Hi jjpark,
I understand. Just, are you sure you indicate that this custom application is being sent by DIA or by the SD-WAN overlay?
I too have a case with TAC for this problem, I even see private traffic being categorized as "ms-office-365" or Custom Applications that have nothing to do with it.
I understand that it has already been done by TAC, but could you do a FIA Trace and share it? That way I can find out if it's the same for you as it is for me.
These are the commands you have to use:
debug platform condition ipv4 10.154.17.1/32 both (((Note: I understand that this is the IP of your application, if not, please put the IP of the application)))
terminal lenght 0
debug platform packet-trace packet 8192 fia-trace data-size 4096
debug platform condition start
[[[[[[[[[[[[[[[[[[Generate traffic against the application during a minute]]]]]]]]]]]]]]]]]]
debug platform condition stop
show platform packet-trace summary
show platform packet-trace packet all decode
The FIA Trace brings data from the NBAR categorization and the Traffic Data sequence in which this flow is matched.
It would also be great to have a PCAP of that flow and DNS resolution, since NBAR uses SNI (SSL) and DNS response.
