Troubleshooting Tip: FortiGate session table information
Products
FortiGate
Description
This article provides an explanation of various fields of the FortiGate session table.
Solution
To display the session table:
#diagnose sys session list
To setup session filter:
# diagnose sys session filter <options>
clear       clear session filter

dport       dest port
dst         dest ip address
duration    duration
expire      expire
negate      inverse filter
policy      policy id
proto       protocol number
sport       source port
src         source ip address
vd          index of virtual domain. -1 matches all

To clear filtered or all sessions (if no session filter set):
# diagnose sys session clear

Example of session table entry:
session info: proto=6 proto_state=01 duration=142250 expire=3596 timeout=3600 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=4
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ helper=rsh vlan_cos=255/255
state=local
statistic(bytes/packets/allow_err): org=9376719/61304/1 reply=3930213/32743/1 tuples=2
tx speed(Bps/kbps): 65/0 rx speed(Bps/kbps): 27/0
orgin->sink: org out->post, reply pre->in dev=13->0/0->13 gwy=0.0.0.0/10.5.27.238
hook=out dir=org act=noop 10.5.27.238:16844->173.243.132.165:514(0.0.0.0:0)
hook=in dir=reply act=noop 173.243.132.165:514->10.5.27.238:16844(0.0.0.0:0)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 policy_id=0 auth_info=0 chk_client_info=0 vd=0
serial=0161f3cf tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id = 00000000
dd_type=0 dd_mode=0

proto: protocol number
proto_state: state of the session (depending on protocol)

a) ICMP (proto 1)
Note: There are no states for ICMP, it always shows proto_state=00

b) TCP (proto 6)
Note: proto_state is a 2 digit number because the FortiGate is a stateful firewall (keeps the track of both directions of the session); proto_state=OR meaning Original direction and the Reply direction


State

Value

Expire Timer (default)

NONE

0

10 s

ESTABLISHED

1

3600 s

SYN_SENT

2

120 s

SYN & SYN/ACK

3

60 s

FIN_WAIT

4

120 s

TIME_WAIT

5

1 s

CLOSE

6

10 s

CLOSE_WAIT

7

120 s

LAST_ACK

8

30 s

LISTEN

9

120 s


c) UDP (proto 17)
Note: Even though UDP is a stateless protocol, the FortiGate still keeps track of 2 different 'states'


State

Value

UDP Reply not seen

0

UDP Reply seen

1


d) SCTP (proto 132)

State

Value

Expire Timer (default)

SCTP_S_NONE

0

60 s

SCTP_S_ESTABLISHED

1

3600 s

SCTP_S_CLOSED

2

10 s

SCTP_S_COOKIE_WAIT

3

5 s

SCTP_S_COOKIE_ECHOED

4

10 s

SCTP_S_SHUTDOWN_SENT

5

30 s

SCTP_S_SHUTDOWN_RECD

6

30 s

SCTP_S_SHUTDOWN_ACK_SENT

7

3 s

SCTP_S_MAX

8

n/a



duration: duration of the session (value in seconds)
expire: a countdown from the “timeout” since the last packet passing via session (value in seconds)
timeout: indicator how long the session can stay open in the current state (value in seconds)
*shaper: the traffic shaper profile info (if traffic shaping is utilized)
policy_dir: 0 original direction | 1 reply direction
tunnel: VPN tunnel name
helper: name of the utilized session helper
vlan_cos: Ingress COS values are displayed in the session output in the range 0-7/255, but admin COS values are displayed in the range 8-15/255 even though the value on the wire will be in the range 0-7. When no COS is utilized the value is 255/255
state:

may-dirty

Session details allowed to be altered

dirty

Session has been altered (requires may-dirty)

npu

Session goes through an acceleration ship

npd

Session is denied for hardware acceleration

npr

Session is eligible for hardware acceleration (more info with npu info: offload=x/y )

rem

Session is allowed to be reset in case of memory shortage

eph

Session is ephemeral

oe

Session is part of Ipsec tunnel (from the originator)

re

Session is part of Ipsec tunnel (from the responder)

