Which of the following regarding protocol states is true?

The correct answer is D. proto_state=01 indicates an established TCP session. The proto_state field is actually a two‑bit bitmask where the bits track seen packet directions, but for TCP FortiGate only flips into 01 once the three‑way handshake completes and the session is fully established. UDP sessions never set those bits (they stay at 00), and ICMP…

Analyze and Troubleshoot FortiGate Operation

Question

Options

Aproto_state=10 indicates an established TCP session.
Bproto_state=00 indicates that UDP traffic flows in both directions.
Cproto_state=01 indicates one-way ICMP traffic.
Dproto_state=01 indicates an established TCP session.

How the community answered

(46 responses)

B
2% (1)
C
4% (2)
D
93% (43)

Explanation

The proto_state field is actually a two‑bit bitmask where the bits track seen packet directions, but for TCP FortiGate only flips into 01 once the three‑way handshake completes and the session is fully established. UDP sessions never set those bits (they stay at 00), and ICMP uses its own state machine. Seeing proto_state=01 in a TCP session listing always means that the TCP handshake has finished and the session is established.

Topics

#proto_state#TCP session state#session table#protocol flags

Community Discussion

No community discussion yet for this question.

Full FCSS_NST_SE-7.6 Practice