iptable string matching to find application type / application layer protoco
Clash Royale CLAN TAG#URR8PPP
up vote
0
down vote
favorite
I would like to know is it possible to match the type of applications/application layer protocols using iptables string matching extension?
iptables netfilter
asked Nov 29 '17 at 18:45
Corey
132
add a comment |Â
up vote
0
down vote
favorite
I would like to know is it possible to match the type of applications/application layer protocols using iptables string matching extension?
iptables netfilter
asked Nov 29 '17 at 18:45
Corey
132
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I would like to know is it possible to match the type of applications/application layer protocols using iptables string matching extension?
iptables netfilter
asked Nov 29 '17 at 18:45
Corey
132
I would like to know is it possible to match the type of applications/application layer protocols using iptables string matching extension?
iptables netfilter
asked Nov 29 '17 at 18:45
Corey
132
asked Nov 29 '17 at 18:45
Corey
132
asked Nov 29 '17 at 18:45
Corey
132
asked Nov 29 '17 at 18:45
Corey
132
132
add a comment |Â
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
0
down vote
Yes it is possible,
If you know a unique string specifically that application or clients using that application includes it to communication packets.
But if it is encrypted, you probably can not.
answered Nov 30 '17 at 5:51
ibrahim
308111
Thank you ibrahim. Do you know where can I find a list of these unique strings? any thing like snort rules....
– Corey
Nov 30 '17 at 8:17
I don't think there is such list. Why dont you use snort instead?
– ibrahim
Nov 30 '17 at 11:12
I don't know much about snort but do you think Snort can identify the applications?or it can just identify the attacks?
– Corey
Dec 4 '17 at 10:38
Snort inspecting network packets like iptables do. So if you can write a snort rule for the application you want to detect, you can identify.
– ibrahim
Dec 7 '17 at 9:44
BTW some companies developed some tools for specifically that purpose. NAVL is one of them. proceranetworks.com/hubfs/Datasheets/…
– ibrahim
Dec 7 '17 at 9:52
 |Â
show 1 more comment
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
Yes it is possible,
If you know a unique string specifically that application or clients using that application includes it to communication packets.
But if it is encrypted, you probably can not.
answered Nov 30 '17 at 5:51
ibrahim
308111
Thank you ibrahim. Do you know where can I find a list of these unique strings? any thing like snort rules....
– Corey
Nov 30 '17 at 8:17
I don't think there is such list. Why dont you use snort instead?
– ibrahim
Nov 30 '17 at 11:12
I don't know much about snort but do you think Snort can identify the applications?or it can just identify the attacks?
– Corey
Dec 4 '17 at 10:38
Snort inspecting network packets like iptables do. So if you can write a snort rule for the application you want to detect, you can identify.
– ibrahim
Dec 7 '17 at 9:44
BTW some companies developed some tools for specifically that purpose. NAVL is one of them. proceranetworks.com/hubfs/Datasheets/…
– ibrahim
Dec 7 '17 at 9:52
 |Â
show 1 more comment
up vote
0
down vote
Yes it is possible,
If you know a unique string specifically that application or clients using that application includes it to communication packets.
But if it is encrypted, you probably can not.
answered Nov 30 '17 at 5:51
ibrahim
308111
Thank you ibrahim. Do you know where can I find a list of these unique strings? any thing like snort rules....
– Corey
Nov 30 '17 at 8:17
I don't think there is such list. Why dont you use snort instead?
– ibrahim
Nov 30 '17 at 11:12
I don't know much about snort but do you think Snort can identify the applications?or it can just identify the attacks?
– Corey
Dec 4 '17 at 10:38
Snort inspecting network packets like iptables do. So if you can write a snort rule for the application you want to detect, you can identify.
