Page Comparison

...

show security flow session dynamic-application junos:RDP

10.0.0.5 is the JumpStation ( attached to ge-0/0/6.0 )

10.0.1.99 the PC ( attached to ge-0/0/6.0 )

Code Block

title	show flow session

jcluser@JCL-NGFW-99> show security flow session dynamic-application junos:RDP    
Session ID: 91269, Policy name: Permit-Trust2Trust/4, Timeout: 1798, Valid
  In: 10.0.0.5/60370 --> 10.0.1.99/3389;tcp, Conn Tag: 0x0, If: ge-0/0/6.0, Pkts: 1513, Bytes: 91312, 
  Out: 10.0.1.99/3389 --> 10.0.0.5/60370;tcp, Conn Tag: 0x0, If: ge-0/0/5.0, Pkts: 1368, Bytes: 119825, 

Session ID: 91270, Policy name: Permit-Trust2Trust/4, Timeout: 58, Valid
  In: 10.0.0.5/58179 --> 10.0.1.99/3389;udp, Conn Tag: 0x0, If: ge-0/0/6.0, Pkts: 1315, Bytes: 405220, 
  Out: 10.0.1.99/3389 --> 10.0.0.5/58179;udp, Conn Tag: 0x0, If: ge-0/0/5.0, Pkts: 1893, Bytes: 1479872, 

Session ID: 92039, Policy name: Permit-Trust2Trust/4, Timeout: 1800, Valid
  In: 10.0.0.5/60443 --> 10.0.2.99/3389;tcp, Conn Tag: 0x0, If: ge-0/0/6.0, Pkts: 630, Bytes: 37066, 
  Out: 10.0.2.99/3389 --> 10.0.0.5/60443;tcp, Conn Tag: 0x0, If: ge-0/0/4.0, Pkts: 629, Bytes: 69530, 

Session ID: 92040, Policy name: Permit-Trust2Trust/4, Timeout: 60, Valid
  In: 10.0.0.5/55733 --> 10.0.2.99/3389;udp, Conn Tag: 0x0, If: ge-0/0/6.0, Pkts: 936, Bytes: 443400, 
  Out: 10.0.2.99/3389 --> 10.0.0.5/55733;udp, Conn Tag: 0x0, If: ge-0/0/4.0, Pkts: 1005, Bytes: 780477, 
Total sessions: 4

show security flow session dynamic-application junos:RDP extensive

Code Block

title	extensive

jcluser@JCL-NGFW-99> show security flow session dynamic-application junos:RDP extensive 
Session ID: 91269, Status: Normal
Flags: 0x100040/0x0/0x6003/0x2008103
Policy name: Permit-Trust2Trust/4
Source NAT pool: Null
Dynamic application: junos:COTP, Dynamic nested application: junos:RDP
Encryption:  No
Url-category:  Unknown
Application traffic control rule-set: INVALID, Rule: INVALID
Maximum timeout: 1800, Current timeout: 1798
Session State: Valid
Start time: 83954, Duration: 1450
   In: 10.0.0.5/60370 --> 10.0.1.99/3389;tcp, 
  Conn Tag: 0x0, Interface: ge-0/0/6.0, 
    Session token: 0x7, Flag: 0x1621
    Route: 0x120010, Gateway: 10.0.0.5, Tunnel ID: 0, Tunnel type: None
    Port sequence: 0, FIN sequence: 0, 
    FIN state: 0, 
    Pkts: 1633, Bytes: 96112
   Out: 10.0.1.99/3389 --> 10.0.0.5/60370;tcp, 
  Conn Tag: 0x0, Interface: ge-0/0/5.0, 
    Session token: 0x7, Flag: 0x1620
    Route: 0x100010, Gateway: 10.0.1.99, Tunnel ID: 0, Tunnel type: None
    Port sequence: 0, FIN sequence: 0, 
    FIN state: 0, 
    Pkts: 1488, Bytes: 130745

Session ID: 91270, Status: Normal
Flags: 0x100040/0x0/0x6003/0x103
Policy name: Permit-Trust2Trust/4
Source NAT pool: Null
Dynamic application: junos:RDP, Dynamic nested application: junos:UNKNOWN
Encryption:  No
Url-category:  Unknown
Application traffic control rule-set: INVALID, Rule: INVALID
Maximum timeout: 60, Current timeout: 56
Session State: Valid
Start time: 83954, Duration: 1450
   In: 10.0.0.5/58179 --> 10.0.1.99/3389;udp, 
  Conn Tag: 0x0, Interface: ge-0/0/6.0, 
    Session token: 0x7, Flag: 0x621
    Route: 0x120010, Gateway: 10.0.0.5, Tunnel ID: 0, Tunnel type: None
    Port sequence: 0, FIN sequence: 0, 
    FIN state: 0, 
    Pkts: 1408, Bytes: 408924
   Out: 10.0.1.99/3389 --> 10.0.0.5/58179;udp, 
  Conn Tag: 0x0, Interface: ge-0/0/5.0, 
    Session token: 0x7, Flag: 0x620
    Route: 0x100010, Gateway: 10.0.1.99, Tunnel ID: 0, Tunnel type: None
    Port sequence: 0, FIN sequence: 0, 
    FIN state: 0, 
    Pkts: 1947, Bytes: 1482547

