[Snort-users] Commercial Advanced Packet Sniffers, how do they do this? Application signatures?

Dimitri Syuoul dsyuoul at ...11827...
Fri Jan 22 15:22:01 EST 2010


Hello guys,

I was wondering if anybody could give me feedback on these two
commercial appliances:

http://www.paloaltonetworks.com/solutions/app-control.html
http://www.bluecoat.com/products/sg


It seems these have two key things a.) proxy for 443/80 with SSL
termination, and b.) an advanced packet sniffer for all the other
ports


Iam interested in B. With over 900 application "signatures" including
Bittorent, Skype, MSN (which now a days uses multiple ports also)...
it even lets you block if you want to allow Instant Messaging but not
allow WebCams inside instant messaging...

I have been breaking my head for days now and Id like to head from the
people at snort... how exactly would an appliance be able to
"signature" all these and manipulate them? As far as I Know the
community has never seen application signatures.. right?

Please do not reply this message and say a standard port base blocking
does this, because we know it doesnt ;-) specially Skype who can
connect pretty much on any open port available on the client machine.

Thanks.

--Dimitri




More information about the Snort-users mailing list