Quick viewing(Text Mode)

Release Notes

Release Notes

1

Juniper Networks Deep Packet Inspection-Decoder (Application Signature) Release Notes

August 04, 2020

Contents Recent Release History | 2

Overview | 2

New Features and Enhancements | 3

New Software Features and Enhancements Introduced in JDPI-Decoder Release 3313 | 3

New Applications | 3

Updated Applications | 30

Custom Applications | 38

New or Modified Application Groups | 38

Obsolete Applications | 40

Resolved Issues | 46

Requesting Technical Support | 47

Self-Help Online Tools and Resources | 47

Creating a Service Request with JTAC | 48

Revision History | 49 2

Recent Release History

Table 1 on page 2 summarizes the features and resolved issues in recent releases. You can use this table to help you decide to update the JDPI-Decoder version in your deployment.

Table 1: JDPI-Decoder Features and Resolved Issues by Release

Release Signature JDPI Decoder Engine Engine Date Pack Version Version Version 4 Version 5 Features and Resolved Issues

Aughst The relevant 1.460.2-43 4.20.0-111 5.3.0-61 This JDPI-Decoder version is 04, 2020 signature supported only on the Junos OS package 12.3X48-D80 and later releases, version is 3313. 15.1X49-D140 and later releases, and Junos OS 17.4R1 and later releases on all supported SRX Series platforms.

Starting in Junos OS release 20.1R1, enhancements to custom applications are included in the JDPI-Decoder release.

Overview

The JDPI-Decoder is a dynamically loadable module that mainly provides application classification functionality and associated protocol attributes. It is hosted on an external server and can be downloaded as a package and installed on the device. The package also includes XML files that contain additional details of the list of applications and groups. The list of applications can be viewed on the device using the CLI command show services application-identification application summary. Additional details of any particular application can be viewed on the device using the CLI command show services application-identification application detail . For additional details, see Application Signature.

NOTE: This upgrade is only supported for Junos OS 12.3X48-D80 and later releases, 15.1X49-D140 and later releases, and 17.4R1 and later releases. This is because the older Junos releases have an engine which is incompatible with the 1.380.0 major protobundle version. So the older Junos releases will remain on JDPI-Decoder version 1.340.0-73.005 and there will be no more updates for these releases. 3

New Features and Enhancements

IN THIS SECTION

New Software Features and Enhancements Introduced in JDPI-Decoder Release 3313 | 3 New Applications | 3 Updated Applications | 30 Custom Applications | 38

The following sections describe new features and enhancements available in the JDPI-Decoder releases:

New Software Features and Enhancements Introduced in JDPI-Decoder Release 3313

The following sections describe new features and enhancements available in JDPI-Decoder Release 3313.

New Applications

Table 2 on page 3 Shows the applications that this release of JDPI-Decoder is introducing.

Table 2: New Applications

Application Application Name Type Reported Over Description

9GAG Web HTTP/HTTP2/HTTPS/QUIC 9GAG is a –based online platform and . SPDY/SSL 9GAG allows its users to upload and share content or other content from external social media

24SEVENOFFICE Web HTTP/HTTP2/HTTPS/SPDY/SSL 24SevenOffice is a web-based Enterprise resource planning (ERP) systems. 4

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

4SYNC Web HTTP/HTTP2/HTTPS/SPDY/SSL 4Sync is a cloud storage service.

ACRONIS- Web ACRONIS Acronis products including Acronis Backup use Acronis Cloud. CLOUD

ACRONIS- Infrastructure ACRONIS Acronis Backup is a backup platform that use cloud or local storage, and BACKUP can save multiple hosts using agents.

ACRONIS Web HTTP/HTTP2/HTTPS This plug-in classifies flows related to Acronis products. SPDY/SSH/SSL/TCP

AWS-CONSOLE Web -AWS/DNS/SSL AWS Console is a for managing .

AMAZON- Web SSL/SIP/STUN/QUIC/RTSP Cognito is an Amazon AWS server that allows you to keep track of user. COGNITO SPDY/HTTP2/HTTP-PROXY

AMAZON-AWS

ALIBABA-GROUP Web HTTP/HTTP2/HTTPS/QUIC Holding Limited is a Chinese multinational conglomerate SPDY/SSL specializing in e-commerce, retail, , AI and technology. This plug-in is the default classification of domain names owned by Alibaba Group.

ANCHORFREE Infrastructure DNS/HTTP/HTTP2/HTTPS AnchorFree is an anonymous VPN software from Betternet (formerly SPDY/SSL/TCP/UDP vpnintouch) company.

ANONYTUN-VPN Web HTTP/HTTP2/HTTP-PROXY/ AnonyTun is an android VPN client to customize a few parameters related HTTPS/QUIC/SPDY/SSL/TCP to tunnel. 5

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

ANYWHEREUSB Infrastructure TCP AnywhereUSB Remote I/O Concentrator is a remote networking solution that utilizes USB over IP technology to enable you to connect USB devices over a network. This AppID classifies traffic from TCP/3422 related data from the devices connected to AnywhereUSB.

AGE-OF-MAGIC Gaming AKAMAI-SSL/SSL/SIP/STUN Age of Magic is a single player game for mobile platforms. QUIC/RTSP/SPDY/HTTP2

HTTP-PROXY/DNS/PLAYKOT/TCP

ACCOUNTKIT Web HTTP/HTTP2/HTTPS/QUIC Account Kit is a product of . Account Kit uses your phone number SPDY/SSL or email address to let you quickly register to a registered app without a password.

ARTE-TV Web AKAMAI-SSL/AKAMAI-VIDEO/HTTP TV is a Franco-German television channel. This plug-in classifies traffic HTTP2/HTTPS/SPDY/SSL that the website generates.

APPLE-NEWS Web HTTP/HTTP2/HTTPS/SPDY/SSL Apple News is a mobile app and news aggregator from Apple Inc.

ALIBABA- Web BMFF/HTTP/HTTP2/HTTPS , also known as Aliyun, is a Chinese CLOUD QUIC/SPDY/SSL/TCP company. Alibaba Cloud is a subsidiary of Alibaba Group.

APPNEXT Web AKAMAI-SSL/HTTP/HTTP2/HTTPS Appnext is mobile monetization, app marketing and re-engagement LLNWD/QUIC/SPDY/SSL platform.

ARD Remote-access VNC/UDP Apple Remote Desktop allows you to manage Mac computers remotely. 6

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

ALICALL Messaging HTTP/HTTP2/HTTPS Alicall is an application that provides International Voice over Internet SPDY/SSL/UDP Protocol (VoIP) call feature.

AIR-WATCH Web HTTP/HTTP2/HTTPS/SPDY/SSL Air Watch is a Mobile Device Management solution (MDM). This plug-in classifies the traffic that cloud solution generates.

BIGO Web HTTP/HTTP2/HTTPS/SPDY/SSL BIGO social media company. BIGO allows you to watch live , broadcast your life and video chat with your friends.

BARRACUDA- Infrastructure TCP/UDP This plug-in classifies TINA protocol. Barracuda VPN protocol TINA VPN provides VPN services.

BARRACUDA Web HTTP/HTTP2/HTTPS/SPDY/SSL Barracuda Networks, Inc. is a company that provides security, networking and storage products based on network appliances and cloud services. This plug-in classifies traffic related to Barracuda web site and Could Control service.

BIGBIGCHANNEL Web TVB Big Big Channel is an . TVB operates Big Big Channel.

BLUEHOST Web SSL/SIP/STUN/QUIC/RTSP/SPDY Bluehost is a website hosting provider. This plug-in classifies web HTTP2/HTTP-PROXY/HTTPS site management traffic.

BRAWLHALLA Gaming Brawlhalla is a free to play battle arena on- multiplayer game. Blue Mammoth is the developer and Ubisoft is the publisher of Brawlhalla. 7

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

BYTEDANCE Web AKAMAI-SSL/HTTP/HTTP2/HTTPS ByteDance is publishes several applications including TikTok, SPDY/SSL BuzzVideo and Vigo Video. This plug-in classifies traffic from web site.

CALL-OF-DUTY Gaming SSL/SIP/STUN/QUIC/RTSP/SPDY Call of Duty (COD) is a video game First Personal Shooter (FPS) available HTTP2/HTTP-PROXY on Xbox, PS4, . DEMONWARE/HTTP/UDP Activision publishes COD. This plug-in classifies the World War II edition.

CODEMETER Infrastructure HTTP/HTTP2/HTTPS/SPDY/SSL/TCP Wibu Codemeter is a license server (Software Asset Management). This plug-in classifies Wibu Codemeter as used in FactoryTalk Activation Manager.

CISCO- Infrastructure RTP Cisco smart probe sends packets from Cisco PfRv3 enabled routers to ensure SMARTPROBE link quality.

CISCO-SDAVC Infrastructure UDP Cisco Software-Defined AVC (SD-AVC) is a component of Cisco Application Visibility and Control (AVC). This plug-in works as a centralized network service and operates with specific participating devices in a network.