Session ID: 92039, Status: Normal
Flags: 0x100040/0x0/0x6003/0x2008103
Policy name: Permit-Trust2Trust/4
Source NAT pool: Null                   
Dynamic application: junos:COTP, Dynamic nested application: junos:RDP
Encryption:  No
Url-category:  Unknown
Application traffic control rule-set: INVALID, Rule: INVALID
Maximum timeout: 1800, Current timeout: 1800
Session State: Valid
Start time: 84592, Duration: 812
   In: 10.0.0.5/60443 --> 10.0.2.99/3389;tcp, 
  Conn Tag: 0x0, Interface: ge-0/0/6.0, 
    Session token: 0x7, Flag: 0x1621
    Route: 0x120010, Gateway: 10.0.0.5, Tunnel ID: 0, Tunnel type: None
    Port sequence: 0, FIN sequence: 0, 
    FIN state: 0, 
    Pkts: 751, Bytes: 41906
   Out: 10.0.2.99/3389 --> 10.0.0.5/60443;tcp, 
  Conn Tag: 0x0, Interface: ge-0/0/4.0, 
    Session token: 0x7, Flag: 0x1620
    Route: 0x130010, Gateway: 10.0.2.99, Tunnel ID: 0, Tunnel type: None
    Port sequence: 0, FIN sequence: 0, 
    FIN state: 0, 
    Pkts: 750, Bytes: 80541

Session ID: 92040, Status: Normal
Flags: 0x100040/0x0/0x6003/0x103
Policy name: Permit-Trust2Trust/4
Source NAT pool: Null
Dynamic application: junos:RDP, Dynamic nested application: junos:UNKNOWN
Encryption:  No
Url-category:  Unknown
Application traffic control rule-set: INVALID, Rule: INVALID
Maximum timeout: 60, Current timeout: 56
Session State: Valid
Start time: 84593, Duration: 811
   In: 10.0.0.5/55733 --> 10.0.2.99/3389;udp, 
  Conn Tag: 0x0, Interface: ge-0/0/6.0, 
    Session token: 0x7, Flag: 0x621
    Route: 0x120010, Gateway: 10.0.0.5, Tunnel ID: 0, Tunnel type: None
    Port sequence: 0, FIN sequence: 0, 
    FIN state: 0, 
    Pkts: 1027, Bytes: 447050
   Out: 10.0.2.99/3389 --> 10.0.0.5/55733;udp, 
  Conn Tag: 0x0, Interface: ge-0/0/4.0, 
    Session token: 0x7, Flag: 0x620
    Route: 0x130010, Gateway: 10.0.2.99, Tunnel ID: 0, Tunnel type: None
    Port sequence: 0, FIN sequence: 0, 
    FIN state: 0, 
    Pkts: 1059, Bytes: 783143
Total sessions: 4

jcluser@JCL-NGFW-99>

show services application-identification application summary | match RDP

Code Block

title	RDP

jcluser@JCL-NGFW-99> show services application-identification  application summary | match RDP                   
  junos:NRDP                                    No               2695    5      
  junos:WORDPRESS                               No               297     5      
  junos:IPP-RDP                                 No               717     1      
  junos:RDP                                     No               159     1

show services application-identification application detail | find junos:RDP

Code Block

title	RDP

jcluser@JCL-NGFW-99> show services application-identification  application detail | find junos:RDP                        
Application Name: junos:RDP                                                  
Application type: RDP                                                        
Description: This signature detects Microsoft Remote Desktop (RDP) traffic. RDP is a remote
             administration tool.
Application ID: 159    
Priority: high   
Order: 0
 
Disabled: No                
Cacheable: Yes 
Activation Date: 2003-05-05     
Last Modified: 2017-06-28     
Number of Parent Group(s): 1      
Application Groups:
    junos:remote-access:interactive-desktop     
Application Tags:
    layer                 : 4                                                
    characteristic        : Prone to Misuse                                  
    characteristic        : Bandwidth Consumer                               
    risk                  : 4                                                
    subcategory           : Interactive-Desktop                              
    category              : Remote-Access                                    
Underlying consolidated Protocols/ports application is dependent on:
    Protocols:
        Protocol: junos:UDP   / 216       
        Protocol: junos:SSL   / 199       
        Protocol: junos:TCP   / 205       
        Protocol: junos:SPDY  / 1469      
        Protocol: junos:LIBJINGLE-PSEUDOTCP / 3237      
        Protocol: junos:STUN  / 201       
        Protocol: junos:HTTPS / 68        
        Protocol: junos:HTTP  / 67        
        Protocol: junos:NET-PROXY / 2629      
        Protocol: junos:HTTP2 / 2553      
        Protocol: junos:HTTP-TUNNEL / 750       
        Protocol: junos:HTTP-PROXY / 2956      
        Protocol: junos:HAPROXY / 3331      
        Protocol: junos:COTP  / 22        
        Protocol: junos:MCS   / 112       
        Protocol: junos:CAPWAP / 1289      
    TCP Ports:
        Port: 3389       
Layer-7 Immediate Protocol(s):
    Protocol: UDP         / 216       
    Protocol: SSL         / 199       
    Protocol: MCS         / 112       
    Protocol: COTP        / 22        
Application Specific Ports:
    Default ports: TCP/3389
Signature:
    Port range: N/A                    
    Client-to-server
    Order: 1

Versions Compared

Old Version 2

New Version Current

Key