RT System Log Messages
This chapter describes messages with the RT prefix. They are generated on routers running the JUNOS Software with enhanced services by the Packet Forwarding Engine as it processes packets for security control in real time.
RT_FLOW_SESSION_CLOSE
System Log Message
session closed reason: source-address/source-port->destination-address/destination-port service-name nat-source-address/nat-source-port->nat-destination-address/nat-destination-port src-nat-rule-name dst-nat-rule-name protocol-id policy-name source-zone-name destination-zone-name session-id-32 packets-from-client(bytes-from-client) packets-from-server(bytes-from-server) elapsed-time
Description
A security session was closed.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_FLOW_SESSION_CREATE
System Log Message
session created source-address/source-port->destination-address/destination-port service-name nat-source-address/nat-source-port->nat-destination-address/nat-destination-port src-nat-rule-name dst-nat-rule-name protocol-id policy-name source-zone-name destination-zone-name session-id-32
Description
A security session was created.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_FLOW_SESSION_DENY
System Log Message
session denied source-address/source-port->destination-address/destination-port service-name protocol-id(icmp-type) policy-name source-zone-name destination-zone-name
Description
A security session was not permitted by policy.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_BAD_LICENSE
System Log Message
GTP invalid license (gtpP memory-address)
Description
The GPRS tunneling protocol (GTP) is not enabled. The user needs to enable GTP to solve this problem.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_GTP_DEL_TUNNEL_V0
System Log Message
Delete tunnel for V0 gtp-array-index (tid gtp-mobile-id1gtp-mobile-id2), in gtp-tunnel-in-count out gtp-tunnel-out-count, duration: duration seconds
Description
A GPRS tunneling protocol (GTP) version 0 tunnel was deleted.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_DEL_TUNNEL_V1
System Log Message
Delete tunnel V1 gtp-array-index (SGSN teid gtp-teid), in gtp-tunnel-in-count out gtp-tunnel-out-count, duration: duration seconds
Description
A GPRS tunneling protocol (GTP) version 1 tunnel was deleted.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_APN_IE
System Log Message
APN IE: name
Description
Displays the contents of the Access Point Name (APN) information element carried in the GPRS tunneling protocol (GTP) message.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_DESCRIPTION_CHARGING
System Log Message
GTP source-address -> destination-address charging vmajor-version
Description
Displays the GPRS tunneling protocol (GTP) packet description for a GTP charging message. The description includes the source and destination address and version.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_DESCRIPTION_V0
System Log Message
GTP source-address -> destination-address TID gtp-mobile-id1gtp-mobile-id2 (index gtp-array-index)
Description
Displays the GPRS tunneling protocol (GTP) packet description for a GTP version 0 message. The description includes the source and destination address, 64-bit tunnel ID, and index.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_DESCRIPTION_V1
System Log Message
GTP source-address -> destination-address TeID xgtp-teid (index gtp-array-index)
Description
Displays the GPRS tunneling protocol (GTP) packet description for a GTP version 1 message. The description includes the source and destination address, tunnel endpoint ID, and index.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_ENDUSER_ADDR_IE_IPV4
System Log Message
EndUserAddr IE: ip-address
Description
Displays the contents of the IPv4 End User Address information element carried in the GPRS tunneling protocol (GTP) message. The content includes the end user IP address.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_GSNADDR_IE
System Log Message
GSNaddr IE: ip-address
Description
Displays the contents of the GPRS Support Node (GSN) Address information element carried in the GPRS tunneling protocol (GTP) message. The content includes the GSN IP address.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_IMSI_IE
System Log Message
IMSI IE: gtp-mobile-id1gtp-mobile-id2
Description
Displays the contents of the International Mobile Subscriber Identity (IMSI) information element carried in the GPRS tunneling protocol (GTP) message. The content includes the lower and higher halves of the GTP mobile ID.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_MSISDN_IE
System Log Message
MSisdn IE: gtp-isdn-number
Description
Displays the contents of the MS International PSTN/ISDN Number (MSISDN) information element carried in the GPRS tunneling protocol (GTP) message. The content includes the ISDN number.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_PKT_RESULT
System Log Message
***message
Description
Displays the GPRS tunneling protocol (GTP) packet process result, providing information about whether the packet is passed or dropped.