COUCHBASE Infrastructure AMAZON/AMAZON-AWS Couchbase Server is a distributed, open NoSQL engine. ERLANG-DISTRIBUTION Couchbase Server stores key/values GOLANG/HTTP/HTTP2/HTTPS or JSON documents.

SPDY/SSL/TCP/ZENDESK 8

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

CISCO-CMX- Web CISCO Cisco Connected Mobile Experiences (CMX) Cloud is a cloud-delivered CLOUD version of the on-premises CMX 10 software. Use CMX Cloud for the delivery of services. CMX Cloud integrates with the Cisco wireless infrastructure and creates out-of-the-box capabilities.

CISCO-UCM Messaging CISCO/FTP/FTP-DATA/H225RAS/HTTP Cisco Unified Communication Manager is an IP PBX for enterprises. HTTP2/HTTPS/INFORMIX/JAVA-RMI This plug-in classifies Cisco specific MGCP/RTP/SCCP/SIP/SOAP/SPDY protocols between Cisco Unified Communication components and SRTP/SSL/TFTP-DATA devices, and the administration web interface

CISCO Web HTTP/HTTP2/HTTPS/QUIC/SPDY This plug-in classifies the website browsing traffic from CISCO.. SSL/STUN/UDP

CISCO-AMC Infrastructure CISCO-UCM This plug-in classifies the protocol of CUCAM (Cisco Unified Communications Alert Manager and Collector). This service is used by CUC (Cisco Unified Communications) or the RTMT (Real-Time Monitoring Tool) to provide performance monitoring, data collection, logging, and alerting.

COINIMP Web CLOUDFLARE/HTTP/HTTP2/HTTPS This plug-in classifies the traffic related to Monero SPDY/SSL/ (XMR) mining and web traffic.

CRYPTO-POOL- Web HTTP/HTTP2/HTTPS/MONERO Monero-pool.fr is the mining pool for Monero cryptocurrency. FR SPDY/SSL 9

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

CYBERGHOST Infrastructure HTTP/HTTP2/HTTPS/SPDY/SSL CyberGhost is a VPN service. You can use this to unblock sites and browse privately and anonymously.

CODEPEN-IO Web SSL/SIP/STUN/QUIC/RTSP CodePen is an online community for testing and showcasing user-created SPDY/HTTP2/HTTP-PROXY HTML, CSS and JavaScript code AMAZON/AMAZON-AWS/DISQUS snippets. This plug-in classifies only the free plan traffic. HTTP/HTTPS

COCO Messaging HTTP/HTTP2/HTTPS/QUIC/SPDY Coco is an application with VoIP feature. SSL/STUN

CMORE Multimedia AKAMAI-SSL/HTTP/HTTP2/HTTPS C More is a television company that provides paid videos on demand. SPDY/SSL

CIBN Web APPLE-HLS/BMFF/HTTP/HTTP2 International Broadcasting Network (CIBN) is an internet TV HTTPS/SPDY/SSL platform. This plug-in classifies website traffic.

CISCO-CORP-TV Web CISCO Cisco Corporate TV is an interactive web streaming, and live studio shows platform.

CISCO-IP-SLA Infrastructure UDP Cisco IP SLA uses active traffic to monitor IP applications.

CISCO-NMSP Infrastructure HTTP2/HTTPS/SPDY/SSL This plug-in exchanges data between the Cisco Mobility Service Engine (MSE) and the Cisco Wireless LAN Controller (WLC).

CAKE-HR Web SSL/SIP/STUN/QUIC/RTSP/SPDY CakeHR is an online HR management software. HTTP2/HTTP-PROXY/AMAZON-AWS

CLOUDFLARE/HTTPS 10

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

DAZN Multimedia AKAMAI-SSL/AMAZON DAZN is a video streaming service for sports. AMAZON-AWS

HTTP/HTTP2/HTTP-PROXY

HTTPS/LLNWD/SPDY/SSL

DISCOURSE Web SSL/SIP/STUN/QUIC/RTSP Discourse is an open source Internet forum and mailing list management SPDY/HTTP2/HTTP-PROXY/HTTP/HTTPS software application.

DIDI Web DNS/HTTP/HTTP2/HTTPS/SPDY Didi is a shared transport application. This plug-in adds classification of SSL/TCP/UDP traffic from Android and iOS platforms.

DEMONWARE Gaming HTTP/HTTP2/HTTPS/SPDY DemonWare is a software development company and a SSL/TCP/UDP subsidiary of Activision Blizzard, Inc.

DISCORD Messaging SSL/SIP/STUN/QUIC/RTSP/SPDY is a chat, audio and video call application for gaming. HTTP2/HTTP-PROXY/CLOUDFLARE

DTLS/HTTPS/RTCP/RTP/UDP

DNS-CRYPT Infrastructure TCP/UDP The DNScrypt protocol translates Fully Qualified Domain Name (FQDN) into IP address and IP address to FQDN with encrypted communication.

DRAGON-BALL Gaming SSL/SIP/STUN/QUIC/RTSP/SPDY This plug-in classifies traffic from DRAGON BALL FighterZ video game. HTTP2/HTTP-PROXY/HTTPS

TCP/UDP

EVOZI Web CLOUDFLARE/HTTP/HTTP2/HTTPS Evozi is an apk downloader website and also a mobile apps developer. This SPDY/SSH/SSL plug-in classifies website traffic. 11

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

EXPRESSVPN Infrastructure AMAZON/AMAZON-AWS/HTTP2 ExpressVPN is a provider of VPN tunnels with servers located in over HTTPS/ESP-OVER-UDP/IKE 140 countries and several standards SPDY/SSL/TCP/UDP or obfuscated protocols. This plug-in classifies the website, software, and manual setups using the ExpressVPN provided configuration file.

EPROXY Infrastructure SSH Eproxy is a VPN for forward proxies with custom payload and optional ssh support. This plug-in classifies automatically generated fake HTTP headers and the embedded SSH clients.

ERLANG- Infrastructure TCP Erlang distribution protocol allows several nodes to communicate DISTRIBUTION together and exchange information.

FTPS-DATA Infrastructure SSL FTP is a to share files in the network TCP/IP.

FOXPLUS Web FOXNETWORKS Fox Plus is a streaming platform that lets people watch latest TV series, documentaries, Hollywood and Asian movies of Fox Networks.

FUZE Multimedia SSL/SIP/STUN/QUIC/RTSP/SPDY provides cloud-based Unified Communications Service. HTTP2/HTTP-PROXY

AMAZON-AWS/HTTP

HTTPS/RTCP/RTP/SPLUNK-CLOUD

DUCKDUCKGO Web SSL/SIP/STUN/QUIC/RTSP/SPDY DuckDuckGo is an Internet search engine and a web browser for mobile HTTP2/HTTP-PROXY/CLOUDFLARE devices. HTTPS 12

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

DICOM Infrastructure TCP Digital Imaging and Communications in Medicine (DICOM) supports traffic on usual TCP port 104 and 11112.

DWARFPOOL- Web CLOUDFLARE/HTTP/HTTP2/HTTPS Dwarf Pool is a mining pool for Monero cryptocurrency. COM MONERO/SPDY

ETISALAT-C-ME Messaging HTTP2/HTTPS/RTCP/RTP/SPDY/SSL C'Me is a mobile application, which offers voice and video calls along with TCP/UDP instant messaging. Etisalat developed C'Me.

FIREFOX-VPN Infrastructure HTTP/MOZILLA/SSL Firefox Private Network is a Firefox extension which provides a secure and encrypted tunnel.

EPDG-TUNNEL Infrastructure ESP-OVER-UDP/IKE This plug-in classifies the traffic coming from WLAN between a user equipment (UE) and the evolved Packet Data Gateway (ePDG) in order to access the IP Multimedia Subsytem (IMS).

EASY-ANTI-CHEAT Web HTTP/HTTP2/HTTPS/SPDY/SSL/TCP Easy Anti-Cheat is an anti-cheat service for multiplayer PC games.

FREEPP Messaging HTTP/HTTP2/HTTPS/SPDY/SSL FreePP is an instant messaging application, which provides domestic and international calls feature. This plug-in only classifies the instant messaging traffic.

FANDOM Web HTTP/HTTP2/HTTPS is a free Wiki website hosting service. QUIC/SPDY/SSL

FAST-COM Web NETFLIX-STREAM Fast is a web service which allows to assess Internet throughput. Netflix provides this service. 13

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

FOXNETWORKS Web ADOBE/AKAMAI-SSL Fox Networks Group is a subsidiary of Fox Entertainment Group for AKAMAI-VIDEO television and cable. SSL/SIP/STUN/QUIC/RTSP/

SPDY/HTTP2/HTTP-PROXY

AMAZON-AWS/HTTP/HTTPS

UPLYNK

FUTURE-PLC Web HTTP/HTTP2/HTTPS/SPDY/SSL Future Plc is a British publisher media company.

FACE-APP Web HTTP/HTTP2/HTTP-PROXY/HTTPS FaceApp is a mobile application to transform faces in photographs. This QUIC/SPDY/SSL plug-in classifies traffic from free version.

