What are three reasons why an installed session can be identified with the "application incomplete" tag? (Choose three.)

Question

Options

• AThere was no application data after the TCP connection was established.
• BThe client sent a TCP segment with the PUSH flag set.
• CThe TCP connection was terminated without identifying any application data.
• DThere is not enough application data after the TCP connection was established.
• EThe TCP connection did not fully establish.

• A
  93% (26)
• B
  4% (1)
• D
  4% (1)

Explanation

Incomplete means that either the three-way TCP handshake did not complete OR the three-way TCP handshake did complete but there was no enough data after the handshake to identify the application. In other words that traffic being seen is not really an application. One example is, if a client sends a server a SYN and the Palo Alto Networks device creates a session for that SYN , but the server never sends a SYN ACK back to the client, then that session Insufficient data means not enough data to identify the application. So for example, if the three- way TCP handshake completed and there was one data packet after the handshake but that one data packet was not enough to match any of our signatures, then user will see insufficient data in the application field of the traffic log. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC

No community discussion yet for this question.