Added Zoom protocol support removing invalid STUN/Skype detections

8 files changed, 70 insertions, 249 deletions

diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 74ac55e38..5091b458d 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -372,7 +372,5 @@ void init_modbus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_i
 void init_line_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
-void init_zoom_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
-void init_ps_vue_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 
 #endif /* __NDPI_PROTOCOLS_H__ */
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 48404fcfd..380b622b3 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -3309,12 +3309,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* Targus Getdata */
   init_targus_getdata_dissector(ndpi_struct, &a, detection_bitmask);
 
-  /* ZOOM */
-  init_zoom_dissector(ndpi_struct, &a, detection_bitmask);
-
-  /* PS Vue */
-  init_ps_vue_dissector(ndpi_struct, &a, detection_bitmask);
-
   /* ----------------------------------------------------------------- */
 
   ndpi_struct->callback_buffer_size = a;
diff --git a/src/lib/protocols/ps_vue.c b/src/lib/protocols/ps_vue.c
deleted file mode 100644
index a608c96c6..000000000
--- a/src/lib/protocols/ps_vue.c
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * ps_vue.c
- *
- * Copyright (C) 2018 by ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "ndpi_protocol_ids.h"
-
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_PS_VUE
-
-#include "ndpi_api.h"
-
-static u_int8_t ps_vue_ptree_match(struct ndpi_detection_module_struct *ndpi_struct, struct in_addr *pin) {
-  return((ndpi_network_ptree_match(ndpi_struct, pin) == NDPI_PROTOCOL_PS_VUE) ? 1 : 0);
-}
-
-/* ******************************************* */
-
-static u_int8_t is_ps_vue_flow(struct ndpi_detection_module_struct *ndpi_struct,
-                             struct ndpi_flow_struct *flow) {
-  struct ndpi_packet_struct *packet = &flow->packet;
-
-  if(packet->iph) {
-    struct in_addr saddr, daddr;
-
-    saddr.s_addr = packet->iph->saddr;
-    daddr.s_addr = packet->iph->daddr;
-
-    if(ps_vue_ptree_match(ndpi_struct, &saddr) ||
-       ps_vue_ptree_match(ndpi_struct, &daddr)) {
-      return(1);
-    }
-  }
-
-  return(0);
-}
-
-static void ndpi_check_ps_vue(struct ndpi_detection_module_struct *ndpi_struct,
-				  struct ndpi_flow_struct *flow) {
-
-  NDPI_LOG_DBG(ndpi_struct, "search ps_vue video \n");
-
-  if (is_ps_vue_flow(ndpi_struct, flow)){
-    NDPI_LOG_INFO(ndpi_struct, "found ps_vue\n");
-
-    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PS_VUE,
-                               NDPI_PROTOCOL_UNKNOWN);
-    return;
-  } else {
-      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-  }
-}
-
-void ndpi_search_ps_vue(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  struct ndpi_packet_struct *packet = &flow->packet;
-
-  NDPI_LOG_DBG(ndpi_struct, "search ps_vue\n");
-
-  /* skip marked packets */
-  if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_PS_VUE)
-    ndpi_check_ps_vue(ndpi_struct, flow);
-}
-
-
-void init_ps_vue_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
-  ndpi_set_bitmask_protocol_detection("PS_VUE", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_PS_VUE,
-				      ndpi_search_ps_vue,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD,
-				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
-				      ADD_TO_DETECTION_BITMASK);
-  *id += 1;
-}
diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c
index 2f3aac2f6..8ada5d997 100644
--- a/src/lib/protocols/skype.c
+++ b/src/lib/protocols/skype.c
@@ -23,13 +23,6 @@
 
 #include "ndpi_api.h"
 
-static void ndpi_skype_report_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
-  /* printf("-> payload_len=%u\n", flow->packet.payload_packet_len); */
-  
-  NDPI_LOG_INFO(ndpi_struct, "found skype\n");
-  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE_CALL, NDPI_PROTOCOL_SKYPE);
-}
-
 static int is_port(u_int16_t a, u_int16_t b, u_int16_t c) {
   return(((a == c) || (b == c)) ? 1 : 0);
 }
@@ -60,7 +53,11 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
 	   ((payload_len >= 16)
 	    && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */
 	    && (packet->payload[2] == 0x02))) {
-	  ndpi_skype_report_protocol(ndpi_struct, flow);
+
+	  if(is_port(sport, dport, 8801))
+	    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZOOM, NDPI_PROTOCOL_UNKNOWN);
+	  else
+	    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE_CALL, NDPI_PROTOCOL_SKYPE);
 	}
       }
       
