topic Re: iperf is always matched as unknown-udp/tcp in General Topics

iperf is always matched as unknown-udp/tcp

nicholasstone — Thu, 13 Apr 2017 09:48:18 GMT

Is there any reason why iperf traffic in either TCP or UDP is recognised as unknown-udp/tcp by the PAFW?

there is an app-id called 'iperf' but it never matches.

Re: iperf is always matched as unknown-udp/tcp

bradk14 — Thu, 13 Apr 2017 11:14:15 GMT

I just tried it using the iperf3 64 bit windows binaries from https://iperf.fr/iperf-download.php and it matches on 8.0.1

can you offer more specifics on what you're using?

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Thu, 13 Apr 2017 11:22:29 GMT

jperf 2.0.2

PAN-OS 7.1.7

testing with iperf now, however it shouldnt be any different as jperf is just a Java frontend.

Re: iperf is always matched as unknown-udp/tcp

TranceforLife — Thu, 13 Apr 2017 11:39:10 GMT

Can you please post the detailed traffic logs.

Re: iperf is always matched as unknown-udp/tcp

bradk14 — Thu, 13 Apr 2017 11:39:49 GMT

same result for me using jperf2.0.2 from the Google Code archive. your app/threat content is current? you are using the default port of 5001?

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Thu, 13 Apr 2017 11:51:51 GMT

Re: iperf is always matched as unknown-udp/tcp

TranceforLife — Thu, 13 Apr 2017 11:57:45 GMT

Some users did report weird stuff with app-id before so wondering if you can create a separate policy to allow iperf only as an application and test again.

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Thu, 13 Apr 2017 12:01:52 GMT

I thought the same as well, and ran that test with rule #1 being an iperf app-id rule

Re: iperf is always matched as unknown-udp/tcp

TranceforLife — Thu, 13 Apr 2017 12:09:50 GMT

Getting interesting isn't it :0 Reinstall app-id database possible in your environment? I guess this is the only one app at the moment that is not identified correctly?

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Thu, 13 Apr 2017 12:13:41 GMT

yea i can reinstall, its also the 2nd firewall in a completely different environment that ive seen this on.

yes, only iperf for now

Re: iperf is always matched as unknown-udp/tcp

TranceforLife — Thu, 13 Apr 2017 12:44:22 GMT

Now your issue is my issue:0

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Thu, 13 Apr 2017 12:49:01 GMT

just checking one more thing, however looks like apps and threats version 689-3957 has the fix, perviosly i was using the version released on the 30/3.

I did an upgrade in there somewhere too, so just waiting to test downgrade...

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Tue, 18 Apr 2017 00:00:01 GMT

hmm... better behaviour, but still weird.

default port 5001 works fine, however, 5201 and non-default ports get mapped to unknown-tcp

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Tue, 18 Apr 2017 10:10:10 GMT

did an upgrade to 8.0 for S&G and still no luck.

it seems that if i enable log on start i *might* get a match on iperf on port 5001, but then after disabling it works for a little while then stops.

This doesnt work for other ports.

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Wed, 26 Apr 2017 04:37:36 GMT

Ok, I have more interesting information that I would like to see if others can replicate.

when performing iperf test using iperf 3.1.3 from iperf.fr, every test that is greater than 9 and less than 100 sec is identified correctly. Anything elese is unknown.

iperf.exe -c {host} -t 9 --> NOT working

iperf.exe -c {host} -t 10 --> working

iperf.exe -c {host} -t 99 --> working

iperf.exe -c {host} -t 100 --> NOT working

its as if the encoder is expecting the -t switch to be 2 digits.

jperf still doesnt work on 5201....

Re: iperf is always matched as unknown-udp/tcp

TranceforLife — Wed, 26 Apr 2017 08:12:58 GMT

Ha! Interesting;0 Nice findings by the way. So it is something to with the app-id signature or the way the engine does an identification. Are you able to raise with TAC and share your findings?

Re: iperf is always matched as unknown-udp/tcp

nicholasstone — Wed, 26 Apr 2017 23:37:45 GMT

Yea I have a case open, but it seems to be niche, so im hoping others here can post if they seem the same behaviors