About grenierm

I am looking for some documentation on how to use the custom application identification for unknown udp traffic. I have been successful with looking for strings within HTTP based traffic but am struggling to identify applications that aren't HTTP based. Within the signature section I have tried to identify the application using the operator "pattern match" and entering the ascii string as I have done with HTTP and the application is not identified. I then reverted to utilizing the "equal to" operator choosing to identify the first 4 bytes of the payload. For this particular test, I am simply trying to identify UDP based traffic from the application Iperf. Attached is the payload from that traffic and the first 4 bytes are 00 00 04 dc(the first two bytes are always 00 00 for this traffic). For my mask I am entering 0xff000000 and for the value I enter 0x00000000. The way I would interpret this would be to match the first byte only (because of the ff in the mask) and don't worry about the remaining 3 bytes. So, my value of 00 matches the actual value of the packet payload 00 but it still won't identify the traffic as my custom application.This is in a very isolated environment with only two laptops connected on each side of a vwire (no other competing traffic) Can someone explain where my logic has gone wrong or show me a good document that outlines how to do this? Thanks ... View more