How to identify app data vs differen in traffic recieved on app data

[fatboy1607]

Hi Guys,

Lets say I have application SAP that allows port 8443 but looks like APP-ID is not getting matched and we are getting insufficent data followed by deny rule , question is how can we look for difference between expected application data and difference we are seeing.

Just to approve application owners this is pattern we are looking for but we are getting following difference.

[reaper]

if the application is a well known application but is not matching app-id, there are usuually 2 possibilities:

- the developer took some 'liberties' with the implementation and now the app is not behaving like it would normally do, causing app-ID to treat this as anomalous (and a threat as it may be an evasion technique) and drop the session

- the app was updated and app-id signature has not been updated to match new bahavior, this would need to go through TAC to have the app updated

in both cases you'll want to packetcapture and see what the traffic looks like

on the firewall you can capture 'drop' stage so you;ll also be able to see at which point the firewall decides the session is no longer ok to keep processing

[MP18]

Thanks Reaper for answering the question.