Interpreting NSX DFW Packet Logs

Sample Log Line found in dfwpktlogs.log file

2016-09-15T21:30:23.864Z internal.shahzad.local dfwpktlogs: INET match PASS domain-c543/1247 OUT 48 TCP 11.11.34.44/57856->172.18.44.171/3306 S
2016-09-15T16:00:04.125Z internal.shahzad.local dfwpktlogs: INET match DROP domain-c543/1002 OUT 116 TCP 11.11.34.44/52791->172.18.44.171/3306 FPA

AF Value: INET, INET6
Reason: match, bad-offset, fragment, short, normalize, memory, bad-timestamp, congestion, ip-option, proto-cksum, state-mismatch, state-insert, state-limit, src-limit, synproxy, spoofguard

Action: PASS, DROP, PUNT, REDIRECT, COPY, TERMINATE
Rule set value: Internal MoRef ID (e.g domain-c543)
Rule-ID: e.g 1247 or 1002
Direction: OUT, IN
Length: Packet Length (e.g 48 or 116)
Protocol: TCP, UDP, PROTO
Source IP Address/Port: e.g 11.11.34.44/57856
Destination IP Address/Port:e.g 172.18.44.171/3306
Flags: Flag for TCP. (e.g FPA = FIN, PUSH and ACK)

Reference:
https://communities.vmware.com/thread/537662