📅 Tuesday, 30 September 2025
🕐 12:22 AM
diagnose sys session filter clear
diagnose sys session filter src
diagnose sys session filter dst
diagnose sys session filter dport
diagnose sys session list
Heres how to read it:
Top line:
session info: proto=6 proto_state=01 duration=5429 expire=3577 timeout=3600
-
proto=6 is TCP (17 = UDP)
-
proto_state=01 means traffic was established
-
duration = how long the session’s been up (sec)
-
expire = how long until timeout if idle
-
timeout = idle timeout threshold
Traffic stats:
org=1647940/1404/1 reply=58520/1119/1
-
Origin (src → dst): bytes/packets/errors
-
Reply (dst → src): bytes/packets/errors
Nexthop/Gateway:
gwy=
Translation (NAT/VIP):
hook=pre dir=org act=dnat ip1→ip2(ip3)
-
hook=pre → This is before forwarding (ingress into the firewall).
-
dir=org → The origin direction (client → server).
-
act=dnat → Destination NAT is being applied.
-
ip1 → Client IP and source port.
-
→ ip2 → Destination VIP the client thinks it’s talking to.
-
(ip3) → Actual backend IP/port after DNAT.
hook=post dir=reply act=snat ip1→ip2(ip3)
-
hook=post → After forwarding (egress).
-
dir=reply → Reply direction (server → client).
-
act=snat → Source NAT is applied.
-
ip1 → Real backend server sending the reply.
-
→ ip2 → Back to the client.
-
(ip3) → Source is rewritten to the VIP so the client thinks it’s still talking to .99.
Policy it has used:
policy_id=26 → firewall rule that allowed it