Get count of half open tcp sessions

You may check the below link:

https://www.fortiguard.com/encyclopedia/ips/100663396

Hello nnair,

Thanks for your answer. How could the provided Link help me to answer my questions?

I'd like to know if the Fortigate can somehow provide a smarter protection than just limiting the pps count.

Also, how can I check the count of half open TCP sessions on a fortigate. Is this even possible?

Thank you!

Hi team,

if you set these thresholds too low, it can potentially impact legitimate traffic, causing it to slow down or even time out. This is especially true for features like connection limits, which can impact the number of concurrent connections allowed.

Hi @TheChosenOne 

You can get the session stats by the below command 

diagnose sys session stats

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards!

hi Team,

To  get the count of half opened connections from the fortigate.
Use the following command to display the count of half-opened connections:
get sys session list | grep "half-open"
This command retrieves the list of active sessions and then filters for entries with "half-open" in their description. It will show you the count of half-open connections.
Let us know if this has answered your query.

Hi nageentaj,

have you tried what you wrote me?
"get sys session list" has no description column where a "half-open" could appear. grepping for it will never bring any results.

I found out a
"diagnose sys session list"
has the information im looking for, but the output is huge.

diagnose sys session clear to clear a fliter that is leftover, maybe
diagnose sys session filter proto 6 to add a filter for TCP
diagnose sys session filter proto-state 02 to add a filter for SYN_SENT session state
diagnose sys session list to liste the sessions with the filter criteria from above. The last line of the results is the total number of sessions.

Would be nice if one could get this via API.