GRAMMARLY Web HTTP/HTTP2/HTTPS/SPDY/SSL Grammarly is a cloud-based English-language writing-enhancement platform.

GOOGLE-ONE Web -GEN/HTTP/HTTP2/QUIC Google One is a service for managing the storage paid plan for Google SPDY/SSL applications.

GOOGLE-BOOKS Web SSL/SIP/STUN/QUIC/RTSP/SPDY Google Books is an online file storage and sharing web-service from Google. HTTP2/HTTP-PROXY

GOOGLE-API/GOOGLE-GEN

ANDROID-MARKETPLACE-

DOWNLOAD

GOOGLE-STATIC/HTTP

GOV-SG Web SSL/SIP/STUN/QUIC/RTSP/SPDY Gov.sg is the web portal for Government. This plug-in classifies HTTP2/HTTP-PROXY/HTTP/HTTPS the traffic from Gov.sg. 14

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

GAODE-MAP Web ALIBABA-GROUP/HTTP/HTTP2 Gaode Map is an online mapping service. Gaode Map belongs to HTTPS/SPDY/SSL Alibaba Group.

GOOGLE-NEWS Web GOOGLE-GEN Google News is a news aggregator and application. Google News is a product of Google.

GOOGLE-BLOG Web GOOGLE-GEN/HTTP/SSL Google Blog is a public blog of Google.

GOOGLE-ADS Web GOOGLE-GEN/HTTP/HTTP2 This AppID detects SSL access to DoubeClick. DoubleClick is an HTTPS/QUIC/SPDY/SSL advertisement service. Google bought DoubleClick in 2007.

GRAB Web AMAZON/AMAZON-AWS/HTTP/ Taxi is a company offering ride hailing service in South East of . HTTP2/HTTPS/SPDY/SSL

GOOGLE-VIDEO Web GOOGLE-GEN hosting service provides video streaming to Google Youtube applications.

GOOGLE- Web SSL/SIP/STUN/QUIC/RTSP/SPDY Google Takeout allows users of Google products to export their data TAKEOUT HTTP2/HTTP-PROXY to a downloadable archive file. The GOOGLE-GEN classification of the download is gstatic.

GOOGLE-API Web GOOGLE-GEN/HTTP/HTTP2 Google APIs is a set of application programming interfaces (APIs). Google HTTP-PROXY/SPDY/SSL API is a product of Google. Google API allows communication between Google services and their integration to other services. 15

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

GVCP Multimedia UDP Give Vision Control Protocol is a standard for industrial cameras (GVCP). Several companies support this standard. This plug-in classifies GVCP traffic related to control and discovery.

GAANA Multimedia AKAMAI-SSL/AKAMAI-VIDEO Gaana is an application of musical streaming. SSL/SIP/STUN

QUIC/RTSP/SPDY/HTTP2

HTTP-PROXY/HTTP/HTTPS

GLOBE-TELCO Web SSL/SIP/STUN/QUIC/RTSP/SPDY Globe Telecom is a provider of services in the HTTP2/HTTP-PROXY Philippines. The plug-in classifies AMAZON-AWS website traffic of Globe Telecom.

CLOUDFLARE/HTTP/HTTPS

GCASH Web SSL/SIP/STUN/QUIC/RTSP/SPDY Gcash is a mobile payment application. The plug-in classifies HTTP2/HTTP-PROXY website traffic of Gcash. GLOBE-TELCO/HTTP/ZENDESK

HDFS Infrastructure HADOOP Hadoop uses this plug-in to store and exchange data across a cluster.

HTTP-INJECTOR Infrastructure EVOZI/SSH/TCP HTTP Injector is a VPN tool. This plug-in classifies the ssh tunneling.

HIKE- Messaging HTTP/HTTP2/HTTPS/SPDY/SSL/UDP is an instant messaging application. MESSENGER

HYPERS Web HTTP/HTTP2/HTTPS/SPDY/SSL Hypers is a cloud platform. This plug-in classifies only website browsing. 16

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

HEXATECH Infrastructure SSL/SIP/STUN/QUIC/RTSP Hexatech is a VPN to unblock any web site or application. SPDY/HTTP2/HTTP-PROXY

ANCHORFREE/HTTP/UDP

HARRY- Gaming HTTP/NIANTIC/SSL Harry Potter Wizards Unite is an online mobile game developed from POTTER-WU Niantic Labs.

HOXX-VPN Web DNS/SSL/VPN1-COM Hoxx VPN is a popular anonymizing web proxy. You can use Hoxx VPN to unblock websites and encrypt connection.

HOOQ Multimedia AKAMAI-SSL/AMAZON HOOQ is a streaming service for Asia. AMAZON-AWS

HTTP/HTTP2/HTTPS

/QUICKPLAY/SPDY/SSL

HBO Web SSL/SIP/STUN/QUIC/RTSP Home Box Office (or HBO) is an American pay TV channel. This plug-in SPDY/HTTP2 classifies website traffic of HBO. HTTP-PROXY/FASTLY

HTTP/HTTPS

HRPC Infrastructure HDFS HPRC is used between client and NameNode machine.

IFLIX Multimedia ADOBE/AKAMAI-SSL Iflix is a video streaming application based on the Akamai cloud service. AMAZON-AWS

HTTP/HTTP2/HTTPS

SPDY/SSL 17

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

I-WANT-TV Multimedia AKAMAI-VIDEO/SSL/SIP IWant TV is an over-the-top content (OTT) platform exclusively available STUN/QUIC in the Philippines. RTSP/SPDY/HTTP2/HTTP-PROXY

HTTP/HTTPS

IBOOKS Web APPLE-IOS-UPDATE-SSL iBooks is a standard iOS application to buy, read and manage books and APPSTORE/ITUNES audio books.

IRONSOURCE Web AKAMAI-SSL/HTTP/HTTP2/HTTPS IronSource is a digital content company. SPDY/SSL

IBM Web HTTP/HTTP2/HTTPS/SPDY/SSL International Business Machines Corporation (IBM) is an American multinational technology company.

INMOJI Web HTTP/HTTP2/HTTPS/SPDY/SSL Inmoji provides . This plug-in classifies the traffic from the Inmoji web site

INSKIN Web HTTP/HTTP2/HTTPS/SPDY/SSL Inskin is a media advertising company.

INJUSTICE-2 Gaming HTTP/HTTP2/HTTPS/SPDY/SSL This plug-in classifies Injustice-2 web site. is an . NetherRealm is the editor and Warner Bros is the publisher of Injustice 2.

IEC61850-SV Infrastructure 8021Q/ETH IEC 61850 Sampled Measured Values (SMV or SV) is a protocol that electrical substations use IEC61850-SV to share data between Intelligent Electronic Device (IED) under hard real time constraints (IEC 61850-9-2). 18

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

JIBE-CLOUD Web HTTP2/HTTPS/SPDY/SSL Jibe Cloud is a platform implementing Rich Communication Services (RCS). Google distributes this service to telecom operators integrating RCS.

JIBE Web HTTP/HTTP2/HTTPS/SPDY/SSL Jibe Cloud is a platform implementing Rich Communication Services (RCS). Google provides Jibe Cloud. This plug-in only handles traffic related to web page promoting Jibe Cloud.

JUMPSHARE Web AMAZON-AWS/DNS/HTTP/HTTP2 Jumpshare is a service. This plug-in classifies traffic from the HTTPS/SPDY/SSL basic offer.

JSCOUNT Web SSL/SIP/STUN/QUIC JsCount is a real-time website monitoring service for web server RTSP/SPDY/HTTP2 performance measurement. This HTTP-PROXY/HTTP/HTTPS plug-in classifies website traffic of JsCount.

JSFIDDLE Web HTTP/HTTP2/HTTPS/SPDY/SSL JSFiddle is an online web tools development.

KEKU Messaging AMAZON-AWS/HTTP KeKu provides virtual phone numbers to make and receive calls, and send HTTP2/HTTPS and receive SMS. QUIC/SIP/SPDY/SSL/STUN

KODI Infrastructure HEROKU/HTTP/HTTP2 Kodi (formerly XBox Media Center) is a free media player sofware HTTPS/SPDY/SSL application.

KAFKA Infrastructure TCP Kafka is a high throughput distributed messaging system.

LEARNET Web NS-SG Learnet2.ns.sg is an online training website for Singaporean soldiers. This plug-in classifies only the SSL traffic on learnet2.ns.sg. 19

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

LIBON Messaging HTTP/HTTP2/HTTPS is an application that provides international audio call feature. QUIC/RTCP/RTP owns Libon. SPDY/SSL/STUN

LINE2-COM Messaging HTTP/HTTP2/HTTPS/SPDY/SSL Line2 is a company that provides a second TCP/UDP/WINDOWS-AZURE phone number for USA or Canada.

LITRES-RU Web HTTP/HTTP2/HTTPS/SPDY/SSL This plug-in classifies traffic that Litres Audio and Listres Listen generate. Litres Audio and Listres Listen are e-book reader applications.

LIFESIZE Multimedia HTTP/HTTP2/HTTPS Lifesize is a video and audio telecommunications company. This QUIC/SPDY/SSL/STUN plug-in classifies the traffic from Android and Chrome platforms.

