A field technician's laptop at Meridian Electric Cooperative runs a messaging application configured to use a nonstandard TCP port instead of its usual default. Why is application control still able to identify and act on that traffic, unlike a rule that matched purely on destination port?
Select an answer to reveal the explanation.
Short Explanation
A firewall rule keyed to a port number only knows the number, not what's actually inside the traffic. Application control looks at the traffic's own behavior and protocol fingerprint, so it recognizes the messaging app whether it's running on its usual port or one the technician picked instead.
Full Explanation
Application control is built around signatures that examine characteristics of the traffic itself — protocol handshakes, packet structure, and behavioral patterns typical of a given application — rather than depending on which port number the session happens to use. That's precisely why moving an application to a nonstandard port doesn't hide it from application control the way it would from a policy that matches purely on port: the signature engine is still looking at what the traffic is doing, not just where it's going. The claim that application control ignores port numbers and relies only on source IP misstates the mechanism; source IP identifies the sender, not the application in use, and isn't how these signatures work. The claim that application control needs the documented default port to function is essentially the limitation the question describes application control as overcoming — it would make port-hopping an easy evasion technique, which is exactly what signature-based identification is designed to prevent. And application control doesn't depend on DNS filter results; the two are separate profile types evaluating different data. A caveat worth remembering: unusual traffic patterns can occasionally produce ambiguous or delayed identification for the first packets of a session. Confirm identification is working by checking the application control log for a session record naming the recognized application despite the nonstandard port.