Order of entries in the session browser or show session all command

Showing results for 
Search instead for 
Did you mean: 

Order of entries in the session browser or show session all command

L1 Bithead

Can anyone explain what order the session are in when viewing sessions in either the session browser or using the show session all command. For me, it is not obvious. Am I missing something?


Cyber Elite
Cyber Elite

Interesting question.

I would say there is no real apparent pattern, but it does seem to somewhat (and very loose interpretation) to say that the session browser is showing open/outstanding sessions that have not yet closed.  Whereas what started as a new session (WebEx) but not end for hours (because of audio/video, etc), but there is also other web-browsing and DNS sessions that start and stop, it appears that the list gets out of order.


BUT.. if you sort/filter on a specific application, you may sort of see a pattern emerge.



I would say, that my screen capture shows my .6 camera has established the longest/oldest connection on my FW.

Next followed by my .7 camera, newer by 2 secs.

But my .8 camera did not establish until  yesterday.


Then for the other 2 entries, it is a same app, but different rule, so again, oldest one is showing below the newest one.


So, maybe you need to create some filters around to see/interpret what I am saying.



Help the community: Like helpful comments and mark solutions

Thanks for the ideas but it did not work out like that for me. I filtered on SSL in the session browser and the start times were all out of order. Same thing with LDAP. 

Feel free to share out a few screen captures.


For us that volunteer our time, as customers of PANW, I am not sure we can provide a proper response.

I did my best effort, based on my FW sessions, but future experiences may be different.  😛

Help the community: Like helpful comments and mark solutions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!