Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.


PIX TCP connection flags

Does anyone know how to interpret the output of "show conn" command, specifically the "flags"?

Here is an example:

SNIFF# sho conn local net

TCP out in idle 0:00:02 Bytes 375 flags U


TCP out in idle 0:00:50 Bytes 1011 flags


TCP out in idle 0:00:01 Bytes 1917 flags


I'd appreciate any feedback on this.


Mustafa Hussein

Comark, Inc.

New Member

Re: PIX TCP connection flags

Here’s the breakdown. d=Dump, clean up connection. f=FIN seen in inbound packet. F=FIN seen in outbound packet. H=HTTP get in a UDP connection, H can also mean H.323. I Data in. J=Java applets are not permitted on connection. m=SMTP data. O=Data out. q= SQL*Net data fixup. R=Remote Procedure Call (RPC). r=In use. U=Connection is up. I think some other flags may show up but they are specifically for Cisco engineering if requested during trouble-shooting.

New Member

Re: PIX TCP connection flags

Where did you find this stuff? (its great!)

New Member

Re: PIX TCP connection flags

Unfortunatelly CCO does not give any information on the flags. You can find some of them only in the documentation of 4.4. It seems they are not important any more.. :)

Once I opened a case for some connections flags, and got almost all of them:

| Flag | Description

| U | up

| f | inside FIN

| F | outside FIN

| r | inside acknowledged FIN

| R | outside acknowledged FIN

| s | awaiting outside SYN

| S | awaiting inside SYN

| M | SMTP data

| H | HTTP get (not used)

| | SIP connection

| | SKINNY (not used)

| I | inbound data

| O | outbound data

| q | SQL*Net data

| n | nailed connection (no supported)

| d | dump

| P | inside back connection

| E | outside back connection

| G | group

| p | replicated (unused)

| a | awaiting outside ACK to SYN

| A | awaiting inside ACK to SYN

| B | initial SYN from outside

| R | RPC

| H | H.323

| | SIP connection

| | SIP media connection

| | SIP trans connection

| D | DNS



New Member

Re: PIX TCP connection flags

many thanks, this goes in the bag of tricks