Overview In Captive Portal scenarios, traffic flows through the Palo Alto Networks device for unidentified users. The traffic logs show an empty Source User ... Remove the 'n' from 'neq,' so that the filter appears as (user.src eq ''). Click the Apply Filter button (green arrow) to activate the filter. owner: kadak. Other users also viewed: