Understanding Session Table Output: proto=6, duration, expire
An administrator runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?
Quick Answer
The correct answer is that a TCP session on port 443 has been active for 1 hour and will expire in 3599 seconds. This is determined by parsing the output of the `diagnose sys session filter dport 443` command, where `proto=6` indicates TCP, `duration=3600` shows the session has been live for 3600 seconds (one hour), and `expire=3599` means the session will be removed from the session table in 3599 seconds. On the Fortinet NSE 7 Advanced Security NSE7 exam, this command tests your ability to read real-time session table diagnostics, a critical skill for troubleshooting firewall behavior and understanding stateful inspection. A common trap is confusing `duration` with `expire`—remember that duration counts backward from session creation, while expire counts down to session deletion. For a memory tip, think of a one-hour parking meter: the time you’ve already parked is the duration, and the time left on the meter is the expire value.
⚠ Common exam trap
The trap here is that candidates may misinterpret 'expire=3599' as the session expiring soon or already expired, when in fact it indicates the remaining time before timeout, and the session is still active with a duration of 3600 seconds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A TCP session on port 443 has been active for 1 hour and will expire in 3599 seconds
The output shows a TCP session (proto=6) on port 443 with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds, meaning the session has been active for 1 hour and will expire in 3599 seconds. The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP established state, confirming an active TCP session.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session has expired and is being removed
Why it's wrong here
expire=3599 indicates it is still valid.
- ✗
A UDP session on port 443 is being blocked
Why it's wrong here
proto=6 is TCP, not UDP.
- ✗
The firewall policy is incorrectly configured
Why it's wrong here
No policy information is shown.
- ✓
A TCP session on port 443 has been active for 1 hour and will expire in 3599 seconds
Why this is correct
The session is established and in state 01 (established).
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator runs 'diagnose sys session filter dport 443' and sees the following output: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate?
hard- A.The session is a TCP session that has been idle for 1 hour
- B.The session is a UDP flow
- ✓ C.The session was established 1 hour ago and will expire in about 1 hour
- D.The session is in a half-open state
Why C: proto=6 indicates TCP. Fortinet's TCP state encoding: proto_state=01 means ESTABLISHED, not SYN_SENT. This session has been established for 3600 seconds (1 hour) and will expire in 3599 seconds (about 1 hour). Therefore, it is an established TCP session, not half-open.
Variation 2. An administrator runs 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?
medium- A.The session is a UDP flow
- ✓ B.The session is in TCP SYN_SENT state
- C.The session will expire in 3599 milliseconds
- D.The session has been idle for 3600 seconds
Why B: The output shows proto=6 (TCP) and proto_state=01 (SYN_SENT). However, a session with a duration of 3600 seconds cannot remain in SYN_SENT state; it would have timed out or transitioned to ESTABLISHED. Therefore, the output is contradictory and none of the provided options correctly describe the session. Option A is wrong because proto=6 is TCP, not UDP. Option B is wrong because a session alive for an hour cannot be in SYN_SENT. Option C is wrong because 'expire' is in seconds, not milliseconds. Option D is wrong because 'duration' is the total session time, not idle time.
Variation 3. An administrator runs 'diagnose sys session filter dport 443' and sees: proto=6 proto_state=01 duration=3600 expire=3599 What does this indicate about the session?
hard- A.The session is a UDP session
- B.The session is in TIME_WAIT state
- ✓ C.The session is in SYN_SENT state
- D.The session is in ESTABLISHED state
Why C: The output shows `proto=6`, indicating TCP. The `proto_state=01` corresponds to the TCP SYN_SENT state, meaning the session is in the process of establishing a connection. The `duration=3600` and `expire=3599` show the session has been active for 3600 seconds and will expire in 3599 seconds, which is typical for a session in SYN_SENT state that has not yet transitioned to ESTABLISHED. Therefore, option C is correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.