show security flow session session-identifier

A unique number that a server assigns a specific user for the duration of that session.

Internal flag depicting the state of the session, used for debugging purposes. It is internal. The three available flags are:

Flags: 0x42/0x0/0x1/0x8103

• natflag:

• natflag2:

• natflag3:

• flag:

Name and ID of the policy that the first packet of the session matched and that permitted the traffic.

Session log entries are tied to policy configuration. Each main session event—create, close, and deny—creates a log entry if the controlling policy has enabled logging.

The name of the source pool where NAT is used.

A NAT pool is a user-defined set of IP addresses that are used for translation. Unlike static NAT, where there is a one-to-one mapping that includes destination IP address translation in one direction and source IP address translation in the reverse direction, with source NAT, the original source IP address is translated to an IP address in the address pool.

Source NAT is used to allow hosts with private IP addresses to access a public network.

Dynamic application: INCONCLUSIVE.

If the dynamic application has yet to be determined, the output indicates Pending. If the dynamic application cannot be determined, the output indicates junos: UNKNOWN.

Traffic with an application ID of junos: UNKNOWN matches a dynamic application of junos: UNKNOWN. If there is no such rule defined, the default rule is applied.

The term junos: UNKNOWN is a reserved keyword.

Type of encryption, if the application traffic is encrypted.

Encryption:  Unknown.

Name of the application traffic control rule set.

Application traffic control rule-set: INVALID.

Maximum session timeout, in seconds.

Session state: Valid.

Time, in seconds, when the session was created, offset from the system start time.

For the input flow:

• Source and destination addresses, ports, and protocol tuple for the input flow.

• Interface: Input flow interface.

• Session token: Internal token derived from the virtual routing instance.

• Flag: Internal debugging flags.

• Route: Internal next hop of the route to be used by the flow.

• Gateway: Next-hop gateway of the flow.

• Tunnel: Used for internal debugging. If the flow is going into a tunnel, the decimal format of the tunnel ID, plus the tunnel type. Otherwise, 0 (zero). See Table 2 for tunnel type identification.

• Port Sequence, FIN sequence, FIN state, Cookie: Internal TCP state tracking information.

• Pkts, Bytes, CP Session ID: Packets and bytes matched on the wing, and the associated CP session ID of the wing.

• Conn tag: Session connection tag for GRPS tunneling protocol, user plane (GTP-U) flow sessions and Stream Control Transmission Protocol (SCTP) flow sessions.

For the reverse flow:

• Source and destination IP addresses, and application protocol for the reverse flow.

• Interface: Reverse flow interface.

• Session token: Internal token derived from the virtual routing instance.

• Flag: Internal debugging flags.

• Route: Internal next hop of the route to be used by the flow.

• Gateway: Next-hop gateway of the flow.

• Tunnel: Tunnel type identifier. Used for internal debugging.

  If the flow is going into a tunnel, species the decimal format of the tunnel ID, plus the tunnel type. Otherwise, 0 (zero). See Table 2 for tunnel type identification.

• Port Sequence, FIN sequence, FIN state, Cookie: Internal TCP state tracking information.

• Pkts, Bytes, CP Session ID: Packets and bytes matched on the wing, and the associated CP session ID of the wing.

• Conn tag: Session connection tag for GRPS tunneling protocol, user plane (GTP-U) flow sessions and Stream Control Transmission Protocol (SCTP) flow sessions.

Session status:

• Auth (NAT flag with NAT_AUTH)

• Transparent (NAT flag with NAT_TRANSPARENT)

• Expired (NAT flag with NAT_INVALID)

• Normal (no flag)

Virtual system to which the session belongs (it is optional).

Application match for applying the rule.

Application: junos-http/6.

Name of the application traffic control rule.

Rule: INVALID.

Remaining time for the session unless traffic exists in the session.

Length of time, in seconds, for which the session is active.

Name of the ALG, if there is resource manager.

Group identification number, if there is resource manager.

Resource identification number, if there is resource manager.