Interpreting session details

The log details tell you a lot about a session, but not everything. Sessions, while being processed, have several different parameters that only translate to how they are being processed at a particular moment in time.

One such caveat is when Log at Session Start is enabled on a security rule, a log will only appear once the first data packet is received rather than when the TCP handshake is completed. This means a session could already exist in the session table because the handshake completed successfully, without a log entry being generated because no data has been received yet.

The session table is made up of a finite number of session IDs, so session IDs end up getting reused after the available IDs have been cycled through.

There are seven different states that a session can be in:

• Initial or INIT: A session that is ready and waiting to be used by a new flow is in the INIT state.
• Opening: This is a transient state in...