https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280309#M75836 <P>I usually see unkown for incomplete TCP hanshake.&nbsp; What protocol/App is it?</P><P><A href="https://docs.paloaltonetworks.com/cortex/explore/explore-schema-reference/long-field-descriptions/panw-fields/long-panw-session_end_reason" target="_blank" rel="noopener">https://docs.paloaltonetworks.com/cortex/explore/explore-schema-reference/long-field-descriptions/panw-fields/long-panw-session_end_reason</A></P> Wed, 31 Jul 2019 14:23:53 GMT JulioMancia 2019-07-31T14:23:53Z https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280301#M75835 <P>Have any of you seen "unknown" in the "session end reason" field?</P><P>PA-5220 running 8.1.8.</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="unknown-session-end-reason.png" style="width: 367px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/20838iEA0FAD28F5C448B8/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="unknown-session-end-reason.png" alt="unknown-session-end-reason.png" /></span></P> Wed, 31 Jul 2019 14:09:26 GMT https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280301#M75835 tmhorne 2019-07-31T14:09:26Z https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280309#M75836 <P>I usually see unkown for incomplete TCP hanshake.&nbsp; What protocol/App is it?</P><P><A href="https://docs.paloaltonetworks.com/cortex/explore/explore-schema-reference/long-field-descriptions/panw-fields/long-panw-session_end_reason" target="_blank" rel="noopener">https://docs.paloaltonetworks.com/cortex/explore/explore-schema-reference/long-field-descriptions/panw-fields/long-panw-session_end_reason</A></P> Wed, 31 Jul 2019 14:23:53 GMT https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280309#M75836 JulioMancia 2019-07-31T14:23:53Z https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280316#M75837 <P>A bunch are UDP, so there is no handshake.</P><P>But some are TCP.</P><P>Some are &gt;1Gb of data transfer.</P><P>It's all over the map.<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="unknown-session-end-reason2.png" style="width: 477px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/20839iDCD6FB838FA0CF4E/image-size/large/is-moderation-mode/true?v=v2&amp;px=999" role="button" title="unknown-session-end-reason2.png" alt="unknown-session-end-reason2.png" /></span></P> Wed, 31 Jul 2019 14:30:48 GMT https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280316#M75837 tmhorne 2019-07-31T14:30:48Z https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280317#M75838 <P>Premature session end on the DP's is the only thing that comes to mind, but that is only a guess.</P> Wed, 31 Jul 2019 14:54:02 GMT https://live.paloaltonetworks.com/t5/general-topics/quot-uknown-quot-in-session-end-reason/m-p/280317#M75838 JulioMancia 2019-07-31T14:54:02Z