topic Re: Windows Update Delivery Optimization (WUDO) Custom App-ID in Custom Signatures

Windows Update Delivery Optimization (WUDO) Custom App-ID

DonJarmon — Mon, 06 May 2019 17:07:36 GMT

Just seeking a Custom App-ID for Windows Update Delivery Optimization (WUDO).

Re: Windows Update Delivery Optimization (WUDO) Custom App-ID

EricHep — Fri, 02 Aug 2019 14:14:40 GMT

I second this - really surprised this is not already identified. Search for port 7680 in your logs and you're likely to see it come up a lot.

Re: Windows Update Delivery Optimization (WUDO) Custom App-ID

sebastianvd — Tue, 24 Nov 2020 08:31:45 GMT

any update on this one ?

Re: Windows Update Delivery Optimization (WUDO) Custom App-ID

Tim.Whittaker — Tue, 24 Nov 2020 13:41:19 GMT

For now I did a custom to tcp/7680 with the following sig that matches pretty consistently

Signature

Pattern Match

Context: unknown-req-tcp-payload

Pattern: \x0e 53 77 61 72 6d 20 70 72 6f 74 6f 63 6f 6c 00\x

Re: Windows Update Delivery Optimization (WUDO) Custom App-ID

claudec — Tue, 24 Nov 2020 15:52:55 GMT

Be aware that this byte pattern could possibly match anything that uses the swarm protocol, not just WUDO.

Re: Windows Update Delivery Optimization (WUDO) Custom App-ID

cjohnston_hill — Wed, 13 Mar 2024 20:05:01 GMT

Not to reopen a dead topic, but has there been any movement on this? We are still getting a large number of 7860 port requests from one VLAN to the next that are being dropped.