Order of entries in the session browser or show session all command

[ChrisIsett]

Can anyone explain what order the session are in when viewing sessions in either the session browser or using the show session all command. For me, it is not obvious. Am I missing something?

[S.Cantwell]

Interesting question.

I would say there is no real apparent pattern, but it does seem to somewhat (and very loose interpretation) to say that the session browser is showing open/outstanding sessions that have not yet closed.  Whereas what started as a new session (WebEx) but not end for hours (because of audio/video, etc), but there is also other web-browsing and DNS sessions that start and stop, it appears that the list gets out of order.

BUT.. if you sort/filter on a specific application, you may sort of see a pattern emerge.

I would say, that my screen capture shows my .6 camera has established the longest/oldest connection on my FW.

Next followed by my .7 camera, newer by 2 secs.

But my .8 camera did not establish until  yesterday.

Then for the other 2 entries, it is a same app, but different rule, so again, oldest one is showing below the newest one.

So, maybe you need to create some filters around to see/interpret what I am saying.

[ChrisIsett]

Thanks for the ideas but it did not work out like that for me. I filtered on SSL in the session browser and the start times were all out of order. Same thing with LDAP. 

[S.Cantwell]

Feel free to share out a few screen captures.

For us that volunteer our time, as customers of PANW, I am not sure we can provide a proper response.

I did my best effort, based on my FW sessions, but future experiences may be different.  😛