I wanted to understand how does the Sourcefire NGIPS understand which application has initiated the traffic. I am aware that the protocol is learned from the ports, but, how does it determine that so and so application has initiated this traffic?

E.g., RDP traffic being generated by "RDP Client", HTTP traffic being generated by "Mozilla Firefox"

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 2:27

I am aware that the protocol is learnt from the ports...

That is the way conventional firewalls do it. Next-Gen firewalls and IPSs can do deep packet inspection, among other things, to determine what the traffic is. For instance, it will read the payload of packets in a flow, and it can see that the HTTP requests are coming from Mozilla Firefox the same way that the HTTP server can: by the contents of the HTTP requests.

Since software changes all the time, and new software regularly appears, it is important that you keep the code on the device up to date; a subscription is mandatory for current protection.

| improve this answer | |
  • Thanks for your reply. :) Is there any specific field in a stream of packets that identify the application? Would I be able to identify the application by running a packet capture? – Abhishek Sha Mar 31 '16 at 15:46
  • There is no specific field in a packet which identifies it the way you describe. It is the payload which must be examined, and algorithms are run to try to determine what the traffic is. Some things, like HTTP requests are easy since they are plaintext, including the browser version. – Ron Maupin Mar 31 '16 at 15:53
  • Thats right. "deep packet inspection' is the answer and is what differentiates legacy firewalls from "Next Generation Firewalls" NGFW's. – Ronnie Royston Jul 29 '16 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.