The article explains why the traffic is being classified under Default by PacketShaper
SAP traffic is being classified in Inbound/Default and Outbound/Default.
Run the commands traffic flow -tupxsfIC inbound/default and traffic flow -tupxsfIC outbound/default, and refer to the Flag column. If you see S or s, the traffic is asymmetric. The flag S indicates that the packet has SYN-ACK but no SYN, while s indicates that the packet has SYN without SYN-ACK. PacketShaper requires a complete TCP handshake for classification.
InAddr Port OutAddr Port Idle S Flags ClasI ClasO Svc
----------------------------------------------------------------------------------------------------
192.xxx.xx.xx 3215 10.0.xx.xxx 3452 33s X S /Inbound/Default /Outbound/Default -
192.xxx.xx.xxx 3600 10.0.xx.xxx 3449 36s H O S /Inbound/Default /Outbound/Default -
192.xxx.xx.xxx 3218 172.0.xx.xx 49180 52s H O S /Inbound/Default /Outbound/Default -
To avoid traffic being unclassified, you need to review the deployment and understand the packet path and route.