In that case I would use best-match which would give jDownloader as final result. You can compare it to using your web-browser and visit youtube. Is it web-browsing or is it youtube? Actually its both (which you will see if you enable log on session start how the flow hops between applications). You can also search on "management" and "client-server" in applipedia to see various applications (runned on the client) and not applications as in which url is being visited. But sure in order to successfully identify jdownloader there has to be something to identify at. Useragent is one of the things (since its using http). Another thing could be, in combination with useragent, which headers are actually being used (present) and in which order? Perhaps chunked downloading is being used? Or multiple sessions towards the same ip address? and so on. There can also be secondary trigger points which can be used - in case the application phones home, similar to how skype is being identified (sure you can block skype with PA but to do this you are forced to allow skype-probe to pass through). With PA you can at least be sure that HTTP is allowed and nothing else. If you want to block which browser the client uses to download stuff over HTTP you need to apply whitelisting on the client computers (there are several products that does this on the market with various results, http://www.cryptzone.com/products/se46-application-whitelisting/ is one of them).
... View more
