topic Re: false detection of application since today 06:00am in General Topics

false detection of application since today 06:00am

Wolfgang — Mon, 21 Nov 2022 15:05:12 GMT

Starting today November 21. 06am (local time in Germany) we could observe a lot of false positives with application control/url filter. Most of legitimate traffic will be detected as "ExpressVPN". This application has risk level critical and will be blocked.

Interesting detail, only traffic related to proxy connections will be detect as "expressVPN". We can see this for connections proxy => proxy and between client and proxy

This view shows timeline of the application "expressVPN" only:

Anyone seeing same problem?

Re: false detection of application since today 06:00am

mp2012 — Mon, 21 Nov 2022 15:11:23 GMT

Hi,

I can confirm this, same behaviour here.

kind regards,

mp2012

Re: false detection of application since today 06:00am

the_rock — Mon, 21 Nov 2022 15:31:14 GMT

Trying to figure out if there is an easy way to test this in the lab with just one windows PC behind it...I did filter like below for 30 days in my lab and dont see anything, but will ask customer who runs app control to do it and see what they get.

blade:"Application Control" AND appi_name:ExpressVPN

Re: false detection of application since today 06:00am

_Val_ — Mon, 21 Nov 2022 15:33:58 GMT

Do you have a TAC case for this?

Re: false detection of application since today 06:00am

Wolfgang — Mon, 21 Nov 2022 15:35:38 GMT

@the_rock it's only seen with involved proxy, without no problem !

Re: false detection of application since today 06:00am

the_rock — Mon, 21 Nov 2022 15:37:22 GMT

Ah, gotcha...never mind then.

Re: false detection of application since today 06:00am

Wolfgang — Mon, 21 Nov 2022 15:48:06 GMT

TAC case is open, R&D is working on it. Told me ther's a known issue with the application database.

Re: false detection of application since today 06:00am

_Val_ — Tue, 22 Nov 2022 12:25:06 GMT

Is this resolved for you yet?

Re: false detection of application since today 06:00am

mp2012 — Tue, 22 Nov 2022 12:33:55 GMT

Hi,

for me problem is solved now (environment with proxies involved too).

kind regards,

mp2012

Re: false detection of application since today 06:00am

Wolfgang — Tue, 22 Nov 2022 12:55:54 GMT

@_Val_ problem is solved with an updated package for ApplicationControl/URLFilter from the last night. This was a little nightmare last day, because most of all Internet traffic was detected as "critical" and blocked. Teams, O365, sometimes www.google.de and a lot more.

Re: false detection of application since today 06:00am

_Val_ — Tue, 22 Nov 2022 13:36:09 GMT

I certainly understand, and I am sorry about it.