@@ -90,7 +87,7 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
 	/* printf("[SKYPE] %u/%u\n", ntohs(packet->tcp->source), ntohs(packet->tcp->dest)); */
 	
 	NDPI_LOG_INFO(ndpi_struct, "found skype\n");
-	ndpi_skype_report_protocol(ndpi_struct, flow);
+	  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE_CALL, NDPI_PROTOCOL_SKYPE);
       } else {
 	// printf("NO [SKYPE] payload_len=%u\n", payload_len);
       }
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 9475192da..cef2a1b31 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -144,7 +144,8 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 					   const u_int16_t payload_length) {
   u_int16_t msg_type, msg_len;
   struct stun_packet_header *h = (struct stun_packet_header*)payload;
-
+  int rc;
+  
   /* STUN over TCP does not look good */
   if (flow->packet.tcp)
     return(NDPI_IS_NOT_STUN);
@@ -319,6 +320,11 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 #endif
 
         switch(attribute) {
+	case 0x0103:
+          flow->guessed_host_protocol_id = NDPI_PROTOCOL_ZOOM;
+          return NDPI_IS_STUN;
+	  break;
+	  
         case 0x4000:
         case 0x4001:
         case 0x4002:
@@ -457,15 +463,12 @@ udp_stun_found:
   printf("==>> NDPI_PROTOCOL_WHATSAPP_CALL\n");
 #endif
 
-  if ((ntohs(packet->udp->source) == 3478) || (ntohs(packet->udp->dest) == 3478)) {
-      flow->guessed_host_protocol_id = (is_messenger_ip_address(ntohl(packet->iph->saddr)) ||
-          is_messenger_ip_address(ntohl(packet->iph->daddr))) ? NDPI_PROTOCOL_MESSENGER :
-                                                                NDPI_PROTOCOL_WHATSAPP_CALL;
-  } else
-    flow->guessed_host_protocol_id = (is_google_ip_address(ntohl(packet->iph->saddr)) ||
-        is_google_ip_address(ntohl(packet->iph->daddr))) ? NDPI_PROTOCOL_HANGOUT_DUO : NDPI_PROTOCOL_WHATSAPP_CALL;
-
-  int rc = (flow->protos.stun_ssl.stun.num_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN;
+  if(is_messenger_ip_address(ntohl(packet->iph->saddr)) || is_messenger_ip_address(ntohl(packet->iph->daddr)))      
+    flow->guessed_host_protocol_id = NDPI_PROTOCOL_MESSENGER;
+  else if(is_google_ip_address(ntohl(packet->iph->saddr)) || is_google_ip_address(ntohl(packet->iph->daddr)))
+    flow->guessed_host_protocol_id = NDPI_PROTOCOL_HANGOUT_DUO;
+  
+  rc = (flow->protos.stun_ssl.stun.num_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN;
 
