iperf is always matched as unknown-udp/tcp

Reply
L6 Presenter

Re: iperf is always matched as unknown-udp/tcp

Now your issue is my issue:0

 

iperf.PNG

 

iperf3.PNG

L2 Linker

Re: iperf is always matched as unknown-udp/tcp

just checking one more thing, however looks like apps and threats version 689-3957 has the fix, perviosly i was using the version released on the 30/3.

 

I did an upgrade in there somewhere too, so just waiting to test downgrade...

 

 

Highlighted
L2 Linker

Re: iperf is always matched as unknown-udp/tcp

hmm... better behaviour, but still weird.

 

default port 5001 works fine, however, 5201 and non-default ports get mapped to unknown-tcp

L2 Linker

Re: iperf is always matched as unknown-udp/tcp

did an upgrade to 8.0 for S&G and still no luck.

 

it seems that if i enable log on start i *might* get a match on iperf on port 5001, but then after disabling it works for a little while then stops.

This doesnt work for other ports.

L2 Linker

Re: iperf is always matched as unknown-udp/tcp

Ok, I have more interesting information that I would like to see if others can replicate.

 

when performing iperf test using iperf 3.1.3 from iperf.fr, every test that is greater than 9 and less than 100 sec is identified correctly. Anything elese is unknown.

 

iperf.exe -c {host} -t 9 --> NOT working

iperf.exe -c {host} -t 10 --> working

iperf.exe -c {host} -t 99 --> working

iperf.exe -c {host} -t 100 --> NOT working

 

its as if the encoder is expecting the -t switch to be 2 digits.

 

jperf still doesnt work on 5201....

L6 Presenter

Re: iperf is always matched as unknown-udp/tcp

Ha! Interesting;0 Nice findings by the way. So it is something to with the app-id signature or the way the engine does an identification. Are you able to raise with TAC and share your findings? 

L2 Linker

Re: iperf is always matched as unknown-udp/tcp

Yea I have a case open, but it seems to be niche, so im hoping others here can post if they seem the same behaviors

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!