The sessions extensive command shows detailed per-session information on a VOS (FlexVNF) appliance — source/destination IP and port, protocol, application, byte/packet counters, session age, ingress/egress interfaces and VRFs, zones, the matched SD-WAN and access policy, and more. This article shows how to view that output and how to narrow it down on busy appliances.

1. View sessions for an organization

Run the command against the organization (tenant) you are interested in:

admin@VOS-cli> show orgs org TEST-Name sessions extensive

2. Filter the output with | select

On an appliance with many sessions the raw output is large. Pipe it through | select to display only the sessions matching a specific field value — for example, only the ICMP (predefined) application sessions:

admin@VOS-cli> show orgs org TEST-Name sessions extensive | select application icmp/(predef)
sessions extensive 0 2 46609
 source-ip                  10.73.36.16
 destination-ip             52.123.128.14
 source-port                1178
 destination-port           1178
 protocol                   1
 natted                     No
 sdwan                      No
 application                icmp/(predef)
 forward-pkt-count          5936
 forward-byte-count         166208
 reverse-pkt-count          5894
 reverse-byte-count         165032
 dropped-forward-pkt-count  0
 dropped-forward-byte-count 0
 dropped-reverse-pkt-count  0
 dropped-reverse-byte-count 0
 session-age                04:56:47
 idle-for                   00:00:01
 idle-timeout               10
 pbf-enabled                false
 forward-egress-vrf         TEST-Name-LAN-VR
 reverse-egress-vrf         TEST-Name-LAN-VR
 session-provider-zone      0
 forward-offload            false
 reverse-offload            false
 forward-ingress-interface  vni-0/10.2
 forward-egress-interface   vni-0/7.0
 reverse-ingress-interface  vni-0/7.0
 reverse-egress-interface   vni-0/10.2
 forward-fc                 fc_be
 reverse-fc                 fc_be
 forward-plp                low
 reverse-plp                low
 external-service-chaining  false
 is-child                   No
 parent-sess-id             0
 device                     ""
 source-sgt                 0
 destination-sgt            0
 source-zone                Intf-LAN1-Zone
 destination-zone           TEST-Name-LAN-VR-Zone
 session-start-time         "2026-06-10 06:16:39"
 rx-wan-ckt                 vni-0/10.2
 tx-wan-ckt                 vni-0/10.2
 tx-branch                  -
 forward-ingress-ckt        vni-0/10.2
 forward-egress-ckt         vni-0/7.0
 reverse-ingress-ckt        vni-0/7.0
 reverse-egress-ckt         vni-0/10.2
 forward-sdwan-rule-name    Load-Balance
 access-policy              Allow_From_Trust_Only_To_USA
 access-policy-action       allow

You can select on any field shown in the output, for example | select source-ip 10.73.36.16, | select destination-port 443, or | select protocol 1.

3. Large appliances (millions of sessions): use a session filter first

The | select filter is applied after the appliance walks the entire session table. On a box carrying millions of sessions this is expensive and the command can take a long time or load the system. Instead, install a server-side show session filter so only matching sessions are collected, then run sessions extensive.

Available filter operations

admin@VOS-cli> request orgs org TEST-Name filter-
Possible completions:
  filter-add     - Add show session filter
  filter-delete  - Delete show session filter
  filter-display - Display show session filter

Add a filter

Add a filter scoped to the traffic you want to inspect. The IP prefix must include the prefix length (for a single host use /32):

admin@VOS-cli> request orgs org TEST-Name filter-add filter-name <Filter-Name> source-ip 10.73.36.16/32

Confirm the filter is installed

admin@VOS-cli> request orgs org TEST-Name filter-display filter-name <Filter-Name>

Run sessions extensive against the filter

With the filter in place, only the matching sessions are returned:

admin@VOS-cli> show orgs org TEST-Name sessions filter <Filter-Name> extensive

Delete the filter when done

admin@VOS-cli> request orgs org TEST-Name filter-delete filter-name <Filter-Name>

Note:

  • Use | select for quick lookups on appliances with a normal session count.
  • On appliances with a very large number of sessions, always install a show session filter first so the appliance does not have to walk the entire session table.
  • Keep the filter as specific as possible (single source/destination IP, port, or application) to minimize the impact on the system.
  • Always delete the filter once you have finished collecting the required information.