NBAR2 traffic Showing as Unrecognized

If devices are configured via the following admin guide Set up NBAR2 on Cisco devices and still facing the issue.

Unrecognized: An application that NTA is not able to identify based on information in the current NBAR2 database. This will mostly likely happen when NBAR2 is first enabled on a device and it begins sending flows before sending the applications database. This occurrence depends on the interval set in the device settings.

NTA monitors Network-Based Application Recognition (NBAR2) traffic. NBAR2 is an application classification system used with deep packet inspection technologies to provide better visibility into network traffic.

After you have enabled your devices to export NBAR2 flow records, you can view the Top NBAR2 Applications in summary views and reports.

When the NetFlow data is captured by NTA, the NBAR2 application classification may be unavailable or unknown to NTA. In this case, you may see one of the following identifiers for applications that are unidentified.

• Unknown — a Cisco application for which there is no classification available from Cisco.
• Unclassified— an application that is not supported or recognized by the NBAR engine on Wireless LAN Controller traffic and is captured as unclassified.
• Unrecognized — an application that NTA is not able to identify based on information in the current NBAR2 database. This will mostly likely happen when NBAR2 is first enabled on a device and it begins sending flows before sending the applications database. This occurrence depends on the interval set in the device settings.
• Remaining traffic — this is a standard label used on NTA charts to represent monitored traffic that is not applicable to any category presented on the chart.

You can monitor NBAR2 applications by switching the view type in the top-right corner of the Top XX Applications widget or from the NetFlow Applications Summary view. For more information about monitoring applications, see Monitor NBAR2 Applications in NTA.

You can go through the following Admin Guide for more details. NBAR2 Applications

 By Default, in NTA, the applications detected are based on the Application ID that the device vendor recognizes.

This is also indicated in NBAR2 Applications

So, now verify/test if the router sends the application info correctly through a packet capture tool like Wireshark.

If the router sends the application info correctly after checking/testing for the devices through a packet capture tool like Wireshark, then check the following.

The setting "PacketParserSettingsIsSourceIdMatchRequired" might have changed to True.

We can change it  back to false by going to advanced settings:

1. Log in to the SolarWinds Platform web console.
2. Navigate to https://<SolarWinds_URL>/orion/Admin/AdvancedConfiguration/Global.aspx.
3. Under advanced configuration, change the setting for NetFlow.Processing, search for PacketParserSettingsIsSourceIdMatchRequired.
4. Uncheck the setting (FALSE) and Save the change.