you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 3 years ago (1 child)

can you maybe link some ressources on how the protocol used can be detected? i did not know about this and would like to read into it some more :)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 3 years ago (1 child)

    Look up NBAR for the basic idea. Each vendor has their own 'secret sauce' implementation, Palo Alto only needs 9 bytes of payload for disambiguation, iirc.

  • source
  • parent
  • hideshow 2 child comments