New Signatures

[simpcomp]

I have been looking to implement untangle to log network traffic and block websites. Some of the applications I would like to monitor do not have signatures pre-set in the rack. Could anyone give me some insight on how to create signatures after I have the wireshark logs?

Thanks in advance,
Tony

[dmorris]

Hi Tony,

Welcome.

They're just regular expressions. You can find lots of good regex tutorials around the web.

http://www.regular-expressions.info/tutorial.html/

You just need to write a regular expression that matches the desired string but doesn't match other stuff.

[jcoehoorn]

Note the "doesn't match other stuff" requirement: you have to be pretty specific here or you'll cause problems with other apps.