Juniper JUNOS OS 10.3 - SYSTEM LOG MESSAGES REFERENCE 7-12-2010 Reference Manual page 165

Severity
Facility
ASP_SFW_TCP_PORT_ZERO
System Log Message
Description
Type
Severity
Facility
ASP_SFW_TCP_RECONSTRUCT_DROP
System Log Message
Description
Type
Severity
Facility
Cause
ASP_SFW_TCP_SCAN
System Log Message
Description
Copyright © 2010, Juniper Networks, Inc.
notice
LOG_PFE
syslog-prefix error-code: proto protocol-id (protocol-name),
source-interface-nameseparatorsource-address:source-port ->
destination-addressdestination-port, event-type
The stateful firewall discarded the Transmission Control Protocol (TCP) packet with the
indicated characteristics, because the source or destination port specified in the packet
was zero (0). The discarded packet contained the indicated information about its protocol
(numerical identifier and name), source (logical interface name, IP address, and port
number), and destination (IP address and port number).
Event: This message reports an event, not an error
notice
LOG_PFE
syslog-prefix error-code: proto protocol-id (protocol-name),
source-interface-nameseparatorsource-address:source-port ->
destination-addressdestination-port, event-type
The stateful firewall discarded the Transmission Control Protocol (TCP) packet with the
indicated characteristics, because the session to which the packet belongs violated TCP
standards. The discarded packet contained the indicated information about its protocol
(numerical identifier and name), source (logical interface name, IP address, and port
number), and destination (IP address and port number).
Event: This message reports an event, not an error
notice
LOG_PFE
Possible causes include the following: (1) the amount of previously received but
unacknowledged data exceeded the TCP window (2) there were sequence number errors
(gaps in the sequence or packets with overlapping numbers).
syslog-prefix error-code: proto protocol-id (protocol-name),
source-interface-nameseparatorsource-address:source-port ->
destination-addressdestination-port, event-type
The stateful firewall received a Transmission Control Protocol (TCP) RST packet from
a server, indicating that the server rejected a connection attempt directed to the indicated
destination address and port. The event was reported to intrusion detection services
(IDS) and can cause IDS to activate SYN cookie protection. The RST packet contained
the indicated information about its protocol (numerical identifier and name), source
Chapter 9: ASP System Log Messages
101