# pfctl -s state output explanation



## denizeren (Feb 2, 2012)

Can anybody tell me where can I find full explanation of `pfctl -s state` output?


```
all tcp 192.168.0.123:22 <- 192.168.0.234:38095 ESTABLISHED:ESTABLISHED
```

What direction means, which TCP infos are available like ESTABLISHED:ESTABLISED and so on.

Good day to you..


----------



## SirDice (Feb 2, 2012)

I'd start with getting to know TCP/IP. Once you know how that works the information pfctl(8) presents will be clear.


----------



## denizeren (Feb 2, 2012)

I know TCP/IP I didn't understand the representation. I read in maillist that the arrows which stand for -> for outgoing to firewall from interface and <- for incoming to firewall from interface.

What is value1:value2 representing in example it is (ESTABLISHED:ESTABLISED). What is value1 representing and value2 representing.

Also what are the valid state table states.

I saw these TCP states:
-----------------------
SINGLE
MULTIPLE
LISTEN
SYN_SENT
SYN_RECEIVED
ESTABLISHED
CLOSE_WAIT
LAST_ACK
FIN_WAIT_1
CLOSING
FIN_WAIT_2
TIME_WAIT

Are used. But what does NO_TRAFFIC, SINGLE:MULTIPLE are used for. Are there any other states that I did not write here?


----------



## DutchDaemon (Feb 2, 2012)

If you're versed in things like the three-way handshake (SYN, SYN/ACK, ACK) and how that establishes a state, the statelessness of UDP, how timed-out states get torn down (FIN, FIN/ACK, ACK) after an inactivity time-out (FIN/WAIT, CLOSE/WAIT, CLOSING ...) etcetera, it should be no secret what these terms mean. So SirDice's reply about having to understand TCP/IP basics and terminology is simply the correct answer. One is impossible to understand (and explain) without knowledge of the other.


----------



## denizeren (Feb 2, 2012)

http://lists.freebsd.org/pipermail/freebsd-pf/2011-April/006084.html
Here is said that arrows stand for -> for outgoing from interface to firewall and <- for incoming from interface to firewall.

So how can I determine the source and destination IPs in such entry or does arrow stand for direction of packets:

```
all tcp 192.168.0.123:22 <- 192.168.0.234:38095 ESTABLISHED:ESTABLISHED
```


----------



## DutchDaemon (Feb 2, 2012)

That's a connection from 192.168.0.234:38095 to 192.168.0.123:22 that's fully established (three-way handshake completed and state set up). Given the port (ssh, tcp/22) that's pretty logical.


----------



## SirDice (Feb 2, 2012)

A lot of them are the basic TCP session states. The rest is housekeeping. The state table stores information about connections, return trafic, NAT translations etc. I rarely look at it.


----------

