Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

show services stateful-firewall conversations

Syntax

Description

Display information about stateful firewall conversations.

Options

none

Display standard information about all stateful firewall conversations.
brief | extensive | terse

(Optional) Display the specified level of output.
application-protocol protocol

(Optional) Display information about one of the following application protocols:

  • bootp—Bootstrap protocol

  • dce-rpc—Distributed Computing Environment-Remote Procedure Call protocols

  • dce-rpc-portmap—Distributed Computing Environment-Remote Procedure Call protocols portmap service

  • dns—Domain Name System protocol

  • exec—Exec

  • ftp—File Transfer Protocol

  • h323—H.323 standards

  • icmp—Internet Control Message Protocol

  • iiop—Internet Inter-ORB Protocol

  • login—Login

  • netbios—NetBIOS

  • netshow—NetShow

  • realaudio—RealAudio

  • rpc—Remote Procedure Call protocol

  • rpc-portmap—Remote Procedure Call protocol portmap service

  • rtsp—Real-Time Streaming Protocol

  • shell—Shell

  • sip—Session Initiation Protocol

  • snmp—Simple Network Management Protocol

  • sqlnet—SQLNet

  • tftp—Trivial File Transfer Protocol

  • traceroute—Traceroute

  • winframe—WinFrame
destination-port destination-port

(Optional) Display information for a particular destination port. The range of values is 0 to 65535.
destination-prefix destination-prefix

(Optional) Display information for a particular destination prefix.
interface interface-name

(Optional) Display information about a particular interface. On M Series and T Series routers, the interface-name can be sp-fpc/pic/port or rspnumber.

limit number

(Optional) Maximum number of entries to display.
pgcp

(Optional) Display information about stateful firewall conversations for Packet Gateway Control Protocol (PGCP) flows.
protocol protocol

(Optional) Display information about one of the following IP types:

  • number—Numeric protocol value from 0 to 255

  • ah—IPsec Authentication Header protocol

  • egp—An exterior gateway protocol

  • esp—IPsec Encapsulating Security Payload protocol

  • gre—A generic routing encapsulation protocol

  • icmp—Internet Control Message Protocol

  • igmp—Internet Group Management Protocol

  • ipip—IP-within-IP Encapsulation Protocol

  • ospf—Open Shortest Path First protocol

  • pim—Protocol Independent Multicast protocol

  • rsvp—Resource Reservation Protocol

  • sctp—Stream Control Protocol

  • tcp—Transmission Control Protocol

  • udp—User Datagram Protocol
service-set service-set

(Optional) Display information for the specific service set.
source-port source-port

(Optional) Display information for a particular source port. The range of values is 0 to 65535.
source-prefix source-prefix

(Optional) Display information for a particular source prefix.

Required Privilege Level

view

Output Fields

Table 1 lists the output fields for the show services stateful-firewall conversations command. Output fields are listed in the approximate order in which they appear.

Table 1: show services stateful-firewall conversations Output Fields

Field Name

Field Description

Interface

Name of an adaptive services interface.

Service set

Name of a service set. Individual empty service sets are not displayed, but if no service set has any flows, a flow table header is printed for each service set.

Conversation

Information about a group of related flows.

  • ALG Protocol—Application-level gateway protocol.

  • Number of initiators—Number of flows that initiated a session.

  • Number of responders—Number of flows that responded in a session.

Flow or Flow Prot

Protocol used for this flow.

Source

Source prefix of the flow, in the format source-prefix-port.

Destination

Destination prefix of the flow.

State

Status of the flow:

  • Drop—Drop all packets in the flow without response.

  • Forward—Forward the packet in the flow without looking at it.

  • Reject—Drop all packets in the flow with response.

  • Watch—Inspect packets in the flow.

Dir

Direction of the flow: input (I) or output (O).

Source NAT

Original and translated source IPv4 or IPv6 addresses are displayed if Network Address Translation (NAT) is configured on this particular flow or conversation.

Frm Count

Number of frames in the flow.

Destin NAT

Original and translated destination IPv4 or IPv6 addresses are displayed if NAT is configured on this particular flow or conversation.

Byte count

Number of bytes forwarded in the flow.

TCP established

Whether a TCP connection was established: Yes or No.

TCP window size

Negotiated TCP connection window size, in bytes.

TCP acknowledge

TCP acknowledgment sequence number.

TCP tickle

Whether TCP inquiry mode is on (enabled or disabled) and the time remaining to send the next inquiry, in seconds.

Master flow

Flow that initiated the conversation.

TImeout

Lifetime of the flow, in seconds.

Sample Output

show services stateful-firewall conversations

show services stateful-firewall conversations destination-port

Release Information

Command introduced before Junos OS Release 7.4.

pgcp option introduced in Junos OS Release 8.4.