SRX

last person joined: 23 hours ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.

  • 1.  the traffic log meaning of srx

    Posted 08-31-2011 19:55

    hi,all,

    there are some traffic log output by my srx,as:

    Jun 25 22:57:33 R2 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 12.1.1.1/768->8.8.8.8/4271,1: PERMIT, 1(84) 1(84) 5

    juniper@R2> show log POLICY-LOG | match RT
    Jun 25 22:55:53 R2 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed unset: 12.1.1.1/44432->8.8.8.8/41858,17: PERMIT, 1(40) 0(0) 61
    Jun 25 22:55:59 R2 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed unset: 12.1.1.1/44432->8.8.8.8/42114,17: PERMIT, 1(40) 0(0) 62
    Jun 25 22:56:03 R2 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed unset: 12.1.1.1/44432->8.8.8.8/42370,17: PERMIT, 1(40) 0(0) 61
    Jun 25 22:56:07 R2 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed unset: 12.1.1.1/44432->8.8.8.8/42626,17: PERMIT, 1(40) 0(0) 60
    Jun 25 22:56:13 R2 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed unset: 12.1.1.1/44432->8.8.8.8/42882,17: PERMIT, 1(40) 0(0) 61
    Jun 25 22:57:28 R2 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 12.1.1.1/0->8.8.8.8/4271,1: PERMIT
    Jun 25 22:57:29 R2 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 12.1.1.1/256->8.8.8.8/4271,1: PERMIT
    Jun 25 22:57:29 R2 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 12.1.1.1/512->8.8.8.8/4271,1: PERMIT
    Jun 25 22:57:29 R2 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 12.1.1.1/768->8.8.8.8/4271,1: PERMIT
    Jun 25 22:57:29 R2 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 12.1.1.1/1024->8.8.8.8/4271,1: PERMIT
    Jun 25 22:57:33 R2 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 12.1.1.1/256->8.8.8.8/4271,1: PERMIT, 1(84) 1(84) 6
    Jun 25 22:57:33 R2 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 12.1.1.1/512->8.8.8.8/4271,1: PERMIT, 1(84) 1(84) 5

     

    What is meaning of below sessions? 

    -session closed response received

    -session created
    -session closed unset

     

     

     

    Thank you.



  • 2.  RE: the traffic log meaning of srx
    Best Answer

    Posted 08-31-2011 22:37
    session create is well first packet received by SRX for the session session close response recieved is typically for things like icmp when icmp response is seen session is removed from session table session close unset represents session has timed out on session table


  • 3.  RE: the traffic log meaning of srx

    Posted 08-31-2011 23:01

    hi,WL,

    thank you for your response,could you send me some documents for this?

     

     

    thank you.



  • 4.  RE: the traffic log meaning of srx

    Posted 08-31-2011 23:26
    http://www.juniper.net/techpubs/en_US/junos11.2/information-products/topic-collections/security/software-all/security/topic-41980.html Ref to Table 6: Session Close Log Fields kudos are appreciated 🙂


  • 5.  RE: the traffic log meaning of srx

    Posted 09-01-2011 22:06

    OH,I get it ,thank you very much.