Interpreting session details
The log details tell you a lot about a session, but not everything. Sessions, while being processed, have several different parameters that only translate to how they are being processed at a particular moment in time.
One such caveat is when Log at Session Start is enabled on a security rule, a log will only appear once the first data packet is received rather than when the TCP handshake is completed. This means a session could already exist in the session table because the handshake was completed successfully, without a log entry being generated as no data has been received yet.
The session table is made up of a finite number of session IDs, so session IDs end up getting reused after the available IDs have been cycled through.
Understanding session states and types
There are seven different states that a session can be in:
- Initial or INIT: A session that is ready and waiting to be used by a new flow is in the
INIT...
