topic Re: Session browser vs. traffic logs in General Topics

Session browser vs. traffic logs

joeyjoejoe — Tue, 16 Oct 2018 15:34:51 GMT

Hi all,

Maybe someone can help to bring some light on my question. I'm trying to determine the difference between the session browser and the traffic logs. Why it is that when I search on a rule in the traffic logs I see specific traffic that is not in the session browser? I'm trying to remove a rule from our firewall by first seeing if other rules are taking precedence over it. The problem is when I look at traffic that is using that rule in the traffic log I'm only seeing subnets and not specific IPs. I then attempt to do the same thing in the session browser to see the IPs and do not find the traffic I noticed in the traffic logs? Seems like I'm missing something and probably need a better understanding of how both tools work.

Thanks for the help in advance!

Re: Session browser vs. traffic logs

LukeBullimore — Tue, 16 Oct 2018 15:41:57 GMT

Hi @joeyjoejoe

The traffic log shows you historic information for sessions that have already ended (via the "Log at Session End" option in the security policy).

The session browser allows you to view active sessions currently passing through the firewall. Once those sessions end you'll see them in the traffic log.

Thanks,

Luke.

Re: Session browser vs. traffic logs

joeyjoejoe — Tue, 16 Oct 2018 15:48:38 GMT

Hi @LukeBullimore,

Yeah that makes a lot of sense actually and not sure why I didn't put that together. Thanks for the clarification on that!