Sessions not timing out
-
Not sure how much of an issue this is but i was checking on some connectivity today on my firewall (which was unrelated to this issue) and i noticed my guest network has 4 active states. This is odd because of the type of states that are still active
The two that stick out are the port 443. Why have these sessions been established for that long? There is also the other session to port 6009 which i know what those are - my wife company laptop which was on the network yesterday but as you can see there is still a session established for 24 hours even though the laptop is off the network.
PKTS/BYTES have remained the same so there is definitely no traffic seen for these states its just odd that they are still there and haven't timed out.
Any ideas?
-
@michmoor session timeouts are normally 24 hours.. After no traffic.. you can see when those are set to expire.. I would check that top one in 4 hours and 21 minutes ;) are the packets the same, if so then it should be expired then, see the EXP time.
-
@johnpoz Gotcha. Didnt think it was a problem just needed confirmation.
I just didnt expect these flows to still be active for 24hrs. I thought they drop after a few minute of inactivity to save on system resources.
-
@michmoor if you go to advanced, firewall and nat - at the bottom you can see the timeout values
-
@johnpoz
Yep i see those state timeouts. Thanks for confirming! Appreciate the quick assist -
@michmoor depending on your environment and traffic flows you could adjust those.. but its much less resources to just leave a state open then create a new one..
But depending on how many clients, what sort of traffic patterns, how many different connections they make.. You could run into a scenario where 24 hours might be too long and you run into state exhaustion. If that was the case you could adjust the default timeouts to try and mitigate such issues.
edit:
that being said normally when client is done with a conversation it would close the session with fin, fin,ack or even a RST.. Odd that its still open, but if the device is off and was removed from the network before it could close the session then yeah could stay open for 24 hours. Unless the other end closed it.