LOL-GAME Gaming AKAMAI-SSL/SSL/SIP League of Legends is a popular Multiplayer Online Battle Arena video STUN/QUIC game. Riot Games developed League RTSP/SPDY/HTTP2 of Legends.

HTTP-PROXY/HTTP

HTTPS/UDP/VIVOX

MYNT Web GLOBE-TELCO Mynt is a FinTech startup. Globe Telecom owns Mynt. The plug-in classifies website traffic.

MOJO Web AMAZON-AWS/HTTP/HTTP2 MOJO Marketplace offers themes, plug-ins and professional services for MARKETPLACE HTTPS/SPDY/SSL website creation on wordpress.

MOONTON Gaming HTTP/HTTP2/HTTPS/SPDY/SSL/TCP Moonton is a video game editor.

MONERO Web CLOUDFLARE/HTTP/HTTP2 This plug-in classifies traffic related to cryptocurrency Monero (XMR) HTTPS/SPDY/SSL/TCP mining and web traffic from web site. 20

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

MOJANG Gaming HTTP/HTTP2/HTTPS/SPDY/SSL Mojang is a video game and software development corporation.

MONEROHASH Web HTTP/HTTP2/HTTPS Monerohash.com is a mining pool for Monero cryptocurrency. -COM MONERO/SPDY/SSL

MEGAPHONE- Web SSL/SIP/STUN/QUIC Megaphone provides podcast technology for publishers and FM RTSP/SPDY/HTTP2 advertisers. This plug-in classifies only HTTP-PROXY/FASTLY website traffic of Megaphone.

HTTP/HTTPS

MINEXMR-COM Web HTTP/HTTP2/HTTPS Minexmr.com is a mining pool for Monero cryptocurrency. MONERO/SPDY/SSL

MTALK Messaging HTTP/HTTP2/HTTPS/SIP/SPDY/SSL Mtalk is an instant messaging application that can provide a landline phone number.

MOBILE- Gaming HTTP/MOONTON/SSL/YOUME Mobile_legends provides in-app communication cloud services for LEGENDS games.

MOODLE Web AMAZON/AMAZON-AWS/HTTP Moodle is an open-source learning platform (MOOC). This plug-in HTTP2/HTTPS/SPDY/SSL classifies Moodle website, Moodle cloud instances and HTTP local instances.

MONDIA-MEDIÀ Web HTTP/HTTP2/HTTPS/SPDY/SSL Mondia Media is a content and entertainment services provider. This plug-in classifies website browsing traffic of Mondia Media.

MEDIUM Web SSL/SIP/STUN/QUIC/RTSP/SPDY Medium is an online publishing platform. HTTP2/HTTP-PROXY

HTTPS/ZENDESK 21

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

MODBUS-RTU Infrastructure TCP/UDP Modbus is a serial communications protocol. Programmable Logic Controllers (PLCs) commonly use Modbus to communicate.

MONDAY-COM Web HTTP/HTTP2/HTTPS/SPDY/SSL Monday.com is a collaboration solution for enterprise.

NETFLIX-VIDEO Multimedia AKAMAI-SSL/HTTP2/HTTPS Netflix Video classifies traffic related to Netflix Streaming service. SPDY/SSL

NETIGATE Web HTTP/HTTP2/HTTPS/MAXCDN Netigate is an enterprise feedback management platform. This plug-in SPDY/SSL classifies website traffic of Netigate.

NS-SG Web SSL/SIP/STUN/QUIC/RTSP/SPDY Ns.sg is the web portal for the National Service in Singapore. This HTTP2/HTTP-PROXY plug-in classifies the website traffic HTTP/HTTPS of Ns.sg.

MUMBLE Messaging HTTP/HTTP2/HTTPS Mumble is an open source, low-latency, high quality voice chat SPDY/SSL/UDP software. You can use Mumble while playing online games.

OTO-GLOBAL Messaging HTTP/HTTP2/HTTPS/SPDY/SSL OTO Global is an instant messaging application that provides feature to make landline or international calls.

OPENLOAD Web SSL/SIP/STUN/QUIC Openload is a file-hosting and file-sharing service. RTSP/SPDY/HTTP2

HTTP-PROXY/DISQUS

HTTP/HTTPS

OPERA-VPN Infrastructure HTTP2/HTTPS/SPDY/SSL Opera Web Browser provides Opera VPN. Opera VPN provides VPN fonctionalities. 22

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

OPEN- Web AKAMAI-SSL/AMAZON OpenSignal is a company that specializes in wireless coverage AMAZON-AWS/CLOUDFLARE mapping. This plug-in classifies traffic GOOGLE-API/HTTP/HTTP2 of OpenSignal traffic on iOS and Android platform. HTTPS/SPDY/SSL

PUBNUB Web HTTP/HTTP2/HTTPS/SPDY/SSL PubNub is a global Data Stream Network. This plug-in classifies only PubNub website traffic.

PATREON Web SSL/SIP/STUN/QUIC/RTSP/ Patreon is a crowdfunding platform.

SPDYHTTP2/HTTP-PROXY

AMAZON-AWS/HTTP/HTTPS

ZENDESK

PCCC Infrastructure CIP/ENIP Use Programmable Controller Communication Commands (PCCC) to control software running in Programmable Logic Controler (PLC). This plug-in classifies traffic from Rockwell/Allen-Bradley to communicate with SLC5, PLC5E and MicroLogix PLC for service.

PROTONMAIL Web HTTP/HTTP2/HTTPS This plug-in classifies ProtonMail website, webmail and mail SPDY/SSL/TCP/UDP applications.

PLAYKOT Gaming AKAMAI-SSL/HELPSHIFT Playkot Ltd. is a mobile application developer company. HTTP/HTTP2/HTTPS

SPDY/SSL

QUICKPLAY Multimedia AMAZON-AWS/BMFF/HTTP/HTTP2 Quickplay is a video service provider for IP connected devices. HTTPS/MPEGTS/SPDY/SSL 23

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

QUALTRICS Web AKAMAI-SSL/SSL/SIP/STUN/QUIC Qualtrics is a major online survey platform. This plug-in classifies web RTSP/SPDY/HTTP2 site browsing traffic of HTTP-PROXY/HTTP/HTTPS

REALVNC Gaming HTTP/HTTP2/HTTPS/QUIC/SPDY RealVNC is a company that provides remote access software. This plug-in SSL/STUN/TCP/UDP classifies website browsing traffic of RealVNC.

REDIS Infrastructure TCP Redis is a data structure server. Redis is an in-memory data structure project.

ROCKYOU Web HTTP/HTTP2/HTTPS/SPDY/SSL RockYou is a full-service entertainment and media company.

ROCKWELL-RNA Infrastructure TCP Rockwell Network Applications (RNA) is Rockwell implementation of Windows DNA-M. Rockwell Factory Talk products use Rockwell to communicate.

RAKUTEN-VIDEO Multimedia AKAMAI-SSL/AMAZON-AWS Rakuten Video hosting service provides video streaming to Rakuten HTTP/HTTP2 TV application. HTTPS/LLNWD/SPDY/VERIZON

RAKUTEN-TV Multimedia SSL/SIP/STUN/QUIC Rakuten TV is a video-on-demand (VOD) streaming service. This plug-in RTSP/SPDY/HTTP2 classifies traffic from Rakuten TV for HTTP-PROXY/HTTP/HTTPS and .

RAKUTEN-VIDEO/ZENDESK 24

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

RING-CENTRAL Messaging ADOBE/AMAZON-AWS This plug-in classifies website traffic of RingCentral. RingCentral is an HTTP/HTTP2 application for video/audio HTTPS/SALESFORCE/SPDY conferencing.

SSL/ZOOM

SOURCE-ENGINE Gaming HTTP/HTTP2/HTTPS/SPDY/UDP This plug-in classifies online games using Valve's Source engine, such as HalfLife, CounterStrike, and TeamFortress.

STREAMCO- Multimedia AKAMAI-SSL/HTTP/HTTP2 StreamCo Media, Ltd is a solutions company. MEDIA HTTP-PROXY

HTTPS/QUIC/SPDY/SSL

SPLUNK-CLOUD Infrastructure SSL/SIP/STUN/QUIC Splunk Cloud is the data collection, indexing, and visualization service for RTSP/SPDY/HTTP2 operational intelligence. HTTP-PROXY/SPLUNK

SPLUNK-UFWD

STAN Multimedia AMAZON-AWS/HTTP Stan is an subscription-based video on demand streaming company. Stan HTTP2/HTTP-PROXY is subsidiary of StreamCo. HTTPS/QUIC/SPDY/SSL

STOREBUFF Web HTTP/HTTP2/HTTPS/SPDY/SSL Storebuff tests and analyzes network traffic from a given URL. This plug-in classifies traffic from web site.

