diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2025-06-21 12:41:00 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-06-21 12:41:00 +0200 |
| commit | aa6dcad15e50c0a149b51d2f4ea6fdcd914a09ea (patch) | |
| tree | 2cb034ed730960ac7eb1f62fb1335be8b209b51c | |
| parent | a671226078347ed058a6ddcbfebd27e8a524bd1d (diff) | |
ndpiReader: print categories summary (#2895)
679 files changed, 1867 insertions, 0 deletions
diff --git a/example/ndpiReader.c b/example/ndpiReader.c index 56eb9c7d7..f18dd3361 100644 --- a/example/ndpiReader.c +++ b/example/ndpiReader.c @@ -2453,6 +2453,7 @@ static void node_print_known_proto_walker(const void *node, static void node_proto_guess_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) { struct ndpi_flow_info *flow = *(struct ndpi_flow_info **) node; u_int16_t thread_id = *((u_int16_t *) user_data), proto, fpc_proto; + ndpi_protocol_category_t category; (void)depth; @@ -2478,6 +2479,8 @@ static void node_proto_guess_walker(const void *node, ndpi_VISIT which, int dept fpc_proto = flow->fpc.proto.app_protocol ? flow->fpc.proto.app_protocol : flow->fpc.proto.master_protocol; fpc_proto = ndpi_map_user_proto_id_to_ndpi_id(ndpi_thread_info[thread_id].workflow->ndpi_struct, fpc_proto); + category = flow->detected_protocol.category; + ndpi_thread_info[thread_id].workflow->stats.protocol_counter[proto] += flow->src2dst_packets + flow->dst2src_packets; ndpi_thread_info[thread_id].workflow->stats.protocol_counter_bytes[proto] += flow->src2dst_bytes + flow->dst2src_bytes; ndpi_thread_info[thread_id].workflow->stats.protocol_flows[proto]++; @@ -2487,6 +2490,9 @@ static void node_proto_guess_walker(const void *node, ndpi_VISIT which, int dept ndpi_thread_info[thread_id].workflow->stats.fpc_protocol_counter_bytes[fpc_proto] += flow->src2dst_bytes + flow->dst2src_bytes; ndpi_thread_info[thread_id].workflow->stats.fpc_protocol_flows[fpc_proto]++; ndpi_thread_info[thread_id].workflow->stats.fpc_flow_confidence[flow->fpc.confidence]++; + ndpi_thread_info[thread_id].workflow->stats.category_counter[category] += flow->src2dst_packets + flow->dst2src_packets; + ndpi_thread_info[thread_id].workflow->stats.category_counter_bytes[category] += flow->src2dst_bytes + flow->dst2src_bytes; + ndpi_thread_info[thread_id].workflow->stats.category_flows[category]++; } } @@ -4072,6 +4078,12 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us cumulative_stats.fpc_protocol_flows[i] += ndpi_thread_info[thread_id].workflow->stats.fpc_protocol_flows[i]; } + for(i = 0; i < NDPI_PROTOCOL_NUM_CATEGORIES; i++) { + cumulative_stats.category_counter[i] += ndpi_thread_info[thread_id].workflow->stats.category_counter[i]; + cumulative_stats.category_counter_bytes[i] += ndpi_thread_info[thread_id].workflow->stats.category_counter_bytes[i]; + cumulative_stats.category_flows[i] += ndpi_thread_info[thread_id].workflow->stats.category_flows[i]; + } + cumulative_stats.ndpi_flow_count += ndpi_thread_info[thread_id].workflow->stats.ndpi_flow_count; cumulative_stats.flow_count[0] += ndpi_thread_info[thread_id].workflow->stats.flow_count[0]; cumulative_stats.flow_count[1] += ndpi_thread_info[thread_id].workflow->stats.flow_count[1]; @@ -4519,6 +4531,33 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us } } + if(!quiet_mode) { + printf("\n\nCategory statistics:\n"); + + for(i = 0; i < NDPI_PROTOCOL_NUM_CATEGORIES; i++) { + if(cumulative_stats.category_counter[i] > 0) { + printf("\t%-20s packets: %-13llu bytes: %-13llu " + "flows: %-13llu\n", + ndpi_category_get_name(ndpi_thread_info[0].workflow->ndpi_struct, i), + (long long unsigned int)cumulative_stats.category_counter[i], + (long long unsigned int)cumulative_stats.category_counter_bytes[i], + (long long unsigned int)cumulative_stats.category_flows[i]); + } + } + } + if(results_file) { + fprintf(results_file, "\n"); + for(i = 0; i < NDPI_PROTOCOL_NUM_CATEGORIES; i++) { + if(cumulative_stats.category_counter[i] > 0) { + fprintf(results_file, "%-20s %13llu %-13llu %-13llu\n", + ndpi_category_get_name(ndpi_thread_info[0].workflow->ndpi_struct, i), + (long long unsigned int)cumulative_stats.category_counter[i], + (long long unsigned int)cumulative_stats.category_counter_bytes[i], + (long long unsigned int)cumulative_stats.category_flows[i]); + } + } + } + printRiskStats(); printFlowsStats(); diff --git a/example/reader_util.h b/example/reader_util.h index b755d3ab6..bbd1ac949 100644 --- a/example/reader_util.h +++ b/example/reader_util.h @@ -378,6 +378,9 @@ typedef struct ndpi_stats { u_int64_t *fpc_protocol_counter; u_int64_t *fpc_protocol_counter_bytes; u_int32_t *fpc_protocol_flows; + u_int64_t category_counter[NDPI_PROTOCOL_NUM_CATEGORIES]; + u_int64_t category_counter_bytes[NDPI_PROTOCOL_NUM_CATEGORIES]; + u_int32_t category_flows[NDPI_PROTOCOL_NUM_CATEGORIES]; u_int32_t ndpi_flow_count; u_int32_t flow_count[3]; u_int64_t tcp_count, udp_count; diff --git a/tests/cfgs/caches_cfg/result/ookla.pcap.out b/tests/cfgs/caches_cfg/result/ookla.pcap.out index f53e9f46a..04d7a4299 100644 --- a/tests/cfgs/caches_cfg/result/ookla.pcap.out +++ b/tests/cfgs/caches_cfg/result/ookla.pcap.out @@ -30,6 +30,9 @@ Ookla 74 12870 4 Safe 103 36036 5 Acceptable 10 2375 1 +Web 39 25541 2 +Network 74 12870 4 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 2 diff --git a/tests/cfgs/caches_cfg/result/teams.pcap.out b/tests/cfgs/caches_cfg/result/teams.pcap.out index 9a3982463..3e3c6dd96 100644 --- a/tests/cfgs/caches_cfg/result/teams.pcap.out +++ b/tests/cfgs/caches_cfg/result/teams.pcap.out @@ -45,6 +45,15 @@ Acceptable 714 378066 54 Fun 1 82 1 Unrated 4 456 1 +Unspecified 4 456 1 +Web 123 55119 6 +Chat 3 186 1 +VoIP 124 33394 13 +Cloud 2 1054 2 +Network 91 18328 27 +Collaborative 1150 568376 32 +Music 1 82 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.6 7 diff --git a/tests/cfgs/caches_global/result/bittorrent.pcap.out b/tests/cfgs/caches_global/result/bittorrent.pcap.out index 0846cac52..815c0272b 100644 --- a/tests/cfgs/caches_global/result/bittorrent.pcap.out +++ b/tests/cfgs/caches_global/result/bittorrent.pcap.out @@ -24,6 +24,8 @@ BitTorrent 299 305728 24 Acceptable 299 305728 