04-24-2019 12:02 PM
Init session info
Does TCP 3 way handshake gets started and completed here?
04-24-2019 01:31 PM
Yep. When the first packet (a SYN for a TCP connection) is assigned a session ID it moves from INIT to Opening then almost immediately to Active.
You would be lucky to get a "show session id" output that has any of the transient states, they're super fast. Microseconds fast.
04-24-2019 01:19 PM
Init means it's not an active session. Full breakdown here:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk9CAC
Short answer: when a session ends, the session state retuns to INIT. You can still see the most recent session details that used that particular session ID until new traffic allocates that ID.
04-24-2019 01:25 PM
Seems my understanding is that tcp 3 way handshake happens in active stage ?
Need to confirm with you?
04-24-2019 01:31 PM
Yep. When the first packet (a SYN for a TCP connection) is assigned a session ID it moves from INIT to Opening then almost immediately to Active.
You would be lucky to get a "show session id" output that has any of the transient states, they're super fast. Microseconds fast.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
