Applipedia - search by port number?

[dagibbs]

Does anyone know if it's possible to search for an application by port number instead of name, to see if you can find a match?

I have some connections using an application that shows a known - and recognised - PORT number when I run a packet capture, vis-a-vis

12:49:53.009216 IP (tos 0x0, ttl 128, id 47750, offset 0, flags [none], proto: UDP (17), length: 260) www.xxx.yyy.zzz.epnsdp > someone.else.somewhere.net.62395: [udp sum ok] UDP, length 232

which shows the proocol as epnsdp (UDP 2051, which matches the descriptions I can find for this port by JFGI) but I can't find if there's already a defined application which I might be able to use for this traffic in a policy (rather than the app-override I've got now) before I bother PA with a request for a new application.

I don't want to go through all 1200-odd applications looking for this port so I can try applications and see if they match under some other name than what the guys using it know it as.

Hope this isn't as muddled as it sounds to me. Oh well. Maybe someone will have an idea.

Cheers

[kbrazil]

Hi there,

You can search applications by port in the Applipedia:  http://ww2.paloaltonetworks.com/applipedia/

I didn't find anything using port 2051.

Even if you did find a matching port, it may not be the same application since App-ID's don't use port numbers for the signatures.

If you allow the port through via security policy the firewall will still do App-ID so you can check the identified application in the logs.  If it comes up as "unknown-udp" then you will need to open a case to have the application added to in a future content release.  A PCAP may be requested to get the signature written.

Cheers,

Kelly

[dagibbs]

kbrazil wrote:
Hi there,
You can search applications by port in the Applipedia:  http://ww2.paloaltonetworks.com/applipedia/
I didn't find anything using port 2051.
Even if you did find a matching port, it may not be the same application since App-ID's don't use port numbers for the signatures.
If you allow the port through via security policy the firewall will still do App-ID so you can check the identified application in the logs.  If it comes up as "unknown-udp" then you will need to open a case to have the application added to in a future content release.  A PCAP may be requested to get the signature written.
Cheers,
Kelly

I gave up on this one and just put in an any/any rule to allow the traffic out - it's one weird app. I've got a single packet captured, so I might chuck it into an app request and see if one of the fellas with brains at PA can make head or tails or it.

Thanks.

[rob.burgoyne]

Thanks this helped out a lot!