SYMANTEC-SEP Infrastructure DCERPC/HTTP/HTTP2 Symantec Endpoint Protection is a security software suite, which consists HTTPS/SPDY/SSL of anti-malware, intrusion prevention and firewall features for servers and desktops. Symantec developed Symantec Endpoint Protection. 25

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

STARZ Multimedia SSL/SIP/STUN/QUIC/RTSP/SPDY Starz is an American cable and satellite television network. This HTTP2/HTTP-PROXY plug-in classifies traffic from Starz. AMAZON/BMFF/FASTLY

HTTP/HTTPS/MPEGTS

SPRINGTECH- Infrastructure HTTP/HTTP2/HTTPS/SPDY/SSL This plug-in classifies traffic from SpringTech VPN services. VPN TCP/UDP

SIGNIANT Infrastructure SSL/SIP/STUN/QUIC/RTSP/SPDY Media Shuttle is a cloud based file sharing solution from Signiant HTTP2/HTTP-PROXY/HTTP targeting high volume transfers. HTTPS/TCP/UDP

SIMPLI-FI Web SPDY/SSL This protocol plug-in classifies LiveRail which is an online video advertising platform.

TALKBOX Messaging HTTP/HTTP2/HTTPS/SPDY TalkBox is a mobile group chat application from Hong Kong with SSL/TCP/UDP support for voice .

TARGET-COM Web ADOBE/SSL/SIP/STUN/QUIC/RTSP Target Corporation is the department store retailer in the . SPDY/HTTP2/HTTP-PROXY This plug-in classifies traffic from HELPSHIFT/HTTP Target website and Android application. HTTPS/SALESFORCE

TRELLO Web SSL/SIP/STUN/QUIC/RTSP/SPDY Trello is list making application.

HTTP2/HTTP-PROXY/AMAZON

AMAZON-AWS/HEROKU

HTTP/HTTPS/ZOHO-SSL 26

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

TESLA Web SSL/SIP/STUN/QUIC/RTSP/SPDY Tesla, Inc. is an automotive and energy company. This plug-in HTTP2/HTTP-PROXY/HTTP/ classifies website traffic of Tesla Inc. HTTPS/QUALTRICS/SALESFORCE

TEXTPLUS Messaging HTTP/HTTP2/HTTPS/RTCP/RTP TextPlus is an instant messaging application for the US and Canada. SPDY/SSL/STUN

TIANGE-9158 Web HTTP/HTTP2/HTTPS Tiange 9158 is a that provides streaming and broadcast live SPDY/SSL/TCP/UDP video feature. This plug-in does not support the traffic of broadcast of live video workflow.

TWEAKWARE Infrastructure HTTP/HTTP2/HTTPS/SPDY/TCP Tweakware is a VPN application.

TIM-VISION Web TIM Tim Vision is a smart phone application and web application. Tim Vision is a product of TIM.

TIM Web ADOBE/SSL/SIP/STUN/QUIC/RTSP Tim is an telecommunication company. This plug-in classifies the SPDY/HTTP2/HTTP-PROXY website browsing. APPLE-HLS/HTTP/HTTPS

MONDIA-MEDIA/SILVERLIGHT

TIKL Messaging AMAZON-AWS/FLURRY/HTTP Tikl is a simple Voice over Internet Protocol (VoIP) communication HTTP2/HTTPS/SPDY/SSL/TCP/UDP application.

TANIUM Infrastructure TCP Tanium is an Endpoint Detection and Response (EDR) solution. It is Endpoint Management System to protect enterprise against cyber threats. This plug-in classifies Tanium Client traffic. 27

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

TVB Web SSL/SIP/STUN/QUIC/RTSP/SPDY Television Broadcasts Limited is a Hong Kong based audio-visual group. HTTP2/HTTP-PROXY/AMAZON-AWS This plug-in classifies only website HTTP/HTTPS browsing traffic of TVB.

TIBBR Web TIBCO Tibbr is a social network for work. This plug-in classifies traffic of Tibber.

TUNNELBEAR Infrastructure AMAZON-AWS/DNS/HTTP TunnelBear VPN is a desktop application and browser extension HTTP2/HTTPS/SPDY/SSL that provide VPN. TCP/UDP/ZENDESK

TIBCO Web HTTP/HTTP2/HTTPS/SPDY/SSL This protocol is a generic layer. All the Tibco protocols use this protocol as a base.

TOYO- Infrastructure TCP This layer classifies only a limited number of protocols that Toyo PROTOCOL hardware (PLC) uses.

TRIBAIR Messaging SSL/SIP/STUN/QUIC Tribair is an Voice over Internet Protocol (VoIP) application for RTSP/SPDY/HTTP2 national and international audio calls. HTTP-PROXY/HTTP

HTTPS/IAX2

TIM-MUSIC Web TIM Tim Music is a application and web application. TIM provides Tim Music.

UNITY Gaming SSL/SIP/STUN/QUIC Unity is a 3D engine supported by more than 25 platforms. This plug-in RTSP/SPDY/HTTP2 focuses on the video game services. HTTP-PROXY/GOOGLE-API

HTTP/HTTPS

QUALTRICS 28

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

UDT Infrastructure UDP This plug-in supports fourth version of UDT over UDP. It is a protocol for high performance data transfer with and session control.

VENTRILO Messaging HTTP/HTTP2/HTTPS is a low-latency, encrypted voice chat software. You can use SPDY/TCP/UDP Ventrilo while playing online games.

VPN1-COM Web DNS/HTTP/HTTP2 vpn1.com is a website hosts two popular proxies, Hoxx VPN and HTTPS/SPDY/SSL/ setupvpn. TCP/VPN1-COM

VYKE Messaging HTTP/HTTP2/HTTPS Vyke is an Instant Messaging allowing to buy phone number from countries RTCP/RTP/SPDY/SSL such US, UK, Canada and do VoIP, text messaging (SMS), and usual chat.

VOXER Messaging HTTP/HTTP2/HTTPS/SPDY/SSL Voxer is an instant messaging application that provides voice, text, photo, and video with walkie talkie messaging (Push-to-talk PTT) features in a secure messaging application.

VISUAL-IQ Web HTTP/HTTP2/HTTPS/SPDY/SSL Visual IQ is a marketing solution provider.

VUNGLE Web SSL/SIP/STUN/QUIC Vungle is a mobile advertising platform. RTSP/SPDY/HTTP2

HTTP-PROXY/HTTP/HTTPS

VIU Multimedia AMAZON/AMAZON-AWS Viu is an Asian streaming application.

HTTP/HTTP2

HTTPS/SPDY/SSL 29

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

W3SCHOOLS Web SSL/SIP/STUN/QUIC W3Schools is an educational website for learning web technologies online. RTSP/SPDY/HTTP2

HTTP-PROXY/HTTP/HTTPS

WINDSCRIBE Infrastructure CLOUDFLARE/HTTP2/HTTPS Windscribe is a desktop application and browser extension that provides ESP-OVER-UDP/IKE/SPDY/SSL VPN and Ad blocker features.

WISH-COM Web HTTP/HTTP2/HTTPS/SPDY/SSL Wish is an e-commerce website and application.

WB-GAMES Gaming HTTP/HTTP2/HTTPS/SPDY/SSL This protocol plug-in classifies traffic related to Warner Bros Interactive Entertainment. Warner Bros. Interactive Entertainment (also known as WB Games) is the video game production arm of Warner Bros.

WEBRTC Web DTLS/STUN WebRtc is a free, open-source project that provides real-time communication (RTC) API for web browsers and mobile applications.

XMRPOOL-EU Web HTTP/HTTP2/HTTPS/MONERO Xmrpool EU is mining pool for Monero cryptocurrency. SPDY/SSL

X-VPN Infrastructure FTP/FTP-DATA/HTTP/HTTP2/HTTPS X-VPN is a VPN service. You can use this to unblock sites and browse SMTP/SPDY/SSL/TCP/UDP privately and anonymously on your Android devices.

YAHOO- Messaging HTTP/HTTP2/HTTPS/SPDY/SSL Yahoo Together is a group messaging application. TOGETHER

YOUME Messaging DNS/HTTP/HTTP2/HTTPS Youme provides in-App communication cloud services for SPDY/SSL/TCP/UDP games. 30

Table 2: New Applications (continued)

Application Application Name Type Reported Over Description

YANDEX-TAXI Web HTTP/HTTP2/HTTP-PROXY Yandex Taxi is a Russian online transportation network company QUIC/SPDY/SSL/YANDEX which connects smartphone useres looking for a trip with drivers.

YOLO Web AMAZON/AMAZON-AWS Yolo is an application to send questions and answers to HTTP2/HTTPS/SPDY/SSL users. Currently, Yolo is only available on iOS.

Updated Applications

Table 3 on page 30 shows the applications that this release of JDPI-Decoder is updating.

Table 3: Updated Applications

Application Application Name Type Reported Over Description

AUTODESK Infrastructure AMAZON-AWS/HTTP/HTTP2 Fusion 360 is a SaaS CAM and CAD application from Autodesk. This HTTP-PROXY/HTTPS/QUIC signature classifies traffic from both SPDY/SSL the Web and Desktop versions of the application. This application also classifies generic web access to Autodesk's website.

