Cisco ASA TCP connection creation

Cisco ASA TCP connection creation. ASA message 302013 records a TCP connection built by the firewall.

cisco-asa syslog network perimeter

Source and collection

Device logging subsystem / configured remote syslog or vendor export.

Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 2

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: bf0769449352ed8c0725b366434bc31791e9b5c3b8cb83c806b331eff04a8539

Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-6-302013: Built outbound TCP connection 11757 for outside:192.168.205.104/80 (192.168.205.104/80) to inside:172.31.98.44/1772 (172.31.98.44/1772)

Structure and field interpretation

Observed structure in this specific sample
Field/pathSerialized type
raw recordsyslog
Envelope
Priority, timestamp and hostname depend on the transport format.
Message payload
Use the exact vendor message type and version, not a generic whitespace split.

Investigation uses

Validation boundaries

Built does not establish application success; message IDs define distinct layouts.

This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.