diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2023-03-30 08:45:17 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-03-30 08:45:17 +0200 |
| commit | 3e06bcce8dc558239c4a7e33e936adde8c05791f (patch) | |
| tree | a3fcc2c5295baa39735ca8101d8fb77b67bfb636 | |
| parent | 6e0cd162254e54ee2ca349455f39786fe039b811 (diff) | |
Add another example of custom rules (#1923)
Add an example where traffic matching the same IP, but different ports
is classified to different protocols.
Close #189
| -rw-r--r-- | example/protos.txt | 3 | ||||
| -rw-r--r-- | tests/pcap/custom_rules_same-ip_multiple_ports.pcapng | bin | 0 -> 932 bytes | |||
| -rw-r--r-- | tests/result/custom_rules_same-ip_multiple_ports.pcapng.out | 27 |
3 files changed, 30 insertions, 0 deletions
diff --git a/example/protos.txt b/example/protos.txt index 2ed5e848c..17a68756d 100644 --- a/example/protos.txt +++ b/example/protos.txt @@ -50,6 +50,9 @@ ip:213.75.170.11/32:443@CustomProtocol ip:8.248.73.247:443@AmazonPrime ip:54.80.47.130@AmazonPrime +ip:3.3.3.3:443@CustomProtocolA +ip:3.3.3.3:444@CustomProtocolB + # # Risk Exceptions # diff --git a/tests/pcap/custom_rules_same-ip_multiple_ports.pcapng b/tests/pcap/custom_rules_same-ip_multiple_ports.pcapng Binary files differnew file mode 100644 index 000000000..9f3f5b8cf --- /dev/null +++ b/tests/pcap/custom_rules_same-ip_multiple_ports.pcapng diff --git a/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out b/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out new file mode 100644 index 000000000..8fe727c04 --- /dev/null +++ b/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out @@ -0,0 +1,27 @@ +Guessed flow protos: 0 + +DPI Packets (TCP): 2 (1.00 pkts/flow) +Confidence Unknown : 2 (flows) +Num dissector calls: 0 (0.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 4/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia protocols: 2/2 (search/found) + +CustomProtocolA 3 222 1 +CustomProtocolB 2 148 1 + + 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.339/TLS.CustomProtocolA][IP: 339/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 2 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 340/CustomProtocolB][IP: 340/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |