How to Read diagnose sys session Output: Duration and Expire Fields
An administrator runs 'diagnose sys session filter dport 443' and sees: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?
Quick Answer
The answer is that the session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds. This is correct because the proto=6 field indicates TCP, while proto_state=01 specifically represents the established state in Fortinet’s session table, meaning the three-way handshake has completed and data can flow. The duration field shows the total time the session has been alive (3600 seconds), and the expire field shows the remaining idle timeout (3599 seconds) before the session is torn down if no further packets are sent. On the Fortinet NSE 7 Advanced Security NSE7 exam, this diagnose sys session output interpretation tests your ability to read real-time session diagnostics for troubleshooting firewall behavior, often appearing in scenario-based questions where you must differentiate between active, half-open, or closing states. A common trap is confusing proto_state=01 with a SYN state or misreading expire as total session lifetime—remember that expire counts down from the idle timeout, not from the session start. Memory tip: think of “01” as the number “1” for “established,” and duration is the age, expire is the remaining life.
⚠ Common exam trap
It's easy for candidates to confuse proto_state=01 with a SYN_SENT or timed-out state, or misinterpret proto=6 as UDP, because they do not memorize the TCP state codes or protocol numbers used in FortiOS session diagnostics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds.
The output shows proto=6, which is TCP, and proto_state=01, which indicates the TCP session is in an established state (TCP_ESTABLISHED). The duration=3600 means the session has been active for 3600 seconds, and expire=3599 means it will expire in 3599 seconds (i.e., the idle timeout is counting down). This is a standard TCP session in the established state, not a multicast or UDP session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session is a multicast session with a duration of 3600 seconds.
Why it's wrong here
proto=6 is TCP, not multicast.
- ✓
The session is a TCP session in established state that has been up for 3600 seconds and will expire in 3599 seconds.
Why this is correct
proto=6 means TCP, proto_state=01 typically indicates established state. Duration is the time since session creation, expire is the remaining time before the session is removed if idle.
- ✗
The session is in SYN_SENT state and has timed out after 3600 seconds.
Why it's wrong here
proto_state=01 is not SYN_SENT; it indicates established.
- ✗
The session is a UDP session that has been active for 3600 seconds.
Why it's wrong here
proto=6 is TCP, not UDP.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?
medium- ✓ A.The session has been active for 1 hour and will expire in about 1 hour
- B.The session is about to expire and will be removed soon
- C.The session is using UDP protocol
- D.The session is in a half-open state
Why A: The 'duration=3600' indicates the session has been active for 3600 seconds (1 hour), and 'expire=3599' shows the idle timeout remaining is approximately 1 hour. The proto_state=01 value indicates the session is in the INIT state (SYN sent, full handshake not yet complete); however, the duration shows it has been active for an hour, meaning this is a long-lived session that has not yet progressed to an established state—possibly due to no response. The key point is the duration and expire values, not the proto_state interpretation.
Variation 2. A FortiGate administrator sees the following output: "diagnose sys session filter dport 443 diagnose sys session list session info: proto=6 proto_state=01 duration=3600 expire=3599" What does this session duration and expire time indicate?
medium- ✓ A.The session has a timeout of 7200 seconds (2 hours)
- B.The session is about to be torn down
- C.The session is newly established
- D.The session is using UDP protocol
Why A: The session duration of 3600 seconds and expire time of 3599 seconds indicate that the session has been active for 3600 seconds and has 3599 seconds remaining before timeout. Since the total timeout is the sum of duration and expire time (3600 + 3599 = 7199, approximately 7200 seconds), this matches the default TCP session timeout of 7200 seconds (2 hours) on FortiGate. The 'proto_state=01' confirms a TCP session in established state, and the output shows the session is still valid with a long remaining lifetime.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.