local

Session is attached to local fortigate ip stack

br

Session is bridged (vdom is in transparent mode)

redir

Session is redirected to an internal FGT proxy

wccp

Session is intercepted by wccp process

nlb

Session is from a load-balanced vip

log

Session is being logged

os

Session is shaped on the origin direction

rs

Session is shaped on the reply direction

ndr

Session is inspected by IPS signature

nds

Session is inspected by IPS anomaly

auth

Session is subject to authentication

block

Session was blocked by IPS inspection

ext

(deprecated) Session is handled by a session helper

app_ntf

Session matched a policy entry that contains "set block-notification enable"

dev: interface index can be obtained via “diagnose netlink interface list”:

if=port1 family=00 type=1 index=3 mtu=1500 link=0 master=0

NAT information:

hook=out dir=org act=noop 10.5.27.238:16844->173.243.132.165:514(20.30.40.50:20000)
hook=in dir=reply act=noop 173.243.132.165:514->20.30.40.50:20000(10.5.27.238:16844)


LEGEND: <source_IP>:<source_port>-><destination_IP>:<destination_port>(<NAT_IP>:<NAT_port>)

-when applying SNAT, NAT information is overwriting the <source_IP>:<source_port>
-when applying DNAT, NAT information is overwriting the <destination_IP>:<destination_port>

policy_id: policy ID, which is utilized for the traffic
auth_info: indicates if the session holds any authentication data (1) or not (0)
vd: VDOM index can be obtained via “diagnose sys vd list”:

name=root/root index=0 enabled use=237 rt_num=144 asym_rt=0 sip_helper=1, sip_nat_trace=1, mc_fwd=1, mc_ttl_nc=0, tpmc_sk_pl=0

serial: unique session identifier
tos:
a) The policy has tos/dscp configured to override this value on a packet.
b) A proxy-based feature is enabled and it is necessary to preserve the tos/dscp on packets in the flow by caching the tos/dscp on the kernel session from the original packet and then setting it on any subsequent packets that are generated by the proxy.

app: application ID
url_cat:

Potentially Liable:

   48 Personal Vehicles

    1 Drug Abuse

   54 Dynamic Content

    3 Hacking

   55 Meaningless Content

    4 Illegal or Unethical

   58 Folklore

    5 Discrimination

   68 Web Chat

    6 Explicit Violence

   69 Instant Messaging

   59 Proxy Avoidance

   70 Newsgroups and Message Boards

   62 Plagiarism

   71 Digital Postcards

   83 Child Abuse

   77 Child Education

Bandwidth Consuming:

   78 Real Estate

   19 Freeware and Software Downloads

   79 Restaurant and Dining

   24 File Sharing and Storage

   80 Personal Websites and Blogs

   25 Streaming Media and Download

   82 Content Servers

   72 Peer-to-peer File Sharing

   85 Domain Parking

   75 Internet Radio and TV

   87 Personal Privacy

   76 Internet Telephony

   89 Auction

General Interest - Personal:

General Interest - Business:

   17 Advertising

   31 Finance and Banking

   18 Brokerage and Trading

   41 Search Engines and Portals

   20 Games

   43 General Organizations

   23 Web-based Email

   49 Business

   28 Entertainment

   50 Information and Computer Security

   29 Arts and Culture

   51 Government and Legal Organizations

   30 Education

   52 Information Technology

   33 Health and Wellness

   53 Armed Forces

   34 Job Search

   56 Web Hosting

   35 Medicine

   81 Secure Websites

   36 News and Media

   84 Web-based Applications

   37 Social Networking

   92 Charitable Organizations

   38 Political Organizations

   93 Remote Access

   39 Reference

   94 Web Analytics

   40 Global Religion

   95 Online Meeting

   42 Shopping

    0 Unrated

   44 Society and Lifestyles

Local Categories:

   46 Sports

  140 custom1

   47 Travel

  141 custom2


Related Articles
Technical Tip: Using filters to clear sessions on a FortiGate unit
Last Modified Date: 09-21-2019 Document ID: FD30042