It makes it more of an art form than a science reading the logs, because now you have to weed out the entries that say the traffic was allowed, but the application is incomplete. Since the firewall has to allow the traffic through until it can identify the application you get these somewhat confusing entries in the logs. The users tend to blame the firewall for things not working and you can't really tell them "the firewall allowed it" since that's not the definitive entry, for it may or may not have blocked it further along in the conversation.
... View more