Managing Servers › How Servers Work › TCP Session Identification

TCP Session Identification

To enable the management console to accurately report application response times from the server, a monitoring device must be able to identify the server-side of a client/server TCP session. A monitoring device uses the following criteria to determine which of the two endpoints in a TCP session represents the server side:

• New TCP session. To identify the server-side in a new TCP conversation, the IP address that is the SYN recipient is checked against the server subnets definition. The IP address of the SYN recipient must be in one of the specified server subnets. Both the SYN and SYN-ACK must be observed.
• Existing TCP session (traffic for conversations where the TCP connection setup was not seen). If neither endpoint IP falls within the included range of one of the server subnets, then the conversation is ignored.

  If only one of the two IP addresses lies within the range of a server subnet, then that endpoint is presumed to be the server.

  If both IP addresses lie within the range of one or more server subnets and neither is recorded as a well-known application, the monitoring device assumes that the lowest port is the server.