topic Re: session browser source=0.0.0.0? in General Topics

session browser source=0.0.0.0?

LCMember2860 — Fri, 30 Mar 2012 09:25:04 GMT

seeing a lot of sessions in the session-browser with a source ip of 0.0.0.0 (in the internal "trust" zone) - these tend to be UDP protocols, RTP, bittorrent, skype etc and the session browser shows them not matching any rule or having any bytes. Are these sessions in the process of being setup?

Re: session browser source=0.0.0.0?

emr_1 — Fri, 30 Mar 2012 17:11:34 GMT

I guess you are talking about PREDICT sessions.

These are not actual sessions, just predicting application.

It looks like a picture I attached.

Type FLOW is actual session.

Regards,

Emr

Re: session browser source=0.0.0.0?

KiCheon.Lee — Wed, 30 Oct 2013 08:15:36 GMT

I am helped from your information.

Thanks.

I have a question about it.

There is a predict session in session-browser.

If a packet that match the predict session is no one. and this predict session is ended by session time-out.

Does FW write traffic log for this predict session or not?

Regards,

Cheon

Re: session browser source=0.0.0.0?

Retired Member — Thu, 31 Oct 2013 17:34:10 GMT

Predict sessions are created due to ALG function in a particular application decoder. When a packet arrives which matches the predict session, it will be converted to a regular Flow session. Predict sessions do not generate a traffic log. But the resulting Flow session will.

Hope that helps.

-Richard

Re: session browser source=0.0.0.0?

KiCheon.Lee — Fri, 01 Nov 2013 05:34:26 GMT

Thanks for your helps, Richard.