Sophos firewall application classification errors

Hello rfcat,

Thank you for contacting the Sophos Community.

For issues related to Classification Errors, you would need to do a pcap capture, take a screenshot of the Log Viewer Application Filter so we can submit this to labs for them to analyze.

Regards,

Hi Emmanuel,

the thunderVPN is being investigated in another long running thread.

removed all unwanted results.

Where is the pcap output file stored?

Ian

Hello rfcat,

You need to capture the pcap capture.

Regards,

Hi Emmanuel,

that is not PCAP but tcpdump, how does that relate to using the PCAP in logviewer? PCAP in logviewer reports that it is capturing data, but never displays the data.

Ian

Hello rfcat,

So the command is the below, basically, it is a tcpdump save as pcap capture which then Labs uses the stream of data to analyze it.

# tcpdump -ni any host  x.x.x.x and host x.x.x.x -b -w /tmp/application.pcap -s0

The x.x.x.x would be the IP of the computer doing the request and the Public IP of the Destination.

Regards,

Thank you, I understand that, but that wan't the answer to the question about PCAP in logviewer.

I will try the tcpdump commands again and send you the files.

Ian

Thank you, I understand that, but that wan't the answer to the question about PCAP in logviewer.

I will try the tcpdump commands again and send you the files.

Ian