Hello akawimandan~ As I told me,, For applications changing from one to another, Identification is done via protocol decoding in content inspection. as far as I know that PA has two engine(App-id, Content) When Someone connect facebook, Does always PA flow Content Engine,,? and than also I have another question~ I guess that unknown-tcp, unknown-udp, or non-syn-tcp. Finally, When PA check Heuristic Engine to know application eventually PA doesn't find application Does the traffic return to check [application signatures]? because, I think so, There are unknown-tcp, unknown-udp, or non-syn-tcp signatures ^_^;;; I don't know exactly App-id Engine I am also used to red uploaded documents by you
... View more
