This article describes how the security flow session will be for trace-route traffic passing through SRX.

For the pass through trace-route traffic the security flow session on SRX will be as below:

> show security flow session destination-prefix a.b.c.d

Session ID: 77309472606, Policy name: internet policy/11, Timeout: 10, Session State: Valid

In: w.x.y,z/54997 --> a.b.c.d/33459;udp, Conn Tag: 0x0, If: st0.0, Pkts: 1, Bytes: 60,

Out: a.b.c.d/33459 --> w.x.y.z/54997;udp, Conn Tag: 0x0, If: ge-0/0/8.0, Pkts: 0, Bytes: 0,

The return flow will have zero pkts and zero bytes

The behaviour is expected.

In traceroute(UDP) , every packet is send with limited TTL based on the hop. It doesn’t expect any reply packet with UDP.

When TTL is equal to 0, Packet is dropped and an ICMP error message (Type 0 Code 11 error) is sent back to the source with IP of the current node, which means TTL expired.

So, the return session flow remain 0 is an expected behaviour.