ntp-tcp-Protocol-Signature Traffic

[Ihenock1011]

Hi All,

I have checkpoint r81.10 gateway and in my firewall log I get a lot of "ntp-tcp-Protocol-Signature Traffic" dropped traffic what is this service used for please help if it is a legit or not ?

Thanks

[G_W_Albrecht]

Who is sending this traffic ? NTP uses UDP, so the drop is understandable...

[Ihenock1011]

Users which is allowed internet access 

[G_W_Albrecht]

I would suggest to contact CP TAC to get an explanation!

[PhoneBoy]

NTP is used to synchronize clocks with a trusted time source, but it generally happens over UDP, not TCP.
A snapshot of the log card (with sensitive details redacted) would be helpful.

[Ihenock1011]

Dear @PhoneBoy kindly find the screenshot 

 

[Lesley]

Maybe a screenshot of 1 log entry?

Also maybe you made a custom application at one point that now is matching?

https://support.checkpoint.com/results/sk/sk103051

[PhoneBoy]

That's not a full log card, open up one of the log entries and send a screenshot (again with sensitive details redacted).