Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

Signature for Clash of Clans game

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Signature for Clash of Clans game

L4 Transporter

I built the attached custom application signature for the Clash of Clans game (previously identified as unknown-tcp) based on taking multiple pcaps and finding the first 7 bytes of the first 4 data packets appear to be constant across sessions. However, I have a rather limited test bed of one iPad accessing one clan at this time. Comments and refinements welcome.

4 REPLIES 4

L6 Presenter

are you trying to identify and block this app? or.... ?

I use this signature to positively identify the application as the firewall policy is configured to block all unknown-tcp and unknown-udp.

 

-David

 

L4 Transporter

Hi,

 

I also recently created a signature to identify that game. First, the protocol used is common to all Supercell games, not just Clash of Clans. I haven't seen a way yet to differentiate between the different games (not that I care about that). My signature was pretty similar to yours at first, but sometimes it would not match, like when an Android user needs to install an update for the game. I also sometimes see UDP traffic on the same port, after the game connects using TCP. I haven't been able to reproduce that traffic on my iPhone though. I suspect the UDP traffic is only used on Android clients. Also, I don't see any repeating pattern in it, probably because the negotiation happens in the TCP stream. I will try to get my hands on an Android device to reproduce the traffic.

 

Benjamin

This signature worked perfectly for me with Boom Beach, Thanks for sharing!

  • 10270 Views
  • 4 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!