The network sessions table is displayed on the Network sessions tab in the Network map section.
The network sessions table contains the following information:
ID is the network session identifier assigned in Kaspersky Industrial CyberSecurity for Networks.
Status – the network session status. A registered network session can have one of the following statuses:
Active. This status is assigned when a network session is registered and is retained as long as devices within this session send network packets.
Closed. This status is assigned to a network session if no network packets are sent during one minute within this session or if the network session detection technology is disabled on the corresponding node or monitoring point.
Side 1 – MAC and/or IP addresses of the first network interaction side. MAC and IP addresses can be enabled and disabled.
Side 1 port – port number of the first side of the interaction.
Side 2 – MAC and/or IP addresses of the second network interaction side. MAC and IP addresses can be enabled and disabled.
Side 2 port – port number of the second side of the interaction.
Device 1 – name of a device known to the application to which the address information of the first interaction side corresponds.
Device 2 – name of a device known to the application to which the address information of the second interaction side corresponds.
Transfer protocol – transport protocol used in the network session.
Application protocol – application layer protocol used in the network session.
Current speed – current data transfer rate in the network session.
Average speed – average data transfer rate in the network session.
Total transmitted – the number of bytes transmitted in the network session.
Monitoring points – names of the monitoring points that receive the network session traffic.
Start – date and time of the first network packet in the network session or the start date and time of the time interval which data is received from the EPP application.
Last interaction – date and time of the last network packet in the network session or the expiration date and time of the time interval which data is received from the EPP application (if only one packet is received in the network session, the value is the same as the Start value).
Number of packets – the number of network packets transmitted in the network session.
When exporting network sessions to JSON format, the file also contains lists of extracted protocol attributes (which the application can analyze using SQL queries in Network Anomaly Detection rules).