About mivaldi

Documented the solution in a Knowledge Base Article: How to implement DHCP Option 119 (Domain Search List) in a Palo Alto Networks firewall ... View more

@GlobalAxis what PAN-OS version are you running? ... View more

Why do you want to report it via email? ... View more

Also check if the misdetection began around March 15, 2022, that's when the change was pushed in Content. https://live.paloaltonetworks.com/t5/customer-resources/app-id-decoders-enhancement-plan/ta-p/469547   You can test adding ntp-non-rfc as an allowed app in your policy to see if it resolves the issue. ... View more

I replayed your PCAP to my lab. I see NTPv4 traffic detected as ntp-base, and NTPv1 traffic detected as ntp-non-rfc. I don't see any bittorrent traffic, but I am running 10.2.2, maybe your PAN-OS identifies it differently. Check the source ports of the sessions identified as bittorrent, and compare them to your packet capture to see if there is a correlation between NTPv1 and bittorrent, versus NTPv4 and correct identifification of ntp-base traffic. It is possible that your firewall is detecting ntp-non-rfc as bittorrent. ... View more