Sample Output

The following is a complete sample output from the show services stateful-firewall conversations application-protocol ftp operational mode command:

Interface: sp-1/3/0, Service set: CLBJI1-AAF001
Conversation: ALG protocol: ftp
  Number of initiators: 2, Number of responders: 2
Flow                                                State    Dir       Frm count
TCP           1.1.79.2:14083 ->        2.2.2.2:21    Watch    I              13
    NAT source        1.1.79.2:14083   ->   194.250.1.237:50118   
TCP           1.1.79.2:14104 ->        2.2.2.2:20    Forward  I               3
    NAT source        1.1.79.2:14104   ->   194.250.1.237:50119   
TCP            2.2.2.2:21    ->  194.250.1.237:50118 Watch    O              12
    NAT dest     194.250.1.237:50118   ->        1.1.79.2:14083   
TCP            2.2.2.2:20    ->  194.250.1.237:50119 Forward  O               5
    NAT dest     194.250.1.237:50119   ->        1.1.79.2:14104   

For each flow, the first line shows flow information, including protocol (TCP), source address, source port, destination address, destination port, flow state, direction, and frame count.

• The state of a flow can be Watch, Forward, or Drop:
  • A Watch flow state indicates that the control flow is monitored by the ALG for information in the payload. NAT processing is performed on the header and payload as needed.
  • A Forward flow forwards the packets without monitoring the payload. NAT is performed on the header as needed.
  • A Drop flow drops any packet that matches the 5 tuple.
• The frame count (Frm count) shows the number of packets that were processed on that flow.

The second line shows the NAT information.

• source indicates source NAT.
• dest indicates destination NAT.
• The first address and port in the NAT line are the original address and port being translated for that flow.
• The second address and port in the NAT line are the translated address and port for that flow.