Type
Event: This message reports an event, not an error
Severity
info
Facility
LOG_PFE
RT_GTP_SANITY_EXTENSION_HEADER
System Log Message
*** GTP-DROP message-type (sanity): wrong extension header
Description
The GPRS tunneling protocol (GTP) packet has an incorrect extension header and the packet will be dropped.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_GTP_SYSTEM_ERROR
System Log Message
*** GTP-DROP message-type: bad system status (error-code)
Description
The GPRS tunneling protocol (GTP) packet was dropped due to a firewall system error, as indicated by the error code.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_H323_CALL_LIMIT_EXCEED
System Log Message
Failed to process the packet, active call limit exceeded maximum-value
Description
The maximum H.323 call limit has been exceeded.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_H323_NAT_COOKIE_NOT_FOUND
System Log Message
object-name cannot find cookie from session
Description
Failed to find the H.323 NAT cookie.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_H323_RAS_REQ_FLOOD
System Log Message
RAS Request flood to gatekeeper destination-address detected, request threshold threshold
Description
H.323 Registration Authentication Status request messages have exceeded the configured threshold.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_IPSEC_BAD_SPI
System Log Message
IPSec tunnel on int interface-name with tunnel ID 0xtunnel-id received a packet with a bad SPI. source-address->destination-address/length, type, SPI 0xindex, SEQ 0xsequence-number.
Description
Received IPSec packet with bad SPI
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_IPSEC_REPLAY
System Log Message
Replay packet detected on IPSec tunnel on interface-name with tunnel ID 0xtunnel-id! From source-address to destination-address/length, type, SPI 0xindex, SEQ 0xsequence-number.
Description
Received IPSec replay packet
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_MGCP_CALL_LIMIT_EXCEED
System Log Message
Exceed maximum call max active call numbermaximum-value
Description
The maximum MGCP active call limit has been exceeded.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_MGCP_DECODE_FAIL
System Log Message
Failed to decode MGCP packet
Description
Failed to decode MGCP message.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_MGCP_MEM_ALLOC_FAILED
System Log Message
Failed to allocate memory for object-name
Description
Failed to allocate memory for the MGCP objects.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_MGCP_REG_NAT_VEC_FAIL
System Log Message
Failed to add MGCP object-name to flow module
Description
Failed to register the MGCP ALG vector with the flow module.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_MGCP_REG_RM_FAIL
System Log Message
Failed to register MGCP ALG with Resource Manager
Description
Failed to register the MGCP Resource Manager client.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_MGCP_REM_NAT_VEC_FAIL
System Log Message
Failed to remove MGCP object-name from flow module
Description
Failed to remove the MGCP ALG vector from the flow module.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_MGCP_RM_CLIENTID_FAIL
System Log Message
MGCP ALG Resource Manager client registration failed
Description
Failed to obtain the MGCP Resource Manager client identifier.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_MGCP_UNREG_BY_RM
System Log Message
MGCP ALG client has been unregistered by Resource Manager
Description
The Resource Manager has unregistered the MGCP Resource Manager client.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SCCP_CALL_LIMIT_EXCEED
System Log Message
Failed to create SCCP ALG call, call limit maximum-value exceeded
Description
The maximum SCCP call limit has been exceeded.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SCCP_CALL_RATE_EXCEED
System Log Message
The SCCP active call rate limit maximum-value has been exceeded
Description
The SCCP active call rate limit has been exceeded.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SCCP_DECODE_FAIL
System Log Message
Failed to decode SCCP packet from source-address->destination-address
Description
Failed to decode SCCP packet.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SCCP_NAT_COOKIE_NOT_FOUND
System Log Message
Failed to find SCCP ALG cookie from session
Description
Failed to find SCCP NAT cookie.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SCCP_REM_NAT_VEC_FAIL
System Log Message
Failed to remove SCCP ALG vector from flow module
Description
Failed to remove the SCCP ALG vector from the flow module.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SCCP_UNREG_RM_FAIL
System Log Message
Failed to unregister SCCP client from Resource Manager when the ALG was unregistered
Description
Failed to unregister SCCP client from Resource Manager when the ALG was unregistered.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SCREEN_ICMP
System Log Message
attack-name source: source-address, destination: destination-address, zone name: source-zone-name, interface name: interface-name
Description
ICMP attack category
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_ICMP_FLOOD
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
ICMP flood attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_ICMP_FRAG
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
fragmented ICMP packet attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_ICMP_ID
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
ICMP zero ID attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_ICMP_LARGE
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
large ICMP packet attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_ICMP_PING_DEATH
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
ping of death attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP
System Log Message
attack-name source: source-address, destination: destination-address, protocol-id: protocol-id, zone name: source-zone-name, interface name: interface-name
Description
IP attack category
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_BAD_OPT
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP bad option attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_FRAG
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP fragment attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_LAND
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP land attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_OPT_FILTER_ROUTE
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP source route option attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_OPT_LSR
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP loose source route option attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_OPT_RECORD
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP record route option attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_OPT_SCHT
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP security option attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_OPT_SSR
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP strict source route option attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_OPT_STREAM
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP stream option attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_OPT_TIMESTAMP
