topic unknown-tcp for Exchange 2016 when decrypted in General Topics

unknown-tcp for Exchange 2016 when decrypted

nikoo — Fri, 29 Mar 2019 13:57:51 GMT

Hi,

I'm doing decryption for Exchange 2013 OWA web part and it was doing good - was seeing mostly applications like ms-exchange, activesync, outlook-web which makes sense.

Customer upgraded their infrastructure to Exchange 2016 and after trying to decryot that I'm getting a bunch of unknown-tcp traffic after decryption instead of ms-exchange and/or outlook-web. Even for full length sessions with bunch of traffic. Activesync still seems to be recognized normally. Due to that had to allow unknown-tcp traffic in security policy as well, which is not great, but still better then not decrypting at all.

Decryption itself seems to be working fine, as there are no errors, same key was used on the new servers when migration was done.

Have anyone seen similar results?

Re: unknown-tcp for Exchange 2016 when decrypted

BPry — Fri, 29 Mar 2019 18:33:21 GMT

@nikoo,

I would guess that the app-ids simply haven't been expanded to fully support Exchange 2016 just yet. I would log a support case so they can verify that there isn't anything else going on and then raise the issue internally so the proper app-ids get expanded in a feature content update.

Re: unknown-tcp for Exchange 2016 when decrypted

nikoo — Mon, 08 Apr 2019 11:11:47 GMT

Indeed, that's why it is rather strange as I would guess the product is widely used and I would expect it to be recognized properly by this time.