About undecided application.

[ttongfly]

Hello guys.

I have some question about APP-ID.

For session browser, PAN recognized application was UNDECIDED and traffic was passed and state was ACTIVE. so traffic was not dropped but why PAN could not recognized application properly and recognizing UNDECIDED that means PAN could not identified APP-ID for its traffic.

1. Why PAN could not recognized properly app-id and session browser showed app-id was UNDECIDED?

2. What is UNDECIDED mean exactly on session browser?

3. UNDECIDED application traffic has got a so many packets (of course this traffic over the 7 packets that could do identifying app-id)  and bytes. so I think PAN should recognize this traffic as a proper app-id.

Please let me know why did PAN recognize UNDECIDE as a app-id on session browser.

Thanks.

Regards.

Roh.

[mikand]

Undecided?

According to the admin guide an app can be "unknown" where the reason can be either "incomplete" or "insufficient-data".

Where "incomplete" means that a handshake took place but no data packets were sent prior to the timeout.

And "insufficient-data" means that a handshake took place followed by one or more data packets. However not enough data packets were exchanged to identify the application.

To fix this you can either create a custom appid or contact PA to make it into the common appid database:

You can request app enhancement from the Apps and Threats Research Center.

http://www.paloaltonetworks.com/researchcenter/tools/

From there you can click on Submit an app and provide details there.

In your case to answer why the PA didnt identify your traffic you would need to provide either the forum, or better, the appid request team with a pcap.

[ttongfly]

Hello mikand,

Thanks for reply.

As you wrote "insufficient-data' means that is not enough data packets for identifying the application. I think insufficient-data, not to be identified app-id, was undecided application on session browser.

However in my case, UNDECIDED traffic had got so many packets and data exceed over about 1.3GB on session browser. Its traffic could be insufficient-data? I suspect that.

When captured PCAPs, the traffic was recognized NFS protocol on wireshark.

Thanks.

Regards.

Roh.

[Kali]

Have you tried putting NFS protocol/App on your block list/filter?. Then try capturing sessions if "undecided" still shows up.

[paulocamargoagility]

Security Rule Behavior with Applications Allowed with Service 'Any'
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVmCAK

Why do Sessions Show Application "Undecided" When in ACTIVE State but have an App When Moved to DISCARD State?
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLK0CAO

These are the ones that helped me to understand it!