How is sliding sequence window made?


Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

L2 Linker

How is sliding sequence window made?



I found below on manual:

The Palo Alto Networks Firewall creates a sliding sequence window starting with the original ACK (the window size is based on the type of traffic within the session). It is expected that the packet sequence numbers within the current session reside within this sliding window. This window adjusts with the type of traffic and whenever new ACK messages are received. The default behavior on the device is to drop packets when sequence numbers are outside this window.


I want to know how 'sliding sequence window' is made.


The manual said it starts with the original ACK, but when I test something in my lab following is happened:

1 : SYN packet

2 : ACK with out of sequence -> passed

3 : RST with out of sequence(for packet 2) -> dropped


Pan os is 8.1, and all session setting was default. When I change asymmetric path to bypass, all of three packet is passed.

In this case, how sliding seq window is made? I think there's no original ACK in that..

Can anyone tell me what was the process in my situation?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!