topic Re: insufficient-data and probe-skype Problems in General Topics

insufficient-data and probe-skype Problems

TigranGevorgyan — Thu, 30 Oct 2014 09:58:27 GMT

Hi Guys,

When I'm trying to monitor the traffic via Monitor tab on Palo Alto, i can see insufficient-data under Apllication tab(usin tcp protocol) and probe-skype(using udp protocol).

Who can explain me what means that two applications?I need more info about them.

Thanks

Re: insufficient-data and probe-skype Problems

HULK — Thu, 30 Oct 2014 11:38:01 GMT

Hello TigranGevorgyan ,

Insufficient data means that there was not enough data to identify the application. So for example, if the 3-way TCP handshake completed and there was one data packet after the handshake, but that one data packet was not enough to match any of our signatures, then you would see insufficient data in the application field of the traffic log.

If you open the traffic logs and analyze it in details, you will see the number of packets in each direction (server to client and client to server) will be very less.

Secondly, the skype-probe is an application for controlling the probing behaviour of Skype. It is working on a UPD protocol with dynamic port.

Reference DOC

Controlling Skype

Incomplete, Insufficient data and Not-applicable in the application field

Hope this helps.

Thanks

Re: insufficient-data and probe-skype Problems

hshah — Thu, 30 Oct 2014 12:36:21 GMT

Hi Tigran,

Please refer following document for insufficient-data app.

Incomplete, Insufficient data and Not-applicable in the application field

Refer following doc for SKYPE probe.

How to Block SKYPE

Regards,

Hardik Shah

Re: insufficient-data and probe-skype Problems

HULK — Thu, 30 Oct 2014 12:59:05 GMT

Few more related discussion threads for your reference:

Skype

Re: Skype & unknown traffic

Skype-probe rule catching other traffic

tcp

Hope this helps.

Thanks

Re: insufficient-data and probe-skype Problems

markk96 — Thu, 30 Oct 2014 21:02:23 GMT

Good luck controlling skype with the PALO, research using group policy if you are active directory on how to deploy policy to lock things down, this will help you with your attempt to use the PALO app IDS.

Re: insufficient-data and probe-skype Problems

TigranGevorgyan — Fri, 31 Oct 2014 13:14:34 GMT

Guys,

Thanks a lot for your support.I'll observe the documentation you gave to me to understand the issue better.

Huge Thanks

Tigran

Re: insufficient-data and probe-skype Problems

TigranGevorgyan — Fri, 31 Oct 2014 13:33:28 GMT

Guys i would like to clarify one of the Problems, that has happened this week.I received call from another company, they said that they noticed, that it seemed a udp scan or something like attack from our side.they had our real-ip.and they gave me an ip that we "wanted" to scan.In traffic logs i found the host from where went that traffic, in monitor log the protocol udp, application-Skype probe or insufficient-data.And that takes almost 1 week.then i have disconnect and reconnect the host internet and everything works now fine.Since the restarting the network everything is also ok on the other(other Firma's) side.

Who can help me to understand this mystery )

Thanks in Advance

Tigran

Re: insufficient-data and probe-skype Problems

HULK — Fri, 31 Oct 2014 13:48:15 GMT

Could you please let me know what host it was..? As you said "disconnect and reconnect the host internet and everything works fine".

Thanks

Re: insufficient-data and probe-skype Problems

TigranGevorgyan — Fri, 31 Oct 2014 13:57:09 GMT

Host is the Macbook of one of our developers.I reconnect the internet and Everything solved.

Re: insufficient-data and probe-skype Problems

HULK — Fri, 31 Oct 2014 14:12:51 GMT

Hello Tigran,

There is a possibility that one or more process on that Macbook was corrupted and it was flooding packets towards random public IP address. Did you check the utilization on that Mac before re-connect the internet..?

Thanks

Re: insufficient-data and probe-skype Problems

TigranGevorgyan — Fri, 31 Oct 2014 14:24:26 GMT

Hi Hulk,

Now i didn't check anything before reconnecting.But I think the user of that mac would shut down the device after working day.Is it possible, that the corrupted process continue work almost 1 week? how can i check utilization on that Mac?

Huge thanks

Tigran