Testing Application Identification Features of Firewalls

As many applications migrate to the use of HTTP-based protocols, traditional firewalls have become less effective as an access control. To address this, the firewall industry has adopted a new feature generically referred to in this paper as Application Identification. Over the next decade, it is surmised that administrators will become increasingly dependent on application identification to apply proper access control at their network perimeter. A question that is too rarely asked, though, is how do we know application identification works as advertised? Is it easy to evade? Most of this technology to date is closed-source. This paper aims to answer that question by suggesting and demonstrating possible methods of evasion.