topic Re: About undecided application. in General Topics

About undecided application.

ttongfly — Wed, 04 Jul 2012 05:38:29 GMT

Hello guys.

I have some question about APP-ID.

For session browser, PAN recognized application was UNDECIDED and traffic was passed and state was ACTIVE. so traffic was not dropped but why PAN could not recognized application properly and recognizing UNDECIDED that means PAN could not identified APP-ID for its traffic.

1. Why PAN could not recognized properly app-id and session browser showed app-id was UNDECIDED?

2. What is UNDECIDED mean exactly on session browser?

3. UNDECIDED application traffic has got a so many packets (of course this traffic over the 7 packets that could do identifying app-id) and bytes. so I think PAN should recognize this traffic as a proper app-id.

Please let me know why did PAN recognize UNDECIDE as a app-id on session browser.

Thanks.

Regards.

Roh.

Re: About undecided application.

mikand — Wed, 04 Jul 2012 06:15:09 GMT

Undecided?

According to the admin guide an app can be "unknown" where the reason can be either "incomplete" or "insufficient-data".

Where "incomplete" means that a handshake took place but no data packets were sent prior to the timeout.

And "insufficient-data" means that a handshake took place followed by one or more data packets. However not enough data packets were exchanged to identify the application.

To fix this you can either create a custom appid or contact PA to make it into the common appid database:

You can request app enhancement from the Apps and Threats Research Center.

http://www.paloaltonetworks.com/researchcenter/tools/

From there you can click on Submit an app and provide details there.

In your case to answer why the PA didnt identify your traffic you would need to provide either the forum, or better, the appid request team with a pcap.

Re: About undecided application.

ttongfly — Wed, 04 Jul 2012 07:37:18 GMT

Hello mikand,

Thanks for reply.

As you wrote "insufficient-data' means that is not enough data packets for identifying the application. I think insufficient-data, not to be identified app-id, was undecided application on session browser.

However in my case, UNDECIDED traffic had got so many packets and data exceed over about 1.3GB on session browser. Its traffic could be insufficient-data? I suspect that.

When captured PCAPs, the traffic was recognized NFS protocol on wireshark.

Thanks.

Regards.

Roh.

Re: About undecided application.

Kali — Fri, 06 Jul 2012 00:02:56 GMT

Have you tried putting NFS protocol/App on your block list/filter?. Then try capturing sessions if "undecided" still shows up.

Re: About undecided application.

paulocamargoagility — Tue, 13 Aug 2024 13:31:25 GMT

Security Rule Behavior with Applications Allowed with Service 'Any'
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVmCAK

Why do Sessions Show Application "Undecided" When in ACTIVE State but have an App When Moved to DISCARD State?
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLK0CAO

These are the ones that helped me to understand it!