Verifying App Control Configuration

To verify your policy configuration, you can send some traffic that should match your policy. You can use a network protocol analyzer such as Wireshark to view the packets. For information about using Wireshark, see Wireshark .

Be sure to test for both included and excluded users and groups. You should also run tests according to the schedule that you configured, to determine that the policy is in effect when you want it to be. Check for log entries in the Log > View or the Dashboard > Log Monitor page in the SonicOS user interface.

You can view tooltips on the Firewall > App Rules page when you hover your cursor over each policy. The tooltips show details of the match objects and actions for the policy. Also, the bottom of the page shows the number of policies defined, enabled, and the maximum number of policies allowed.

Useful Tools

This section describes two software tools that can help you use Application Control to the fullest extent. The following tools are described:

•
Wireshark
•
Hex Editor

Wireshark

Wireshark is a network protocol analyzer that you can use to capture packets from applications on your network. You can examine the packets to determine the unique identifier for an application, which you can use to create a match object for use in an App Rules policy.

Wireshark is freely available at: http://www.wireshark.org

The process of finding the unique identifier or signature of a Web browser is illustrated in the following packet capture sequence.

1
In Wireshark, click Capture > Interfaces to view your local network interfaces.
2
In the Capture Interfaces dialog, click Capture to start a capture on your main network interface:

As soon as the capture begins, start the browser and then stop the capture. In this example, Firefox is started.

3
In the captured output, locate and click the HTTP GET command in the top pane, and view the source for it in the center pane. In the source code, locate the line beginning with User-Agent.

4
Scroll to the right to find the unique identifier for the browser. In this case, it is Firefox/1.5.0.7.

5
Type the identifier into the Content text field in the Match Objects Settings widow.
6
Click OK to create a match object that you can use in a policy.

Hex Editor

You can use a hexadecimal (hex) editor to view the hex representation of a file or a graphic image. One such hex editor is XVI32, developed by Christian Maas and available at no cost at the following URL:

http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm

For example, if there is a certain graphic contained within all confidential company documents, you could use the hex editor to obtain a unique identifier for the graphic, and then use the identifying hex string to create a match object. You could reference the match object in a policy that blocks the transfer of files with content matching that graphic.

Using the SonicWALL graphic as an example, you would take the following steps:

1
Start XVI32 and click File > Open to open the graphic image GIF file.

2
In the left pane, mark the first 50 hex character block by selecting Edit > Block <n> chars… and then select the decimal option and type 50 in the space provided. This will mark the first 50 characters in the file, which is sufficient to generate a unique thumbprint for use in a custom match object.

Alternatively you can mark the block by using the following sequence:

•
Click on the first character (#0).
•
Press Ctrl+B.
•
Click on the character in position #49.
•
Press Ctrl+B.

To locate the character in position #49, click on a character in the right pane (the text pane) and then look at the bottom left corner for the decimal address. Try different characters until it shows Adr. dec: 49.

* 
NOTE: You must click on the corresponding location in the left pane before you press Ctrl+B to mark the block.

When the block is marked, it changes to red font. To unmark a block of characters, press Ctrl+U.

3
After you mark the block, click Edit > Clipboard > Copy As Hex String.
4
In Textpad or another text editor, press Ctrl+V to paste the selection and then press Enter to end the line.

This intermediary step is necessary to allow you to remove spaces from the hex string.

5
In Textpad, click Search > Replace to bring up the Replace dialog box. In the Replace dialog box, type a space into the Find text box and leave the Replace text box empty. Click Replace All.

The hex string now has 50 hex characters with no spaces between them.

6
Double-click the hex string to select it, then press Ctrl+C to copy it to the clipboard.
7
In the SonicOS user interface, navigate to Firewall > Match Objects and click Add Match Object.
8
In the Match Object Settings dialog, type a descriptive name into the Object Name field.
9
In the Match Object Type drop-down menu, select Custom Object.
10
For Input Representation, click Hexadecimal.
11
In the Content field, press Ctrl+V to paste the contents of the clipboard.
12
Click Add.

13
Click OK.

You now have an Match Object containing a unique identifier for the image. You can create an App Rules policy to block or log traffic that contains the image matched by this Match Object. For information about creating a policy, see Configuring an App Rules Policy .