Almost all traffic identified as unknown-tcp?

Reply
L4 Transporter

Almost all traffic identified as unknown-tcp?

We are seeing some of our Palo's periodically logging (almost) all traffic as unknown-tcp.

 

As the traffic is being allowed through (and logged against) rules that do not allow it we assume this is a problem with the logs, rather than traffic being miscategorised.  However we do seem to be be experiencing some random issues that may, or mayt not be connected.

 

Rebooting the Palo seems to clear the problem.

 

Just wondering if anyone else has see this (we are 8.1.1) before opening a support call.

L7 Applicator

Re: Almost all traffic identified as unknown-tcp?

@apackard,

I've been running 8.1.1 on some lab equipment and at home for a bit and haven't seen this issue at all; further I haven't heard of anyone else experiancing an issue like this running 8.1.*. 

That being said you probably want to open a ticket simply to at least provide PA with the logs so that they can see why you are experiancing this issue. 

L0 Member

Re: Almost all traffic identified as unknown-tcp?

Did that the problem get fixed? 

Our customer is facing with the same problem as you. (ver. 8.1.1 , pa-3020.) 

As you said, rebooting the Palo seems to clear the problem.  

Highlighted
L4 Transporter

Re: Almost all traffic identified as unknown-tcp?

Fraid not - we're currently escalaing this with Palo.

 

In a way it's good to know others are impacted by this as we're being told it's never been seen before.

 

Interestingly for us we see this much more in our US locations - we have same hardware, same OS version, same rules in EU and Asia locations and we're seeing 90% less unknown trafic types being logged.

L0 Member

Re: Almost all traffic identified as unknown-tcp?

Checking to see if you ever heard back from TAC on this issue.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!