Interpreting session details
The log details tell you a lot about a session, but not everything. Sessions, while being processed, have several different parameters that only translate to how they are being processed at a particular moment in time.
The session table is made up of a finite number of session IDs, so session IDs end up getting reused after the available IDs have been cycled through. There are seven different states that a session can be in:
- Initial or INIT: A session that is ready and waiting to be used by a new flow is in the
INITstate. - Opening: This is a transient state in which a session ID is assigned to a flow while it is being evaluated to become a full session. This stage accounts for half-open TCP connections, so it has more aggressive timers that close the session if the handshake is not completed within due time.
- Active: This is the state in which everything happens – the flow is up and packets are being passed back and forth.
- Closing...
