Release Notes

SP3.43

Allot DART Signature Pack 3.43

Release Notes

Copyright 2016 Allot Communications Ltd. All rights reserved.

Allot Communications, its logo and certain names, product and service names referenced herein may be registered trademarks, trademarks,
trade names or service marks of Allot Communications Ltd. in certain jurisdictions. All other names are or may be the trademarks of their
respective owners. The content herein is subject to change without further notice.
The material contained herein is proprietary, privileged, and confidential and owned by Allot or its third party licensors. This information herein is
provided to the person or entity to which it is addressed, for its own use only and evaluation of this document, therefore no disclosure of the content of
this document will be made to third parties, including without limitation Allots competitors, without the express written permission of Allot
Communications Ltd

Allot DART Signature Pack Release Notes

Contents
1

About This Signature Pack ................................................................................................................................ 3

1.1

Compatibility............................................................................................................................................ 3

1.2

New Applications ..................................................................................................................................... 4

1.3

Updated Applications............................................................................................................................... 4

1.4

Resolved Issues ...................................................................................................................................... 5

1.5

Known Issues .......................................................................................................................................... 6

DART Signature Pack Update Procedure .......................................................................................................... 8

2.1

Updating NetXplorer Server ..................................................................................................................... 8

2.2

Updating NetXplorer Server with no Internet connectivity ........................................................................ 9

2.3

Updating In-Line Platforms .................................................................................................................... 11

New Applications Full Description ................................................................................................................ 13

Updated Applications Full Description .......................................................................................................... 15

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

Allot DART Signature Pack Release Notes

1 About This Signature Pack

This document details new features, known issues and clarifications concerning DART
Signature Pack 3.43. This release pertains to all Allot products capable of receiving Signature
Pack updates.
Please check http://www.allot.com/support for any updates to this document.

1.1 Compatibility
This Signature Pack may be installed on any of the following AOS versions and any
maintenance software versions which are based on one of these versions:
PLATFORM

COMPATIBLE AOS VERSIONS

SG-9500

AOS14.1.600 and later

SG-Tera

AOS14.1.14 and later

SG-Sigma

AOS13.3.24 and later

SG-Sigma E

AOS14.1.14 and later

AC-6000

AOS14.1.14 and later

AC-3000

AOS13.1.65

AC-1400

AOS13.1.65

AC-500

AOS13.1.65

Table 1-1: Compatibility Matrix

If your installed AOS version does not appear in this list, check if you are working with a
maintenance release which is based on one of these versions. At the beginning of every
maintenance release note, you will see a list of the software versions on which that
maintenance release was based.
If your software version does not appear there either, check the migration path in section
Error! Reference source not found. below to discover the appropriate version to which you
hould upgrade.

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

Allot DART Signature Pack Release Notes

1.2 New Applications

The following applications were added in this DART Signature Pack release:

Imo

Imo Calls

Halo 5

Battlefield 4

GTA 5

Rockstar Games

BBC News

iPlayer_Radio

VPNmaster

TunnelBear_VPN

Hotspot_Shield_VPN

For full details about each of the new applications in the list above, refer to New Applications
Full Description below.

1.3 Updated Applications

The following applications were updated in this Signature Pack release:

Psiphon/PsiphonCDN/PsiphonServer

GoogleHangout

GoogleHangout Video Calls

GoogleHangout Voice Calls

Google Play

GoogleServices

POP3 SSL

TOR / TOR Scramblesuite

Facebook Video

Skype

For full details about each of the updated applications in the list above, refer to Updated
Applications Full Description below.