BITTORRENT P2P HTTP/HTTP2/HTTP-PROXY/HTTPS This signature detects the network connections of different BitTorrent QUIC/SOAP/SOCKS4SOCKS5/SPDY clients. This signature, along with SPID/SSL/TCP/UDP/UTP others signatures, can prevent BitTorrent file sharing. 31

Table 3: Updated Applications (continued)

Application Application Name Type Reported Over Description

CISCO-RRM Infrastructure UDP Cisco Wireless LAN controller coordinates a set of Cisco wireless LAN access points. This plug-in classifies the Neighbor Discovery Packet (NDP) packets and the protocol used between wireless LAN controller (WLC) instances for the radio resource management functionality. The WLC also communicates with the access points using CAPWAP tunnels and classifies the protocols.

DCERPC Infrastructure HTTP/SMB/TCP/UDP The DCERPC protocol is an RPC implementation. Distributed Computing Environments USES DCERPC protocol. Microsft Exchange and many other software applications use DCERPC protocol.

DNS Infrastructure CLOUDFLARE/GOOGLE This signature detects Domain Name System (DNS), which is used for GOOGLE-GEN/HTTP/HTTP2 Internet mail and host address HTTPS/MOZILLA/SPDY/SSL support.

TCP/UDP

EMC- Infrastructure TCP Clariion is a SAN product line from EMC. NaviSphere is the remote NAVISPHERE configuration interface of Clarion. This plug-in classifies the internal communication protocols and web interface of NaviSphere.

FULLSTORY Web SSL/SIP/STUN/QUIC/RTSP/SPDY FullStory is a digital analytics platform. This plug-in classifies HTTP2/HTTP-PROXY/HTTP/HTTPS website traffic of FullStory. 32

Table 3: Updated Applications (continued)

Application Application Name Type Reported Over Description

FLEXERA Infrastructure ADOBE/SSL/SIP/STUN This plug-in classifies FLEXNet license servers and Flexera website. QUIC/RTSP/SPDY/HTTP2

HTTP-PROXY/HTTP/HTTPS

TCP

GE-PROFICY Infrastructure TCP Proficy is a General Electric product for industrial environment. Proficy monitors and do data management from SCADA network. This plug-in classifies traffic related to Proficy Gateway service (PR Gateway) and Proficy Licensing server (PR Licensing).

HADOOP Infrastructure TCP Apache Hadoop is an open source tool that enables distributed parallel processing of huge amounts of data across servers that both store and process the data.

HBASE Infrastructure HDFS Hbase is a distributed database based on Google Bigtable.

IMO Messaging HTTP/HTTP2/HTTP-PROXY IMO is a Web-based instant-messaging service that HTTPS/QUIC/SPDY/SSL provides unified access to many TCP/UDP popular messaging protocols. This AppID detects Imo.im.

ICF- Web HTTP/HTTP2/HTTPS/SPDY/SSL ICF Technology is a provider of high-definition video streaming and TECHNOLOGY credit card processing services. Numerous adult content services have icf_technology as a subflow.

IPERF Infrastructure TCP/UDP Self-titled tool for network performance measures uses the iPerf protocol. 33

Table 3: Updated Applications (continued)

Application Application Name Type Reported Over Description

JETDIRECT Infrastructure TCP HP network printers use the Jetdirect protocol.

LDAP Infrastructure TCP/UDP This signature detects Lightweight Directory Access Protocol (LDAP), which is a networking protocol for querying and modifying directory services running over TCP/IP. The default port for LDAP is TCP/UDP 389.

MILESTONE- Multimedia DNS/HTTP/HTTP2/HTTPS Milestone Systems is an IP video management software platform. This SYSTEMS SPDY/SSL plug-in classifies only website traffic.

MOXA-ASPP Infrastructure HTTP2/HTTPS/SPDY This plug-in classifies ASPP (Async Server Proprietary Protocol) from SSL/TCP Moxa (NPort devices) without activating .

MS-SSAS Infrastructure SOAP Microsoft SQL Server Analysis Services (MS-SSAS) is optional component of SQL Server for OnLine Analytical Processing (OLAP). This plug-in classifies XMLA (XML for Analysis), which is a SOAP protocol for accessing those .

MS-DIME Infrastructure TCP Direct Internet Message Encapsulation (DIME) is a lightweight binary format to encapsulate a binary payload along with its type. This plug-in handles version 1 of Dime.

MSSQL Infrastructure TCP This siganture detects Microsoft SQL Server database which uses TDS (Tabular Data Stream). TDS is a protocol or a set of rules to transmit data between two computers. By default, MS SQL Server uses TCP port 1433. 34

Table 3: Updated Applications (continued)

Application Application Name Type Reported Over Description

MYTV-SUPER Web TVB MyTV SUPER is an online video platform. TVB operates MyTV SUPER. This plug-in classifies only website browsing.

MINERGATE- Web HTTP/HTTP2/HTTPS/MONERO Minergate.com is a mining pool for Monero cryptocurrency. COM SPDY/SSL

MS-TEAMS Messaging HTTP/MICROSOFT is a chat-based workspace in Office 365. Most of the OFFICE365-CREATE-CONVERSATION application traffic is classified as SSL or office365.

NDMP Infrastructure TCP NDMP (Network Data Management Protocol) is an open protocol for enterprise-wide network based backup over TCP.

OFFICE365 Web AKAMAI-SSL/HTTP/HTTP2 This AppID detects a new email in Office365. Office365 is the corporate HTTP-PROXY/HTTPS/QUIC/SPDY cloud based office suite. This SSL/WINDOWS-AZURE signature may require SSL Forward Proxy configuration.

ORACLE-OEM Infrastructure HTTP2/HTTPS/SPDY/SSL This module classifies the traffic from ORACLE OEM Management. Oracle OEM (Oracle Enterprise Manager / Enterprise Manager Cloud Control) is an orchestrator for the IT and cloud instances. It deploys and configure Oracle products, including Oracle from PXE.

OPTIMICDN Web HTTP/HTTP2/HTTPS/SPDY/SSL OptimiCDN pilots multiple CDNs is an All-in-One Multi CDN service for optimized web performances and enhanced User Experience. 35

Table 3: Updated Applications (continued)

Application Application Name Type Reported Over Description

PREZI Web AKAMAI-SSL/AMAZON Prezi is a presentation software. This plug-in classifies traffic from AMAZON-AWS/HTTP Individual Premium features of Prezi. HTTP2/HTTPS/SPDY/SSL

PI-DATA Infrastructure TCP This is an OSI PI DataArchive and Server SCADA protocol.

QUIC Web UDP QUIC is an open networking protocol developed primarily at Google for transporting web content.

ROCKWELL- Infrastructure TCP Rockwell Network Applications (RNA) is Rockwell implementation of RNA Windows DNA-M. RNA establishes communication between Rockwell FactoryTalk products.

ROCKWELL Web ADOBE/AKAMAI-SSL/HTTP/HTTP2 This plug-in classifies the Rockwell Automation websites and related API. HTTPS/ORACLE

SPDY/SSL/WINDOWS-AZURE

RIPPLE Web AMAZON/FASTLY/HTTP/HTTP2 Ripple is a cryptocurrency but unlike other it is not based HTTPS/SPDY/SSL on a block chain. RippleNet design is more centralized.

SKYPE Infrastructure HTTP/HTTP2/HTTP-PROXY/HTTPS This signature detects SSL access to any of the Skype domains. Skype is a MICROSOFT/MS-TEAMS/SIP/SPDY Voice Over Internet Protocol (VOIP) SSL/STUN/TCP/UDP and popular instant messenger from Microsoft. WINDOWS-AZURE

SPEEDTEST Web FTP/HTTP/HTTP2/HTTPS Speed test is a Web site and a mobile application to test both SPDY/SSL/TCP/UDP and latency of any internet connection. 36

Table 3: Updated Applications (continued)

Application Application Name Type Reported Over Description

SPOTIFY Multimedia AKAMAI-SSL/AMAZON-AWS is a music streaming service.

FASTLY

GOOGLE-ANALYTICS-TRACKING

HTTP/HTTP2

HTTP-PROXY/HTTPS/RTMP

SOCKS4/SOCKS5/SPDY/SSL

TCP//UDP

SCCP Infrastructure TCP This AppID detects the Skinny Call Control Protocol, which is a lightweight protocol for session signaling with Cisco CallManager.

TELEGRAM Messaging HTTP/HTTP2/HTTPS/SPDY/SSL is an instant messaging protocol such as Whatsapp. TCP/UDP

TIKTOK Messaging BYTEDANCE TikTok is a social network application. TikTok allows its users to share live stream video content.

TEXTME Messaging AMAZON-AWS/HTTP Text Me is an instant messaging application which can make texting HTTP2/HTTPS and calling to any phone and make ITUNES/RTP/SPDY/SSL national and international calls.

ZENDESK

TAOBAO Web ALIBABA-CLOUD/HTTP This AppID detects Taobao, which is a non-stop online platform for HTTP2/HTTPS shopping, socializing, and information SPDY/SSL/TCP sharing for consumers in China.

