Palo_Alto_Networks
PCNSC · Question #45
A session in the Traffic log is reporting the application as "incomplete". What does "incomplete" mean?
The correct answer is A. The three-way TCP handshake did not complete. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC
Monitoring, Logging, and Reporting
Question
A session in the Traffic log is reporting the application as "incomplete". What does "incomplete" mean?
Options
- AThe three-way TCP handshake did not complete.
- BData was received but wan instantly discarded because of a Deny policy was applied before App
- CThe three-way TCP handshake was observed, but the application could not be identified.
- DThe traffic is coming across UDP, and the application could not be identified.
How the community answered
(46 responses)- A93% (43)
- C4% (2)
- D2% (1)
Explanation
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC
Topics
#application identification#TCP handshake#incomplete session#traffic logs
Community Discussion
No community discussion yet for this question.