What Does Application Incomplete Mean On Palo Alto?

What Does Application Incomplete Mean On Palo Alto?

Palo Alto firewalls flag traffic as Incomplete when session logs show a TCP or UDP connection that never produced usable application data. As of 2026, this remains one of the most common head-scratchers in Traffic logs—traffic appears to flow, but the firewall can’t identify what it is. Here’s the straight-shot fix and every fallback you’ll need.

What’s Actually Happening Here?

When Palo Alto logs show “Incomplete” in the Traffic log, two things usually explain it:

• The TCP handshake never finished (SYN, SYN-ACK, ACK never completed).
• The handshake finished, but neither client nor server sent enough data for App-ID to fingerprint the app.

As of 2026, the firewall still uses App-ID v3.0 signatures. Any flow delivering fewer than the minimum signature bytes (<128 B for TCP, <64 B for UDP) gets tagged “insufficient-data,” which shows up in the GUI as Incomplete in the App column.

How to Fix It, Step by Step

1. First, confirm the traffic is real

   • SSH into the firewall or open the CLI tab in the web UI.
   • Run show session all filter field app incomplete.
   • Note the Source Zone, Destination Zone, Source IP, Destination IP, Destination Port.

2. Check if the port is the problem

   If the destination port is a well-known one (80, 443, 3389, 5432, etc.) but the app is still unknown, the handshake may be completing while the payload stays too small.

   • Go to Objects → Services → Add.
   • Name it: Service-Override-Port.
   • Set Protocol to TCP or UDP.
   • Enter Destination Port: 80 (example).
   • Leave Source Port blank.
   • Click OK and commit.

3. Create an Application Override rule

   This tells the firewall, “Trust the port—don’t bother fingerprinting.”

   • Head to Policies → Application Override → Add.
   • Name it: AO-Port.
   • Pick the Source Zone where traffic enters.
   • Pick the Destination Zone where traffic exits.
   • Set Source Address to any.
   • Enter the server IP or range under Destination Address.
   • Choose the Service object you just made in step 2.
   • Set Action to Allow.
   • Use None for Profile Type (or your usual profiles).
   • Commit.

4. Increase the session timeout

   If the traffic is legitimate but slow to start (think MQTT keep-alive), give it more time.

   • Navigate to Device → Setup → Sessions → Session Timeout.
   • Change TCP/UDP Timeout from 30 to 60 seconds.
   • Commit.

Still Stuck? Try These Next Steps

• Look for asymmetric routing

  If packets take different paths in and out, the firewall never sees the SYN-ACK or data. Run show session all filter field src-addr client-ip and check the egress-interface column. If it’s different from the ingress, fix the routing or add a policy-based forwarding rule.

• Fire up a packet capture

  If you’re still unsure whether the handshake completes:

  • Go to Device → Packet Capture → Add.
  • Name it: TCP-port.
  • Set Type to Layer-3.
  • Pick the ingress/egress interface.
  • Use this filter: host client-ip and host server-ip and port port.
  • Capture for 30 seconds, stop, and download the .pcap.
  • Open in Wireshark, filter tcp.port == port, and look for SYN, SYN-ACK, ACK.

• Lower the App-ID signature threshold

  For custom or proprietary apps, you can relax the rules:

  • Go to Device → App-ID → Advanced → Minimum Bytes for TCP/UDP Fingerprint.
  • Change TCP from 128 to 64, UDP from 64 to 32.
  • Commit and test.

How to Keep This From Happening Again