[Snort-openappid] Trouble detecting Skype App

Shayne Civitarese shayne.civitarese at wedgenetworks.com
Tue Oct 3 11:47:37 EDT 2017

Thanks for the reply, I meant web.skype.com in my previous message. I was just recently able to get detection of Skype traffic using Windows Live Messenger as the OpenAppID.

It's worth mentioning an issue I am now having with detecting WhatsApp. The desktop client gets detected fine, but the mobile device (Android) does not seem to get detected. Sending an image will trigger the OpenAppID for whats app on the mobile, but not a log in event or normal chat traffic.


On 2017-10-03 07:34 AM, Costas Kleopa (ckleopa) wrote:
The coverage we have in OpenAppID is mostly for patterns for login in, not the actual voice/video traffic. I understand there were some changes in Skype lately that we may not cover.

This site chat.skype.com<http://chat.skype.com> does not exist, but either way I’ll work with the team to see what kind of coverage we can get for OpenAppID.


On Oct 2, 2017, at 1:59 PM, Shayne Civitarese <shayne.civitarese at wedgenetworks.com<mailto:shayne.civitarese at wedgenetworks.com>> wrote:

I am having issues detecting both Skype and Skype for business traffic
using OpenAppId. Can anyone confirm that the provided OpenAppId
detectors are sufficient for detecting traffic of the Skype App? I am
attempting to use the windows desktop client, the webapp from
chat.skype.com<http://chat.skype.com> and the App from the Google Play store for Android. I am
able to detect other applications like WhatsApp, but not Skype. I can
post further details to help troubleshoot if anyone can confirm
OpenAppId can detect Skype.


Shayne Civitarese

Snort-openappid mailing list
Snort-openappid at lists.snort.org<mailto:Snort-openappid at lists.snort.org>

Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-openappid/attachments/20171003/5bc66622/attachment.html>

More information about the Snort-openappid mailing list