Interpreting diagnose sys session filter Output in FortiGate
You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?
Quick Answer
The correct answer is that this indicates a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds. This is because the `proto=6` field corresponds to the protocol number for TCP, while `dport=443` confirms the destination is HTTPS traffic; the `duration=3600` and `expire=3599` values directly show the session’s age and remaining lifetime in seconds. On the Fortinet NSE 4 Network Security Professional exam, you must be able to interpret `diagnose sys session filter` output quickly, as it tests your ability to read session state fields like `proto_state=01`, which is a TCP state code, and to distinguish between duration and expiry. A common trap is confusing `expire` with total timeout—remember that `expire` counts down, not up. For a quick memory tip, think of `proto=6` as “TCP on port 6” (though it’s actually protocol 6), and pair `duration` with “how long it’s been alive” versus `expire` with “how long until it dies.”
⚠ Common exam trap
Many candidates confuse protocol numbers (e.g., thinking '6' is UDP or ICMP) or misinterpret 'expire' as the time since expiration rather than the remaining time until expiration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is a TCP session to port 443 that has been active for 3600 seconds and will expire in 3599 seconds.
The output shows 'proto=6', which is the protocol number for TCP, and 'dport=443' indicates the destination port is HTTPS. The 'duration=3600' means the session has been active for 3600 seconds, and 'expire=3599' means it will expire in 3599 seconds. The 'proto_state=01' is a TCP state code, confirming this is a TCP session.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?
easy- A.The session is in a half-closed state
- B.The session is about to expire
- C.The session is a UDP session
- ✓ D.The session is active and established
Why D: The output shows `proto=6` (TCP), `proto_state=01` (TCP ESTABLISHED), `duration=3600` seconds, and `expire=3599` seconds remaining. This indicates a fully established TCP session that has been active for one hour and still has nearly a full hour of idle timeout remaining. Therefore, the session is active and established, making option D correct.
Variation 2. You run 'diagnose sys session filter dport 443' and see the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?
medium- A.The session is blocked by a firewall policy
- B.The session is a UDP connection to port 443
- C.The session is experiencing high latency
- ✓ D.The session is a TCP connection to port 443 that has been active for 1 hour
Why D: The best answer because the output shows proto=6 (TCP) and dport=443 (HTTPS). However, the duration=3600 and expire=3599 fields indicate the session has a total lifetime of 3600 seconds and has been active for only 1 second (duration - expire). The session will expire in 3599 seconds (about 1 hour). The option's wording 'active for 1 hour' is a common misinterpretation; the session has not yet been active for 1 hour, but it will expire in 1 hour. This is the most accurate among the given choices.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.