This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unclassified Traffic

Hello. What is the unclassified traffic that i see everyday (see attachment)? It is the most traffic that i have and don't know waht it is in a daily basis.
The firewall runs with version 9.307.

Regards

This thread was automatically locked due to age.

0 Scott_Klassen over 9 years ago

What is the unclassified traffic that i see everyday
It's traffic that hasn't been classified by the Application Control engine. Nobody here can get more specific than that, as the only information you've given is a screenshot that says unclassified. Use the Bandwidth Usage report to find your systems showing unclassified traffic, then figure out what's been running on those systems. Process of elimination.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 gband over 9 years ago

Hello. Thanks for the info. The strange is that everyday unclassified traffic is more than any other traffic (http,smtp). So i don't really know what is happening.
Anyway, I hope that Application Control engine will be improved and provide better reporting.
Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

ID34234 9.305 AFC problem with transparent mode

Still not fixed in 9.308.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 gband over 9 years ago

Hello. Using flow monitor i found unclassified traffic to sof01s11-in-f2.1e100.net. What host is this and why clients from the internal network contact him for?

Regards.
Cancel
Vote Up 0 Vote Down

Cancel
0 apijnappels over 9 years ago

https://support.google.com/faqs/answer/174717?hl=en

All kinds of Google servers are using this (reverse DNS name of the IP-address).

Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 gband over 9 years ago

Hello. Any news about this?
Is there a schedule?
Regards.
Cancel
Vote Up 0 Vote Down

Cancel
0 RegencyBlue over 3 years ago

Hi All, not meaning to hijack this post but we are trying to ascertain why Zoom traffic is considered unclassified traffic, also want to be able to make sure our Firewall passes all 8081 & 8082 traffic so Zoom conversations can occur fluidly.

So much packet loss according to Zoom statistics at the moment and we believe it is our Firewall.

Currently on 9.703-3...
Cancel
Vote Up 0 Vote Down

Cancel
0 Kaos over 3 years ago

I wouldn't really worry about it, it is just as stated, just unclassified network traffic. I see some as well.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 3 years ago in reply to RegencyBlue

Does the following help?

https://docs.microsoft.com/en-us/microsoftteams/prepare-network

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 RegencyBlue over 3 years ago in reply to BAlfson

Hi Bob,

Thanks for the reply but that article is about MS Teams and involves different port numbers, etc..

I've read through a lot of the articles on here and applied a few of the suggestions (throttling & DSCP etc) but we still get grainy and choppy calls.

Have a managed 200MB leased line with decent infrastructure internally to deal with everything. Just wondering what else I could be missing out... oh and Zoom traffic going over ports 8081 and 8082 still show up in unclassified traffic...
Cancel
Vote Up 0 Vote Down

Cancel