https://live.paloaltonetworks.com/t5/next-generation-firewall/app-id/m-p/1226325#M5796 <P>Hello Techie,</P> <P>&nbsp;</P> <P>I've one generic query related to aap id feature, one of the PA docs says it requires 4packets or 2000bytes to identify any single applications where in live scenerio I do see see it works with only 1 single layer 7 packet(C2S/S2C) can identify the application though it was for dns traffic. Is it specific for UDP traffic.</P> <P>&nbsp;</P> <P>Thanks</P> <P>Gopal</P> Fri, 11 Apr 2025 08:09:07 GMT GopalMajumder 2025-04-11T08:09:07Z https://live.paloaltonetworks.com/t5/next-generation-firewall/app-id/m-p/1226325#M5796 <P>Hello Techie,</P> <P>&nbsp;</P> <P>I've one generic query related to aap id feature, one of the PA docs says it requires 4packets or 2000bytes to identify any single applications where in live scenerio I do see see it works with only 1 single layer 7 packet(C2S/S2C) can identify the application though it was for dns traffic. Is it specific for UDP traffic.</P> <P>&nbsp;</P> <P>Thanks</P> <P>Gopal</P> Fri, 11 Apr 2025 08:09:07 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/app-id/m-p/1226325#M5796 GopalMajumder 2025-04-11T08:09:07Z https://live.paloaltonetworks.com/t5/next-generation-firewall/app-id/m-p/1226610#M5801 <P>Hello,</P> <P>As you have discovered, some applications are identified quicker. This is due to the standard structure of a DNS packet, in this case.</P> <P>Regards,</P> Tue, 15 Apr 2025 19:01:04 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/app-id/m-p/1226610#M5801 OtakarKlier 2025-04-15T19:01:04Z