Unknown App-ID

[yu_jie]

I noticed from Taffic Logs there are some App-ID that couldn't be found in Object (non-syn-tcp and incomplete). Is there any resources we can look for more description?

[panos]

Incomplete, Insufficient data and Not-applicable in the application field

[panos]

by default non-syn tcp is dropped.You probably changed the behaviour from zone protection or with command(global setting)

[panos]

Here is the detail about that

How to Determine the Number of Non-SYN TCP Packets Being Rejected?

Is it Possible to Allow Asymmetric Traffic from a Different Zone on a Palo Alto Networks Firewall?

How to Set the Palo Alto Networks Firewall to Allow non-Syn First Packet

[yu_jie]

Yes due to asymmetric routing in customer environment, we disabled "Reject Non-SYN TCP" in zone protection.

[panos · Accepted solution]

you cannot identify an application from non-stateful traffic.This is normal.