Difference between Session and Connection??

[BeaconBits]

Hello everyone,

I know that this question has answered before but allow me to say that even after reading it is still confusing.

Here I would like to know from 'Checkpoint' that what actually they mean about 'Connection' and 'Session'.

Any checkpoint guru please???

Regards,

B

[PhoneBoy]

A connection is a single TCP connection or virtual UDP/IP Protocol session.

A session provides context for those individual connections by correlating them together.

For example, looking at connections, I can see:

• Host X opened hundreds of connections on TCP port 443 to servers A, B, and C

Sessions correlated from the above connections tell you:

• Joe Roberts spent 1 hour using Facebook

Hope that helps.

[BeaconBits]

Hi Dameon,

Thanks for the explanation.

Do you mind explaning in more example? I'm more looking into what sort of information we can see in session that we can't see in Connection.

OR

Does a Session is a subset of the Connection?

Regards,

Shaiq

[PhoneBoy · Accepted solution]

A session is a collection (a superset) of connections.

A connection only tells you very basic things (layer 3-4 information) about a single TCP/UDP connection.

It does tell you how that single connection relates to others that have been seen from that same user/host. 

A session correlates what happens over several individual connections, including information from multiple blades (e.g. App Control, URL Filtering, Identity Awareness, etc) into a single log entry.

Through looking at thousands of individual connection logs manually, you could probably tell Joe Roberts spent an hour surfing Facebook.

A session log can show you this in a single log entry with the number of bytes transferred, an estimate of how long he spent, and so on, all correlated automatically. 

[fcamus]

Hi,

If users are connecting using VPN (cisco ASA) with ip pool configured instead of DHCP, the client IP will change after each disconnection (no DHCP lease). With wifi, this results in regular ip change for the clients.

So if session is based on ip source, saying "Joe Roberts spent an hour surfing Facebook." may not be correct.

Joe may have had several ip and these ip may have been reused by other user.

correct ? 

Regards,

Fred

[G_W_Albrecht]

You have to configure either a fixed Office Mode IP for each user (easily possible with CheckPoint GWs) or use Identity Awareness.

[bSingh]

Is that possible to check the number of sessions through the gateway via cli and gui.

[PhoneBoy · Accepted solution]

Best you can get are the number of connections on the gateway: fw tab -t connections -s.
There are four entries in the connections table for a single connection (more if NAT is involved). 
Sessions are correlated on the management side and we do not keep a count of them.

[Ahsan_Khan]

Hey 

Does enabling the session logging  - increase load on GW / logserver ? 

[Leandro_RD]

hi @Ahsan_Khan ,  did you get any answer to your question? I wonder the same.

[G_W_Albrecht]

This is a logical result, i would assume - and also the reason that it is disabled by default (and configurable in SmartConsole) since R80.20.