topic Init session - Is TCP 3 way handshake gets completed here? in General Topics

Init session - Is TCP 3 way handshake gets completed here?

MP18 — Wed, 24 Apr 2019 19:02:33 GMT

Init session info

Does TCP 3 way handshake gets started and completed here?

Re: Init session - Is TCP 3 way handshake gets completed here?

gwesson — Wed, 24 Apr 2019 20:19:48 GMT

Init means it's not an active session. Full breakdown here:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk9CAC

Short answer: when a session ends, the session state retuns to INIT. You can still see the most recent session details that used that particular session ID until new traffic allocates that ID.

Re: Init session - Is TCP 3 way handshake gets completed here?

MP18 — Wed, 24 Apr 2019 20:25:14 GMT

Seems my understanding is that tcp 3 way handshake happens in active stage ?

Need to confirm with you?

Re: Init session - Is TCP 3 way handshake gets completed here?

gwesson — Wed, 24 Apr 2019 20:31:56 GMT

Yep. When the first packet (a SYN for a TCP connection) is assigned a session ID it moves from INIT to Opening then almost immediately to Active.

You would be lucky to get a "show session id" output that has any of the transient states, they're super fast. Microseconds fast.