简介
本文档介绍有关自适应安全设备(ASA)TCP连接标志的信息。
先决条件
要求
Cisco 建议您了解以下主题:
使用的组件
本文档中的信息基于ASA 8.4版。
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您的网络处于活动状态,请确保您了解所有命令的潜在影响。
ASA TCP连接标志
当您通过自适应安全设备对TCP连接进行故障排除时,为每个TCP连接显示的连接标志提供了大量有关到ASA的TCP连接状态的信息。此信息可用于排除ASA的问题以及网络中其他位置的问题。
以下是show conn protocol tcp命令的输出,其中显示了通过ASA的所有TCP连接的状态。使用show conn命令也可以看到这些连接。
ASA# show conn protocol tcp
101 in use, 5589 most used.
TCP outside 10.23.232.59:5223 inside 192.168.1.3:52419, idle 0:00:11, bytes 0, flags saA
TCP outside 192.168.3.5:80 dmz 172.16.103.221:57646, idle 0:00:29, bytes 2176, flags UIO
TCP outside 10.23.232.217:5223 inside 192.168.1.3:52425, idle 0:00:10, bytes 0, flags saA
TCP outside 10.23.232.217:443 inside 192.168.1.3:52427, idle 0:01:02, bytes 4504, flags UIO
TCP outside 10.23.232.57:5223 inside 192.168.1.3:52412, idle 0:00:23, bytes 0, flags saA
TCP outside 10.23.232.116:5223 inside 192.168.1.3:52408, idle 0:00:23, bytes 0, flags saA
TCP outside 10.23.232.60:5223 inside 192.168.1.3:52413, idle 0:00:23, bytes 0, flags saA
TCP outside 10.23.232.96:5223 inside 192.168.1.3:52421, idle 0:00:11, bytes 0, flags saA
TCP outside 10.23.232.190:5223 inside 192.168.1.3:52424, idle 0:00:10, bytes 0, flags saA
此图显示了ASA TCP连接标志在TCP状态机的不同阶段。可以在ASA上使用show conn命令查看连接标志。
![ASA TCP Connection Flags at Different Stages of the TCP State Machine](/c/dam/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113602-ptn-113602-00.png)
TCP连接标志值
![TCP Connection Flag Values](/c/dam/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113602-ptn-113602-01.png)
此外,要查看所有可能的连接标志,请在命令行上发出show connection detail命令:
ASA5515-X# show conn detail
35 in use, 199 most used
Flags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,
B - initial SYN from outside, b - TCP state-bypass or nailed,
C - CTIQBE media, c - cluster centralized,
D - DNS, d - dump, E - outside back connection, F - outside FIN, f - inside FIN,
G - group, g - MGCP, H - H.323, h - H.225.0, I - inbound data,
i - incomplete, J - GTP, j - GTP data, K - GTP t3-response
k - Skinny media, M - SMTP data, m - SIP media, n - GUP
O - outbound data, P - inside back connection, p - Phone-proxy TFTP connection,
q - SQL*Net data, R - outside acknowledged FIN,
R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,
s - awaiting outside SYN, T - SIP, t - SIP transient, U - up,
V - VPN orphan, W - WAAS,
X - inspected by service module,
x - per session, Y - director stub flow, y - backup stub flow,
Z - Scansafe redirection, z - forwarding stub flow