topic App-ID RPC Syntax in General Topics

App-ID RPC Syntax

PeterT — Wed, 23 Dec 2015 21:02:56 GMT

So trying to further classify RPC data as the correct type of RPC data based on program number (300029 in this case). Not trying to re-invent the wheel though on how PA already correctly classifies it as RPC data, curious if there is a way in a custom App-ID to say something like "If known_existing_app AND XYZ then new_custom_app_ID", i.e. "If RPC and magic_bytes=300029 then Custom_App, not RPC". The existing RPC detection does a better job than I can ever hope to manually recreate off the top of my head, woud like to reutilize it. [and if not a way to reference it, there a way to look at the actual signature so I could copy it]

Re: App-ID RPC Syntax

reaper — Thu, 24 Dec 2015 07:25:46 GMT

When creating the custom app you can try setting the parent app to RPC, then look for the magic byte in the session/transaction.

That should allow most of the session to follow regular app-id into RPC and then only trigger the custom app once the magic byte shows up

regards

Tom

Re: App-ID RPC Syntax

PeterT — Thu, 24 Dec 2015 19:20:30 GMT

I was wondering if nesting worked like that, couldn't find any documentation on it. Will give it a shot and get back to you.