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

Allot DART Signature Pack Release Notes

1.4 Resolved Issues

The following major issues were resolved in this Signature Pack release:
ID #

Case ID #

47167

196445

46937

191637

46510

193912

46611

194415

46531

193916

46412
46375

193266

46845
46836

46268
46267
46233

WhatsApp v2.16.5 is not properly identified

Tor 5.5.5 mode= obfs4 wasnt blocked in some specific
flows
TOR might not be identified correctly when running
with Skype in the background
Orbot mode obfs4 wasnt blocked on Android 5.0.1
Some HTTPS based services werent accessible due to
false positive Phison identification
Tor 5.5.4 mode= obfs4 wasnt blocked in some specific
flows
IPsec VPN was blocked in some cases due to
misidentification as Psiphon
In many cases Skype Voice/Video calls on Android &
iOS were identified as Other UDP
In many cases LINE Voice/Video calls on Android were
identified as Other UDP
In some cases the Psiphon application wasnt blocked

46662
46529

DESCRIPTION

193978

In some cases Skype login on iOS & Android wasnt

blocked
Google Hangouts connections were recognized as
Google Services or as HTTPs
Google Play application downloads were recognized as
HTTPS
POP3 SSL connections were identified as SSL

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

Allot DART Signature Pack Release Notes

1.5 Known Issues

The following are known issues in this Signature Pack release:
ID#
APPLICATION ISSUE DESCRIPTION
Skype Video

Skype Video might be misidentified as Skype Audio when the

call starts as an audio call and escalates to a video call.

VPN Master

In some situations the VPN Master Application on Android

Devices might be misidentified as OpenVPN and therefore will
not be blocked as expected.
When upgrading to a new Signature Pack, if modifications
were made to the Application catalog some of the applications
will be restored to their default location in the catalog.

Facebook chat

When Facebook PC traffic over HTTP (not secured) is

blocked, chat will be visible as Facebook messages, i.e.
instead of instant messaging this will be converted to Email
by Facebook. The user will need to refresh the web browser
in order to view the message.
Some P2P clients use several P2P protocols in parallel in
order to share files. In order to manage the traffic created by
these clients it is necessary to control several services, such
as eDonkey, BitTorrent, HTTP download manager and
possibly others. A typical example is QQ which uses eDonkey
BitTorrent and HTTP download manager for file sharing so in
order to control QQ, all these applications need to be
controlled.

Thunder

Specifically for Thunder applications, Allot recommends:

To perform shaping on Thunder streaming traffic, the

user should set a Drop/Maximum QoS entry on traffic
associated with the Thunder service.
To perform shaping on Thunder file transfer traffic, the
user should set a Drop/Maximum QoS entry on traffic
associated with Thunder, HTTP Download Manager,
HTTP File Transfer, eDonkey, Bittorrent and FTP
related services

AOL

AOL traffic might be occasionally identified as ICQ traffic.

MSN file
transfer

Blocking MSN file transfer is problematic in some scenarios. It

is recommended to deal with these scenarios by defining a
maximum QoS limit with the lowest possible bandwidth.

ICQ VoIP

When setting the ICQ VOIP service to drop, the application

might switch to using clean RTP so in order to completely drop
it the user must drop all RTP traffic.

AOL VoIP

AOL VoIP can only be identified by AOS-based devices

running version AOS10.1.0 and above (due to infrastructure
limitations of older platforms).

Apple Video
Conference

In some scenarios Apple Video Conference, including

Facetime and iChat, may be identified as other Apple video
conferencing applications.

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

Allot DART Signature Pack Release Notes

ID#

APPLICATION

ISSUE DESCRIPTION

21877

iCloud

The iCloud control protocol is unique to Apple and is identified

as iCloud. The data is transferred over Amazon cloud and
Microsofts Azure protocols. In AOS version 12.3 and above
the traffic running these protocols might be identified as such
and not as iCloud. Therefore in AOS version 12.3 and above,
it is possible to block iCloud by blocking the control protocol.

21878

Facebook Chat

In Facebook Chat, PC traffic with a secure connection

(HTTPS) may be misidentified as Facebook.

16710

OviStore

Some traffic (mainly icons) from the OviStore application is not

identified. This traffic will be identified as HTTP Browsing.

20395

Scydo

Scydo is not recognized by AC-400.

19098

IMPS

IMPS is misidentified on Sigma E devices with PP 3.13 as

Mobile HTTP Browsing.

