About Froning

We seem to have a new h.225/h.323 scanning campaign going on that disturbs meetings. The strings that seem to be the same throughout are "productId: MERA RTU" and "versionId: 4.4.0-06a".   So I've tried two different methods of catching this traffic. Custom threat signatures and custom apps with the same pattern matched, but neither work. Here's a sample custom threat signature:   <vulnerability-threat version="6.1.0"> <entry name="42006"> <signature> <standard> <entry name="H323 productId MERA RTU"> <and-condition> <entry name="And Condition 1"> <or-condition> <entry name="Or Condition 1"> <operator> <pattern-match> <pattern>\x4d45524120525455\x</pattern> <context>unknown-req-tcp-payload</context> </pattern-match> </operator> </entry> </or-condition> </entry> </and-condition> <order-free>yes</order-free> <scope>protocol-data-unit</scope> </entry> </standard> </signature> <default-action> <alert/> </default-action> <threatname>H323 MERA Test 4</threatname> <severity>high</severity> <direction>client2server</direction> <affected-host> <server>yes</server> </affected-host> </entry> </vulnerability-threat> I've also tried matching with the versionId pattern (\x342e342e302d303661\x) or the word "MERA", both fail. Any idea how to catch this with a signature?   Here are the relevant parts of the pcap:   I've a case open with support, but our partner support can be slow...   Thanks, Will ... View more