Cisco ASA “show connection” with Flags

show connection” is a great troubelshooting command which displays the ACTIVE ASA connection table. All traffic that passes through the ASA will create a connection.

Quick Reference:
UIO = Outbound Connection
UIOB = Inbound Connection

A – awaiting inside ACK to SYN,
a – awaiting outside ACK to SYN,
B – initial SYN from outside,
b – TCP state-bypass or nailed,
C – CTIQBE media,
D – DNS, d – dump,
E – outside back connection,
F – outside FIN,
f – inside FIN,
G – group,
g – MGCP,
H – H.323,
h – H.225.0,
I – inbound data,
i – incomplete,
J – GTP,
j – GTP data,
K – GTP t3-response
k – Skinny media,
M – SMTP data,
m – SIP media,
n – GUP
O – outbound data,
P – inside back connection,
p – Phone-proxy TFTP connection,
q – SQL*Net data,
R – outside acknowledged FIN,
r – inside acknowledged FIN,
S – awaiting inside SYN,
s – awaiting outside SYN,
T – SIP,
t – SIP transient,
U – up,
V – VPN orphan,
X – inspected by service module


TCP Outside: inside:,
    flags UIOB, idle 27s, uptime 1D5h, timeout 1h0m, bytes 20155

U = the connection UP
I = there’s INBOUND data
O = there’s OUTBOUND data
B = initiated from the outside


TCP outside: inside:,
    flags UIO, idle 24s, uptime 5m25s, timeout 1h0m, bytes 1982

U = the connection UP
I = there’s INBOUND data
O = there’s OUTBOUND data


TCP Outside: inside:,
    flags Ti, idle 5m49s, uptime 5m49s, timeout -, bytes 0

T = this is SIP traffic
i = incomplete