At a retailer, a record says the application peer-file-share was denied even though an older rule had allowed that TCP port. Which technology produced the deny?

Network application control that denied peer-file-share even though an older rule allowed the TCP port produced the deny. Network application control identifies the application and can deny it even when an older rule permitted the TCP port. The retailer record names peer-file-share and says that application was denied. The control that can express the application name is the one that made this decision. A stateful firewall that tracks the TCP connection but cannot name the application the session carried tracks the TCP connection. Tracking state tells you the connection is established and which port it uses. It does not name the application inside that connection, so it cannot be the source of a deny that cites peer-file-share. A NetFlow record that counts packets and bytes for the flow and carries no deny verdict counts packets and bytes. A flow record has no application deny. It would not say peer-file-share was blocked, and it would not refer to an older allow rule. A host antivirus pop-up that quarantined a file on the register after a known-bad hash match quarantines a file on the register after a known-bad hash match. It is not a network decision that names an application while a TCP port rule still allows the port. Exam caveat: an older permit for a TCP port can remain in the policy while application control denies the identified application. Operational check: find both the older TCP permit and the deny that names peer-file-share, and confirm they are separate rules.