Palo Alto Networks Knowledgebase: What do the NS, ND and NB Session Flags Mean?

What do the NS, ND and NB Session Flags Mean?

Created On 02/07/19 23:41 PM - Last Updated 02/07/19 23:41 PM


  • In the output of 'show session all',  some sessions will show a flag:
admin@anuragFW> show session all

16752 dns ACTIVE FLOW NS[57002]/Inside/17 ([54745])
vsys1[53]/Outside ([53])
16880 web-browsing ACTIVE FLOW *NS[51297]/Inside/6 ([53511])
vsys1[443]/Outside ([443])



The session flags are as follows:

  • NS (NAT Source) means the source address was translated.
  • ND (NAT Destination) means the destination address was translated.
  • NB (NAT Bidirectional) means both the source and destination addresses were translated.

Note:   A flag with an asterisk  *  indicates that the session was decrypted.



See also

View session statistics from CLI

Session states and types

Tips and Tricks: Session timeouts



owner: ansharma

  • Print
  • Copy Link

Choose Language