Identifying Reasons for Session Close in NSM
NSM supports the log reason for the session close feature. NSM displays the reason for session close so that you can differentiate session creation messages from session close messages. If you do not want the reason to display, you can explicitly configure the device not to display the field. Table 1 lists the reasons for session close that NSM identifies. Any session that cannot be identified is labeled OTHER.
Table 1: Session Closings
TCP connection torn down because of FIN packet.
TCP connection torn down because of RST packet.
Special sessions, such as PING and DNS, close when response is received.
ICMP error received.
Connection aged out normally.
ALG forced session close either because of error or other reasons specific to that ALG.
NSRP session close message received.
Session closed because of authentication failure.
Reason for close not identified.