https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/174349#M54791 <P>High amount of unknown-udp or unknown-tcp is main reason for high dataplane cpu as firewall has to use heuristics.</P><P>If this is in-house application then create custom app-id or use application override rules.</P><P>If this is general application then ask Palo to create app-id on their side.</P><P>If you see unknown-tcp in your users accessing regular internet then this is suspicious.</P><P>From ACC identify top user with unknown-tcp traffic and identify what application is causing it.</P> Fri, 01 Sep 2017 14:09:53 GMT Raido_Rattameister 2017-09-01T14:09:53Z https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/173391#M54580 <P>Hello all.</P><P>&nbsp;</P><P>We use pa-3020.</P><P>PanOS 7.1.5</P><P>&nbsp;</P><P>1, session 43%</P><P>2,CPU 100%</P><P>&nbsp;</P><P>Why CPU 100% used?</P><P>Normaly, 500Mbps use.</P><P>&nbsp;</P><P>BUG??</P><P>&nbsp;</P><P>I get show tech messages.</P><P>&nbsp;</P><P>:<BR />:Resource monitoring sampling data (per second):<BR />:<BR />:CPU load sampling by group:<BR />:flow_lookup&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 95%<BR />:flow_fastpath&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 91%<BR />:flow_slowpath&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 95%<BR />:flow_forwarding&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 95%<BR />:flow_mgmt&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 73%<BR />:flow_ctrl&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 73%<BR />:nac_result&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 95%<BR />:flow_np&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 91%<BR />:dfa_result&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 95%<BR />:module_internal&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 95%<BR />:aho_result&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 95%<BR />:zip_result&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 95%<BR />:pktlog_forwarding&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 96%<BR />:lwm&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp;&nbsp; 0%<BR />:flow_host&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; :&nbsp;&nbsp;&nbsp; 73%<BR />:</P><P>&nbsp;</P><P>:Resource utilization (%) during last 15 seconds:<BR />:session:<BR />: 42&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43&nbsp; 43<BR />:<BR />:packet buffer:<BR />:&nbsp; 2&nbsp;&nbsp; 1&nbsp;&nbsp; 2&nbsp;&nbsp; 1&nbsp;&nbsp; 1&nbsp;&nbsp; 1&nbsp;&nbsp; 9&nbsp;&nbsp; 3&nbsp;&nbsp; 3&nbsp;&nbsp; 2&nbsp;&nbsp; 2&nbsp;&nbsp; 1&nbsp;&nbsp; 1&nbsp;&nbsp; 1&nbsp;&nbsp; 3<BR />:<BR />:packet descriptor:<BR />: 16&nbsp; 16&nbsp; 16&nbsp; 15&nbsp; 16&nbsp; 15&nbsp; 17&nbsp; 16&nbsp; 16&nbsp; 15&nbsp; 16&nbsp; 15&nbsp; 16&nbsp; 15&nbsp; 16<BR />:<BR />:packet descriptor (on-chip):<BR />:&nbsp; 6&nbsp;&nbsp; 6&nbsp; 12&nbsp;&nbsp; 5&nbsp;&nbsp; 2&nbsp;&nbsp; 5&nbsp; 27&nbsp;&nbsp; 9&nbsp;&nbsp; 9&nbsp;&nbsp; 6&nbsp; 23&nbsp;&nbsp; 6&nbsp;&nbsp; 2&nbsp;&nbsp; 2&nbsp;&nbsp; 8</P><P>&nbsp;</P><P>Total num processes: 15<BR />Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CPU%&nbsp; FDs Open&nbsp;&nbsp; Virt Mem&nbsp;&nbsp;&nbsp;&nbsp; Res Mem&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; State&nbsp;&nbsp;&nbsp;&nbsp;<BR />all_pktproc_4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1221&nbsp;&nbsp;&nbsp;&nbsp; 100&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 51096&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9432&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; R&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />monitor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1223&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 53340&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 13132&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; R&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />dha&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1185&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 50968&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8100&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />all_pktproc_3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1219&nbsp;&nbsp;&nbsp;&nbsp; 100&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 51228&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9520&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; R&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />flow_mgmt&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1222&nbsp;&nbsp;&nbsp;&nbsp; 98&nbsp;&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 51068&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9124&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; R&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />mprelay&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1183&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 51048&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8320&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />pktproc_n_log&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1218&nbsp;&nbsp;&nbsp;&nbsp; 100&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 70896&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 29072&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; R&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />bfd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1186&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 10&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 51680&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8768&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />comm&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1184&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 19&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 560112&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 