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP timestamp option attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_SPOOFING
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP spoofing attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_SWEEP
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
IP sweeping attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_IP_UNKNOWN_PROT
System Log Message
source: source-address, destination: destination-address, protocol-id: protocol-idzone name: filter-name, interface name: interface-name
Description
IP unknown protocol attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_MAL_URL
System Log Message
source: source-address-source-port, destination: destination-address-destination-port, protocol-id: protocol-idzone name: filter-name, interface name: interface-name
Description
malicious URL attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_OVER_SESSION_DST
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
session from the same destination address exceeds the threshold
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_OVER_SESSION_SRC
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
session from the same source address exceeds the threshold
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_PORT_SCAN
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
port scan attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_SESSION_LIMIT
System Log Message
attack-name message: ip-address, zone name: source-zone-name, interface name: interface-name
Description
Session limit category
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_SYN_ACK_ACK
System Log Message
source: source-address-source-port, destination: destination-address-destination-port, zone name: filter-name, interface name: interface-name
Description
SYN-ACK-ACK attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TCP
System Log Message
attack-name source: source-address:source-port, destination: destination-address:destination-port, zone name: source-zone-name, interface name: interface-name
Description
TCP attack category
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TCP_DST_IP
System Log Message
attack-name destination: destination-address, zone name: source-zone-name, interface name: interface-name
Description
TCP destination IP attack category
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TCP_FIN_NO_ACK
System Log Message
source: source-address-source-port, destination: destination-address-destination-port, zone name: filter-name, interface name: interface-name
Description
TCP FIN without ACK flag attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TCP_FRAG
System Log Message
source: source-address-source-port, destination: destination-address-destination-port, zone name: filter-name, interface name: interface-name
Description
TCP fragment attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TCP_NO_FLAG
System Log Message
source: source-address-source-port, destination: destination-address-destination-port, zone name: filter-name, interface name: interface-name
Description
TCP no flag attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TCP_SRC_IP
System Log Message
attack-name source: source-address, zone name: source-zone-name, interface name: interface-name
Description
TCP source IP attack category
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TCP_SYN_FIN
System Log Message
source: source-address-source-port, destination: destination-address-destination-port, zone name: filter-name, interface name: interface-name
Description
TCP SYN-FIN flag attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TCP_SYN_FLOOD
System Log Message
source: source-address-source-port, destination: destination-address-destination-port, zone name: filter-name, interface name: interface-name
Description
TCP SYN flood attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_TEAR_DROP
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
tear drop attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_UDP
System Log Message
attack-name source: source-address:source-port, destination: destination-address:destination-port, zone name: source-zone-name, interface name: interface-name
Description
UDP attack category
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_UDP_FLOOD
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
UDP flood attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCREEN_WINNUKE
System Log Message
source: source-address, destination: destination-address, zone name: filter-name, interface name: interface-name
Description
winnuke attack
Type
Event: This message reports an event, not an error
Severity
error
Facility
LOG_PFE
RT_SCTP_LOG_INFO
System Log Message
***SCTP configuration: message
Description
SCTP log info.
Type
Event: This message reports an event, not an error
Severity
info
Facility
ANY
RT_SCTP_PKT_INFO
System Log Message
***SCTP (type message-type source-address/source-port -> destination-address/destination-port) message
Description
SCTP packet info.
Type
Event: This message reports an event, not an error
Severity
info
Facility
ANY
RT_SIP_CALL_LIMIT_EXCEED
System Log Message
Exceed maximum call
Description
The maximum SIP call limit has been exceeded.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SIP_DECODE_FAIL
System Log Message
Failed to decode SIP packet error-message
Description
Failed to decode incoming SIP packet.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SIP_INIT_EP_FAIL
System Log Message
The SIP stack failed to create an endpoint with the configuration
Description
Failed to initialize SIP endpoint.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SIP_INIT_LISTENER_FAIL
System Log Message
The SIP stack failed endpoint failed to create a dummy listener
Description
Failed to initialize SIP transport listener.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SIP_MEM_ALLOC_FAILED
System Log Message
Failed to allocate memory for object-name
Description
Failed to allocate memory from the memory pool.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SIP_REG_NAT_VEC_FAIL
System Log Message
Failed to add SIP ALG vector to flow module
Description
Failed to register SIP ALG vector with the flow module.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SIP_REG_RM_FAIL
System Log Message
Failed to register SIP ALG with the Resource Manager
Description
Failed to register the SIP ALG Resource Manager client.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SIP_REM_NAT_VEC_FAIL
System Log Message
Failed to remove SIP ALG vector from flow module
Description
Failed to remove the SIP ALG vector from the flow module.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SIP_UNREG_BY_RM
System Log Message
SIP client has been unregistered by RM
Description
The Resource Manager has notified SIP that a client has been unregistered.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SOURCE_NAT_ALARM_CLEAR
System Log Message
Utilization of source nat pool 'nat-pool-name' hits clear threshold 'threshold%%'
Description
Utilization of source NAT pool reaches the alarm clear threshold.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
RT_SOURCE_NAT_ALARM_RAISE
System Log Message
Utilization of source nat pool 'nat-pool-name' hits raise threshold 'threshold%%'
Description
Utilization of source NAT pool reaches the alarm raise threshold.
Type
Error: An error occurred
Severity
error
Facility
LOG_PFE