TALKRAY Messaging AMAZON-AWS/FLURRY/HTTP Talkray is an instant messaging application. HTTP2/HTTPS/SPDY/TCP/UDP 37

Table 3: Updated Applications (continued)

Application Application Name Type Reported Over Description

TECH-RADAR Web HTTP/HTTP2/HTTPS/SPDY/SSL TechRadar is a technology news web site.

TENOR Web HTTP/HTTP2/HTTPS/SPDY/SSL Tenor is a Graphics Interchange Format (GIF) search engine.

TELNET Remote-access TCP This signature detects Telnet, which is an remote text-based login protocol. Telnet usually runs on TCP port 23.

UBISOFT Gaming AKAMAI-SSL/HTTP Ubisoft is an online Game software editor and publisher. HTTP2/HTTPS/SPDY

SSL/TCP/UDP

VONAGE- Messaging HTTP/HTTP2/HTTPS/SIP Vonage Mobile is an instant messaging application that provides MOBILE SPDY/SSL/STUN/TCP/UDP features to make landline or international calls.

XPROTECT Multimedia HTTP/HTTP2/HTTPS Xprotect is a professional video surveillance system from Milestone MILESTONE-SYSTEMS Systems. This plug-in only supports SOAP/SPDY/TCP the demonstration version on mobile devices.

YOPMAIL Web HTTP/HTTP2/HTTPS/SPDY YOPmail is a disposable email platform. YOPmail provides a fake temporary and anonymous email address.

ZENDESK Web AMAZON-AWS/CLOUDFLARE/DNS Zendesk is a cloud-based customer service platform that includes HTTP/HTTP2/HTTPS/QUIC/SPDY ticketing, self-service options, and SSL/TCP/UDP customer support features. 38

Table 3: Updated Applications (continued)

Application Application Name Type Reported Over Description

ZOOM Messaging SSL/SIP/STUN/QUIC/RTSP/SPDY Zoom Video Conferencing is also known as Zoom by users. This HTTP2/HTTP-PROXY/HTTP application combines video HTTPS/TCP/UDP conferencing, online meetings, and mobile collaboration into one platform.

Custom Applications

This release of JDPI-Decoder is not introducing any enhancements to the custom applications.

New or Modified Application Groups

Table 4 on page 38 shows the application groups and the applications that this release of JDPI-Decoder is adding or modifying.

Table 4: Modified Application Groups

Application Group Name Applications Details

applications:gaming Added AGE-OF-MAGIC, BRAWLHALLA, CALL-OF-DUTY, DEMONWARE, DRAGON-BALL, HARRY-POTTER-WU, INJUSTICE-2, LOL-GAME, MOONTON, MOJANG, MOBILE-LEGENDS, PLAYKOT, REALVNC, SOURCE-ENGINE, UNITY, and WB-GAMES applications to the application group. 39

Table 4: Modified Application Groups (continued)

Application Group Name Applications Details

applications:infrastructure Added ACRONICS-BACKUP, AUTODESK, ANCHORFREE, ANYWHEREUSB, BARRACUDA-VPN, CODEMETER, CISCO-SMARTPROBE, CISCO-SDAVC, COUCHBASE, CISCO-AMC, CYBERGHOST, DNS, FLEXERA, PCCC, CISCO-IP-SLA, CISCO-NMSP, DNS-CRYPT, EXPRESSVPN, EPROXY, ERLANG-DISTRIBUTION, FTPS-DATA, DICOM, FIREFOX-VPN, EPDG-TUNNEL, HDFS, HTTP-INJECTOR, HEXATECH, HRPC, IEC61850-SV, KODI, KAFKA, LDAP, MODBUS-RTU, OPERA-VPN, REDIS, ROCKWELL-RNA, SPLUNK-CLOUD, SYMANTEC-SEP, SPRINGTECH-VPN, SIGNIANT, SKYPE, TWEAKWARE, TANIUM, TOYO-PROTOCOL, TUNNELBEAR, UDT, VPN-MASTERPRO, VPN-MONSTER, WINDSCRIBE, and X-VPN applications to the application group.

applications:messaging Added ALICALL, CISCO-UCM, COCO, DISCORD, ETISALAT-C-ME, FREEPP, HIKE-MESSENGER, KEKU, LIBON, LINE2-COM, MTALK, MUMBLE, OTO-GLOBAL, RING-CENTRAL, TALKBOX, TEXTPLUS, TIKL, TRIBAIR, VENTRILO, VYKE, VOXER, YAHOO-TOGETHER, and YOUME applications to the application group.

applications:multimedia Added CMORE, DAZN, FUZE, GVCP, GAANA, HOOQ, IFLIX, I-WANT-TV, LIFESIZE, MS-TEAMS, NETFLIX-VIDEO, QUICKPLAY, RAKUTEN-VIDEO, RAKUTEN-TV, STREAMCO-MEDIA, STAN, STARZ, VIU, and ZOOM applications to the application group.

applications:remote-access Added ARD, TELNET applications to the application group. 40

Table 4: Modified Application Groups (continued)

Application Group Name Applications Details

applications:web Added 9GAG, 24SEVENOFFICE, 4SYNC, ACRONICS-CLOUD, ACRONICS, AWS-CONSOLE, AMAZON-COGNITO, ALIBABA-GROUP, ANONYTUN-VPN, ACCOUNTKIT, ARTE-TV, APPLE-NEWS, ALIBABA-CLOUD, APPNEXT, AIR-WATCH, BIGO, BARRACUDA, BLUEHOST, BYTEDANCE, CISCO-CMX-CLOUD, CISCO, COINIMP, CRYPTO-POOL-FR, CODEPEN-IO, CIBN, CISCO-CORP-TV, CAKE-HR, DISCOURSE, DIDI, EVOZI,BIGBIGCHANNEL, DWARFPOOL-COM, FOXPLUS, DUCKDUCKGO, EASY-ANTI-CHEAT, FANDOM, FAST-COM, FOXNETWORKS, FUTURE-PLC, FACE-APP, GRAMMARLY, GOOGLE-ONE, GOOGLE-BOOKS, GOV-SG, GAODE-MAP, GOOGLE-NEWS, GOOGLE-BLOG, GOOGLE-ADS, GRAB, HBO, GOOGLE-VIDEO, GOOGLE-TAKEOUT, GOOGLE-API, GLOBE-TELCO, GCASH, HYPERS, HOXX-VPN, IRONSOURCE, IBM, INMOJI, INSKIN, JIBE-CLOUD, JIBE, JUMPSHARE, JSCOUNT, JSFIDDLE, LITRES-RU, MYNT, MOJOMARKETPLACE, MONERO, MONEROHASH-COM, MEGAPHONE-FM, MINEXMR-COM, MOODLE, MONDIA-MEDIÀ, MEDIUM, MONDAY-COM, NETIGATE, NS-SG, OPENLOAD, OPEN-SIGNAL, PUBNUB, PATREON, PROTONMAIL, QUIC, QUALTRICS, ROCKYOU, STOREBUFF, SIMPLI-FI, TARGET-COM, TRELLO, LEARNET, TESLA, TIANGE-9158, TIM-VISION, TIM, TVB, TIBBR, TIBCO, TIM-MUSIC, VPN1-COM, VISUAL-IQ, VUNGLE, IBOOKS, W3SCHOOLS, WISH-COM, WEBRTC, XMRPOOL-EU, YANDEX-TAXI, and YOLO applications to the application group.

Obsolete Applications

Table 5 on page 41 shows the applications that are obsolete either because they are no longer in use in the field or they have been replaced with more recent applications. While configuration commit will not fail if these obsolete applications are already configured, the recommendation is to remove these applications from configurations of AppSecure modules (AppFW, AppQoS, APBR, AppQoE and Unified Policy), as they will no longer be classified or reported. The applications which have been replaced are added as an alias under a related application which are provided in the specific reason column. You cannot configure a new policy with these obsolete applications, instead you can use the related applications mentioned in the specific reason column where available. 41

Table 5: Obsolete Applications

Application Name Specific Reason Description

AIMEXPRESS Not applicable This signature detects AIM Express, which is a Web-based instant messaging and e-mail system used to communicate with others using a Web browser.

BABELGUM Not applicable This signature detects Babelgum, which is a Web-based multimedia portal. Use Babelgum to stream music, movies, and television programs over the Internet.

BIGADDA Not applicable BIGADDA is an Indian e-commerce website, and a subsidiary of .

BONPOO Not applicable Bonpoo provides a free, email-based file-sharing service.

BLIP-TV-STREAM Not applicable This signature detects video streaming from .tv

BT-WRZRU Not applicable This plug-in is a Bittorrent tracker search engine.

CORALCDN Not applicable This signature detects any Web client attempting to retrieve content that Coral network caches.

CIRCLEOF FACEBOOK-CIRCLEOFMOMS replaced Circle of Moms is a parenting social network CIRCLEOFMOMS. for mothers to share stories, problems, and MOMS tips of motherhood.

CSTRIKE SOURCE-ENGINE replaced CSTRIKE. CounterStrike game uses Cstrike protocol.

