Custom Signature

You can create a custom match object that matches any part of a packet if you want to control traffic that does not have a predefined object type in Application Control. This allows you to create a custom signature for any network protocol.

For instance, you can create a custom signature to match HTTP GET request packets. You might use this if you want to prevent Web browsing from your local area network.

To determine a unique identifier for a HTTP GET packet, you can use the Wireshark network protocol analyzer to view the packet header. For more information about using Wireshark, see Wireshark. In Wireshark, capture some packets that include the traffic you are interested in. In this case, you want to capture a HTTP GET request packet. You can use any web browser to generate the HTTP GET request.

To create a custom policy for a custom signature:
1
Access Wireshark in any web browser.
2
In Wireshark, generate the HTTP GET request.
3
Wireshark displays the HTTP GET request packet:

4
In the top pane of Wireshark, scroll down to find the HTTP GET packet.
5
Click on that line.

The packet is displayed in the two lower panes. For a SYN packet, the center pane provides a human-readable interpretation of the packet header, and the actual header bytes are displayed in hexadecimal in the lower pane.

6
In the center pane, expand the Hypertext Transfer Protocol section to see the packet payload.
7
Click on the identifier you want to reference in Application Control. In this case, the identifier is the GET command in the first three bytes. Click on this to highlight the corresponding bytes in the lower pane.
8
You can determine the offset and the depth of the highlighted bytes in the lower pane. Offset and depth are terms used by Application Control. Offset indicates which byte in the packet to start matching against, and depth indicates the last byte to match. Using an offset allows very specific matching and minimizes false positives.
* 
NOTE: When you calculate offset and depth, the first byte in the packet is counted as number one (not zero). Decimal numbers are used rather than hexadecimal to calculate offset and depth. Offset and depth associated with a custom match object are calculated starting from the packet payload (the beginning of the TCP or UDP payload). In this case, the offset is 1 and the depth is 3.
9
Navigate to Firewall > Match Object.
10
Click Add New Match Object. The Add/Edit Match Object dialog displays.
11
Create a custom match object that uses this information.

a
Enter a descriptive name for the object in the Object Name field.
b
Select Custom Object from the Match Object Type drop-down menu. Select Exact Match from the Match Type drop-down menu.
c
Select the Enable Settings check box. The settings fields become available.
d
In the Offset field, type 1 (the starting byte of the identifier).
e
In the Depth field, type 3 (the last byte of the identifier).
* 
TIP: You can leave the Payload Size set to the default value. The Payload Size is used to indicate the amount of data in the packet, but in this case we are only concerned with the packet header.
f
For Input Representation, select Hexadecimal.
g
In the Content field, type the bytes as shown by Wireshark: 474554. Do not use spaces in hexadecimal content.
12
Click OK.
13
Navigate to Firewall > App Rules.
14
Click Add New Policy. The Edit App Control Policy dialog displays.
15
Create a policy that uses the HTTP GET match object:

16
Enter a descriptive name for the policy in the Policy Name field.
17
Select HTTP Client for the policy type from the Policy Type drop-down menu.
18
From the Match Object drop-down menu, select the match object that you just defined, HTTP GET.
19
Select a custom action or a default action such as Reset/Drop.
20
For the Connection Side, select Client Side. You can also modify other settings. For more information about creating a policy, see Prerequisites to Configuring App Rules Policies.
21
Click OK.