Build-Up和Teardown ASA TCP連線標誌

簡介

本文檔介紹有關自適應安全裝置(ASA)TCP連線標誌的資訊。

必要條件

需求

思科建議您瞭解以下主題：

• TCP通訊協定基礎知識

• ASA CLI基礎知識

採用元件

本文檔中的資訊基於ASA 8.4版。

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。

ASA TCP連線標誌

當您通過自適應安全裝置對TCP連線進行故障排除時，為每個TCP連線顯示的連線標誌提供了大量有關到ASA的TCP連線狀態的資訊。此資訊可用於排除ASA的問題以及網路中其他位置的問題。

以下是show conn protocol tcp命令的輸出，其中顯示了通過ASA的所有TCP連線的狀態。這些連線也可使用show conn命令看到。

ASA# show conn protocol tcp
101 in use, 5589 most used.
TCP outside 10.23.232.59:5223 inside 192.168.1.3:52419, idle 0:00:11, bytes 0, flags saA
TCP outside 192.168.3.5:80 dmz 172.16.103.221:57646, idle 0:00:29, bytes 2176, flags UIO
TCP outside 10.23.232.217:5223 inside 192.168.1.3:52425, idle 0:00:10, bytes 0, flags saA
TCP outside 10.23.232.217:443 inside 192.168.1.3:52427, idle 0:01:02, bytes 4504, flags UIO
TCP outside 10.23.232.57:5223 inside 192.168.1.3:52412, idle 0:00:23, bytes 0, flags saA
TCP outside 10.23.232.116:5223 inside 192.168.1.3:52408, idle 0:00:23, bytes 0, flags saA
TCP outside 10.23.232.60:5223 inside 192.168.1.3:52413, idle 0:00:23, bytes 0, flags saA
TCP outside 10.23.232.96:5223 inside 192.168.1.3:52421, idle 0:00:11, bytes 0, flags saA
TCP outside 10.23.232.190:5223 inside 192.168.1.3:52424, idle 0:00:10, bytes 0, flags saA

此圖顯示TCP狀態機不同階段的ASA TCP連線標誌。在ASA上使用show conn命令可檢視連線標誌。

TCP連線標誌值

此外，若要檢視所有可能的連線旗標，請在命令列上發出show connection detail命令：

ASA5515-X# show conn detail
35 in use, 199 most used
Flags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,
       B - initial SYN from outside, b - TCP state-bypass or nailed,
       C - CTIQBE media, c - cluster centralized,
       D - DNS, d - dump, E - outside back connection, F - outside FIN, f - inside FIN,
       G - group, g - MGCP, H - H.323, h - H.225.0, I - inbound data,
       i - incomplete, J - GTP, j - GTP data, K - GTP t3-response
       k - Skinny media, M - SMTP data, m - SIP media, n - GUP
       O - outbound data, P - inside back connection, p - Phone-proxy TFTP connection,
       q - SQL*Net data, R - outside acknowledged FIN,
       R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,
       s - awaiting outside SYN, T - SIP, t - SIP transient, U - up,
       V - VPN orphan, W - WAAS,
       X - inspected by service module,
       x - per session, Y - director stub flow, y - backup stub flow,
       Z - Scansafe redirection, z - forwarding stub flow