DOTME Not applicable This signature detects access to the Apple MobileMe product.

DOUBLECLICK GOOGLE-ADS REPLACED DOUBLECLICK. This signature detects access to Doubleclick, which is an internet advertising and tracking service.

FACEBOOK-MAIL FACEBOOK-MAIL is now a part of Facebook This signature detects and can block usage of Messenger. the Facebook mail functionality. 42

Table 5: Obsolete Applications (continued)

Application Name Specific Reason Description

FEDGEWING Not applicable FledgeWing is an online community aimed at entrepreneurial university students.

FILESTUBE Not applicable This signature detects Filetubes, which is a Web-based file sharing application that is used to share files with people over the Internet.

FRIENDSTER Not applicable This signature detects Friendster, which is a membership-based online gaming service.

GE-PROCIFY Replaced with GE-PROFICY Proficy is a General Electric product for industrial environment allowing monitoring and data management from SCADA network. This plug-in classifies traffic related to Proficy Gateway service and Proficy Licensing server.

GROOVESHARK- Not applicable This signature detects requests for streaming music from Grooveshark.com. STREAMING

GRABOID-SSL GRABOID replaced GRABOID-SSL. This signature detects Graboid. Graboid is an application that searches the internet for videos and makes it simple to view them as a streaming video.

GOOGLE- GOOGLE-PLUS replaced GOOGLE-PLUS-SSL. This signature detects SSL access to Google Plus, which is an social network from Google. PLUS-SSL

GOOGLE- GOOGLE-ADS replaced This signature detects SSL access to GOOGLE-ADSERVICES-SSL. DoubeClick. DoubleClick is an advertisement ADSERVICES- service from Google. SSL

GOOGLE- YOUTUBE replaced GOOGLE-VIDEOS. Google Videos is a video search engine.

VIDEOS 43

Table 5: Obsolete Applications (continued)

Application Name Specific Reason Description

HALF-LIFE SOURCE-ENGINE replaced HALF-LIFE. Half-Life is a real time gaming protocol. Many different games such as Half-Life, Half-Life 2, Counter-Strike, Counter-Strike: Source, Call of Duty 4 use Half-Life.

HOT-VPN Not applicable HotVPN helps you to access blocked applications and websites.

IPP-AH Not applicable IPP Type 51 - IPP-AH - is an authentication Header

IWIW Not applicable This signature detects IWIW, which is a Hungarian social networking Web site.

IPP-ESP Not applicable IPP Type 50 - IPP-ESP - is Encap Security Payload

JAJAH-WEB Not applicable This signature detects Jajah as service that connects existing traditional landlines or mobile phones with calls initiated from the cloud.

JUSTIN-TV Not applicable This signature detects Justin.tv, a YouTube like Web site that allows users to produce or watch live streaming video.

KINGDOMXXX Not applicable Kingdom xxx is a Bittorrent tracker search engine.

KHMER-NEWS Not applicable Khmer News is a Cambodian news portal.

LIVE-STORAGE LIVE-STORAGE moved to ONEDRIVE plug-in. This signature detects access to Skydrive over SSL. Skydrive is part of the Live suite of applications and is responsible for cloud storage.

MEGASHARES-COM Not applicable Classifies web browsing on the megashares.com Direct DownLoad links service. 44

Table 5: Obsolete Applications (continued)

Application Name Specific Reason Description

MEGAUPLOAD Not applicable This signature detects , which is a Web-based file uploading portal used to host files for sharing.

MSN LIVE-STORAGE replaced MSN. MSN2GO is a Web-based Microsoft Messenger client.

MEGAUPLOAD Not applicable This signature detects MegaUpload, which is a Web-based file uploading portal used to host files for sharing.

MEGAVIDEO Not applicable This signature detects Megavideo, which is an online video streaming application similar to YouTube.

MINECRAFT-POCKET Not applicable Minecraft Pocket is a game about placing blocks and going on adventures.

MXIT Not applicable Mxit is a free instant messaging application developed by Mxit Lifestyle Ltd. in South Africa that runs on multiple mobile and computing platforms.

MULTIUPLOAD Not applicable This signature detects Multiupload, which is a Web-based file sharing application that is used to share files with people over the Internet.

NETLOG Not applicable This signature detects Netlog, which is a Belgian social networking Web site specifically targeted at the European youth demographic.

PANDO Not applicable Pando provides free file-sharing services and paid content-delivery for enterprises.

SAVEFILE-COM Not applicable Savefile.com classifies web browsing on the savefile.com Direct DownLoad links service.

SCIENCESTAGE Not applicable This protocol plug-in classifies the http traffic to the host sciencestage.com. 45

Table 5: Obsolete Applications (continued)

Application Name Specific Reason Description

SNAP-VPN SPRINGTECH-VPN replaced SNAP-VPN. SnapVPN helps you to access blocked applications and websites.

SKYROCK Not applicable This signature detects Skyrock, a social network that is targeted towards musicians.

TURBO-VPN SPRINGTECH-VPN replaced TURBO-VPN. Turbo VPN helps you to access blocked applications and websites.

UPLOADINGIT-COM Not applicable This plug-in classifies web browsing on the uploadingit.com Direct DownLoad links service.

VPN-MASTER SPRINGTECH-VPN replaced VPN-MASTER. VPN Master helps you to access blocked applications and websites.

VPN-MONSTER SPRINGTECH-VPN replaced VPN-MONSTER. VPN Monster helps you to access blocked applications and websites.

VPN-ROBOT SPRINGTECH-VPN replaced VPN-ROBOT. VPN Robot helps you to access blocked applications and websites.

VPN-MASTERPRO SPRINGTECH-VPN replaced VPN Master Pro helps you to access blocked VPN-MASTERPRO. applications and websites.

WIKIA FANDOM replacedWIKIA. This signature detects Wikia, which is a free wiki hosting service.

YAHOO-WEBMESSENGER YAHOO-TOGETHER replaced This signature detects Yahoo! WebMessenger, YAHOO-WEBMESSENGER. which lets users use the Yahoo! Messenger service without downloading the application.

YOURFILEHOST Not applicable This signature detects YourFileHost, which is a Web-based file sharing portal.

YMSG Not applicable This signature detects YMSG contact information. YMSG is the protocol that Yahoo! Messenger uses for standard operations.

YMSG-VIDEO Not applicable Yahoo Messenger uses this protocol to convert videos. 46

Table 5: Obsolete Applications (continued)

Application Name Specific Reason Description

YMSG-TRANSFER Not applicable This protocol is used for file tranfers over ymsg.

YMSG-CONF Not applicable This protocol is used in signaling part in a conference.

Resolved Issues

Table 6 on page 46 describes the issues that this release of JDPI-Decoder is resolving.

Table 6: Resolved Issues

PR Description

JDPI–Decoder

1279801 Need support to detect Google API applications.

1475961 SRX4100 cluster is unable to handle JetDirect Application.

1483136 SRX4100 cluster is unable to handle NaviSphere Application.

1500692 AppID labeling port 9389 as PI-Data, but it Active Directory (AD).

1501418 AppID is unable to detect customized application HTTP:USERAPP and traffic hit wrong policy.

1507754 AppID is unable to detect O365 auth traffic as O365 application.

1515793 AppID is unable to detect AWS/MS-SQL application traffic and marking the applications as unknown or inconclusive.

1519690 AppID is unable to detect Zoom and ms-teams-voice. SD-WAN for these applications are not routing correctly.

1522139 AppID is unable to detect Telnet.

1528365 AppID is unable to detect latest gQUIC implementation. 47

Requesting Technical Support

Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or Partner Support Service support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC.

• JTAC policies—For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at https://www.juniper.net/us/en/local/pdf/resource-guides/7100059-en.pdf.

• Product warranties—For product warranty information, visit http://www.juniper.net/support/warranty/.

• JTAC hours of operation—The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year.

Self-Help Online Tools and Resources

For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features:

• Find CSC offerings: https://www.juniper.net/customers/support/

• Search for known bugs: https://prsearch.juniper.net/

• Find product documentation: https://www.juniper.net/documentation/

• Find solutions and answer questions using our Knowledge Base: https://kb.juniper.net/

• Download the latest versions of software and review release notes: https://www.juniper.net/customers/csc/software/

• Search technical bulletins for relevant hardware and software notifications: https://kb.juniper.net/InfoCenter/

• Join and participate in the Juniper Networks Community Forum: https://www.juniper.net/company/communities/

• Create a service request online: https://myjuniper.juniper.net

To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: https://entitlementsearch.juniper.net/entitlementsearch/ 48

Creating a Service Request with JTAC

You can create a service request with JTAC on the Web or by telephone.

• Visit https://myjuniper.juniper.net.

• Call 1-888-314-JTAC (1-888-314-5822 toll-free in the USA, Canada, and Mexico).

For international or direct-dial options in countries without toll-free numbers, see https://support.juniper.net/support/requesting-support/. 49

Revision History

August 04, 2020—Revision 1, JDPI Release Notes

Copyright © 2020, Juniper Networks, Inc. All rights reserved.

Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners.

Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

Top View