we have a Fortigate3100D v6.2.3 and we have a CheckMK-monitoring server running. The monitoring server sends always the same ping requests to a few destinations which cannot be monitored with snmp.
Sometimes it occurs that the result of monitoring shows packet losses of the monitored host. To have a second opinion we monitored the same destination with an other ping tool and the comparison shows that the destination host is reachable.
A view to the "FortiSessions" shows, that packetlosses at CheckMk appearing when the Fortigate declars the application as "PING" and not as "...Ping" (given in in the picture) Both traffics are "accepted" but the PING-session never contains transmitted packets and remains at "0B / 0B" in the statistics.
My questions are now:
1. Why can it occur that the same traffic is recognised as "unknown service" or as "network.service"
2. Does "Accept" in the traffic log (given in the picture) always mean, that the traffic is allowed?
3. Is a dependence possible between the classifying as unknown PING and transmitting no packets?
The fear is, that wrong classifiying also affects other traffic, e.g. datatransfer-protocols.
Regards from Germany,