Cisco Cisco ASA 5510 Adaptive Security Appliance Leaflet

Cisco ASA Series 명령 참조, S 명령      

4장      show bgp through show cpu 명령

소스 및 대상 보안 그룹 테이블 값 또는 보안 그룹 이름을 지정하지 않고 security-group 키워드를 
지정한 경우에는 ASA에서 모든 SXP 연결에 대한 데이터를 표시합니다.

ASA는 security_group_name(SGT_value) 형식 또는 SGT_value(보안 그룹 이름을 알 수 없는 경우)
로 연결 데이터를 표시합니다.

참고

스텁 연결에는 보안 그룹 데이터를 사용할 수 없습니다. 스텁 연결은 느린 경로를 통해 이동하지 않
기 때문입니다. 스텁 연결은 연결 소유자에게 패킷을 전달하는 데 필요한 정보만 유지합니다.

단일 보안 그룹 이름을 지정하여 클러스터의 모든 연결을 표시할 수 있습니다. 예를 들어 다음 예
에서는 클러스터의 모든 디바이스에서 security-group mktg와 일치하는 연결을 표시합니다.

ciscoasa# show cluster conn security-group name mktg

예

여러 연결 유형을 지정할 때는 공백 없이 쉼표를 사용하여 키워드를 구분합니다. 다음 예에서는 Up 
상태의 RPC, H.323 및 SIP 연결에 대한 정보를 표시합니다.

ciscoasa# show conn state up,rpc,h323,sip

다음은 show conn count 명령의 샘플 출력입니다.

ciscoasa# show conn count

54 in use, 123 most used

다음은 show conn 명령의 샘플 출력입니다. 이 예에서는 내부 호스트 10.1.1.15와 10.10.49.10에 있
는 외부 텔넷 서버 간의 TCP 세션 연결을 표시합니다. B 플래그가 없으므로 이 연결은 내부에서 시
작됩니다. “U”, “I” 및 “O” 플래그는 연결이 활성 상태이고 인바운드 및 아웃바운드 데이터를 수신
했음을 나타냅니다.

ciscoasa# show conn

54 in use, 123 most used

TCP out 10.10.49.10:23 in 10.1.1.15:1026 idle 0:00:22, bytes 1774, flags UIO

UDP out 10.10.49.10:31649 in 10.1.1.15:1028 idle 0:00:14, bytes 0, flags D-

TCP dmz 10.10.10.50:50026 inside 192.168.1.22:5060, idle 0:00:24, bytes 1940435, flags 

UTIOB

TCP dmz 10.10.10.50:49764 inside 192.168.1.21:5060, idle 0:00:42, bytes 2328346, flags 

UTIOB

TCP dmz 10.10.10.51:50196 inside 192.168.1.22:2000, idle 0:00:04, bytes 31464, flags UIB

TCP dmz 10.10.10.51:52738 inside 192.168.1.21:2000, idle 0:00:09, bytes 129156, flags UIOB

TCP dmz 10.10.10.50:49764 inside 192.168.1.21:0, idle 0:00:42, bytes 0, flags Ti

TCP outside 192.168.1.10(20.20.20.24):49736 inside 192.168.1.21:0, idle 0:01:32, bytes 0, 

flags Ti

TCP dmz 10.10.10.50:50026 inside 192.168.1.22:0, idle 0:00:24, bytes 0, flags Ti

TCP outside 192.168.1.10(20.20.20.24):50663 inside 192.168.1.22:0, idle 0:01:34, bytes 0, 

flags Ti

TCP dmz 10.10.10.50:50026 inside 192.168.1.22:0, idle 0:02:24, bytes 0, flags Ti

TCP outside 192.168.1.10(20.20.20.24):50663 inside 192.168.1.22:0, idle 0:03:34, bytes 0, 

flags Ti

TCP dmz 10.10.10.50:50026 inside 192.168.1.22:0, idle 0:04:24, bytes 0, flags Ti

TCP outside 192.168.1.10(20.20.20.24):50663 inside 192.168.1.22:0, idle 0:05:34, bytes 0, 

flags Ti

TCP dmz 10.10.10.50:50026 inside 192.168.1.22:0, idle 0:06:24, bytes 0, flags Ti

TCP outside 192.168.1.10(20.20.20.24):50663 inside 192.168.1.22:0, idle 0:07:34, bytes 0, 

flags Ti

다음은 SSM에서 연결을 스캔하는 중임을 나타내는 “X” 플래그가 포함된 show conn 명령의 샘플 
출력입니다.

ciscoasa# show conn address 10.0.0.122 state service_module