Cisco Secure Firewall ASA · Event 302016
ASA 302016: A UDP conversation timed out
UDP has no connections, so the firewall invents one and closes it when nothing has been heard for a while. That means the duration in this message measures the firewall's idle timer, not the conversation — and it is why DNS alone can account for most of the lines in an ASA log.
Also written as %ASA-6-302016ASA 302016Teardown UDP connectionasa udp connection teardown
- How oftenFires constantly
- Vendor calls it%ASA-6 (Informational)
- Logsyslog
What it means for you
For an analyst
The field that carries information in a TCP teardown — the reason — carries none here, because a UDP pseudo-connection almost always ends the same way. What is left is the byte count and the endpoints, which makes 302016 the ASA's flow record for DNS, NTP, syslog and VPN traffic. Worth knowing that DNS gets its own much shorter idle timeout by default, which is why DNS produces a vastly disproportionate share of these messages; if the volume is a problem, adjusting that timeout changes the message rate without changing what actually traverses the firewall.
The fields that decide it
Everything else in the log line is context.
- Connection ID
- The number matching this teardown to the 302015 that created the pseudo-connection. The only reliable way to pair them.
- Duration
- How long the entry sat in the connection table before the idle timer expired. On UDP this measures the timer, not how long two hosts were actually talking.
- Bytes
- How much moved. For UDP this is the useful field — a DNS exchange is a few hundred bytes, and something moving megabytes over UDP to one destination is worth explaining.
- Source and destination with interfaces
- The two ends and which side of the firewall each was on. In aggregate this is a map of which internal hosts use which external services.
-
destination port 53DNS. Expect this to dominate the volume and to have a much shorter idle timeout than other UDP. -
destination port 123NTP. Regular, small, and predictable. -
destination port 500 or 4500IPsec VPN negotiation and NAT traversal. -
a high port with sustained bytesStreaming, gaming, or something worth identifying. UDP moving significant volume to one host deserves a name.
Common questions
Why does the ASA log connections for UDP when UDP is connectionless?
Because a stateful firewall has to remember that an outbound request went out in order to let the reply back in. It creates a table entry that behaves like a connection and removes it when nothing has been heard for the idle timeout. The syslog messages follow the table entry, not any real connection, which is why the duration reflects the timer rather than the conversation.
Why are there so many 302015 and 302016 messages for DNS?
Because every DNS query creates a table entry and every entry produces a build and a teardown message. DNS is high-volume and short-lived by nature, and the ASA applies a much shorter idle timeout to it than to other UDP, so entries are created and destroyed constantly. On a busy network this pair alone can be the majority of the log.
What does the duration field mean in a UDP teardown?
Almost always the idle timeout, not the length of the exchange. If your UDP idle timeout is two minutes, expect to see durations of about two minutes on conversations that took milliseconds. Do not read it as how long two hosts were talking — for that, count the messages or look at the byte totals.
How do I reduce ASA 302015 and 302016 volume?
The clean approach is to stop sending those two message IDs to your log server with 'no logging message 302015' and 'no logging message 302016', which keeps everything else intact. Raising the DNS idle timeout also reduces the message rate by keeping entries alive longer, though that grows the connection table. Either way, decide first whether you use the flow data — for many networks these messages are the only record of what talks to what over UDP.
Read next
- The equivalent of Cisco ASA 302014: A TCP connection was torn down The TCP teardown, where the reason field genuinely tells you how the connection ended.
- The equivalent of Cisco ASA 302013: A TCP connection was built The TCP build message, the connection-oriented counterpart to a UDP pseudo-connection being created.
- Read alongside Cisco ASA 106023: Traffic denied by an access-list Access-list denies, which is what UDP that never gets a connection entry produces instead.
- Usually comes after ASA 733100: A drop rate crossed a threat-detection threshold Threat detection rates, which UDP floods contribute to.
Mentioned by
Vendor documentation
Last reviewed 6 September 2026