– ibrahim
Dec 7 '17 at 9:44
BTW some companies developed some tools for specifically that purpose. NAVL is one of them. proceranetworks.com/hubfs/Datasheets/…
– ibrahim
Dec 7 '17 at 9:52
 |Â
show 1 more comment
up vote
0
down vote
up vote
0
down vote
Yes it is possible,
If you know a unique string specifically that application or clients using that application includes it to communication packets.
But if it is encrypted, you probably can not.
answered Nov 30 '17 at 5:51
ibrahim
308111
Yes it is possible,
If you know a unique string specifically that application or clients using that application includes it to communication packets.
But if it is encrypted, you probably can not.
answered Nov 30 '17 at 5:51
ibrahim
308111
edited Nov 30 '17 at 11:09
answered Nov 30 '17 at 5:51
ibrahim
308111
answered Nov 30 '17 at 5:51
ibrahim
308111
answered Nov 30 '17 at 5:51
ibrahim
308111
308111
Thank you ibrahim. Do you know where can I find a list of these unique strings? any thing like snort rules....
– Corey
Nov 30 '17 at 8:17
I don't think there is such list. Why dont you use snort instead?
– ibrahim
Nov 30 '17 at 11:12
I don't know much about snort but do you think Snort can identify the applications?or it can just identify the attacks?
– Corey
Dec 4 '17 at 10:38
Snort inspecting network packets like iptables do. So if you can write a snort rule for the application you want to detect, you can identify.
– ibrahim
Dec 7 '17 at 9:44
BTW some companies developed some tools for specifically that purpose. NAVL is one of them. proceranetworks.com/hubfs/Datasheets/…
– ibrahim
Dec 7 '17 at 9:52
 |Â
show 1 more comment
Thank you ibrahim. Do you know where can I find a list of these unique strings? any thing like snort rules....
– Corey
Nov 30 '17 at 8:17
I don't think there is such list. Why dont you use snort instead?
– ibrahim
Nov 30 '17 at 11:12
I don't know much about snort but do you think Snort can identify the applications?or it can just identify the attacks?
– Corey
Dec 4 '17 at 10:38
Snort inspecting network packets like iptables do. So if you can write a snort rule for the application you want to detect, you can identify.
– ibrahim
Dec 7 '17 at 9:44
BTW some companies developed some tools for specifically that purpose. NAVL is one of them. proceranetworks.com/hubfs/Datasheets/…
– ibrahim
Dec 7 '17 at 9:52
Thank you ibrahim. Do you know where can I find a list of these unique strings? any thing like snort rules....
– Corey
Nov 30 '17 at 8:17
Thank you ibrahim. Do you know where can I find a list of these unique strings? any thing like snort rules....
– Corey
Nov 30 '17 at 8:17
I don't think there is such list. Why dont you use snort instead?
– ibrahim
Nov 30 '17 at 11:12
I don't think there is such list. Why dont you use snort instead?
– ibrahim
Nov 30 '17 at 11:12
I don't know much about snort but do you think Snort can identify the applications?or it can just identify the attacks?
– Corey
Dec 4 '17 at 10:38
I don't know much about snort but do you think Snort can identify the applications?or it can just identify the attacks?
– Corey
Dec 4 '17 at 10:38
Snort inspecting network packets like iptables do. So if you can write a snort rule for the application you want to detect, you can identify.
– ibrahim
Dec 7 '17 at 9:44
Snort inspecting network packets like iptables do. So if you can write a snort rule for the application you want to detect, you can identify.
– ibrahim
Dec 7 '17 at 9:44
BTW some companies developed some tools for specifically that purpose. NAVL is one of them. proceranetworks.com/hubfs/Datasheets/…
– ibrahim
Dec 7 '17 at 9:52
BTW some companies developed some tools for specifically that purpose. NAVL is one of them. proceranetworks.com/hubfs/Datasheets/…
– ibrahim
Dec 7 '17 at 9:52
 |Â
show 1 more comment
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f407796%2fiptable-string-matching-to-find-application-type-application-layer-protoco%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
