topic NTP and Bittorrent traffic issue in VirusTotal

NTP and Bittorrent traffic issue

riza.emet — Mon, 06 Jun 2022 12:50:48 GMT

Hello and sorry for my poor English.

I wrote this question/feedback before here, but no one wrote an answer. I decided to share it here as well.

We are a member of pool.ntp.org

Our time server url is ntp.cbu.edu.tr

Beginning May 19th problem appeared on our NTP service. We started getting a lot of bittorrent requests. Of course, requests were denied. However, pool.ntp.org started reporting that we were not responding to ntp requests.

We captured the packets that PaloAlto detected as bittorrent. When we examined the packages, we could not see anything other than ntp traffic.

As a result, we think that PaloAlto mistakenly detected ntp traffic as bittorrent traffic.

If you want to examine it, I'm putting a file here that the packages we capture.

Thank you.

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: NTP and Bittorrent traffic issue

kiwi — Thu, 09 Jun 2022 09:37:26 GMT

Hi @riza.emet ,

The Community Feedback area is dedicated to questions about the LIVEcommunity.

In order to get better traction for your question I've moved it to the VirusTotal discussions area. This area is moderated by the threat team to check signatures and verdicts.

Cheers,

-Kiwi.

Re: NTP and Bittorrent traffic issue

Jerry748 — Fri, 10 Jun 2022 06:57:23 GMT

did you get any proper solution for this problem

Re: NTP and Bittorrent traffic issue

riza.emet — Fri, 10 Jun 2022 07:12:54 GMT

No, we haven't found it yet. However, we have opened a case to PaloAlto Support for the issue. We're waiting.

Re: NTP and Bittorrent traffic issue

mivaldi — Fri, 10 Jun 2022 17:35:36 GMT

Sorry but I don't believe this has anything to do with VirusTotal either. This forum is for non-customers. The Threat and Vulnerability forum may have been a better fit, however, posts in the LIVECommunity expect answers from other Palo Alto Networks customers. If you need a response from Palo Alto Networks Support, the correct avenue for help is filing a Support ticket.

Re: NTP and Bittorrent traffic issue

Adrian_Jensen — Fri, 10 Jun 2022 18:22:16 GMT

What is your Security policy for the incoming NTP traffic to your server? Are you using Application="ntp" and Service="application-default" in your allow rule? Or are you using a Service="udp_123" or something similar?

Re: NTP and Bittorrent traffic issue

riza.emet — Fri, 10 Jun 2022 18:38:13 GMT

We are using Application="ntp" and Service="application-default" in our allow rule.

Monitor show some udp-123 traffic "ntp", some udp-123 traffic "bittorrent". As expected bittorrent blocked but they are actually ntp.

Re: NTP and Bittorrent traffic issue

Adrian_Jensen — Fri, 10 Jun 2022 19:04:11 GMT

Seems like a false positive then. Looking thru my PaloAlto Apps and Threats release notes I don't see anything about bittorrent Application changes in the last year. I think you are going to have to get PaloAlto support to investigate/fix the false positive. If it is a serious problem for you, you could temporarily bypass the application filter and just allow UDP 123 in the mean time.

Re: NTP and Bittorrent traffic issue

mivaldi — Fri, 10 Jun 2022 19:42:18 GMT

I replayed your PCAP to my lab. I see NTPv4 traffic detected as ntp-base, and NTPv1 traffic detected as ntp-non-rfc. I don't see any bittorrent traffic, but I am running 10.2.2, maybe your PAN-OS identifies it differently. Check the source ports of the sessions identified as bittorrent, and compare them to your packet capture to see if there is a correlation between NTPv1 and bittorrent, versus NTPv4 and correct identifification of ntp-base traffic. It is possible that your firewall is detecting ntp-non-rfc as bittorrent.

Re: NTP and Bittorrent traffic issue

mivaldi — Fri, 10 Jun 2022 19:49:26 GMT

Also check if the misdetection began around March 15, 2022, that's when the change was pushed in Content. https://live.paloaltonetworks.com/t5/customer-resources/app-id-decoders-enhancement-plan/ta-p/469547

You can test adding ntp-non-rfc as an allowed app in your policy to see if it resolves the issue.

Re: NTP and Bittorrent traffic issue

riza.emet — Fri, 10 Jun 2022 19:47:51 GMT

Thanks for answer. I will compare.

Re: NTP and Bittorrent traffic issue

riza.emet — Fri, 01 Jul 2022 09:02:42 GMT

The problem to be fixed with App&Thread Update 8586. The release note says that false positive is fixed.

Thank you for your interest.