1 Juniper Networks Deep Packet Inspection-Decoder (Application Signature) Release Notes August 04, 2020 Contents Recent Release History | 2 Overview | 2 New Features and Enhancements | 3 New Software Features and Enhancements Introduced in JDPI-Decoder Release 3313 | 3 New Applications | 3 Updated Applications | 30 Custom Applications | 38 New or Modified Application Groups | 38 Obsolete Applications | 40 Resolved Issues | 46 Requesting Technical Support | 47 Self-Help Online Tools and Resources | 47 Creating a Service Request with JTAC | 48 Revision History | 49 2 Recent Release History Table 1 on page 2 summarizes the features and resolved issues in recent releases. You can use this table to help you decide to update the JDPI-Decoder version in your deployment. Table 1: JDPI-Decoder Features and Resolved Issues by Release Release Signature JDPI Decoder Engine Engine Date Pack Version Version Version 4 Version 5 Features and Resolved Issues Aughst The relevant 1.460.2-43 4.20.0-111 5.3.0-61 This JDPI-Decoder version is 04, 2020 signature supported only on the Junos OS package 12.3X48-D80 and later releases, version is 3313. 15.1X49-D140 and later releases, and Junos OS 17.4R1 and later releases on all supported SRX Series platforms. Starting in Junos OS release 20.1R1, enhancements to custom applications are included in the JDPI-Decoder release. Overview The JDPI-Decoder is a dynamically loadable module that mainly provides application classification functionality and associated protocol attributes. It is hosted on an external server and can be downloaded as a package and installed on the device. The package also includes XML files that contain additional details of the list of applications and groups. The list of applications can be viewed on the device using the CLI command show services application-identification application summary. Additional details of any particular application can be viewed on the device using the CLI command show services application-identification application detail <application>. For additional details, see Application Signature. NOTE: This upgrade is only supported for Junos OS 12.3X48-D80 and later releases, 15.1X49-D140 and later releases, and 17.4R1 and later releases. This is because the older Junos releases have an engine which is incompatible with the 1.380.0 major protobundle version. So the older Junos releases will remain on JDPI-Decoder version 1.340.0-73.005 and there will be no more updates for these releases. 3 New Features and Enhancements IN THIS SECTION New Software Features and Enhancements Introduced in JDPI-Decoder Release 3313 | 3 New Applications | 3 Updated Applications | 30 Custom Applications | 38 The following sections describe new features and enhancements available in the JDPI-Decoder releases: New Software Features and Enhancements Introduced in JDPI-Decoder Release 3313 The following sections describe new features and enhancements available in JDPI-Decoder Release 3313. New Applications Table 2 on page 3 Shows the applications that this release of JDPI-Decoder is introducing. Table 2: New Applications Application Application Name Type Reported Over Description 9GAG Web HTTP/HTTP2/HTTPS/QUIC 9GAG is a Hong Kong–based online platform and social media website. SPDY/SSL 9GAG allows its users to upload and share content or other content from external social media websites 24SEVENOFFICE Web HTTP/HTTP2/HTTPS/SPDY/SSL 24SevenOffice is a web-based Enterprise resource planning (ERP) systems. 4 Table 2: New Applications (continued) Application Application Name Type Reported Over Description 4SYNC Web HTTP/HTTP2/HTTPS/SPDY/SSL 4Sync is a cloud storage service. ACRONIS- Web ACRONIS Acronis products including Acronis Backup use Acronis Cloud. CLOUD ACRONIS- Infrastructure ACRONIS Acronis Backup is a backup platform that use cloud or local storage, and BACKUP can save multiple hosts using agents. ACRONIS Web HTTP/HTTP2/HTTPS This plug-in classifies flows related to Acronis products. SPDY/SSH/SSL/TCP AWS-CONSOLE Web AMAZON-AWS/DNS/SSL AWS Console is a web application for managing Amazon Web Services. AMAZON- Web SSL/SIP/STUN/QUIC/RTSP Cognito is an Amazon AWS server that allows you to keep track of user. COGNITO SPDY/HTTP2/HTTP-PROXY AMAZON-AWS ALIBABA-GROUP Web HTTP/HTTP2/HTTPS/QUIC Alibaba Group Holding Limited is a Chinese multinational conglomerate SPDY/SSL specializing in e-commerce, retail, Internet, AI and technology. This plug-in is the default classification of domain names owned by Alibaba Group. ANCHORFREE Infrastructure DNS/HTTP/HTTP2/HTTPS AnchorFree is an anonymous VPN software from Betternet (formerly SPDY/SSL/TCP/UDP vpnintouch) company. ANONYTUN-VPN Web HTTP/HTTP2/HTTP-PROXY/ AnonyTun is an android VPN client to customize a few parameters related HTTPS/QUIC/SPDY/SSL/TCP to tunnel. 