69492&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />sysdagent&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1164&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 520468&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4764&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />ntp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1235&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 76260&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2712&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />ehmon&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1165&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 29368&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4496&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />masterd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1120&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 18&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 201060&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 14948&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />all_pktproc_2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1220&nbsp;&nbsp;&nbsp;&nbsp; 100&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 51096&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9428&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; R&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />brdagent&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1161&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 440736&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8436&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR />syslogd&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1126&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp; 4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3396&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 988&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; S&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>Thanks.</P> Mon, 28 Aug 2017 09:31:25 GMT https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/173391#M54580 awawa100 2017-08-28T09:31:25Z https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/173402#M54582 <P>Hi,</P><P>&nbsp;</P><P>As you know, CPU usage depend of nobre of session but more than that, depend of:</P><P>&nbsp; &nbsp;- nbre of session open / close per second</P><P>&nbsp; &nbsp;- packet size</P><P>&nbsp; &nbsp;- and more ..</P><P>&nbsp;</P><P>Mean you can have only few session but if they are very short, with smal packet, is more CPU intensive than huge nombre of session with large packet and long duration in time.</P><P>&nbsp;</P><P>If you want to optimize CPU utilisation,</P><P>&nbsp; &nbsp;1- check which traffic create this high CPU usage</P><P>&nbsp; &nbsp;2- Try to create App overide&nbsp;</P><P>&nbsp; &nbsp;3- optimize security profile and logging feature</P><P>&nbsp;</P><P>Hope help.</P><P>&nbsp;</P><P>V.&nbsp;</P> Mon, 28 Aug 2017 10:02:24 GMT https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/173402#M54582 VinceM 2017-08-28T10:02:24Z https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/173419#M54585 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/64415">@awawa100</a>,</P><P>It appears simply processing your traffic is pegging the CPU. Without additiional informaiton it's really impossible to say what exactly is causing it and what could help you decrease the percentage.&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/5976">@VinceM</a>&nbsp;already gave some great advice, I would add that unless your CPU is staying pegged you could have just been hit with more traffic. Just because your session utilization is low doesn't mean your pps isn't high or the packet size isn't an issue. If this stayed pegged then I would look into it a little more.&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 28 Aug 2017 14:09:27 GMT https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/173419#M54585 BPry 2017-08-28T14:09:27Z https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/174047#M54730 <P>Thankyou!</P><P>&nbsp;</P><P>We use meny web-based protocol, but be judged "unknown_tcp" .</P><P>&nbsp;</P><P><SPAN class="short_text"><SPAN>I will investigate</SPAN></SPAN>.</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 31 Aug 2017 05:30:52 GMT https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/174047#M54730 awawa100 2017-08-31T05:30:52Z https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/174349#M54791 <P>High amount of unknown-udp or unknown-tcp is main reason for high dataplane cpu as firewall has to use heuristics.</P><P>If this is in-house application then create custom app-id or use application override rules.</P><P>If this is general application then ask Palo to create app-id on their side.</P><P>If you see unknown-tcp in your users accessing regular internet then this is suspicious.</P><P>From ACC identify top user with unknown-tcp traffic and identify what application is causing it.</P> Fri, 01 Sep 2017 14:09:53 GMT https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/174349#M54791 Raido_Rattameister 2017-09-01T14:09:53Z https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/174507#M54830 <P>Thank you.</P><P>&nbsp;</P><P>I found messages&nbsp;unknown-tcp&nbsp;and incomplete.</P><P>I will be some over-ride settings and more.</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 04 Sep 2017 03:45:53 GMT https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/174507#M54830 awawa100 2017-09-04T03:45:53Z https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/178222#M55494 <P><SPAN class="short_text"><SPAN class="alt-edited">It solved it.</SPAN></SPAN></P><P>&nbsp;</P><P><SPAN class="short_text"><SPAN>Thanks for your advice</SPAN>s.</SPAN></P> Fri, 22 Sep 2017 01:44:25 GMT https://live.paloaltonetworks.com/t5/general-topics/high-dataplane-cpu-at-panos-7-1-5/m-p/178222#M55494 awawa100 2017-09-22T01:44:25Z