At the NIP console, in real-time monitoring window can see flow, but can't see session.
Use Sniffer software analysis the data of the switch port which connects IDS monitor port, confirm whether the IDS monitor port can monitor to the complete session. As long as it can monitor to the complete session, it can be displayed at console.
The session in NIP is TCP session, it can be displayed after monitored to have completed to shake hands for three times. Several situations may be unable to monitor the complete session:
1, when mirroring port in switch, only mirrored a single direction flow;
2, asymmetric routing environment, namely the return path does not consistent.
3, image data brings with VLAN TRUNK (802.1 Q) mark, at present some ports of NIP can't identify the data with 802.1Q mark.