5 Table 2: New Applications (continued) Application Application Name Type Reported Over Description ANYWHEREUSB Infrastructure TCP AnywhereUSB Remote I/O Concentrator is a remote networking solution that utilizes USB over IP technology to enable you to connect USB devices over a network. This AppID classifies traffic from TCP/3422 related data from the devices connected to AnywhereUSB. AGE-OF-MAGIC Gaming AKAMAI-SSL/SSL/SIP/STUN Age of Magic is a single player video game for mobile platforms. QUIC/RTSP/SPDY/HTTP2 HTTP-PROXY/DNS/PLAYKOT/TCP ACCOUNTKIT Web HTTP/HTTP2/HTTPS/QUIC Account Kit is a product of Facebook. Account Kit uses your phone number SPDY/SSL or email address to let you quickly register to a registered app without a password. ARTE-TV Web AKAMAI-SSL/AKAMAI-VIDEO/HTTP Arte TV is a Franco-German television channel. This plug-in classifies traffic HTTP2/HTTPS/SPDY/SSL that the website generates. APPLE-NEWS Web HTTP/HTTP2/HTTPS/SPDY/SSL Apple News is a mobile app and news aggregator from Apple Inc. ALIBABA- Web BMFF/HTTP/HTTP2/HTTPS Alibaba Cloud, also known as Aliyun, is a Chinese cloud computing CLOUD QUIC/SPDY/SSL/TCP company. Alibaba Cloud is a subsidiary of Alibaba Group. APPNEXT Web AKAMAI-SSL/HTTP/HTTP2/HTTPS Appnext is mobile monetization, app marketing and re-engagement LLNWD/QUIC/SPDY/SSL platform. ARD Remote-access VNC/UDP Apple Remote Desktop allows you to manage Mac computers remotely. 6 Table 2: New Applications (continued) Application Application Name Type Reported Over Description ALICALL Messaging HTTP/HTTP2/HTTPS Alicall is an application that provides International Voice over Internet SPDY/SSL/UDP Protocol (VoIP) call feature. AIR-WATCH Web HTTP/HTTP2/HTTPS/SPDY/SSL Air Watch is a Mobile Device Management solution (MDM). This plug-in classifies the traffic that cloud solution generates. BIGO Web HTTP/HTTP2/HTTPS/SPDY/SSL BIGO social media company. BIGO allows you to watch live videos, broadcast your life and video chat with your friends. BARRACUDA- Infrastructure TCP/UDP This plug-in classifies TINA protocol. Barracuda VPN protocol TINA VPN provides VPN services. BARRACUDA Web HTTP/HTTP2/HTTPS/SPDY/SSL Barracuda Networks, Inc. is a company that provides security, networking and storage products based on network appliances and cloud services. This plug-in classifies traffic related to Barracuda web site and Could Control service. BIGBIGCHANNEL Web TVB Big Big Channel is an online video platform. TVB operates Big Big Channel. BLUEHOST Web SSL/SIP/STUN/QUIC/RTSP/SPDY Bluehost is a website hosting provider. This plug-in classifies web HTTP2/HTTP-PROXY/HTTPS site management traffic. BRAWLHALLA Gaming UBISOFT Brawlhalla is a free to play battle arena on-line multiplayer game. Blue Mammoth is the developer and Ubisoft is the publisher of Brawlhalla. 7 Table 2: New Applications (continued) Application Application Name Type Reported Over Description BYTEDANCE Web AKAMAI-SSL/HTTP/HTTP2/HTTPS ByteDance is publishes several applications including TikTok, SPDY/SSL BuzzVideo and Vigo Video. This plug-in classifies traffic from web site. CALL-OF-DUTY Gaming SSL/SIP/STUN/QUIC/RTSP/SPDY Call of Duty (COD) is a video game First Personal Shooter (FPS) available HTTP2/HTTP-PROXY on Xbox, PS4, Microsoft windows. DEMONWARE/HTTP/UDP Activision publishes COD. This plug-in classifies the World War II edition. CODEMETER Infrastructure HTTP/HTTP2/HTTPS/SPDY/SSL/TCP Wibu Codemeter is a license server (Software Asset Management). This plug-in classifies Wibu Codemeter as used in FactoryTalk Activation Manager. CISCO- Infrastructure RTP Cisco smart probe sends packets from Cisco PfRv3 enabled routers to ensure SMARTPROBE link quality. CISCO-SDAVC Infrastructure UDP Cisco Software-Defined AVC (SD-AVC) is a component of Cisco Application Visibility and Control (AVC). This plug-in works as a centralized network service and operates with specific participating devices in a network. COUCHBASE Infrastructure AMAZON/AMAZON-AWS Couchbase Server is a distributed, open source NoSQL database engine. ERLANG-DISTRIBUTION Couchbase Server stores key/values GOLANG/HTTP/HTTP2/HTTPS or JSON documents. SPDY/SSL/TCP/ZENDESK 8 Table 2: New Applications (continued) Application Application Name Type Reported Over Description CISCO-CMX- Web CISCO Cisco Connected Mobile Experiences (CMX) Cloud is a cloud-delivered CLOUD version of the on-premises CMX 10 software. Use CMX Cloud for the delivery of wireless services. CMX Cloud integrates with the Cisco wireless infrastructure and creates out-of-the-box capabilities. CISCO-UCM Messaging CISCO/FTP/FTP-DATA/H225RAS/HTTP Cisco Unified Communication Manager is an IP PBX for enterprises. HTTP2/HTTPS/INFORMIX/JAVA-RMI This plug-in classifies Cisco specific MGCP/RTP/SCCP/SIP/SOAP/SPDY protocols between Cisco Unified Communication components and SRTP/SSL/TFTP-DATA devices, and the administration web interface CISCO Web HTTP/HTTP2/HTTPS/QUIC/SPDY This plug-in classifies the website browsing traffic from CISCO.. SSL/STUN/UDP CISCO-AMC Infrastructure CISCO-UCM This plug-in classifies the protocol of CUCAM (Cisco Unified Communications Alert Manager and Collector). This service is used by CUC (Cisco Unified Communications) or the RTMT (Real-Time Monitoring Tool) to provide performance monitoring, data collection, logging, and alerting.