getting traffic after the interface is down

[FarhanKoujalgi]

Hey guys hope you doing well I got a question I get a challenge one of my user getting traffic logs of NetBIOS by source Pvt IP from LAN to WAN the device from the source side is down the 2 Pvt IP still hitting the cleanup rule. The Policy is denied by the firewall but why do the traffic logs show the two source IP which is down from that side. is that any command to clear cache or something please help. and In-application is NetBIOS-ns.

[BPry]

@FarhanKoujalgi,

If you look at the detailed log information is the start_time actually associated with when these clients are known to be down? The logs are probably just session_end logs that are being generated after the firewall closes the session. 

[FarhanKoujalgi]

Dear @BPry 

The interface from the source side is down so why am I getting logs of netbios hitting to deny rule 

I check the logs time by the time it's generated in a gap of 2 5 minutes.

if that side of a link is down then why the firewall show us a log of netbios

[FarhanKoujalgi]

The interface from the source side is down so why am I getting logs of netbios hitting to deny rule 

I check the logs time by the time it's generated in a gap of 2 5 minutes.

if that side of a link is down then why the firewall show us a log of netbios

[Remo]

Is this a single firewall or a cluster? I agree it does not make sense that there are logs when the interdace is down, but did you really rule out any possibility of this? Was the interface effectively down or did it maybe come back already or at least for a short time? Did you check what @BPry asked for - check the detailed logs to see the start time? Is it possible that the start time was prior to the interface down? Was there maybe an application change in the connection - the firewall allowed a few packets, then the interface went down, then anwer packets reached the firewall wan side and them the firewall was able to see netbios so the connection was denied.