UDP Application Mappings are not displaying names in NFA reports.

Document ID : KB000004260
Last Modified Date : 14/02/2018
Show Technical Document Details
Issue:

UDP Application Mappings are showing up like "UDP-65510" instead of the name defined when creating the application mapping.

udp.png

Environment:
NFA 9.3.3 and earlier.
Cause:

When you create an Application Mapping in NFA, it updates several database tables including application_mappings, protocol_domains, and protocol_definitions.

When you create a UDP Application Mapping it only creates an entry for TCP in the protocol_definitions and protocol_domains tables.  When data gets mapped to the new UDP application mapping, it will create an entry in protocol_definitions but doesn't create a corresponding row in the protocol_domains tables.  NFA attempts to get the names from the protocol_domains table, if there is no entry in the protocol_domains table, it uses whatever is in the protocol_definitions table which defaults to just the protocol and port number like 'UDP-65510".

Resolution:

1. Go to the NFA->Admin->Protocol Names page.

2. Click "Select A Protocol"

protocolname.png

 

3. Search based on "Port Number" and "UDP Ports"

portnumber.png

 

And find the problem destination port and select it:

 

4.  Once selected click "Edit Protocol" and update the "Protocol Name" field to what you want to be displayed and click Submit.

protocolConfig.png

 

5. Go back to the report and you should immediately see the new name reflected in your reports.

graph.png