Differences

This shows you the differences between two versions of the page.

--- paloaltonetworks:decoders [2020/08/11 08:43] – bstafford
+++ paloaltonetworks:decoders [2022/11/23 12:49] (current) – external edit 127.0.0.1
@@ Line 2: / Line 2: @@
 I got this list by monitoring the Dynamic Update release emails from Palo Alto Networks.
-Remember a "decoder" is effectivly a "base protocol". You can also detect these within the App-ID database as any application that does not have a "depends on" or "implicily uses".
+Remember a "decoder" is effectivly a "base protocol". You can also detect these within the App-ID database as any application that does not have a "depends on" or "implicily uses". However, if we take this definition then the following list is wrong. In the list below we list some dependencies.
-In their updates, they often list "decoder" udpates in addition to App-ID updates.
+Listed as a decoder by the dynamic update emails and we have an App-ID for it.
   * asterisk-iax
   * bacnet
@@ Line 16: / Line 15: @@
   * ed137
   * ftp
-  * ftp-data
-  * functions
   * gds-db
-  * generic
   * gtp
   * hp-data-protector
-  * http
-  * http2
   * icmp
   * iec-60870-5-104
@@ Line 30: / Line 24: @@
   * imap
   * ipsec-esp-udp
-  * kerberos
   * ldap
   * llmnr
   * lpd
-  * medical
   * mms-ics
   * modbus
@@ Line 42: / Line 34: @@
   * netbios-ss
   * ntp
-  * open-vpn
   * oracle
   * pop3
@@ Line 49: / Line 40: @@
   * rpc
   * rtsp
-  * scada
-  * sccp
-  * sctp
   * sip
-  * smb
-  * smb-8-1
   * smtp
   * ssh
@@ Line 61: / Line 47: @@
   * teamviewer
   * tftp
-  * vmware
   * vnc
   * unknown-tcp
   * unknown-udp
-  * unknown-peer-to-peer
+  * unknown-p2p
+Listed as a decoder by the dynamic update emails and we have no App-ID for it.
+  * ftp-data
+  * functions
+  * generic
+  * http
+  * http2
+  * medical
+  * scada
+  * sctp
+  * smb
+  * smb-8-1
+Listed as a decoder by the dynamic update emails and we have an App-ID for it but it implicitly uses another App-ID. Thus, is it actually a decoder?
+  * kerberos - implicitly uses rpc
+  * vmware - implicitly uses ssl and web-browsing
+Listed as a decoder by the dynamic update emails and we have an App-ID for it but it depends on another App-ID. Thus, is it actually a decoder?
+  * open-vpn - depends on ssl and web-browsing
+  * sccp - depends on  tftp
+Also remember, there are 147 members of the "ip-protocol" list in Application Filters in August 2020. This includes all the IPv6 stuff.