   return rc;
 }
diff --git a/src/lib/protocols/zoom.c b/src/lib/protocols/zoom.c
deleted file mode 100644
index 341fb1c0f..000000000
--- a/src/lib/protocols/zoom.c
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * zoom.c
- *
- * Copyright (C) 2018 by ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "ndpi_protocol_ids.h"
-
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_ZOOM
-
-#include "ndpi_api.h"
-
-static u_int8_t is_zoom_tcp_port(struct ndpi_flow_struct *flow) {
-
-  struct ndpi_packet_struct *packet = &flow->packet;
-  u_int16_t dport = ntohs(packet->tcp->dest);
-
-  if((dport == 8801) || (dport == 8802) || (dport == 5090) || (dport == 5091)){
-    return 1;
-  }
-  return 0;
-}
-
-static u_int8_t is_zoom_udp_port(struct ndpi_flow_struct *flow) {
-
-  struct ndpi_packet_struct *packet = &flow->packet;
-  u_int16_t dport = ntohs(packet->tcp->dest);
-
-  if((dport == 3478) || (dport == 3479) || (dport == 5090) ||
-     (dport >= 8801 && dport <= 8810) || (dport >= 20000 && dport <= 64000)){
-    return 1;
-  }
-  return 0;
-}
-
-static u_int8_t zoom_ptree_match(struct ndpi_detection_module_struct *ndpi_struct, struct in_addr *pin) {
-  return((ndpi_network_ptree_match(ndpi_struct, pin) == NDPI_PROTOCOL_ZOOM) ? 1 : 0);
-}
-
-/* ******************************************* */
-
-static u_int8_t is_zoom_flow(struct ndpi_detection_module_struct *ndpi_struct,
-                             struct ndpi_flow_struct *flow) {
-  struct ndpi_packet_struct *packet = &flow->packet;
-
-  if(packet->iph) {
-    struct in_addr daddr;
-
-    daddr.s_addr = packet->iph->daddr;
-
-    if(zoom_ptree_match(ndpi_struct, &daddr)) {
-      return(1);
-    }
-  }
-
-  return(0);
-}
-
-static void ndpi_check_zoom(struct ndpi_detection_module_struct *ndpi_struct,
-				  struct ndpi_flow_struct *flow) {
-
-  struct ndpi_packet_struct *packet = &flow->packet;
-    
-  NDPI_LOG_DBG(ndpi_struct, "search Zoom video \n");
-
-  if(packet->tcp != NULL)
-    {
-      if (is_zoom_flow(ndpi_struct, flow) && is_zoom_tcp_port(flow)){
-        NDPI_LOG_INFO(ndpi_struct, "found zoom on tcp\n");
-
-        ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZOOM,
-                                   NDPI_PROTOCOL_UNKNOWN);
-        return;
-      }
-    }
-  else if(packet->udp != NULL)
-    {
-      if (is_zoom_flow(ndpi_struct, flow) && is_zoom_udp_port(flow)){
-        NDPI_LOG_INFO(ndpi_struct, "found zoom on udp\n");
-
-        ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZOOM,
-                                   NDPI_PROTOCOL_UNKNOWN);
-        return;
-      }
-    }
-  else
-    {
-      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-    }
-}
-
-void ndpi_search_zoom(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  struct ndpi_packet_struct *packet = &flow->packet;
-
-  NDPI_LOG_DBG(ndpi_struct, "search zoom\n");
-
-  /* skip marked packets */
-  if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_ZOOM)
-    ndpi_check_zoom(ndpi_struct, flow);
-}
-
-
-void init_zoom_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
-  ndpi_set_bitmask_protocol_detection("Zoom", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_ZOOM,
-				      ndpi_search_zoom,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD,
-				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
-				      ADD_TO_DETECTION_BITMASK);
-  *id += 1;
-}
diff --git a/tests/pcap/zoom.pcap b/tests/pcap/zoom.pcap
new file mode 100644
index 000000000..5ac3dfb34
--- /dev/null
+++ b/tests/pcap/zoom.pcap
diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out
new file mode 100644
