A long Session ID (or rather one wi

A long Session ID (or rather one with a great deal of variance) and a shorter validity period would make it far harder to succeed in a brute force attack.

How long would a brute-force attack on all possible Session IDs take?
Is the Session ID space large enough to prevent brute forcing? For example, is the length of the key sufficient when compared to the valid life-span?
Do delays between connection attempts with different Session IDs mitigate the risk of this attack?