When packet capture is used on a Cisco Secure Firewall Threat Defense (FTD) device and the packet flow is waiting on the malware query, the Snort verdict appears as " retry. " This indicates that the device is still processing the malware analysis and has not yet determined the final action for the packet.
The " retry " verdict signifies that the packet is in a holding state while awaiting the result of the malware inspection, which helps in maintaining the security posture until a definitive decision is made.
References:Cisco Secure Firewall Management Center Administrator Guide, Chapter on Packet Capture and Malware Inspection.