"uknown" in session end reason?

[m.horne]

Have any of you seen "unknown" in the "session end reason" field?

PA-5220 running 8.1.8.

[JulioMancia]

I usually see unkown for incomplete TCP hanshake.  What protocol/App is it?

https://docs.paloaltonetworks.com/cortex/explore/explore-schema-reference/long-field-descriptions/pa...

[m.horne]

A bunch are UDP, so there is no handshake.

But some are TCP.

Some are >1Gb of data transfer.

It's all over the map.

[JulioMancia]

Premature session end on the DP's is the only thing that comes to mind, but that is only a guess.