Troubleshooting Page 135 FortiRecorder 2.4.2 Administration Guide
Table 13:IP session table
To refresh the session list snapshot with the most current list, click the dotted circle (Refresh)
icon to the left of Records per page.
To sort the session list based upon the contents of a column, hover your mouse cursor over the
column’s heading then click the arrow that appears on the right side of the heading, and select
either Sort Ascending or Sort Descending.
If you expect sessions that do not exist, be aware that some protocol designs (notably UDP) do
not feature persistent sessions. Their sessions will almost immediately expire and be removed
from the session list, and therefore it may be very difficult to capture a session list snapshot
during the brief moment that the datagram is being transmitted. TCP features persistent
connections, where the socket is maintained until the data transmission either is confirmed to
Refresh
GUI item Description
Protocol The protocol of the session according to the “protocol” ID number field
(or, for IPv6, “next header”) in the IP header of the packets.
• icmp — 1 (Due to the speed of ICMP messages, this will almost
never be seen in the session list.)
• tcp — 6
• udp — 17 (Due to the speed of UDP datagrams, this may be seen
in the session list only rarely.)
From IP The source of the session according the source field in the IP header. If
source NAT is occurring, this is not necessarily the IP in the original
frame from the client.
From Port The source port number.
For a list of port numbers that can originate from the FortiRecorder
NVR, see “Appendix A: Port numbers”.
To IP The destination according to the destination field in the IP header. If
destination NAT is occurring, this is not necessarily the IP in the
original frame from the client.
To Port The destination port number.
For a list of port numbers that can be received by the FortiRecorder
NVR, see “Appendix A: Port numbers”.
Expire (secs) The session timeout in seconds. The expiry counter is reset when
packets are sent or received, indicating that the session is still active.
To Next Page
Loading...