Adding new applications based on vendors docs: pluralsight

[elico]

I have seen couple uses of applications ID in production and nDPI is missing many of these.
One example is pluralsight SNI and IP ranges.
It's pretty simple to define this app based on the official docs at:
https://help.pluralsight.com/help/ip-allowlist

Basically any SNI and domain under the definition of:
*.pluralsight.com
ip-video-course-exercise-files-us-west-2.s3.us-west-2.amazonaws.com

is theirs and also their CDN domains are:
vid.pluralsight.com
vid5.pluralsight.com
vid20.pluralsight.com
vid21.pluralsight.com
vid30.pluralsight.com

They have a test page at:
https://app.pluralsight.com/video/test

I don't know who is responsible or what is the process of adding a new app but many can be added easily based on the vendors docs.

Thanks,
Eliezer

[IvanNardi]

I have seen couple uses of applications ID in production and nDPI is missing many of these.

Could you share the details or, better, push some PRs?

I added a basic support for Pluralsight in #1503.
If you have a pluralsight account, could you share a pcap with a real video stream in it, please?

[elico]

@IvanNardi I will try to capture some traffic in the next couple days.
I cannot push a PR since I am really busy working on other things but I can try to provide a capture and other relevant details.
The next is the access.log from squid:
https://www.ngtech.co.il/squid/pluralsight-access-log.txt

[IvanNardi]

@elico, any updates?

[elico]

Still busy... I will try to update in the end of the week. בתאריך יום ב׳, 25 באפר׳ 2022, 15:54, מאת Ivan Nardi ‏< ***@***.***>:

…

@elico <https://github.com/elico>, any updates? — Reply to this email directly, view it on GitHub <#1501 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AANUHME72XQD6ZFQEW4I4KLVG2IWNANCNFSM5RX6JFKQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[elico]

@IvanNardi The next should be enough to know what is needed.
There is a bit local traffic noise but I assume you will be able to filter the relevant packets.

https://www.ngtech.co.il/static/pluralsight_app/pluralsight_client_hello.pcapng
https://www.ngtech.co.il/static/pluralsight_app/pluralsight_dns.pcapng