topic Re: custom app-id for unknown TCP application in General Topics

custom app-id for unknown TCP application

SinOPtik — Thu, 28 Feb 2019 10:21:21 GMT

good day,

i know that answer might be simple but cannot find correct approach.

I have an application which identified as unknown-TCP and i have created pattern for it with few conditions.

now I have discovered that some devices behave different way and my pattern order not match, so I think to identify app based on first string in ASCII format.

for instance, I have following string in pcap:

My Agent 2.43 pour MSWIN32.

if i create such pattern as unknown-rsp-tcp-payload, it works. But I would like to avoid issue in case of other version for application, but when I use new pattern:

My Agent \d\.[\d]{0,}\s pour MSWin32

it fails to apply.

if I will convert everything to HEX, I am afraid to be depended on version number...

I am new to regex and would like to understand how to create these custom app-id, so please help.

Re: custom app-id for unknown TCP application

reaper — Thu, 28 Feb 2019 11:50:29 GMT

I'd give this a whirl

My Agent [0-9]\.[0-100] pour MSWin32

check out this areticlefor more information about RegEx

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/objects/objects-custom-objects/objects-custom-objects-data-patterns/data-pattern-settings#

Re: custom app-id for unknown TCP application

SinOPtik — Thu, 28 Feb 2019 12:01:47 GMT

Thankyou for reply!

returnes: can't handle two dfas next to each other in pattern

however, I have converted it to hex to exclude version from it, so now I have 2 HEX parts which I am trying to put in conditions...

probable it will work after I find how to add them normally.

🙂