19045

MetaCafe

MetaCafe Web application on Sigma devices with

V10.2.1_B254 is misidentified as HTTP.

15961

GoToMyPC

GoToMyPC is partially identified.

21807

Wirofon

25112

MS Lync

In Wirofon, the RTCP connections cannot be identified. RTCP

connection does not carry the call and consume very low
bandwidth and therefore should not affect the block and QoS
use cases.
The bug itself is related to a general limitation in identifying
RTCP at the AOS level. This limitation cannot be resolved at
the PP level.
MS Lync client-to-client sessions may be mis-classified as MS
enterprise server.
Some BBC Sports live streaming flows which use iPlayer builtin will be identified as iPlayer and not BBC Sports.
Some QQ Live streaming flows may be identified as QQ
streaming.
While Google Play application downloads are classified as
Google Play, browsing flows are identified as GoogleServices.
When using some HiMedia built-in applications device may
appear as iPad.
When using Telegram, large images may be misidentified.

BBC Sports
QQ Live
Google Play
HiMedia
Telegram
Skype
42545

Gmail
Google Drive
Google
Hangout

In AOS 14.1.40 Skype voice flows are sometimes identified as

Skype Video.
Some Gmail flows may be classified as GoogleServices or
GoogleUserContent.
Some Google Drive flows may be classified as
GoogleServices.
Some Google Hangout messages are misclassified under
block use case.

Facebook
Video Calls

Some Google Maps traffic is identified as GoogleServices on

Mobile devices.
Blocking of Facebook VoIP Calls will result in misclassification
of Facebook Video Calls.

Video and
Voice calls

In some cases Video Calls might be misidentified as Voice

calls, or vice versa, due to an AOS limitation.

Google Maps

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

Allot DART Signature Pack Release Notes

ID#

APPLICATION

ISSUE DESCRIPTION

45047

TOR

In some edge use cases TOR Scramblesuit custom bridges

cannot be blocked.

2 DART Signature Pack Update Procedure

This section describes how to update your Signature Pack to the latest version.
NOTE Some AOS versions earlier than AOS13.1 require a Migration Version be
installed before upgrading to more up-to-date versions of AOS and/or
the most recent Protocol Pack version. If you are upgrading from a
version earlier than AOS13.1 contact Allot Customer Support at
support@allot.com for instructions on downloading an appropriate
Migration Version.

2.1 Updating NetXplorer Server

Users must have a valid support contract for their NetXplorer in order to install new Signature
Packs. Additionally, a valid support contract is required for every NetEnforcer or Service
Gateway which is supposed to receive Signature Pack updates.
NOTES

In order to obtain or renew your support contract please contact

sales@allot.com.
It is not possible to rollback from 3.X protocols packs to 2.X protocols
packs. If for some reason this rollback is required, it necessitates a
device S/W version downgrade. Please contact Allot Customer Support
at support@allot.com for additional details.
If you wish to perform a rollback to previous protocol pack versions (for
example from PP3.27 to PP3.25), repeat the rollback operating
instructions twice. For information about rolling back an installed
Protocol Pack update, see the NetXplorer Operation Guide.
Prior to NX13.3, if the Protocol Pack updates a service group in which
there is a service defined by the user (a private service entry), the
service would be removed. Thus it is essential to review which
services/applications are being updated in the Protocol Pack update
prior to applying the upgrade. From NX version 13.3, service groups are
by default maintained after a protocol pack update.
Every AOS software version has a built-in protocol pack version to
which it is aligned by default. Details about the protocol pack that is
built into the AOS version can be found in the relevant AOS release
notes. Please always confirm which Protocol Pack is currently installed
before upgrading the in-line platform to a newer AOS software version.
Be aware that if the new AOS software version is aligned by default with
an older Protocol Pack version than the protocol pack version currently
installed on the in-line platform, upgrading the software version would
result in the in-line platform switching to a rescue policy. In order to
avoid this, please rollback the Protocol Pack before performing the AOS
software upgrade.

If the NetXplorer has Internet connectivity, all APU upgrade actions are performed directly
from the NetXplorer user interface via the following procedure:
1. Go to the NetXplorer Menu Bar and select Tools > Protocol Updates > From Allot
Web Site

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

Allot DART Signature Pack Release Notes

2. In the dialog window click Check for Updates.

3. A dialog with all available updates will appear. Click Update Now to begin the update
process. When a dialog informs you that process was successful, click Next to
prepare to upgrade the in-line platforms on the network.
For details concerning updating in-line platforms, see page Allot System Upgrade
Guide.

2.2 Updating NetXplorer Server with no Internet connectivity

Users must have a valid support contract for their NetXplorer in order to install new Protocol
Packs. Additionally, a valid support contract is required for every NetEnforcer which is
supposed to receive Protocol Pack updates.
NOTES

In order to obtain or renew your support contract please contact

sales@allot.com.
Protocol pack 3.25 is only available for devices whose S/W version
supports 3.X protocol packs (device versions X9.1.1 and above).
It is not possible to rollback from 3.X protocols packs to 2.X protocols
packs. If for some reason this rollback is required, it necessitates a
device S/W version downgrade. Please contact Allot Customer Support
at support@allot.com for additional details.
If you wish to perform a rollback to previous protocol pack versions, for
example from PP3.27 to PP3.25, repeat the rollback operating
instructions twice. For information about rolling back an installed
Protocol Pack update, see the NetXplorer Operation Guide.
If the Protocol Pack updates a service group in which there is a service
defined by the user (a private service entry), the service will be
removed. Thus it is essential to review which services/applications are
being updated in the Protocol Pack update prior to applying the
upgrade.

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

Allot DART Signature Pack Release Notes

Please always confirm which Protocol Pack is installed before

upgrading the in-line platform to a newer version. Be aware that if the
new software version is aligned with an older Protocol Pack version
than the protocol pack version currently installed on the NetEnforcer,
upgrading the software version would result in the NetEnforcer
switching to a rescue policy. In order to avoid this, please rollback the
Protocol Pack before performing the software upgrade.
If the NetXplorer Server does not have Internet connectivity, the user should download the
Protocol Pack from Allot's website and then install it on the NetXplorer Server. Please follow
this procedure:
1. Browse to http://www.allot.com/support and login to your personal support area. Once
logged in, if your license complies with the Protocol Pack Agreement terms you will
be able to download the latest available Protocol Pack.

2. Once logged in, select the Registrations tab, in which your registered products will
be listed. Select the device for which you would like to update the Protocols Pack
(NetXplorer is preferred).

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

10

Allot DART Signature Pack Release Notes

3. From the newly opened screen, select "Download APU" from "Registration Detail"
Section.

4. Following the link, a zipped package will be downloaded. Save it on your computer.
5. Copy the files to C:\APU\ProtocolsPack (create the directory if needed) on a
Windows based NetXplorer Server or to /root/APU/ProtocolsPack (create the
directory if needed) on a Linux based NetXplorer Server.
6. Unzip ProtocolsPack.zip into C:\APU\ProtocolsPack (or /root/APU/ProtocolsPack on
Linux).
7. Make sure that in the same location (C:\APU\ProtocolsPack or
/root/APU/ProtocolsPack) you have a file named web_update_site.xml, this file
defines the current protocol pack version and the next one to be installed. The other
file(s) contain the protocol pack(s) for installation, however only the most up to date
protocol pack will be installed (older packs will be used in case rollback is needed).
8. Now you may start the update procedure. In the NetXplorer GUI select Tools >
Protocol Updates > From Local Package.
9. In the dialog that opens, type in the Protocol Pack path (C:\APU\ProtocolsPack or
/root/APU/ProtocolsPack) and click Next.
10. A dialog with all available updates will appear. Click Update Now to begin the update
process. When a dialog informs you that process was successful, click Next to
prepare to upgrade the in-line platforms on the network. For details concerning
updating NetEnforcers, see below.

