Custom Application and TAC

[ghostrider]

Hello 

Can I request to TAC to create custom application or I have to do by my self? I found this but I guest it is for public application not for internal.

http://researchcenter.paloaltonetworks.com/submit-an-application/

[ghostrider]

@reaper thanks. what about client server applications (tcp/udp) custom applicaitons, there is any parent tcp/udp application like web-browsing for web-application?

Also for build custom application in a rule, should I ask application to check all the funtionalities of application while doing the packet capture? I mean how much traffic need to pass for the rule to build custom application. Appreciated your recommendation

[reaper]

have you checked out these articles ? 

Getting Started: Custom applications and app override

Tips & Tricks: Custom Vulnerability

the amount of data needed for your custom application depends on how your app was created

normally AppID kicks in before the first 2000bytes/8packets but for web-based applications, AppID keeps scanning longer so if your application can only be identified by some string of data in the payload of a web-based session, you can use that to trigger. You will need to decide how long your packetcapture needs to be to get to the information you want to use to create a custom app as in the end you decide which 'string' will need to be matched

[ghostrider]

@reaper The system automatically doing the packet capture for unknown-tcp. Is that capture sufficient for make custom app? 

[reaper]

maybe 🙂 it will capture the packets it cannot identify which will likely contain the signature you want to be looking for, but I would recommend setting up a proper packetcapture to make sure you have a good view of what packets are exchanged and the payload therein