10-19-2011 03:46 AM
Hi,
I have an issue wen my co-worker try to download a file from php.net.
I cannot find wich progam is called in my policies rules.
The file is available at : http(s)://pecl.php.net/get/oci8-1.4.6.tgz and cannot download it.
Thank you and sorry for my bad english
M.B
10-19-2011 12:08 PM
You could be hitting a threat(virus/vulnerability) so check your threat logs. Open a CLI and filter the session table for your IP.
> show session all filter source 10.10.10.10 state discard
This will give you an indication on what's going on when you're trying to download that file. You can then show the session id via the following:
rkalugdan@lab-54-PA-2020(active-primary)> show session id <value> <1-2147483648> Show specific session information
Regards,
Renato
10-20-2011 03:41 AM
Thank you for your great help Rkalugdan.
The session was identified as RSS application, is it a bug ?
I add RSS application in my policies and now it's work.
best regard
M.B
10-20-2011 06:12 AM
If there's a false positive involved, please open a ticket with PAN Support so that we can investigate further. If it is indeed a bug, our Threat Team will deploy the necessary fix in an upcoming release(threat/virus).
Regards,
Renato
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