2.3 Updating In-Line Platforms

1. Once NetXplorer Server has been updated with the newest Protocol Pack, there are
several options for updating the individual in-line platform.
a. A dialog window will appear immediately after updating NetXplorer Server,
showing all available in-line platforms. You may choose to upgrade all, some
or none of the in-line platforms by selecting them in the list.

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

11

Allot DART Signature Pack Release Notes

b. An option to add the Protocol Pack manually to a device may be selected by

choosing Tools > Protocol Updates > Install to Devices. For information
on updating individual in-line platforms, see the NetXplorer Operation Guide.
After a NetEnforcer or Service Gateways Service Catalog has been updated, the
new Protocol Pack will be indicated in the Identification and Keys tab under
Configuration.

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

12

Allot DART Signature Pack Release Notes

3 New Applications Full Description

The table below lists full details for all of the applications which were added in this signature
pack. For each application, you will find the service group in which it is classified in the default
NetXplorer Service Catalog, the platform/s on which it is supported, a brief description of the
application, an explanation of previous behavior where relevant and additional notes.
Imo
Group

Instant Messaging Applications

Platform

Android, iPhone

Description
Change

Free Instant messaging application including chat,

voice & video calls for android & IOS
Previously identified as: Other TCP

Notes

Supported in AOS: 14.1.x and above

Group

VoIP

Platform

Android, iPhone

Description

Imo VoIP Service

Change

Previously identified as: Other UDP

Notes

Supported in AOS: 13.1.x and above

Group

Games

Imo Calls

Halo5

Platform
Description

Xbox One
A first-person shooter video game

Change

Previously identified as: Other UDP, HTTPS

Notes

Supported in AOS: 13.1.x and above

Group

Games

Platform

XBOX One, PC, PS 3/4

Description

A first-person shooter video game

Change

Previously identified as: Other UDP, Other TCP,

HTTPS

Notes

Supported in AOS: 13.1.x and above

Group

Games

Platform

PS4, XBOX One, PC

Description
Change

Grand Theft Auto V is an open world, actionadventure video game

Previously identified as: HTTP, HTTPS, Other UDP

Notes

Supported in AOS: 13.1.x and above

Battlefield 4

GTA5

RockstarGames

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

13

Allot DART Signature Pack Release Notes

Group

Games

Platform

PS4, XBOX One, PC

Description

Change

Rockstar Games, Inc. is a multinational video game

developer and publisher best known for their Grand
Theft Auto
Previously identified as: HTTP, HTTPS

Notes

Supported in AOS: 13.1.x and above

Group

Web Applications

Platform

Android, iPhone, Mac, PC

Description

One of the largest global news content provider

Change

Previously identified as: HTTP, RTMP

Notes

Supported in AOS: 13.1.x and above

Group

Music Streaming

Platform

Android, iPhone, Mac, PC

Description
Change

BBC iPlayer radio is an internet radio service for

people in the United Kingdom.
Previously identified as: iPlayer, HTTP Streaming

Notes

Supported in AOS: 13.1.x and above

Group

Terminals

Platform

Android

Description

Global VPN Service

Change

Previously identified as: OpenVPN, Other TCP,

HTTP, CiscoVPN

Notes

Supported in AOS: 14.1.x and above

Group

Terminals

Platform

iPhone

Description

Global VPN Service

Change

Previously identified as: OpenVPN, CiscoVPN

Notes

Supported in AOS: 14.1.x and above

BBC News

iPlayer_Radio

VPNmaster

TunnelBear_VPN

Hotspot_Shield_VPN
Group

Terminals

Platform

Android, iPhone

Description

Global VPN Service

Change

Previously identified as: Other TCP, HTTP,

CiscoVPN

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

14

Allot DART Signature Pack Release Notes

Notes

Supported in AOS: 14.1.x and above

4 Updated Applications Full Description

The table below lists full details for all of the applications which were updated in this signature
pack. For each application, you will find the service group in which it is classified in the default
NetXplorer Service Catalog, the platform/s on which it is supported, a brief description of the
protocol an explanation of previous behavior where relevant and additional notes.
PsiphonServer
Group

