This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About SRA
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About SRA
07-14-2016
123Posts
21Likes
17Solutions
Jul 14, 2016Last Visited
User
Activity
User
Profile
Latest posts by SRA
| Subject | Views | Posted |
|---|---|---|
| 3906 | 07-24-2013 02:49 PM | |
| 3930 | 07-24-2013 12:40 PM | |
| 3929 | 07-23-2013 01:44 PM | |
| 4042 | 06-24-2013 11:13 AM | |
| 2793 | 06-19-2013 03:36 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 06-24-2013 11:13 AM | |
| 1 Like | 06-05-2013 04:48 PM | |
| 1 Like | 09-13-2010 06:05 PM | |
| 1 Like | 04-15-2011 05:29 PM | |
| 1 Like | 08-15-2011 05:28 PM |
User Badges
Community Statistics
| Member Since | 05-24-2010 03:26 PM |
| Date Last Visited | 07-14-2016 11:19 AM |
| Posts | 123 |
| Total Likes Received | 19 |
07-24-2013
02:49 PM
The session vs. transaction option only matters when you have multiple conditions in the signature, and you want all of those be within a single transaction, or they can occur across transactions in a session. Have you taken a packet capture of the session to check if the patterns are indeed exactly the same as you used in the signature.
... View more
07-24-2013
12:40 PM
The entire session should be blocked, not just a few packets; unless the remaining packets are part of a different session. Also, from your original post it seems like the patterns don't appear in the session in all the editions of their product. Can you confirm from a packet capture that the patterns (either a header or URI) are indeed present in the session.
... View more
07-23-2013
01:44 PM
You can build a custom vulnerability or app signature to identify this traffic. To match on patterns in http request headers, you can use the http-req-headers context, and for matching patterns in URL you can use http-req-uri-path context.
... View more
06-24-2013
11:13 AM
1 Kudo
This does not appear to be a genuine or valid scenario. The scheme devised in the test assumes both the client and server are already under the control of the attacker. We aren't aware of any real-world clients or servers that can talk DNS initially and then switch to SSH. App-ID has coverage for many evasive real-world tunneling applications and we continue to add coverage for more as we discover them. We are currently reviewing this further, stay tuned for an update.
... View more
06-19-2013
03:36 PM
That's the right query. I just tried it on my PA-200 on PAN-OS 5.0.4-h1 and it works right. Are you trying this to the device via Panorama using the target parameter?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-14-2016
11:19 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks