About bhayes

     I have a warehouse management system, and I need to identify the traffic from the WMS client.  Here is a section of the tcp stream from a packet capture: V103^46^^~0~~0~~-1^=^002050^get encryption information V103^45^45736^0^0^^1^1^s^~name~4~4~name~name~^S4^none V104^73^2^^^66^^^~0~~0~~-1^=^002306^list comp versions where base_prog_id = 'Dlx' I found a pattern unique to the client that is presented at  login.    So, I created a custom app and set the signature to look for the  following pattern:   .*(list comp versions where base_prog_id = 'Dlx')     , which I applied to the 'Session' scope.       This signature successfully matches the client logins.  Unfortunately, once logged in, additional new connections initiated from the client are  identified as 'unknown tcp', presumably  because they do not contain the login pattern. Unfortunately, there does not appear to  be anything consistent that I can create a single pattern for to  identify every piece of data sent.  I would have thought that finding a  match at login and identifying the traffic to the 'session' once would be sufficient.   I opened a case with support a week ago, but they are not going to help.   Any ideas or suggestions? Thanks! ... View more