack). How about syslog message since we cannot see the TCP flag in it? Is there similar message in syslog shows that data has been transferred between source and destination?
: 16:10:01.745673 172.16.1.1.1494 > 192.168.154.196.4027: P 3118519132:3118519143(11) ack 563496654 win 64331
3. Sometimes, we also experience SYN flag has been sent by source, but there is not reply (SYN/ACK) from the destination. Since the source address does not receive the SYN/ACK, the destination finally will send RST to terminate the connection. Can we see this message on the syslog?
Thanks
