The (In:) line of the output, also referred to as the ingress wing, means: The packet is coming into the SRX device (ingress) via the ge-0/0/0 interface with a source IP address of 192.168.5.12 and is destined for the IP address 126.96.36.199.
The (Out:) line of the output, also referred to as the egress wing, means: The reply to the firewall (egress) is via the ge-1/0/0 interface and has a source IP address of 188.8.131.52 and is destined for the IP address 184.108.40.206.
Therefore, based on these two 'wings', you can conclude that the source IP address was translated from 192.168.5.12 to 220.127.116.11.
Explanation of the 'flow session' output fields:
Session Identifier = 1234 Security Policy used for this session = icmp-policy Timeout value = 2 Seconds State of session = Valid
(In:) line (Ingress wing): This is how the packet looks when it enters the SRX ingress interface ge-0/0/0.0.
Incoming interface = ge-0/0/0.0 With Source IP/source port = 192.168.5.12/0 and destination IP/destination port = 18.104.22.168/6036 Pkts (packets received) = 1 with total bytes = 84
(Out:) line (Egress wing): This is how the packet is expected to enter the egress interface- ge-1/0/0.0 on its way back to the SRX device.
Incoming interface = ge-1/0/0.0 With the Source IP/Source Port = 22.214.171.124/6036 and destination IP/destination port = 126.96.36.199/49520 ##The Source IP/port = 192.168.5.12/0 in the ingress wing has been source NAT'd to Source IP/port = 188.8.131.52/49520 Pkts = 1 with total bytes = 84
The state of the session is valid and will be used to pass the traffic to and fro, with a timeout value of 2 seconds. As soon as another similar packet hits the session with the id = 1234, the timeout resets to the default value.
For TCP default is 1800 Sec For UDP it is 60 Sec For ICMP it is 2 Sec <needs verification>
Example 1: Flow session output for Destination NAT
In the following flow session output, the Destination IP 184.108.40.206 port 25 is translated to IP 192.168.2.1.