Terminals

Revisited
Platforms

Android, PC

Description

Psiphon proxy server

Change

Previously identified as: Encrypted, HTTPS,

CiscoVPN

Notes

Supported in AOS: 14.1.6x and above

Group

Terminals

Revisited
Platforms

Android, PC

Description

Circumvention system that uses a combination of

secure communication and obfuscation technologies
Previously identified as: Encrypted, HTTPS,
CiscoVPN, SSH

Psiphon

Change
Notes

Supported in AOS: 14.1.6x and above

Group

Terminals

Revisited
Platforms

Android, PC

Description

Psiphon's CDN Meek mode

Change

Previously identified as: HTTPS, Akamai, Facebook,

YouTube, Twitter, Tango, Amazon

Notes

Supported in AOS: 14.1.6x and above

Group

Instant Messaging Applications

Revisited
Platforms

Android

Description

Google's instant messaging service

Change

Previously identified as: GoogleServices, HTTPS

Notes

Supported in AOS: 14.1.x and above

PsiphonCDN

GoogleHangout

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

15

Allot DART Signature Pack Release Notes

GoogleHangout Video Calls

Group

VoIP

Revisited
Platforms

Android

Description

GoogleHangout Video Calls

Change

Previously identified as: STUN, Other TCP,

GoogleHangout, RTP

Notes

Supported in AOS: 14.1.6x and above

GoogleHangout Voice Calls

Group

VoIP

Revisited
Platforms

Android

Description

GoogleHangout Voice Calls

Change

Previously identified as: STUN, Other TCP,

GoogleHangout, RTP

Notes

Supported in AOS: 14.1.6x and above

Group

File Transfer

Revisited
Platforms

Android

Description

Googles latest appstore

Change

Previously identified as: HTTPS, GoogleServices

Notes

Supported in AOS: 14.1.x and above

Group

Web Applications

Revisited
Platforms

Android

Description

A collection of various Google Web services

including:, Google Groups, Google Scholar, Google
Translate, Google Sites, Google News, Google Docs,
gstatic, googleapis, Google Talk Gadget, Google
Accounts,Google Mobile, googleusercontent, gmail
static content(SSL) and Google+ (excluding Google+
voice and video which are identified as part of
Google Talk)

Change

Previously identified as: HTTPS

Notes

Supported in AOS: 14.1.x and above

Group

Mail

Revisited
Platforms

PC

Google Play

GoogleServices

POP3 SSL

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

16

Allot DART Signature Pack Release Notes

Description

Secure POP3

Change

Previously identified as: SSL

Notes

Supported in AOS: 13.1.x and above

Group

Web Applications

Revisited
Platforms

PC, Android as Orfox/Orbot

Description

The Onion Router, An open network for anonymous

browsing

Change

Previously identified as: MicrosoftCDN

Notes

Supported in AOS: 14.1.6x and above

TOR

TOR Scramblesuite
Group

Terminals

Revisited
Platforms

PC, Android as Orfox/Orbot

Description

A pluggable transport protocol for the obfsproxy

obfuscation framework of The Onion Router

Change

Previously identified as: Other Terminals, Encrypted

Notes

Supported in AOS: 14.1.6x and above

Group

Streaming Applications

Revisited
Platforms

Android, iPhone

Description

Facebook video service

Change

Previously identified as: no changes in recognition

Notes

Supported in AOS: 13.1.x and above

Group

Instant Messaging Applications

Platform

iPhone

Description

Popular messaging and telephony application and

service, non-VoIP related activity

Change

Previously identified as: Other TCP, Other UDP,

Other VoIP, Encrypted

Notes

Supported in AOS: 14.1.x and above

Facebook Video

Skype

Note1 To use the functionality the user must enable the quality measurement, predefined observers,
and/or SIT functions. For further information please refer to the latest AOS Operation Guide.

Allot Communications. All Rights Reserved 2016. www.allot.com

www.allo www.Allot.com

17