Solved: Quick PIX syslog Q!

jigsaw2026 · ‎03-30-2007

If a PIX closes a half-closed TCP connection after it's timeout period (default 10 mins), what code/text would that be logged as?

Thanks,

J

David White · ‎03-30-2007

The PIX would log syslog 302014 (TCP connection termination message), and the reason would be "FIN Timeout"

%PIX|ASA-6-302014: Teardown TCP connection id for interface:real-address/real-port to interface:real-address/real-port duration hh:mm:ss bytes bytes [reason] [(user)]

Hope it helps,

David.

View solution in original post

David White · ‎03-30-2007

The PIX would log syslog 302014 (TCP connection termination message), and the reason would be "FIN Timeout"

%PIX|ASA-6-302014: Teardown TCP connection id for interface:real-address/real-port to interface:real-address/real-port duration hh:mm:ss bytes bytes [reason] [(user)]

Hope it helps,

David.

jigsaw2026 · ‎03-30-2007

Brilliant, Thanks David.