Found application from a trace

Owned by Jean-luc KRIKER
Last updated: Mar 25, 2021
2 min read


traceoptions

app type=58 
Mar 24 13:46:59 13:46:59.130371:CID-1:RT:  app 58, timeout 1800s, curr ageout 20s
Mar 24 13:46:59 13:46:59.130371:CID-1:RT:  packet dropped, denied by policy
Mar 24 13:46:59 13:46:59.130371:CID-1:RT:  denied by policy default-policy-logical-system-00(2), dropping pkt
Mar 24 13:46:59 13:46:59.130433:CID-1:RT:  packet dropped,  policy deny.
Mar 24 13:46:59 13:46:59.130433:CID-1:RT:flow_initiate_first_path: first pak no session
Mar 24 13:46:59 13:46:59.130433:CID-1:RT:  flow find session returns error.
Mar 24 13:46:59 13:46:59.130433:CID-1:RT:flow_proc_rc: -1.
Mar 24 13:46:59 13:46:59.130433:CID-1:RT: ----- flow_process_pkt rc 0x7 (fp rc -1)
find the application name
app type

> request pfe execute target fwdd command "show usp app-def tcp" | match type=58

tcp port=443, appl_name=junos-https, service type=58, alg id=0, timeout=1800



app  name

request pfe execute target fwdd command "plugin jdpi show application name 58"

commands 
root@srx320> request pfe execute target fwdd command "plugin jdpi show application name 58"
================ master ================
SENT: Ukern command: plugin jdpi show application name 58

Application ID: 58, Application name: IPP-GRE

1- save the output of the 

2- show services application-identification application detail  | no-more


Application details

show services application-identification application detail junos:IPP-GRE

show app
root@srx320> show services application-identification application detail junos:IPP-GRE
Application Name: junos:IPP-GRE
Application type: IPP-GRE
Description: IPP Type 47 - IPP-GRE - Generic Routing Encapsulation
Application ID: 58
Priority: high
Order: 0
Disabled: No
Cacheable: No
Configurable: No
Activation Date: 2003-05-05
Last Modified: 2016-10-17
Number of Parent Group(s): 1
Application Groups:
    junos:infrastructure:networking:ipp
Application Tags:
    ipproto               : 47
    layer                 : 3
    group-tags            : standardized
    group-tags            : networking
    group-tags            : basic
    risk                  : 1
    subcategory           : Networking
    category              : Infrastructure
Layer-7 Immediate Protocol(s):
    Protocol: MOBILE-IP   / 1292
    Protocol: IPP-IPV4    / 81
Application Specific Ports:
    Default ports: N/A
Signature:
    Port range: N/A
    Client-to-server
    Order: 4

https://threatlabs.juniper.net/signatures/search/#/details/?sigtype=app&sigid=ApplicationID:IPP-GRE