I haven't found the official definition, but from what I've concluded is
this means any traffic that was allowed through the firewall, but did
not form a complete connection. It might also be tied to the session
table timer. For example, if a device ...