L7 filter and regular expression

[cramped_gamut@…]

Hi everyone,

I have some queries regarding the L7 Filter issues for protocol detection.

1. Does every ptotocol leaves a fingerprint inside which we cannot indentify with this mean which are not yet coded and which are not accessible with this methods?

2. the rules about the timing for protocol detection?

3. is the modification necesssary to get the protocols detected, and how is the modification done?

4. As protocol detection with L7 filter is based on application layer protocols. However, even for this do we need to look at the headers from the bottom up of the OSI layer before reaching up to the application layer or only the application layer payload is enough to detect the protocols from L7 filtering method.

5. Is they any means of put some markers for the initial and end of the session in the RegEx? rules??

[jacalvo@…]

Please, this trac is for reporting bugs, questions should be asked at  http://forum.zentyal.org, thanks.