24 +Download 299 305728 24 + 1 TCP 192.168.1.3:52915 <-> 198.100.146.9:60163 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][17 pkts/2745 bytes <-> 193 pkts/282394 bytes][Goodput ratio: 59/95][5.77 sec][bytes ratio: -0.981 (Download)][IAT c2s/s2c min/avg/max/stddev: 12/0 319/30 779/919 241/95][Pkt Len c2s/s2c min/avg/max/stddev: 83/80 161/1463 242/1506 58/218][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 51413,53646][BT Hash: dcfcdccfb9e670ccc3dd40c78c161f2bea243126][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 2,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,93,0,0] 2 TCP 192.168.1.3:52895 <-> 83.216.184.241:51413 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][4 pkts/583 bytes <-> 4 pkts/975 bytes][Goodput ratio: 55/73][4.11 sec][bytes ratio: -0.252 (Download)][IAT c2s/s2c min/avg/max/stddev: 132/72 959/2027 1966/3982 760/1955][Pkt Len c2s/s2c min/avg/max/stddev: 80/73 146/244 198/648 44/235][BT Hash: dcfcdccfb9e670ccc3dd40c78c161f2bea243126][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 25,12,25,12,12,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.1.3:52914 <-> 190.103.195.56:46633 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][4 pkts/640 bytes <-> 3 pkts/910 bytes][Goodput ratio: 59/78][3.54 sec][bytes ratio: -0.174 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 489/661 1178/883 1943/1105 596/222][Pkt Len c2s/s2c min/avg/max/stddev: 75/113 160/303 241/650 62/246][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 51413,53646][BT Hash: dcfcdccfb9e670ccc3dd40c78c161f2bea243126][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 14,14,28,14,0,14,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/caches_global/result/lru_ipv6_caches.pcapng.out b/tests/cfgs/caches_global/result/lru_ipv6_caches.pcapng.out index 46f516804..1a4ee599e 100644 --- a/tests/cfgs/caches_global/result/lru_ipv6_caches.pcapng.out +++ b/tests/cfgs/caches_global/result/lru_ipv6_caches.pcapng.out @@ -29,6 +29,10 @@ Cloudflare 9 8862 3 Acceptable 88 20854 12 +Web 9 8862 3 +Download 25 4546 5 +VoIP 54 7446 4 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/caches_global/result/mining.pcapng.out b/tests/cfgs/caches_global/result/mining.pcapng.out index 3e9c18edd..21387a285 100644 --- a/tests/cfgs/caches_global/result/mining.pcapng.out +++ b/tests/cfgs/caches_global/result/mining.pcapng.out @@ -24,6 +24,8 @@ Mining 673 219078 4 Unsafe 673 219078 4 +Mining 673 219078 4 + 1 TCP 192.168.2.148:46838 <-> 94.23.199.191:3333 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Mining/99][159 pkts/143155 bytes <-> 113 pkts/13204 bytes][Goodput ratio: 93/43][1091.42 sec][currency: ZCash][bytes ratio: 0.831 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 7234/8131 71734/71815 15224/15291][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 900/117 1514/376 709/99][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (method)][Plen Bins: 28,2,0,1,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,29,29,0,0] 2 TCP 147.229.13.222:49307 <-> 185.71.66.39:9999 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Mining/99][112 pkts/10941 bytes <-> 97 pkts/20817 bytes][Goodput ratio: 45/74][295.93 sec][currency: Ethereum][bytes ratio: -0.311 (Download)][IAT c2s/s2c min/avg/max/stddev: 8/0 2992/2893 9784/10017 3265/3384][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 98/215 259/297 57/112][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_128_8192_4697958db063/Windows][PLAIN TEXT (worker)][Plen Bins: 0,1,28,0,12,0,0,58,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.92:55190 <-> 178.32.196.217:9050 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Mining/99][83 pkts/11785 bytes <-> 62 pkts/8859 bytes][Goodput ratio: 53/53][1154.54 sec][currency: ZCash/Monero][bytes ratio: 0.142 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 15953/19141 60205/60205 20621/20751][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 142/143 326/369 91/88][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (method)][Plen Bins: 0,40,0,0,0,44,0,13,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/caches_global/result/ookla.pcap.out b/tests/cfgs/caches_global/result/ookla.pcap.out index f6d568bec..17110a990 100644 --- a/tests/cfgs/caches_global/result/ookla.pcap.out +++ b/tests/cfgs/caches_global/result/ookla.pcap.out @@ -28,6 +28,9 @@ Ookla 113 38411 6 Safe 113 38411 6 +Web 29 23166 1 +Network 84 15245 5 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 2 diff --git a/tests/cfgs/caches_global/result/teams.pcap.out b/tests/cfgs/caches_global/result/teams.pcap.out index 4a7a695b7..c4ea3b205 100644 --- a/tests/cfgs/caches_global/result/teams.pcap.out +++ b/tests/cfgs/caches_global/result/teams.pcap.out @@ -45,6 +45,15 @@ Acceptable 714 378066 54 Fun 1 82 1 Unrated 4 456 1 +Unspecified 4 456 1 +Web 20 11474 2 +Chat 3 186 1 +VoIP 124 33394 13 +Cloud 2 1054 2 +Network 91 18328 27 +Collaborative 1253 612021 36 +Music 1 82 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.6 7 diff --git a/tests/cfgs/caches_global/result/zoom_p2p.pcapng.out b/tests/cfgs/caches_global/result/zoom_p2p.pcapng.out index a7af88a91..2b5be45fd 100644 --- a/tests/cfgs/caches_global/result/zoom_p2p.pcapng.out +++ b/tests/cfgs/caches_global/result/zoom_p2p.pcapng.out @@ -28,6 +28,10 @@ Zoom 691 262429 8 Acceptable 763 271804 12 +Cloud 16 2784 1 +Network 56 6591 3 +Video 691 262429 8 + 1 UDP 192.168.12.156:39065 <-> 192.168.1.226:46757 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 5][cat: Video/26][148 pkts/108673 bytes <-> 174 pkts/110457 bytes][Goodput ratio: 94/93][1.67 sec][bytes ratio: -0.008 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/8 88/71 15/12][Pkt Len c2s/s2c min/avg/max/stddev: 127/98 734/635 1269/1302 277/371][PLAIN TEXT (192.168.1.226)][Plen Bins: 0,0,9,1,0,0,0,6,1,0,0,0,0,2,5,11,10,5,4,4,2,0,0,1,2,2,0,0,0,0,0,1,16,0,0,0,3,1,5,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.156:49579 -> 10.78.14.178:49586 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 5][cat: Video/26][154 pkts/19404 bytes -> 0 pkts/0 bytes][Goodput ratio: 67/0][4.51 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 28/0 82/0 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 126/0 126/0 126/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (10.78.14.178)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.156:42208 -> 10.78.14.178:47312 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 5][cat: Video/26][130 pkts/16380 bytes -> 0 pkts/0 bytes][Goodput ratio: 67/0][2.24 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 18/0 82/0 18/0][Pkt Len c2s/s2c min/avg/max/stddev: 126/0 126/0 126/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (10.78.14.178)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/bittorrent.pcap.out b/tests/cfgs/classification_only/result/bittorrent.pcap.out index 1ef07f6d5..2ba057eef 100644 --- a/tests/cfgs/classification_only/result/bittorrent.pcap.out +++ b/tests/cfgs/classification_only/result/bittorrent.pcap.out @@ -24,6 +24,8 @@ BitTorrent 299 305728 24 Acceptable 299 305728 24 +Download 299 305728 24 + 1 TCP 192.168.1.3:52915 <-> 198.100.146.9:60163 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][17 pkts/2745 bytes <-> 193 pkts/282394 bytes][Goodput ratio: 59/95][5.77 sec][bytes ratio: -0.981 (Download)][IAT c2s/s2c min/avg/max/stddev: 12/0 319/30 779/919 241/95][Pkt Len c2s/s2c min/avg/max/stddev: 83/80 161/1463 242/1506 58/218][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 2,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,93,0,0] 2 TCP 192.168.1.3:52895 <-> 83.216.184.241:51413 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][4 pkts/583 bytes <-> 4 pkts/975 bytes][Goodput ratio: 55/73][4.11 sec][bytes ratio: -0.252 (Download)][IAT c2s/s2c min/avg/max/stddev: 132/72 959/2027 1966/3982 760/1955][Pkt Len c2s/s2c min/avg/max/stddev: 80/73 146/244 198/648 44/235][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 25,12,25,12,12,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.1.3:52914 <-> 190.103.195.56:46633 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][4 pkts/640 bytes <-> 3 pkts/910 bytes][Goodput ratio: 59/78][3.54 sec][bytes ratio: -0.174 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 489/661 1178/883 1943/1105 596/222][Pkt Len c2s/s2c min/avg/max/stddev: 75/113 160/303 241/650 62/246][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 14,14,28,14,0,14,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/bittorrent_tcp_miss.pcapng.out b/tests/cfgs/classification_only/result/bittorrent_tcp_miss.pcapng.out index 4444747aa..0926ad924 100644 --- a/tests/cfgs/classification_only/result/bittorrent_tcp_miss.pcapng.out +++ b/tests/cfgs/classification_only/result/bittorrent_tcp_miss.pcapng.out @@ -24,4 +24,6 @@ BitTorrent 100 96898 1 Acceptable 100 96898 1 +Download 100 96898 1 + 1 TCP 192.168.122.34:48987 <-> 178.71.206.1:6881 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: Download/7][33 pkts/2895 bytes <-> 67 pkts/94003 bytes][Goodput ratio: 38/96][0.31 sec][bytes ratio: -0.940 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/4 33/64 11/12][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 88/1403 525/1494 98/324][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 0,4,1,0,0,0,1,1,0,1,0,1,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,88,0,0] diff --git a/tests/cfgs/classification_only/result/forticlient.pcap.out b/tests/cfgs/classification_only/result/forticlient.pcap.out index 4ff9d200b..87d403b17 100644 --- a/tests/cfgs/classification_only/result/forticlient.pcap.out +++ b/tests/cfgs/classification_only/result/forticlient.pcap.out @@ -25,6 +25,8 @@ FortiClient 2000 430931 5 Safe 2000 430931 5 +VPN 2000 430931 5 + 1 TCP 192.168.1.178:61820 <-> 82.81.46.13:10443 [proto: 91.259/TLS.FortiClient][IP: 0/Unknown][Encrypted][Confidence: DPI (cache)][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VPN/2][1150 pkts/146555 bytes <-> 751 pkts/256436 bytes][Goodput ratio: 48/81][13.06 sec][Hostname/SNI: 82.81.46.13][bytes ratio: -0.273 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 12/19 5218/5218 173/225][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 127/341 1477/1506 88/427][TLSv1.2][Plen Bins: 0,19,33,15,17,6,0,3,0,1,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.178:61812 <-> 82.81.46.13:10443 [proto: 91.259/TLS.FortiClient][IP: 0/Unknown][Encrypted][Confidence: DPI (cache)][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VPN/2][15 pkts/1753 bytes <-> 14 pkts/7481 bytes][Goodput ratio: 43/87][1.09 sec][Hostname/SNI: 82.81.46.13][bytes ratio: -0.620 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 79/81 336/340 94/113][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 117/534 450/1506 104/626][TLSv1.2][Plen Bins: 16,16,0,8,0,0,8,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,8,0,0,0,0,0,0,0,0,0,25,0,0] 3 TCP 192.168.1.178:61806 <-> 82.81.46.13:10443 [proto: 91.259/TLS.FortiClient][IP: 0/Unknown][Encrypted][Confidence: DPI (cache)][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VPN/2][14 pkts/1462 bytes <-> 11 pkts/6959 bytes][Goodput ratio: 36/89][1.09 sec][Hostname/SNI: 82.81.46.13][bytes ratio: -0.653 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 93/89 336/401 92/145][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 104/633 269/1506 66/634][TLSv1.2][Plen Bins: 9,18,0,9,0,9,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,27,0,0] diff --git a/tests/cfgs/classification_only/result/http-basic-auth.pcap.out b/tests/cfgs/classification_only/result/http-basic-auth.pcap.out index 2de654d16..f4d216b15 100644 --- a/tests/cfgs/classification_only/result/http-basic-auth.pcap.out +++ b/tests/cfgs/classification_only/result/http-basic-auth.pcap.out @@ -27,6 +27,8 @@ HTTP 688 353898 25 Acceptable 688 353898 25 +Web 688 353898 25 + 1 TCP 192.168.0.4:54340 <-> 192.254.189.169:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][58 pkts/9591 bytes <-> 74 pkts/74782 bytes][Goodput ratio: 60/93][20.90 sec][Hostname/SNI: browserspy.dk][bytes ratio: -0.773 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 397/166 4647/4811 1045/722][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 165/1011 805/1514 248/628][URL: browserspy.dk/theme/default.css][StatusCode: 304][Server: Apache][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36][PLAIN TEXT (GET /theme/default.css HTTP/1.1)][Plen Bins: 0,0,5,0,4,0,4,2,2,2,0,1,0,0,0,0,0,2,1,0,0,0,8,2,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,63,0,0] 2 TCP 192.168.0.4:54338 <-> 192.254.189.169:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: Web/5][31 pkts/4999 bytes <-> 40 pkts/37974 bytes][Goodput ratio: 59/93][17.45 sec][Hostname/SNI: browserspy.dk][bytes ratio: -0.767 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 716/350 5396/5591 1514/1171][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 161/949 805/1514 246/645][URL: browserspy.dk/password-ok.php][StatusCode: 401][Content-Type: text/html][Server: Apache][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36][PLAIN TEXT (GET /password)][Plen Bins: 0,0,5,0,5,0,5,0,2,2,0,0,0,0,0,2,0,0,0,2,0,0,5,5,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,62,0,0] 3 TCP 192.168.0.4:54584 <-> 192.254.189.169:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][27 pkts/3947 bytes <-> 36 pkts/37139 bytes][Goodput ratio: 55/94][15.57 sec][Hostname/SNI: browserspy.dk][bytes ratio: -0.808 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 502/211 4249/2440 1050/592][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 146/1032 797/1514 225/628][URL: browserspy.dk/pics/logo.png][StatusCode: 304][Server: Apache][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36][PLAIN TEXT (GET /pics/logo.png HTTP/1.1)][Plen Bins: 0,0,6,0,3,0,3,0,3,0,0,0,0,0,0,0,0,3,0,0,0,0,12,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0] diff --git a/tests/cfgs/classification_only/result/http-pwd.pcapng.out b/tests/cfgs/classification_only/result/http-pwd.pcapng.out index 4aceedd20..5bd9c5b3b 100644 --- a/tests/cfgs/classification_only/result/http-pwd.pcapng.out +++ b/tests/cfgs/classification_only/result/http-pwd.pcapng.out @@ -24,4 +24,6 @@ ntop 14 1805 1 Safe 14 1805 1 +Web 14 1805 1 + 1 TCP 127.0.0.1:56451 <-> 127.0.0.1:3000 [proto: 7.26/HTTP.ntop][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 9][cat: Web/5][7 pkts/1151 bytes <-> 7 pkts/654 bytes][Goodput ratio: 65/38][0.00 sec][Hostname/SNI: localhost][bytes ratio: 0.275 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/4 1/1 4/4 2/2][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 164/93 747/306 239/87][URL: localhost:3000/authorize.html][StatusCode: 302][Server: ntopng 6.3.241001 (arm64)][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15][PLAIN TEXT (XPOST /authorize.html HTTP/1.1)][Plen Bins: 0,33,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/http_auth.pcap.out b/tests/cfgs/classification_only/result/http_auth.pcap.out index 62b4cfa22..9d138fa80 100644 --- a/tests/cfgs/classification_only/result/http_auth.pcap.out +++ b/tests/cfgs/classification_only/result/http_auth.pcap.out @@ -24,4 +24,6 @@ HTTP 33 20574 1 Acceptable 33 20574 1 +Web 33 20574 1 + 1 TCP 192.168.0.4:54337 <-> 192.254.189.169:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][14 pkts/1675 bytes <-> 19 pkts/18899 bytes][Goodput ratio: 44/93][7.10 sec][Hostname/SNI: browserspy.dk][bytes ratio: -0.837 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 204/31 1269/206 376/69][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 120/995 805/1514 190/642][URL: browserspy.dk/password-ok.php][StatusCode: 401][Content-Type: text/html][Server: Apache][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36][PLAIN TEXT (GET /password)][Plen Bins: 0,0,6,0,0,0,6,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,6,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,0,0] diff --git a/tests/cfgs/classification_only/result/ookla.pcap.out b/tests/cfgs/classification_only/result/ookla.pcap.out index 2c2033df2..799c2d3e5 100644 --- a/tests/cfgs/classification_only/result/ookla.pcap.out +++ b/tests/cfgs/classification_only/result/ookla.pcap.out @@ -28,6 +28,9 @@ Ookla 113 38411 6 Safe 113 38411 6 +Web 29 23166 1 +Network 84 15245 5 + 1 TCP 192.168.1.128:35830 <-> 89.96.108.170:8080 [proto: 91.191/TLS.Ookla][IP: 0/Unknown][Encrypted][Confidence: DPI (aggressive)][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][21 pkts/21216 bytes <-> 8 pkts/1950 bytes][Goodput ratio: 93/72][0.32 sec][Hostname/SNI: spd-pub-mi-01-01.fastwebnet.it][(Advertised) ALPNs: h2;http/1.1][bytes ratio: 0.832 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 17/61 274/280 62/109][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1010/244 1514/387 612/138][TLSv1.3][Plen Bins: 0,0,4,0,0,0,0,4,9,0,9,0,0,0,0,0,4,0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,55,0,0] 2 TCP 192.168.1.128:48854 <-> 104.16.209.12:443 [proto: 91.191/TLS.Ookla][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 4][cat: Network/14][8 pkts/1620 bytes <-> 6 pkts/3818 bytes][Goodput ratio: 67/89][0.06 sec][Hostname/SNI: www.speedtest.net][(Advertised) ALPNs: h2;http/1.1][bytes ratio: -0.404 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/5 18/15 7/6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 202/636 583/1514 181/646][TLSv1.2][PLAIN TEXT (@oTAgOeedtest.net)][Plen Bins: 0,0,14,0,0,14,0,0,0,0,14,0,0,0,0,0,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,28,0,0] 3 TCP 192.168.1.7:51207 <-> 46.44.253.187:80 [proto: 7.191/HTTP.Ookla][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][12 pkts/2238 bytes <-> 8 pkts/2082 bytes][Goodput ratio: 64/74][5.33 sec][Hostname/SNI: massarosa-1.speedtest.welcomeitalia.it][bytes ratio: 0.036 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/4 528/47 5005/84 1493/28][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 186/260 430/523 168/194][URL: massarosa-1.speedtest.welcomeitalia.it/crossdomain.xml][StatusCode: 200][Content-Type: application/xml][Server: Apache/2.2.22 (Ubuntu)][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/602.4.8 (KHTML, like Gecko) Version/10.0.3 Safari/602.4.8][PLAIN TEXT (GET /crossdomain.xml HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,12,75,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/sip.pcap.out b/tests/cfgs/classification_only/result/sip.pcap.out index b618b7421..1bfe38cff 100644 --- a/tests/cfgs/classification_only/result/sip.pcap.out +++ b/tests/cfgs/classification_only/result/sip.pcap.out @@ -28,6 +28,10 @@ SIP 102 47087 2 Acceptable 111 49013 3 Unrated 1 146 1 +Unspecified 1 146 1 +Media 9 1926 1 +VoIP 102 47087 2 + 1 UDP 192.168.1.2:5060 <-> 212.242.33.35:5060 [proto: 100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 100/SIP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][53 pkts/21940 bytes <-> 31 pkts/15635 bytes][Goodput ratio: 90/92][1521.57 sec][bytes ratio: 0.168 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 158/13 25541/22026 150200/89874 25265/23489][Pkt Len c2s/s2c min/avg/max/stddev: 47/342 414/504 1118/711 343/85][PLAIN TEXT (REGISTER sip)][Plen Bins: 26,0,0,0,0,0,0,0,0,4,8,0,2,4,13,17,0,0,3,0,1,10,0,0,0,5,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.2:5060 <-> 200.68.120.81:5060 [proto: 100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 100/SIP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][15 pkts/7568 bytes <-> 3 pkts/1944 bytes][Goodput ratio: 92/93][67.09 sec][bytes ratio: 0.591 (Upload)][IAT c2s/s2c min/avg/max/stddev: 507/34556 4746/34556 32608/34556 8188/0][Pkt Len c2s/s2c min/avg/max/stddev: 389/637 505/648 864/656 180/8][PLAIN TEXT (INVITE sip)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,5,62,0,0,0,0,0,0,5,11,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.2:30000 -> 212.242.33.36:40392 [proto: 87/RTP][IP: 0/Unknown][Stream Content: Audio][Payload Type: ITU-T G.711 PCMA (8.0)][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: Media/1][9 pkts/1926 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][0.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 20/0 69/0 23/0][Pkt Len c2s/s2c min/avg/max/stddev: 214/0 214/0 214/0 0/0][PLAIN TEXT (VRUDKBuYs)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/teams.pcap.out b/tests/cfgs/classification_only/result/teams.pcap.out index 287cebc00..692f54118 100644 --- a/tests/cfgs/classification_only/result/teams.pcap.out +++ b/tests/cfgs/classification_only/result/teams.pcap.out @@ -45,6 +45,15 @@ Acceptable 714 378066 54 Fun 1 82 1 Unrated 4 456 1 +Unspecified 4 456 1 +Web 20 11474 2 +Chat 3 186 1 +VoIP 124 33394 13 +Cloud 2 1054 2 +Network 91 18328 27 +Collaborative 1253 612021 36 +Music 1 82 1 + 1 TCP 192.168.1.6:60543 <-> 52.114.77.33:443 [proto: 91.219/TLS.Microsoft365][IP: 276/Azure][Encrypted][Confidence: DPI][FPC: 276/Azure, Confidence: IP address][DPI packets: 4][cat: Collaborative/15][67 pkts/86089 bytes <-> 40 pkts/7347 bytes][Goodput ratio: 95/64][0.72 sec][Hostname/SNI: mobile.pipe.aria.microsoft.com][bytes ratio: 0.843 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8/16 152/86 28/26][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1285/184 1494/1506 497/372][TLSv1.2][Plen Bins: 1,1,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0,89,3,0,0] 2 TCP 192.168.1.6:60532 <-> 52.114.77.33:443 [proto: 91.219/TLS.Microsoft365][IP: 276/Azure][Encrypted][Confidence: DPI][FPC: 276/Azure, Confidence: IP address][DPI packets: 4][cat: Collaborative/15][49 pkts/58592 bytes <-> 28 pkts/6555 bytes][Goodput ratio: 94/72][0.71 sec][Hostname/SNI: mobile.pipe.aria.microsoft.com][bytes ratio: 0.799 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 13/29 177/221 32/57][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1196/234 1494/1506 564/435][TLSv1.2][Plen Bins: 2,2,2,0,0,2,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,81,4,0,0] 3 TCP 192.168.1.6:60554 <-> 52.113.194.132:443 [proto: 91.250/TLS.Teams][IP: 250/Teams][Encrypted][Confidence: DPI][FPC: 250/Teams, Confidence: IP address][DPI packets: 4][cat: Collaborative/15][24 pkts/2746 bytes <-> 28 pkts/30546 bytes][Goodput ratio: 52/95][0.23 sec][Hostname/SNI: config.teams.microsoft.com][bytes ratio: -0.835 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/9 21/140 7/29][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 114/1091 1136/1506 217/607][TLSv1.2][Plen Bins: 0,7,0,3,3,3,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,3,0,0,3,0,0,0,0,0,7,0,0,0,0,0,65,0,0] diff --git a/tests/cfgs/classification_only/result/tls_1.2_unidir_client_no_cert.pcapng.out b/tests/cfgs/classification_only/result/tls_1.2_unidir_client_no_cert.pcapng.out index f5047fe9c..b95fc4152 100644 --- a/tests/cfgs/classification_only/result/tls_1.2_unidir_client_no_cert.pcapng.out +++ b/tests/cfgs/classification_only/result/tls_1.2_unidir_client_no_cert.pcapng.out @@ -24,4 +24,6 @@ TLS 10 1549 1 Safe 10 1549 1 +Web 10 1549 1 + 1 TCP 192.168.12.156:39958 -> 172.67.21.133:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 10][cat: Web/5][10 pkts/1549 bytes -> 0 pkts/0 bytes][Goodput ratio: 64/0][0.30 sec][Hostname/SNI: sb.adtidy.org][(Advertised) ALPNs: http/1.1][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 33/0 154/0 47/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 155/0 571/0 179/0][TLSv1.2][Plen Bins: 25,25,0,0,0,0,0,0,0,0,0,0,25,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/tls_1.2_unidir_server_no_cert.pcapng.out b/tests/cfgs/classification_only/result/tls_1.2_unidir_server_no_cert.pcapng.out index 4b225ff69..00f06659a 100644 --- a/tests/cfgs/classification_only/result/tls_1.2_unidir_server_no_cert.pcapng.out +++ b/tests/cfgs/classification_only/result/tls_1.2_unidir_server_no_cert.pcapng.out @@ -24,4 +24,6 @@ TLS 10 1978 1 Safe 10 1978 1 +Web 10 1978 1 + 1 TCP 172.67.21.133:443 -> 192.168.12.156:39958 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 10][cat: Web/5][10 pkts/1978 bytes -> 0 pkts/0 bytes][Goodput ratio: 72/0][0.30 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 33/0 88/0 32/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 198/0 1284/0 365/0][TLSv1.2][Plen Bins: 0,33,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/tls_1.2_unidirectional_client.pcapng.out b/tests/cfgs/classification_only/result/tls_1.2_unidirectional_client.pcapng.out index 295b6ede5..a0878db69 100644 --- a/tests/cfgs/classification_only/result/tls_1.2_unidirectional_client.pcapng.out +++ b/tests/cfgs/classification_only/result/tls_1.2_unidirectional_client.pcapng.out @@ -24,4 +24,6 @@ GoogleServices 17 3004 1 Acceptable 17 3004 1 +Web 17 3004 1 + 1 TCP 192.168.12.156:43854 -> 216.58.209.42:443 [proto: 91.239/TLS.GoogleServices][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 3][cat: Web/5][17 pkts/3004 bytes -> 0 pkts/0 bytes][Goodput ratio: 62/0][11.30 sec][Hostname/SNI: notifications-pa.googleapis.com][(Advertised) ALPNs: h2;http/1.1][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 753/0 10866/0 2704/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 177/0 1090/0 251/0][TLSv1.2][Plen Bins: 0,42,14,0,0,14,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/tls_1.2_unidirectional_server.pcapng.out b/tests/cfgs/classification_only/result/tls_1.2_unidirectional_server.pcapng.out index 3fc5740dc..b5d3cdf0b 100644 --- a/tests/cfgs/classification_only/result/tls_1.2_unidirectional_server.pcapng.out +++ b/tests/cfgs/classification_only/result/tls_1.2_unidirectional_server.pcapng.out @@ -24,4 +24,6 @@ YouTubeUpload 18 7218 1 Fun 18 7218 1 +Media 18 7218 1 + 1 TCP 216.58.209.42:443 -> 192.168.12.156:43854 [proto: 91.136/TLS.YouTubeUpload][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 6][cat: Media/1][18 pkts/7218 bytes -> 0 pkts/0 bytes][Goodput ratio: 83/0][0.43 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 26/0 233/0 57/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 401/0 1484/0 503/0][TLSv1.2][Plen Bins: 0,25,8,0,8,0,0,0,0,8,16,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0] diff --git a/tests/cfgs/classification_only/result/tls_1.3_unidirectional_client.pcapng.out b/tests/cfgs/classification_only/result/tls_1.3_unidirectional_client.pcapng.out index 42f82f61a..a19bdf0b2 100644 --- a/tests/cfgs/classification_only/result/tls_1.3_unidirectional_client.pcapng.out +++ b/tests/cfgs/classification_only/result/tls_1.3_unidirectional_client.pcapng.out @@ -24,4 +24,6 @@ Google 9 1488 1 Acceptable 9 1488 1 +Web 9 1488 1 + 1 TCP 192.168.12.156:39750 -> 142.250.184.68:443 [proto: 91.126/TLS.Google][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 3][cat: Web/5][9 pkts/1488 bytes -> 0 pkts/0 bytes][Goodput ratio: 60/0][0.07 sec][Hostname/SNI: www.google.com][(Advertised) ALPNs: http/1.1][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8/0 25/0 7/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 165/0 630/0 179/0][TLSv1.2][Plen Bins: 25,0,25,0,0,0,0,25,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/tls_1.3_unidirectional_server.pcapng.out b/tests/cfgs/classification_only/result/tls_1.3_unidirectional_server.pcapng.out index d0beef6e8..54e12ba64 100644 --- a/tests/cfgs/classification_only/result/tls_1.3_unidirectional_server.pcapng.out +++ b/tests/cfgs/classification_only/result/tls_1.3_unidirectional_server.pcapng.out @@ -24,4 +24,6 @@ TLS 9 1651 1 Safe 9 1651 1 +Web 9 1651 1 + 1 TCP 142.250.184.68:443 -> 192.168.12.156:39750 [proto: 91/TLS][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 9][cat: Web/5][9 pkts/1651 bytes -> 0 pkts/0 bytes][Goodput ratio: 65/0][0.07 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8/0 20/0 7/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 183/0 921/0 270/0][TLSv1.3][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/classification_only/result/tls_ech.pcapng.out b/tests/cfgs/classification_only/result/tls_ech.pcapng.out index 7ec769207..d4f718ab5 100644 --- a/tests/cfgs/classification_only/result/tls_ech.pcapng.out +++ b/tests/cfgs/classification_only/result/tls_ech.pcapng.out @@ -24,4 +24,6 @@ Cloudflare 10 4226 1 Acceptable 10 4226 1 +Web 10 4226 1 + 1 TCP [2001:b07:a3d:c112:ce16:b409:3d0a:9177]:47460 <-> [2606:4700::6812:1e4e]:443 [proto: 91.220/TLS.Cloudflare][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 4][cat: Web/5][6 pkts/1172 bytes <-> 4 pkts/3054 bytes][Goodput ratio: 55/88][0.07 sec][Hostname/SNI: performance.radar.cloudflare.com][(Advertised) ALPNs: h2;http/1.1][bytes ratio: -0.445 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/3 13/5 49/7 18/2][Pkt Len c2s/s2c min/avg/max/stddev: 86/86 195/764 670/2260 213/890][TLSv1.2][ECH: version 0xfe0d][Plen Bins: 0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25] diff --git a/tests/cfgs/classification_only/result/tls_verylong_certificate.pcap.out b/tests/cfgs/classification_only/result/tls_verylong_certificate.pcap.out index 6d3ee1a4e..5c7a7e5f1 100644 --- a/tests/cfgs/classification_only/result/tls_verylong_certificate.pcap.out +++ b/tests/cfgs/classification_only/result/tls_verylong_certificate.pcap.out @@ -24,4 +24,6 @@ Cybersec 48 22229 1 Safe 48 22229 1 +Cybersecurity 48 22229 1 + 1 TCP 192.168.1.160:54804 <-> 151.101.66.49:443 [proto: 91.283/TLS.Cybersec][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Cybersecurity/33][24 pkts/2404 bytes <-> 24 pkts/19825 bytes][Goodput ratio: 35/92][0.09 sec][Hostname/SNI: feodotracker.abuse.ch][(Advertised) ALPNs: http/1.1][bytes ratio: -0.784 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/4 15/21 5/7][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 100/826 583/1434 109/662][TLSv1.2][Plen Bins: 12,16,0,4,0,4,4,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,55,0,0,0,0,0] diff --git a/tests/cfgs/default/result/1kxun.pcap.out b/tests/cfgs/default/result/1kxun.pcap.out index 5ee1fb491..7d5b281ca 100644 --- a/tests/cfgs/default/result/1kxun.pcap.out +++ b/tests/cfgs/default/result/1kxun.pcap.out @@ -52,6 +52,17 @@ Fun 933 1975152 48 Dangerous 5 1197 2 Unrated 19 5564 9 +Unspecified 19 5564 9 +Media 13 4318 2 +Web 380 410792 43 +Download 2 553 1 +Chat 58 25273 5 +Network 148 18784 68 +Streaming 902 1969950 44 +System 175 40630 22 +SoftwareUpdate 2 1359 1 +Advertisement 24 50551 2 + JA Host Stats: IP Address # JA4C 1 192.168.5.16 2 diff --git a/tests/cfgs/default/result/443-chrome.pcap.out b/tests/cfgs/default/result/443-chrome.pcap.out index a4457f7d0..db1926108 100644 --- a/tests/cfgs/default/result/443-chrome.pcap.out +++ b/tests/cfgs/default/result/443-chrome.pcap.out @@ -26,4 +26,6 @@ TLS 1 1506 1 Safe 1 1506 1 +Web 1 1506 1 + 1 TCP 178.62.197.130:443 -> 192.168.1.13:53059 [proto: 91/TLS][IP: 26/ntop][Encrypted][Confidence: Match by port][FPC: 26/ntop, Confidence: IP address][DPI packets: 1][cat: Web/5][1 pkts/1506 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Susp Entropy **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No client to server traffic / Entropy: 7.855 (Encrypted or Random?)