Description

Broadcast traffic being logged in a policy

Symptoms

Policy or traffic log shows broadcast traffic being logged

Solution

If you have a policy configured to log with destination address of Any and Application of Any, you could have broadcast traffic (like Netbios) logged to that policy.  Here is a sample policy log with TCP Port 138 broadcast: 

Apr 23 17:15:09  SRX210-A07_40 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed unset: 169.254.67.252/137->169.254.255.255/137  junos-nbname
   10.85.49.173/26148->169.254.255.255/137 interface-nat None 17 default-permit trust untrust 4698 21(1854) 0(0) 126

This is as designed.  Any packet that matches a particular policy and creates a session will be logged if session-init or session-close is configured on the policy which is matching this packet.  The packet can be unicast, multicast, or broadcast.  There is no mechanism to filter out logging of broadcast packets.