I've noticed an incomplate request to 111.111.111.111

[TigranGevorgyan]

Hi Guys,

On PAN's Monitor tab i've noticed that one of our hosts(user's computers) send periodically some packets to 111.111.111.111 and receive any packets.on Application tab it stays incomplete!what is the shit?Did anyone have the problem like this?what can i do for figuring this out? any idea?

Huge Thanks

Tigran

[gbogojevic]

Hi Tigran,

Incomplete means that either the three way TCP handshake did NOT complete or the three way TCP handshake did complete but there was no data after the handshake to identify the application. In other words that traffic you are seeing is not really an application.

So to explain a little clearer, if a client sends a server a syn and the Palo Alto device creates a session for that syn, but the server never sends a SYN ACK in response back to the client, then that session would be seen as incomplete. More information can be found here:

Incomplete, Insufficient data and Not-applicable in the application field

In addition , for example virustotal.com can provide you more information about specific IP address:

https://www.virustotal.com/en/ip-address/111.111.111.111/information/

[TigranGevorgyan]

HI gbogojevic,

Thanks for info. I've got all what you said to me, but i don't understand how can i sole this problem? maybe i should scan that computer for viruses?what do you think?

Huge Thanks

Tigran

[panos]

There seems to be a malware on the host.

[gbogojevic]

Hi Tigran,

Yes, you should scan the local computer. In addition, you can apply security profile (antivirus, antispyware, vulnerability and URL profile)  to the security policy that matches traffic from that specific host.

[TigranGevorgyan]

Hi Panos,

I also think so. what kind of programs or ativiruses do you advise to use in such situations?

Thanks

[TigranGevorgyan]

ok, Understood

Thank you so much.

[panos]

using security profiles for related traffic will be fine to secure.

You Still need to clean the host with a tool.

There are many 3rd party freeware tools you can find on the web.from details you can also see the vendors

https://www.virustotal.com/en/file/d2744a38a67fee26410d69d312d80d4802cc5112bfaedc50da8eb9ad7ee43fbe/...

[TigranGevorgyan]

Hi Panos,

I've observed https://www.virustotal.com/en/file/d2744a38a67fee26410d69d312d80d4802cc5112bfaedc50da8eb9ad7ee43fbe/...

this link and have a question.From Up come Antiviruses which Resulsts are in red colour, and then Antiviruses which results are in Green.

As i understand for example

Ad-Aware

Gen:Trojan.Heur.GM.050005010A

This Antivirus can't fixed this  Gen:Trojan.Heur.GM.050005010A trojan virus.

and Avast for example is up to date and can fix all viruses.

am i right?I use Avast, hope it'll help.

Huge thanks

[panos]

That was an example for a file which makes traffic to 111.111.111.111

if it is green then it cannot detect that trojan

As you see top Detection ratio: 8 / 54

[TigranGevorgyan]

As i understand, i should use the one of the top 8 Antiviruses to detect that trojan, am i correct?

[panos]

for that malware and for that update version yes.Maybe with a new update others will also see that file.Or maybe it is a false positive.

[TigranGevorgyan]

Ok, Thanks