"uknown" in session end reason?

m.horne · ‎07-31-2019

Have any of you seen "unknown" in the "session end reason" field?

PA-5220 running 8.1.8.

JulioMancia · ‎07-31-2019

I usually see unkown for incomplete TCP hanshake. What protocol/App is it?

m.horne · ‎07-31-2019

A bunch are UDP, so there is no handshake.

But some are TCP.

Some are >1Gb of data transfer.

It's all over the map.

JulioMancia · ‎07-31-2019

Premature session end on the DP's is the only thing that comes to mind, but that is only a guess.