index 000000000..1eabb9134
--- /dev/null
+++ b/tests/result/zoom.pcap.out
@@ -0,0 +1,51 @@
+DNS	2	205	1
+MDNS	1	87	1
+NetBIOS	3	330	1
+SSDP	1	168	1
+DHCP	1	321	1
+ntop	20	4265	1
+IMAPS	2	226	1
+ICMP	3	210	2
+TLS	2	114	1
+Google	26	8851	3
+Spotify	1	86	1
+Zoom	635	354005	19
+
+JA3 Host Stats: 
+		 IP Address                  	 # JA3C     
+	1	 192.168.1.117            	 4      
+
+
+	1	UDP 192.168.1.117:58327 <-> 109.94.160.99:8801 [proto: 189/Zoom][cat: Video/26][10 pkts/7806 bytes <-> 175 pkts/184434 bytes][bytes ratio: -0.919 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 159.8/7.7 1313/35 407.8/4.5][Pkt Len c2s/s2c min/avg/max/stddev: 55/60 780.6/1053.9 1071/1071 444.1/129.4][PLAIN TEXT (replace)]
+	2	TCP 192.168.1.117:54871 <-> 109.94.160.99:443 [proto: 91.189/TLS.Zoom][cat: Video/26][127 pkts/54118 bytes <-> 83 pkts/17526 bytes][bytes ratio: 0.511 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 15.6/23.1 950/970 85.5/107.9][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 426.1/211.2 1506/1506 458.2/363.6][TLSv1.2][Client: zoomfrn99mmr.zoom.us][JA3C: c51de225944b7d58d48c0f99f86ba8e6][Server: *.zoom.us][JA3S: ada793d0f02b028a6c840504edccb652][Certificate SHA-1: F7:5A:83:A8:77:24:55:D7:6D:2E:93:F6:6E:9C:C9:7E:AD:9B:3B:E8][Validity: 2019-03-25 19:38:42 - 2021-03-25 19:38:42][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
+	3	TCP 192.168.1.117:54866 <-> 52.202.62.236:443 [proto: 91.189/TLS.Zoom][cat: Video/26][16 pkts/3097 bytes <-> 17 pkts/18622 bytes][bytes ratio: -0.715 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 40.0/29.9 210/143 62.8/52.3][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 193.6/1095.4 864/1506 265.3/617.8][TLSv1.2][Client: www3.zoom.us][JA3C: 535aca3d99fc247509cd50933cd71d37][Server: *.zoom.us][JA3S: 3c30f2c064a3aed8cd95de8d68c726a6][Certificate SHA-1: F7:5A:83:A8:77:24:55:D7:6D:2E:93:F6:6E:9C:C9:7E:AD:9B:3B:E8][Validity: 2019-03-25 19:38:42 - 2021-03-25 19:38:42][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
+	4	TCP 192.168.1.117:54865 <-> 52.202.62.196:443 [proto: 91.189/TLS.Zoom][cat: Video/26][15 pkts/2448 bytes <-> 15 pkts/16505 bytes][bytes ratio: -0.742 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 35.5/27.4 122/136 49.7/50.4][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 163.2/1100.3 687/1506 200.1/622.5][TLSv1.2][Client: zoom.us][JA3C: 535aca3d99fc247509cd50933cd71d37][Server: *.zoom.us][JA3S: 3c30f2c064a3aed8cd95de8d68c726a6][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
+	5	TCP 192.168.1.117:54868 <-> 213.19.144.104:443 [proto: 91.189/TLS.Zoom][cat: Video/26][17 pkts/2534 bytes <-> 13 pkts/7180 bytes][bytes ratio: -0.478 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 28.8/37.6 87/168 28.1/55.5][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 149.1/552.3 642/1506 174.8/611.7][TLSv1.2][Client: zoomam104zc.zoom.us][JA3C: c51de225944b7d58d48c0f99f86ba8e6][Server: *.zoom.us][JA3S: ada793d0f02b028a6c840504edccb652][Certificate SHA-1: F7:5A:83:A8:77:24:55:D7:6D:2E:93:F6:6E:9C:C9:7E:AD:9B:3B:E8][Validity: 2019-03-25 19:38:42 - 2021-03-25 19:38:42][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
+	6	TCP 192.168.1.117:54869 <-> 213.244.140.85:443 [proto: 91.189/TLS.Zoom][cat: Video/26][16 pkts/2480 bytes <-> 13 pkts/7182 bytes][bytes ratio: -0.487 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 27.9/36.2 202/224 51.5/64.9][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 155.0/552.5 642/1506 178.5/611.7][TLSv1.2][Client: zoomfr85zc.zoom.us][JA3C: c51de225944b7d58d48c0f99f86ba8e6][Server: *.zoom.us][JA3S: ada793d0f02b028a6c840504edccb652][Certificate SHA-1: F7:5A:83:A8:77:24:55:D7:6D:2E:93:F6:6E:9C:C9:7E:AD:9B:3B:E8][Validity: 2019-03-25 19:38:42 - 2021-03-25 19:38:42][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
+	7	TCP 192.168.1.117:54867 <-> 213.19.144.105:443 [proto: 91.189/TLS.Zoom][cat: Video/26][16 pkts/2468 bytes <-> 13 pkts/7188 bytes][bytes ratio: -0.489 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 32.2/38.7 147/178 41.3/57.3][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 154.2/552.9 642/1506 178.9/611.6][TLSv1.2][Client: zoomam105zc.zoom.us][JA3C: c51de225944b7d58d48c0f99f86ba8e6][Server: *.zoom.us][JA3S: ada793d0f02b028a6c840504edccb652][Certificate SHA-1: F7:5A:83:A8:77:24:55:D7:6D:2E:93:F6:6E:9C:C9:7E:AD:9B:3B:E8][Validity: 2019-03-25 19:38:42 - 2021-03-25 19:38:42][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
+	8	TCP 192.168.1.117:54870 <-> 213.244.140.84:443 [proto: 91.189/TLS.Zoom][cat: Video/26][16 pkts/1832 bytes <-> 12 pkts/6702 bytes][bytes ratio: -0.571 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 35.5/35.4 187/280 53.5/82.1][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 114.5/558.5 583/1506 129.0/636.0][TLSv1.2][Client: zoomfr84zc.zoom.us][JA3C: c51de225944b7d58d48c0f99f86ba8e6][Server: *.zoom.us][JA3S: ada793d0f02b028a6c840504edccb652][Certificate SHA-1: F7:5A:83:A8:77:24:55:D7:6D:2E:93:F6:6E:9C:C9:7E:AD:9B:3B:E8][Validity: 2019-03-25 19:38:42 - 2021-03-25 19:38:42][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
+	9	TCP 192.168.1.117:54864 <-> 52.202.62.238:443 [proto: 91.189/TLS.Zoom][cat: Video/26][10 pkts/2030 bytes <-> 8 pkts/6283 bytes][bytes ratio: -0.512 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 52.0/51.6 110/131 50.3/59.5][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 203.0/785.4 812/1506 256.3/675.1][TLSv1.2][Client: log.zoom.us][JA3C: 535aca3d99fc247509cd50933cd71d37][Server: *.zoom.us][JA3S: 3c30f2c064a3aed8cd95de8d68c726a6][Certificate SHA-1: F7:5A:83:A8:77:24:55:D7:6D:2E:93:F6:6E:9C:C9:7E:AD:9B:3B:E8][Validity: 2019-03-25 19:38:42 - 2021-03-25 19:38:42][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
+	10	TCP 192.168.1.117:53872 <-> 35.186.224.53:443 [proto: 91.126/TLS.Google][cat: Web/5][8 pkts/2017 bytes <-> 8 pkts/4822 bytes][bytes ratio: -0.410 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 8.3/8.1 58/45 20.3/15.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 252.1/602.8 1434/1484 447.5/585.4]
+	11	TCP 192.168.1.117:54863 <-> 167.99.215.164:4434 [proto: 91.26/TLS.ntop][cat: Network/14][10 pkts/2198 bytes <-> 10 pkts/2067 bytes][bytes ratio: 0.031 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 651.9/651.8 5003/5003 1644.8/1644.8][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 219.8/206.7 932/1292 283.1/364.2][TLSv1.2][Client: dati.ntop.org][JA3C: a795593605a13211941d44505b4d1e39][JA3S: dd4b012f7a008e741554bd0a4ed12920][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384]
+	12	TCP 192.168.1.117:54854 -> 172.217.21.72:443 [proto: 91.126/TLS.Google][cat: Web/5][4 pkts/1060 bytes -> 0 pkts/0 bytes][TLSv1][Client: www.googletagmanager.com][JA3C: d78489b860c8bf7838a6ff0b4d131541][PLAIN TEXT (www.googletagmanager.com)]
+	13	TCP 192.168.1.117:53867 <-> 104.199.65.42:80 [proto: 7.126/HTTP.Google][cat: Web/5][4 pkts/710 bytes <-> 2 pkts/242 bytes][bytes ratio: 0.492 (Upload)][IAT c2s/s2c min/avg/max/stddev: 30/64 31.0/64.0 32/64 0.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/121 177.5/121.0 329/121 115.0/0.0]
+	14	UDP 192.168.1.117:61731 <-> 109.94.160.99:8801 [proto: 189/Zoom][cat: Video/26][4 pkts/372 bytes <-> 4 pkts/290 bytes][bytes ratio: 0.124 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/35 28.0/27.3 49/47 18.5/19.9][Pkt Len c2s/s2c min/avg/max/stddev: 55/60 93.0/72.5 151/93 39.9/13.7][PLAIN TEXT (replace)]
+	15	UDP 192.168.1.117:60620 <-> 109.94.160.99:8801 [proto: 189/Zoom][cat: Video/26][4 pkts/408 bytes <-> 3 pkts/222 bytes][bytes ratio: 0.295 (Upload)][IAT c2s/s2c min/avg/max/stddev: 7/31 413.3/15.5 1209/31 562.7/15.5][Pkt Len c2s/s2c min/avg/max/stddev: 55/60 102.0/74.0 149/85 33.3/10.4][PLAIN TEXT (replace)]
+	16	UDP 192.168.1.117:23903 <-> 162.255.37.14:3478 [proto: 78.189/STUN.Zoom][cat: Video/26][3 pkts/258 bytes <-> 3 pkts/222 bytes][bytes ratio: 0.075 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 10/9 10.0/9.0 10/9 0.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 86/74 86.0/74.0 86/74 0.0/0.0]
+	17	UDP 192.168.1.117:23903 <-> 162.255.38.14:3478 [proto: 78.189/STUN.Zoom][cat: Video/26][3 pkts/258 bytes <-> 3 pkts/222 bytes][bytes ratio: 0.075 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 10/9 10.0/9.5 10/10 0.0/0.5][Pkt Len c2s/s2c min/avg/max/stddev: 86/74 86.0/74.0 86/74 0.0/0.0]
+	18	UDP 192.168.1.117:23903 <-> 162.255.38.14:3479 [proto: 78.189/STUN.Zoom][cat: Video/26][3 pkts/258 bytes <-> 3 pkts/222 bytes][bytes ratio: 0.075 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 10/9 10.0/9.5 10/10 0.0/0.5][Pkt Len c2s/s2c min/avg/max/stddev: 86/74 86.0/74.0 86/74 0.0/0.0]
+	19	UDP 192.168.1.117:137 -> 192.168.1.255:137 [proto: 10/NetBIOS][cat: System/18][3 pkts/330 bytes -> 0 pkts/0 bytes][Host: workgroup][PLAIN TEXT ( FHEPFCELEHFCEPFFFACACACACACACA)]
+	20	UDP 192.168.0.1:68 -> 255.255.255.255:67 [proto: 18/DHCP][cat: Network/14][1 pkts/321 bytes -> 0 pkts/0 bytes][Host: tl-sg116e][DHCP Fingerprint: 1,3]
+	21	TCP 192.168.1.117:54341 -> 62.149.152.153:993 [proto: 51/IMAPS][cat: Email/3][2 pkts/226 bytes -> 0 pkts/0 bytes]
+	22	UDP 192.168.1.117:65394 <-> 192.168.1.1:53 [proto: 5/DNS][cat: Network/14][1 pkts/65 bytes <-> 1 pkts/140 bytes][Host: local][PLAIN TEXT (servers)]
+	23	UDP 192.168.1.117:51185 <-> 192.168.1.1:53 [proto: 5.189/DNS.Zoom][cat: Video/26][1 pkts/80 bytes <-> 1 pkts/96 bytes][Host: zoomfrn99mmr.zoom.us][PLAIN TEXT (zoomfrn)]
+	24	UDP 192.168.1.117:58063 <-> 192.168.1.1:53 [proto: 5.189/DNS.Zoom][cat: Video/26][1 pkts/78 bytes <-> 1 pkts/94 bytes][Host: zoomfr84zc.zoom.us][PLAIN TEXT (zoomfr84z)]
+	25	UDP 192.168.1.117:62563 <-> 192.168.1.1:53 [proto: 5.189/DNS.Zoom][cat: Video/26][1 pkts/78 bytes <-> 1 pkts/94 bytes][Host: zoomfr85zc.zoom.us][PLAIN TEXT (zoomfr85z)]
+	26	UDP 192.168.1.117:57025 -> 239.255.255.250:1900 [proto: 12/SSDP][cat: System/18][1 pkts/168 bytes -> 0 pkts/0 bytes][PLAIN TEXT (SEARCH )]
+	27	UDP 192.168.1.117:62988 <-> 192.168.1.1:53 [proto: 5.189/DNS.Zoom][cat: Video/26][1 pkts/72 bytes <-> 1 pkts/88 bytes][Host: www3.zoom.us]
+	28	UDP 192.168.1.117:64352 <-> 192.168.1.1:53 [proto: 5.189/DNS.Zoom][cat: Video/26][1 pkts/71 bytes <-> 1 pkts/87 bytes][Host: log.zoom.us]
+	29	ICMP 192.168.1.117:0 -> 162.255.38.14:0 [proto: 81/ICMP][cat: Network/14][2 pkts/140 bytes -> 0 pkts/0 bytes]
+	30	TCP 192.168.1.117:54798 <-> 13.225.84.182:443 [proto: 91/TLS][cat: Web/5][1 pkts/54 bytes <-> 1 pkts/60 bytes]
+	31	UDP 192.168.1.117:5353 -> 224.0.0.251:5353 [proto: 8/MDNS][cat: Network/14][1 pkts/87 bytes -> 0 pkts/0 bytes][PLAIN TEXT (spotify)]
+	32	UDP 192.168.1.117:57621 -> 192.168.1.255:57621 [proto: 156/Spotify][cat: Music/25][1 pkts/86 bytes -> 0 pkts/0 bytes][PLAIN TEXT (SpotUdp)]
+	33	ICMP 192.168.1.117:0 -> 192.168.1.1:0 [proto: 81/ICMP][cat: Network/14][1 pkts/70 bytes -> 0 pkts/0 bytes]