Sessions#

Monitoring → Sessions, at /sessions. Two views over one read of the router's connection-tracking table: the flows themselves, and the same flows aggregated by host.

It is read-only, apart from one action — see Turning accounting on, below.

How old the table is#

This is not a live stream. The conntrack table is read through the agent's op-mode cache, which answers with what it has and refreshes behind the answer, so what you are looking at was read some time before the response arrived.

The page says which. /api/sessions carries snapshotAgeMs, the age of the snapshot itself, and the dot beside the filter lights live only when that snapshot is under ten seconds old. Otherwise it says snapshot Ns old — and it can be minutes on the first read after the page has sat idle, because nothing was refreshing the cache while nobody asked.

Why a byte column can be empty#

The kernel counts a flow's bytes and packets only when nf_conntrack_acct is on, which this platform ships disabled — and only for flows that were created while it is on. A flow the kernel never counted has no counter at all.

So the columns are empty rather than zero. 0 here always means the kernel counted zero bytes; nothing measured is drawn as a dash, and the Bytes counted tile reads Not measured or None yet rather than 0 B.

Turning accounting on#

When the verdict is off, the page says so and offers a Turn accounting on button. It stages one line:

set system sysctl parameter net.netfilter.nf_conntrack_acct value 1

Nothing is applied until the Commit Bar commits it, like any other change.

After the commit, flows opened from that moment carry counters; the ones already open never will. The page says which is which rather than implying the table is now complete.

What the verdict is, and is not#

accounting.source says where the verdict came from:

Source	Meaning
`kernel`	Read from `/proc` on the router. Authoritative.
`config`	Read from the configuration, because the agent is off-router and cannot read that router's `/proc`.
`default`	Neither was available, so this is the platform's shipped setting.

Counters are never a source. A flow keeps the counter it was created with, and an established TCP flow can live five days, so counters left over from before the sysctl was switched off say nothing about the sysctl now. Reading the verdict off the counters is exactly how the page once reported accounting as on, with no banner and no command, for days after it had been switched off.

The two views#

Flows — one row per tracked connection: source and destination with ports, protocol, state, timeout, and the per-direction counters when they exist.

Top talkers — the same flows aggregated by host, with how many of that host's flows carry a counter. A host whose flows are all uncounted shows its flow count and a dash, not a zero.