Technical Tip: Custom IPS signature for TeamViewer
Article
| Description | This article discusses Custom IPS signature for TeamViewer. |
| Scope | All Forti OS. |
| Solution | To add a custom IPS signature, go to IPS> Signature>Custom and select Create New.
Teamviewer (www.teamviewer.com) is an application for remote-access. It opens big holes especially as it uses dynamic ports (similar to skype) to bypass Firewalls and traverse NAT Devices. As it uses encryption the Signature will trigger the Startup (Login) F-SBID( --name "TeamViewer.RegServer.Login"; --protocol tcp; --dst_port 5938; --flow from_client; --seq =,1,relative; --pattern "|17 24 10 04|"; --within 4,packet; --data_size =9; ) F-SBID( --name "TeamViewer.RegServer.HTTP"; --protocol tcp; --service HTTP; --flow from_client; --pattern "/din.aspx?"; --context uri; --pattern "&client="; --context uri; --no_case; --within 50; --pcre "/s=\d{8}&/i"; --context uri; --distance -70; --within 70; )
Related article: Technical Tip: How to configure custom IPS signature for a specific web site |