topic Traffic with no data (???) is denied in General Topics

Traffic with no data (???) is denied

ldormond — Fri, 09 Dec 2011 11:10:29 GMT

Hello,

I have a PA 2050 device that is configured to allow specified traffic (multiple rules) and one rule that deny all other traffic (at the bottom).

When looking at the "Deny all" rule, I can see a lot of packets that should be allowed by specific rules above that are denied with no data (see screenshot bellow). Is it normal ? And what does it mean that some packets have no bytes received and no bytes sent ?

Regards,

Laurent

Re: Traffic with no data (???) is denied

rmonvon — Tue, 13 Dec 2011 11:41:16 GMT

Yes, that is normal behavior. Your PA2050 will drop all packets that do not meet your explicitly allowed rules. Those packets may be the 1st SYN packet of a TCP handshake where the byte count is recorded as zero.

An explanation can be found here:

https://live.paloaltonetworks.com/docs/DOC-1549

Thanks.

Re: Traffic with no data (???) is denied

ldormond — Tue, 13 Dec 2011 15:33:46 GMT

Hi,

Thanks for your answer, however if you look at the "application" collumn, you can see that this is not one of the three definition tht you provided me, but "unknown-tcp".

Furthermore, as I said in my first post above, there are explicit specific rules for this traffic.

Regards,

Laurent

Re: Traffic with no data (???) is denied

rmonvon — Tue, 13 Dec 2011 17:59:24 GMT

Hi Laurent...My previous post was to answer the app=not-applicable where the bytes=zero. Unknown-tcp means the TCP traffic does not match any of our AppID signatures so the application is unknown.

Tthe traffic must have matched the TCP/UDP ports for your explicit rules but it does not match the applications that you specifically defined in those rules. However, the PA device does not have an app signature for the traffic and classified it as unknown-tcp.

Thanks.