Interpreting proto_state=01 in FortiGate Session Table
You run the following command on a FortiGate:
diagnose sys session filter dport 443 diagnose sys session list
Output: proto=6 proto_state=01 duration=3600 expire=3599
What does the 'proto_state=01' indicate?
Quick Answer
The answer is that proto_state=01 indicates the session is in the 'init' state, meaning the first SYN packet has been seen but the TCP three-way handshake is not yet complete. This is correct because FortiGate tracks TCP session progression through specific state codes: 01 represents the initial SYN sent phase, where the client has initiated the connection but the SYN-ACK from the server has not been received. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your ability to interpret session table output for troubleshooting connectivity issues, often appearing alongside filters for specific ports like 443. A common trap is confusing proto_state=01 with an established session; remember that a fully established TCP connection shows proto_state=02 (post-SYN-ACK) or later states. For a quick memory tip, think "01 = One SYN sent, still waiting for the other side."
⚠ Common exam trap
Candidates often assume 'proto_state=01' means 'established' because they associate '1' with 'active' or 'open', but FortiGate uses a specific state numbering where '01' explicitly means the TCP handshake is incomplete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The session is in the 'init' state, meaning the first SYN packet has been seen but the handshake is not complete
In FortiGate session diagnostics, 'proto_state=01' for TCP (proto=6) indicates the session is in the 'init' state, meaning only the initial SYN packet has been observed and the three-way handshake has not yet completed. This is a transient state before the session transitions to 'established' (proto_state=02) once the final ACK of the handshake is received.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The session is fully established and in the 'established' state
Why it's wrong here
Established state is typically '02' for TCP (SYN-ACK seen).
- ✓
The session is in the 'init' state, meaning the first SYN packet has been seen but the handshake is not complete
Why this is correct
proto_state=01 indicates the session is being initiated (SYN seen).
- ✗
The session is a UDP or ICMP session with no state tracking
Why it's wrong here
UDP sessions have different state values; TCP state 01 is init.
- ✗
The session is being torn down (FIN or RST received)
Why it's wrong here
Tear-down states are typically '03' or '04'.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You run the following command on a FortiGate: `diagnose sys session filter dport 443` Output: `proto=6 proto_state=01 duration=3600 expire=3599` What does this output indicate?
hard- A.The session is for UDP port 443, is in state ESTABLISHED, and has 3599 bytes remaining.
- ✓ B.The session is for TCP port 443, is in state SYN_SENT, and has been active for 3600 seconds.
- C.The session is for TCP port 443, is in state TIME_WAIT, and will expire in 3600 seconds.
- D.The session is for TCP port 443, is in state FIN_WAIT, and will expire in 3599 seconds.
Why B: The output shows `proto=6`, which is the protocol number for TCP, and `dport 443` filters for destination port 443. The `proto_state=01` indicates the TCP state is SYN_SENT (state 1 in the FortiGate session table). The `duration=3600` means the session has been active for 3600 seconds, and `expire=3599` shows the remaining time in seconds before the session times out. Thus, Option B correctly interprets these fields.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.