Palo Alto Firewalls Creating a Custom App-ID

This post is for 3.1.X but the process should be the same for 4.X.

Take a packet capture of the traffic you want an App-ID signature for. This example is a flash video over HTTP.

Note: The Follow TCP Stream feature in Wireshark is handy to see the HTTP headers easily.
(Screenshot shows a different set of headers than the example below is based on)




Look in the capture for fields in the headers that should be static no matter what browser or operating system the client is using and pick those to make a signature with.

Go to the Objects Tab > Applications then click on New...
Create a name, set the properties and characteristics.

Go to the Advanced Tab and set the Defaults and Engine at least.













Go to the Signatures Tab and click New...
Set a name for the Signature.









Create an And and an Or for each item you want to match on (each item to match on must be at least 7 bytes long or roughly 7 characters)
In this example I'll use http-req-params and http-req-host-header. These will match the GET and Host lines in the header send from the client to the server, looking for these values.

Remember to escape periods with a forward slash.



I don't remember where I found this, but it's very helpful:
Field/context definition for custom App and Threat Signatures

Edit: Here's a much nicer guide Palo Alto made for 5.X
https://knowledgebase.paloaltonetworks.com/servlet/fileField?entityId=ka14u000000DSs9AAG&field=Attachment_1__Body__s

APC SmartUPS Console

Anyone that's ever had the joy of trying to console into an APC SmartUPS probably realized they do things a little odd. Baud rate of 2400 and a special cable that doesn't work with anything else. I needed a standard rollover cable to DB9 pinout so I could make some adapters.

The top table here shows the pinout for DB9 to DB9, which I then used to make my adapter.
Cisco has a nice page here that shows what each pin does on a rollover cable, look for the table called "RJ-45 Port Pin-outs."

The adapter I used was part AD-9MT8-G1.




















Here's a table that shows the pinout for the adapter:

Connect the pins as shown in the table then cut off the rest of the pins, don't connect them.









What the final adapter looks like before putting it together:

Note: This was my first test adapter, you should only have pins 1,2 and 9 connected.

Counterfeit Cisco SFPs

The other day I noticed a box of SPFs sitting on a shelf that looked odd, so I grabbed the box and took a look at the individually wrapped SPFs inside. What I saw didn't make me feel any better, they looked like knock-offs I had seen other people run into.

Here's what the box's label looked like that originally got me interested:

Notice how there's no serial number? Cisco always prints all the serial numbers on the box when you buy new equipment.
The quantity is also wrong. This box should have six SFPs not one like it says.

Here's what the anti-static bags looked like that the SFPs were in:

Again, no serial number.
















Here's what the counterfeit SFP looks like compared to a real one:

The real one is on the right side. Notice the CLEI code label on both sides that the counterfeit doesn't have.






Here the real one is on the bottom. You can see the serial number on the counterfeit is not in the usual Cisco format.

So now you know a couple ways to spot a counterfeit Cisco SFP when it's not in use. What about when they've already been installed?

"show inventory raw" is the command you'll need in most cases. Just look for serial numbers that aren't in the correct format (e.g. first 3 letters for manufacturer, 4 numbers for the date code, and 4 unique characters for the ID).

More information about "show inventory raw" can be found on Cisco's feature guide for Unique Device Identifier Retrieval.

Neat FOSS Projects

There are a lot of neat projects that I use or follow. Here is the list of the ones I can remember right now.

Boxee
m0n0wall
Untangle
DD-WRT
GNS3
Pidgin
Notepad++
Zenoss
Smokeping

Additions to the list:
Cacti
7Zip
VLC
WinSCP
Eraser
TightVNC

(omitting the projects that everyone already knows about e.g. Ubuntu, Webmin, etc.)

I love finding a cool piece of software (or hardware) to play with.

Here's an extensive list from Lifehacker:
http://lifehacker.biz/articles/best-open-source-software/