What does the session flag 'br' indicate regarding the mode of traffic?

The session flag 'br' indicates that the traffic is being bridged. In networking, bridging refers to the process of connecting two or more network segments at the data link layer (Layer 2) of the OSI model. When traffic is bridged, it means that the packets are not being routed; instead, they are simply forwarded based on MAC addresses to the appropriate physical interface without any IP layer processing.

In the context of Fortinet's firewall, when packets are marked with the 'br' flag, it signifies that they are part of a bridged interface or a Virtual LAN (VLAN) setup, allowing for the seamless delivery of data between multiple network segments. This is particularly useful in scenarios where devices in different segments need to communicate as if they are on the same local network without being separated by an IP layer.

Understanding this flag helps in diagnosing and configuring network setups effectively, particularly in environments where bridging is utilized to extend network communication efficiently without the overhead of routing.