Made an account just to tell you guys the correct answer is A.
Application is first identified as SSL on port 443, then decrypted, then identified as web-browsing on port 443. Application identification changes due to app shift, but the port number doesn't!
Correct answer is A.
no, since ssl forward proxy is in place. ssl is getting "decrypted", and traffic is identified as web-browsing. app-id will be ssl initially but *shift*!
It is definitely "A". Just looked it up on a firewall:
show session all filter source 192.168.0.***
--------------------------------------------------------------------------------
ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])
Vsys Dst[Dport]/Zone (translated IP[Port])
--------------------------------------------------------------------------------
20714 web-browsing ACTIVE FLOW *NS 192.168.0.***[63325]/abc00/6 (***.***.***.***[35661])
vsys1 104.208.16.90[443]/def00 (104.208.16.90[443])
and looking more closely:
show session id 20714
Session 20714
c2s flow:
source: 192.168.0.*** [abc00]
dst: 104.208.16.90
proto: 6
sport: 63325 dport: 443
...
application : web-browsing
...
tracker stage firewall : TCP FIN
tracker stage l7proc : proxy timer expired
end-reason : tcp-fin
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Pacheco
Highly Voted 3 years, 10 months agokerberos
3 years agomannyvic
Highly Voted 4 years, 10 months agokraut
3 years, 3 months agoNazmulHossain
Most Recent 1 week, 1 day ago0d2fdfa
2 months, 1 week agoMarshpillowz
5 months, 3 weeks agoWoody
1 year, 7 months agofireb
2 years agoMeko
2 years, 1 month agoUFanat
2 years, 1 month agoWilliam88
2 years, 1 month agodatz
2 years, 1 month agoElvenking
2 years, 3 months agoAbuHussain
2 years, 3 months agoSyn1337
2 years, 4 months agokam1967
2 years, 9 months agorenzanjo
2 years, 8 months agoBighize
2 years, 8 months agoRJ45TP
2 years, 7 months agoBreyarg
2 years, 7 months agoLaithFraij
1 year, 4 months agoevdw
3 years, 2 months agovj77
3 years, 2 months ago