https://live.paloaltonetworks.com/t5/custom-signatures/app-id-through-ssl-client-hello/m-p/595901#M512 <P>Dear All,</P> <P>i have gone through packet capture to create an App-ID for the the bellow traffic :</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MEDOCHEMIE_0-1724654153742.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/61716iD3573F9D5E3227A2/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="MEDOCHEMIE_0-1724654153742.png" alt="MEDOCHEMIE_0-1724654153742.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MEDOCHEMIE_1-1724654226734.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/61717i74635DFFF6D14BCD/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="MEDOCHEMIE_1-1724654226734.png" alt="MEDOCHEMIE_1-1724654226734.png" /></span></P> <P>I don't get the respective traffic translated though.</P> <P>Any thoughts why?</P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 26 Aug 2024 06:38:22 GMT MEDOCHEMIE 2024-08-26T06:38:22Z https://live.paloaltonetworks.com/t5/custom-signatures/app-id-through-ssl-client-hello/m-p/595901#M512 <P>Dear All,</P> <P>i have gone through packet capture to create an App-ID for the the bellow traffic :</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MEDOCHEMIE_0-1724654153742.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/61716iD3573F9D5E3227A2/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="MEDOCHEMIE_0-1724654153742.png" alt="MEDOCHEMIE_0-1724654153742.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="MEDOCHEMIE_1-1724654226734.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/61717i74635DFFF6D14BCD/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="MEDOCHEMIE_1-1724654226734.png" alt="MEDOCHEMIE_1-1724654226734.png" /></span></P> <P>I don't get the respective traffic translated though.</P> <P>Any thoughts why?</P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 26 Aug 2024 06:38:22 GMT https://live.paloaltonetworks.com/t5/custom-signatures/app-id-through-ssl-client-hello/m-p/595901#M512 MEDOCHEMIE 2024-08-26T06:38:22Z https://live.paloaltonetworks.com/t5/custom-signatures/app-id-through-ssl-client-hello/m-p/595997#M513 <P>have you tried putting dsadata.intel.com instead of the hex ?</P> Mon, 26 Aug 2024 23:04:10 GMT https://live.paloaltonetworks.com/t5/custom-signatures/app-id-through-ssl-client-hello/m-p/595997#M513 reaper 2024-08-26T23:04:10Z https://live.paloaltonetworks.com/t5/custom-signatures/app-id-through-ssl-client-hello/m-p/596016#M514 <P>yes i did and i get the same result.</P> Tue, 27 Aug 2024 06:17:16 GMT https://live.paloaltonetworks.com/t5/custom-signatures/app-id-through-ssl-client-hello/m-p/596016#M514 MEDOCHEMIE 2024-08-27T06:17:16Z