session browser source=0.0.0.0?

[LCMember2860]

seeing a lot of sessions in the session-browser with a source ip of 0.0.0.0 (in the internal "trust" zone) - these tend to be UDP protocols, RTP, bittorrent, skype etc and the session browser shows them not matching any rule or having any bytes.  Are these sessions in the process of being setup?

[emr_1]

I guess you are talking about PREDICT sessions.

These are not actual sessions, just predicting application.

It looks like a picture I attached.

Type FLOW is actual session.

Regards,

Emr

[KiCheon.Lee]

I am helped from your information.

Thanks.

I have a question about it.

There is a predict session in session-browser.

If a packet that match the predict session is no one. and this predict session is ended by session time-out.

Does FW write traffic log for this predict session or not?

Regards,

Cheon

[Retired Member]

Predict sessions are created due to ALG function in a particular application decoder. When a packet arrives which matches the predict session, it will be converted to a regular Flow session. Predict sessions do not generate a traffic log. But the resulting Flow session will.

Hope that helps.

-Richard

[KiCheon.Lee]

Thanks for your helps, Richard.