A session in the Traffic log is reporting the application as “incomplete.” What does “incomplete” mean?
A . The three-way TCP handshake was observed, but the application could not be identified.
B . The three-way TCP handshake did not complete.
C . The traffic is coming across UDP, and the application could not be identified.
D . Data was received but was instantly discarded because of a Deny policy was applied before App-ID could be applied.
Answer: B
Explanation:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC