Application Signature Detail

IP Address as SSL Server Name

This signature detects the usage of an IP address in the SSL Server Name field. This may indicate a connection to an improperly configured web server or many P2P SSL proxy and VPN services. This may also detect infrastructure gear that self sign's its own certificates.

References

• URL: http://en.wikipedia.org/wiki/Secure_Socket_Layer#Support_for_name-based_virtual_servers
• URL: http://tools.ietf.org/html/rfc4366#section-3.1