Forum Discussion
José_Ramón_Rodr
Nimbostratus
Mar 04, 2025What does session_id = 0 means in ASM session tracking?
We have an ASM policy with session tracking enabled and working fine and we noticed that several ASM logs hace a session_id equals to 0. We suspected some botnet source but we don't know what it's th...
Jmtaylor
Moderator
Nov 21, 2025
I found this information for your question
- Requests with session_id = 0 are typically:
- The initial request from a client before ASM sets its session cookie.
- Requests from clients/bots that do not accept cookies or do not process JavaScript (such as some automated bots, scrapers, or privacy-focused browsers).
- Requests where cookies have been cleared or blocked by the client.
- ASM will only start assigning a non-zero session_id after the client has accepted the ASM cookie and/or completed the JavaScript challenge for device ID.
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects
