If you are using Palo Alto Firewalls it could be at times difficult to see whether or not packets are being dropped. If they are being dropped by a policy, you can see that in the traffic logs, but if they are being dropped do to illegal tcp operation, which could manifest itself from asymmetric packets (you see the syn come in zone A leave Zone B and return zone C,) the session has timed out, but the application is using a longer timeout and tries to use a dead session, or many other reasons.… Read more