Troubleshooting
Page 135
FortiRecorder 2.4.2 Administration Guide
Table 13:
IP session table
To refresh the session list snapshot with the most current list, click the dotted circle (
Refresh
)
icon to the left of
Records per page.
To sort the session list based upon the contents of a column, hover your mouse cursor over the
column’s heading then click the arrow that appears on the right side of the heading, and select
either
Sort Ascending
or
Sort Descending
.
If you expect sessions that do not exist, be aware that some protocol designs (notably UDP) do
not feature persistent sessions. Their sessions will almost immediately expire and be removed
from the session list, and therefore it may be very difficult to capture a session list snapshot
during the brief moment that the datagram is being transmitted. TCP features persistent
connections, where the socket is maintained until the data transmission either is confirmed to
Refresh
GUI item
Description
Protocol
The protocol of the session according to the
(or, for IPv6, “next header”) in the IP header of the packets.
•
icmp
— 1 (Due to the speed of ICMP messages, this will almost
never be seen in the session list.)
•
tcp
— 6
•
udp
— 17 (Due to the speed of UDP datagrams, this may be seen
in the session list only rarely.)
From IP
The source of the session according the source field in the IP header. If
source NAT is occurring, this is not necessarily the IP in the original
frame from the client.
From Port
The source port number.
For a list of port numbers that can originate from the FortiRecorder
NVR, see
.
To IP
The destination according to the destination field in the IP header. If
destination NAT is occurring, this is not necessarily the IP in the
original frame from the client.
To Port
The destination port number.
For a list of port numbers that can be received by the FortiRecorder
NVR, see
.
Expire (secs)
The session timeout in seconds. The expiry counter is reset when
packets are sent or received, indicating that the session is still active.
