Java Control on the PA

[vikasvishwanath]

Hello

One of our client has the requirements to be able to able to monitor/control Java activity from users. I did a bit of check and found that in order to identify Java activity the following would need to be identified:

• File extension .class
• File extension .jar
• File extension .jnlp
• http response header content-type application/java$

The PA can currently identify the file types .class and .jar. Is there any reason why it does not identify jnlp files?

From my understanding:

> We would need to write a custom signature to identify jnlp files and the http response header

> Due to the 7 byte (min) restriction I am not sure how to identify jnlp files in an app signature. So this would need to be done as a data pattern matching signature

> The http response header can be identified in an application signature

I still have not got around to testing this in our lab. Just wanted to check if this is the right approach. Please feel free to correct/contribute to my understanding.

Thanks & Best Regards,

Vikas