SonicOS 7 Rules and Policies


Wireshark is a network protocol analyzer that you can use to capture packets from applications on your network. You can examine the packets to determine the unique identifier for an application, which you can use to create a match object for use in an App Rules policy.

Wireshark is freely available at:

The process of finding the unique identifier or signature of a Web browser is illustrated in the following packet capture sequence.

  1. In Wireshark, click Capture > Interfaces to view your local network interfaces.
  2. In the Capture Interfaces dialog, click Capture to start a capture on your main network interface:

    As soon as the capture begins, start the browser and then stop the capture. In this example, Firefox is started.

  3. In the captured output, locate and click the HTTP GET command in the top pane, and view the source for it in the center pane. In the source code, locate the line beginning with User-Agent.

  4. Scroll to the right to find the unique identifier for the browser. In this case, it is Firefox/

  5. Type the identifier into the Content text field in the Match Objects Settings window.

  6. Click OK to create a match object that you can use in a policy.

Was This Article Helpful?

Help us to improve our support portal

Techdocs Article Helpful form

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.