EDR: Netconn Events Reporting UDP/8 or No Port

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why do some netconn events report UDP/8 or no port?

Environment

• EDR Sensor: 7.3.0

Resolution

The netconn events reporting as UDP/8 are ICMP traffic

Additional Information

• As of the EDR 7.3.0 sensor version it now gathers ICMP protocol events  
• Windows EDR 7.3.0 Sensor release notes     

                   CB-34952: Updated sensor to report ICMP/PING