Design and architecture

The OpenAppID feature has a few components or parts, namely, the following:

• Detectors: These components have the logic for the application detection. These are written in the Lua scripting language. These are packaged as a separate package and not as part of the Snort package (similar to how Snort rules are a separate package). This is done so that the detectors can be developed, tested, and released separately from the Snort package.
• Rules using the application identification information: These are the Snort rules that utilize the appid rule option.
• The OpenAppID inspector: This fits into the Snort architecture as a network inspector module.

Let us look at these components a bit more closely in the next section.

Detectors

The application detectors are the key components as far as OpenAppID is concerned. This is the meat of the functionality. This logic is mainly written in Lua scripts. These inspect the client-side and server-side...