Incomplete Application

[infotech]

What does it mean when it saw the application is incomplete or insufficient data?  But the action is to allow it? I assume the traffic in and out for this unknow app and IP address has been allowed
 
 
 
 
 
 
 
 






 
 
 
 
 
 
 
 
 
 

[infotech]

That is correct bparker. The remote location is not a part of our network but of a vendor

[bparker]

I agree with Hulk at this point we probably could use a screenshoot of the logs from the monitor, or it may also be worth a call to support. Only other issue that might be coming to mind is if you are using application-default service and for some reason the vendor is not allowing viewing of ftp on the default port. Something like that could also cause the handshake not to complete giving you Incomplete application.

[infotech]

Good point bparker I will do that

[infotech]

[infotech]

I called in and got my question answer thanks for the info

[hvcomputech]

and the answer was...?

[reaper]

From the screenshot it looks like the session itself initiated on an accepted rule but no return traffic (0 bytes received) was ever seen.

this could be due to the server not responding or an asymmetric route sending the return packets over a different path.

The traffic is allowed as the syn packet hit a policy that allowed it to go out based on it's source/destination zones and port, but the session never completed appid so app based security policy could not be applied

if there was return traffic but we failed to properly identify the application the application would be set to "unknown-tcp" rather than incomplete.

For unknown-tcp we can apply policy based on application (so if you only have a web-browsing allow, unknown-tcp would be blocked as it is not an allowed application in your security policy)