topic palalto-updates vs ssl in General Topics

palalto-updates vs ssl

herrmoss — Wed, 05 Apr 2017 14:40:37 GMT

After years of content update traffic showing up in traffic logs as paloalto-updates application, this traffic suddenly started showing up in traffic logs as ssl application. This all started at approximately 6:40pm Eastern time on 4/1/2017.

Has anyone else experienced this and if so do you have any idea why this is?

Re: palalto-updates vs ssl

TranceforLife — Wed, 05 Apr 2017 19:47:00 GMT

Hi,

Latest application database and still see as normal:

SSL is a parent app. So you can see that for the same session (initially was a dns request) application changed and has been identified by app-id as "paloalto-updates" in the end. Do you log the session at start, end or both? Maybe app-id doesn't have enough infro (data) to identified traffic as a paloalto-updates for some reasons.

Re: palalto-updates vs ssl

BPry — Thu, 06 Apr 2017 01:53:03 GMT

Likewise I'm seeing all of the traffic getting identified correctly.

Re: palalto-updates vs ssl

herrmoss — Mon, 10 Apr 2017 14:59:52 GMT

Thanks for the response.

We log at session end.

Looking at the traffic this morning it seems that everything went back to "normal" after a content update this past Friday, so your theory about app-id not having enough info seems to hold water.

Thanks again for responding.