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0] diff --git a/tests/cfgs/default/result/443-curl.pcap.out b/tests/cfgs/default/result/443-curl.pcap.out index 3c42a8347..0d9b249d0 100644 --- a/tests/cfgs/default/result/443-curl.pcap.out +++ b/tests/cfgs/default/result/443-curl.pcap.out @@ -24,6 +24,8 @@ ntop 109 73982 1 Safe 109 73982 1 +Network 109 73982 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.13 1 diff --git a/tests/cfgs/default/result/443-firefox.pcap.out b/tests/cfgs/default/result/443-firefox.pcap.out index 1f02e3132..faf18c7aa 100644 --- a/tests/cfgs/default/result/443-firefox.pcap.out +++ b/tests/cfgs/default/result/443-firefox.pcap.out @@ -24,6 +24,8 @@ ntop 667 458067 1 Safe 667 458067 1 +Network 667 458067 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.13 1 diff --git a/tests/cfgs/default/result/443-git.pcap.out b/tests/cfgs/default/result/443-git.pcap.out index c62300a83..75f46f838 100644 --- a/tests/cfgs/default/result/443-git.pcap.out +++ b/tests/cfgs/default/result/443-git.pcap.out @@ -24,6 +24,8 @@ Github 70 37189 1 Acceptable 70 37189 1 +Collaborative 70 37189 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.13 1 diff --git a/tests/cfgs/default/result/443-opvn.pcap.out b/tests/cfgs/default/result/443-opvn.pcap.out index 44d77f33a..4ae2b6d27 100644 --- a/tests/cfgs/default/result/443-opvn.pcap.out +++ b/tests/cfgs/default/result/443-opvn.pcap.out @@ -24,4 +24,6 @@ OpenVPN 46 11573 1 Acceptable 46 11573 1 +VPN 46 11573 1 + 1 TCP 192.168.1.84:52973 <-> 192.12.192.103:1194 [proto: 159/OpenVPN][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: VPN/2][25 pkts/5636 bytes <-> 21 pkts/5937 bytes][Goodput ratio: 70/77][8.96 sec][bytes ratio: -0.026 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 443/427 3959/4015 926/1024][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 225/283 1506/1506 330/399][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][PLAIN TEXT (Registro.it)][Plen Bins: 4,41,4,8,0,0,0,0,0,4,4,0,0,0,4,0,0,4,0,8,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,8,0,0] diff --git a/tests/cfgs/default/result/443-safari.pcap.out b/tests/cfgs/default/result/443-safari.pcap.out index cefd7182e..681c5ba66 100644 --- a/tests/cfgs/default/result/443-safari.pcap.out +++ b/tests/cfgs/default/result/443-safari.pcap.out @@ -24,6 +24,8 @@ ntop 41 19929 1 Safe 41 19929 1 +Network 41 19929 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.13 1 diff --git a/tests/cfgs/default/result/4in4tunnel.pcap.out b/tests/cfgs/default/result/4in4tunnel.pcap.out index e4d295c1c..dec5a805e 100644 --- a/tests/cfgs/default/result/4in4tunnel.pcap.out +++ b/tests/cfgs/default/result/4in4tunnel.pcap.out @@ -24,6 +24,8 @@ Unknown 5 850 1 Unrated 5 850 1 +Unspecified 5 850 1 + Undetected flows: diff --git a/tests/cfgs/default/result/4in6tunnel.pcap.out b/tests/cfgs/default/result/4in6tunnel.pcap.out index 22f13074a..5fdd44f57 100644 --- a/tests/cfgs/default/result/4in6tunnel.pcap.out +++ b/tests/cfgs/default/result/4in6tunnel.pcap.out @@ -24,6 +24,8 @@ Microsoft365 4 2188 1 Acceptable 4 2188 1 +Collaborative 4 2188 1 + JA Host Stats: IP Address # JA4C 1 192.168.0.1 1 diff --git a/tests/cfgs/default/result/6in4tunnel.pcap.out b/tests/cfgs/default/result/6in4tunnel.pcap.out index 44e89a290..899b5351c 100644 --- a/tests/cfgs/default/result/6in4tunnel.pcap.out +++ b/tests/cfgs/default/result/6in4tunnel.pcap.out @@ -33,6 +33,11 @@ Safe 32 15913 3 Acceptable 62 10454 6 Fun 33 13926 1 +Email 4 516 2 +Web 38 17189 2 +SocialNetwork 33 13926 1 +Network 52 8662 5 + JA Host Stats: IP Address # JA4C 1 2001:470:1f17:13f:3e97:eff:fe73:4dec 2 diff --git a/tests/cfgs/default/result/6in6tunnel.pcap.out b/tests/cfgs/default/result/6in6tunnel.pcap.out index e0a35fb7e..9596c0ad8 100644 --- a/tests/cfgs/default/result/6in6tunnel.pcap.out +++ b/tests/cfgs/default/result/6in6tunnel.pcap.out @@ -24,6 +24,8 @@ Unknown 2 212 1 Unrated 2 212 1 +Unspecified 2 212 1 + Undetected flows: diff --git a/tests/cfgs/default/result/BGP_Cisco_hdlc_slarp.pcap.out b/tests/cfgs/default/result/BGP_Cisco_hdlc_slarp.pcap.out index 3ff949fc6..47eafef3f 100644 --- a/tests/cfgs/default/result/BGP_Cisco_hdlc_slarp.pcap.out +++ b/tests/cfgs/default/result/BGP_Cisco_hdlc_slarp.pcap.out @@ -24,4 +24,6 @@ BGP 14 969 1 Acceptable 14 969 1 +Network 14 969 1 + 1 TCP 100.16.1.2:18324 <-> 100.16.1.1:179 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][7 pkts/388 bytes <-> 7 pkts/581 bytes][Goodput ratio: 20/46][50.10 sec][bytes ratio: -0.199 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 10014/9944 50028/49681 20007/19868][Pkt Len c2s/s2c min/avg/max/stddev: 44/44 55/83 101/195 20/49][Risk: ** Malicious Fingerpint **][Risk Score: 100][Risk Info: Unusual TCP fingerprint (scanner detected?)][TCP Fingerprint: 2_32_16384_6bbe28597824/Unknown][Plen Bins: 57,28,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/BGP_redist.pcap.out b/tests/cfgs/default/result/BGP_redist.pcap.out index bdbcb9d2f..01e77ffb2 100644 --- a/tests/cfgs/default/result/BGP_redist.pcap.out +++ b/tests/cfgs/default/result/BGP_redist.pcap.out @@ -24,5 +24,7 @@ BGP 2 322 2 Acceptable 2 322 2 +Network 2 322 2 + 1 TCP 2.2.2.2:179 -> 4.4.4.4:63535 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 13/BGP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/163 bytes -> 0 pkts/0 bytes][Goodput ratio: 70/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 2.2.2.2:179 -> 5.5.5.5:49433 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 13/BGP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/159 bytes -> 0 pkts/0 bytes][Goodput ratio: 72/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/EAQ.pcap.out b/tests/cfgs/default/result/EAQ.pcap.out index 5b75d290d..8b676cc92 100644 --- a/tests/cfgs/default/result/EAQ.pcap.out +++ b/tests/cfgs/default/result/EAQ.pcap.out @@ -26,6 +26,9 @@ EAQ 174 10092 29 Acceptable 197 21835 31 +Web 23 11743 2 +Network 174 10092 29 + 1 TCP 10.8.0.1:40467 <-> 173.194.119.24:80 [proto: 7.126/HTTP.Google][IP: 126/Google][ClearText][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 6][cat: Web/5][8 pkts/591 bytes <-> 6 pkts/9998 bytes][Goodput ratio: 23/97][0.51 sec][Hostname/SNI: www.google.com.br][bytes ratio: -0.888 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/8 76/114 400/349 146/137][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 74/1666 193/2818 45/1240][URL: www.google.com.br/?gfe_rd=cr&ei=1BxnVcP9OKKk8we50oDAAg][StatusCode: 200][Content-Type: text/html][Server: gws][User-Agent: test][Risk: ** HTTP Susp User-Agent **][Risk Score: 100][Risk Info: Suspicious Log4J][TCP Fingerprint: 2_64_14600_38c452335ffe/Unknown][PLAIN TEXT (we50oDAAg HTTP/1.1)][Plen Bins: 0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0,0,60] 2 TCP 10.8.0.1:53497 <-> 173.194.119.48:80 [proto: 7.126/HTTP.Google][IP: 126/Google][ClearText][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 6][cat: Web/5][5 pkts/390 bytes <-> 4 pkts/764 bytes][Goodput ratio: 26/72][0.20 sec][Hostname/SNI: www.google.com][bytes ratio: -0.324 (Download)][IAT c2s/s2c min/avg/max/stddev: 6/10 51/50 139/89 54/40][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 78/191 154/602 39/237][URL: www.google.com/][StatusCode: 302][Content-Type: text/html][Server: GFE/2.0][User-Agent: test][Risk: ** HTTP Susp User-Agent **][Risk Score: 100][Risk Info: Suspicious Log4J][TCP Fingerprint: 2_64_14600_38c452335ffe/Unknown][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.8.0.1:39185 <-> 200.194.132.67:6000 [proto: 190/EAQ][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][5 pkts/290 bytes <-> 5 pkts/290 bytes][Goodput ratio: 27/27][86.62 sec][bytes ratio: 0.000 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 21509/21499 21642/21642 21860/21869 132/138][Pkt Len c2s/s2c min/avg/max/stddev: 58/58 58/58 58/58 0/0][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out b/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out index 3790b0d11..d556980b0 100644 --- a/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out +++ b/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out @@ -26,6 +26,9 @@ Megaco 130 23570 1 Acceptable 1552 259123 5 +Media 1330 182702 1 +VoIP 222 76421 4 + 1 UDP 10.35.60.100:15580 <-> 10.23.1.52:16756 [proto: 87/RTP][IP: 0/Unknown][Stream Content: Audio][Payload Type: ITU-T G.711 PCMA (8.0)][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 25][cat: Media/1][159 pkts/33872 bytes <-> 1171 pkts/148830 bytes][Goodput ratio: 80/66][37.44 sec][bytes ratio: -0.629 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 20/30 81/286 7/49][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 213/127 214/214 12/32][PLAIN TEXT (UUUUUU)][Plen Bins: 0,0,50,0,0,49,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.35.40.25:5060 <-> 10.35.40.200:5060 [proto: 100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 100/SIP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][22 pkts/13254 bytes <-> 24 pkts/13218 bytes][Goodput ratio: 93/92][83.79 sec][SIP From: <sip:unavailable@hostportion>;tag=00e9d478][SIP To: <sip:061963177@italtel.it;user=phone>][bytes ratio: 0.001 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 3385/1643 27628/17187 8177/4202][Pkt Len c2s/s2c min/avg/max/stddev: 425/304 602/551 923/894 205/186][PLAIN TEXT (INVITE sip)][Plen Bins: 0,0,0,0,0,0,0,0,4,0,8,4,22,18,4,0,8,0,0,0,0,0,0,4,8,4,4,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.35.40.22:2944 <-> 10.23.1.42:2944 [proto: 181/Megaco][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 181/Megaco, Confidence: DPI][DPI packets: 1][cat: VoIP/10][65 pkts/7788 bytes <-> 65 pkts/15782 bytes][Goodput ratio: 65/83][109.25 sec][bytes ratio: -0.339 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1409/1356 4370/4370 1953/1909][Pkt Len c2s/s2c min/avg/max/stddev: 77/101 120/243 583/561 107/94][PLAIN TEXT (555282713)][Plen Bins: 0,48,0,23,0,1,1,21,0,0,1,0,0,0,0,1,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/IEC104.pcap.out b/tests/cfgs/default/result/IEC104.pcap.out index 239e71a1b..348215857 100644 --- a/tests/cfgs/default/result/IEC104.pcap.out +++ b/tests/cfgs/default/result/IEC104.pcap.out @@ -24,5 +24,7 @@ IEC60870 15 1431 2 Acceptable 15 1431 2 +IoT-Scada 15 1431 2 + 1 TCP 10.175.211.1:2404 <-> 10.119.105.26:54768 [proto: 245/IEC60870][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: IoT-Scada/31][7 pkts/987 bytes <-> 5 pkts/270 bytes][Goodput ratio: 61/0][2.00 sec][bytes ratio: 0.570 (Upload)][IAT c2s/s2c min/avg/max/stddev: 36/199 360/521 935/935 313/307][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 141/54 306/54 90/0][Plen Bins: 51,0,0,16,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.175.211.3:2404 <-> 10.119.105.26:54769 [proto: 245/IEC60870][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: IoT-Scada/31][2 pkts/120 bytes <-> 1 pkts/54 bytes][Goodput ratio: 5/0][0.22 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/KakaoTalk_chat.pcap.out b/tests/cfgs/default/result/KakaoTalk_chat.pcap.out index 432090f1a..74eb21280 100644 --- a/tests/cfgs/default/result/KakaoTalk_chat.pcap.out +++ b/tests/cfgs/default/result/KakaoTalk_chat.pcap.out @@ -37,6 +37,11 @@ Safe 37 5258 7 Acceptable 105 15763 23 Fun 205 50915 8 +Web 78 10024 10 +SocialNetwork 205 50915 8 +Chat 27 7126 1 +Network 37 3871 19 + JA Host Stats: IP Address # JA4C 1 10.24.82.188 3 diff --git a/tests/cfgs/default/result/KakaoTalk_talk.pcap.out b/tests/cfgs/default/result/KakaoTalk_talk.pcap.out index b743e0581..49ab457fd 100644 --- a/tests/cfgs/default/result/KakaoTalk_talk.pcap.out +++ b/tests/cfgs/default/result/KakaoTalk_talk.pcap.out @@ -39,6 +39,14 @@ Safe 41 5761 8 Acceptable 3147 428304 11 Fun 15 1727 1 +Media 2991 398751 2 +Web 62 7879 11 +Download 15 1727 1 +Chat 85 20646 2 +VoIP 44 6196 2 +Cloud 4 396 1 +Network 2 197 1 + JA Host Stats: IP Address # JA4C 1 10.24.82.188 2 diff --git a/tests/cfgs/default/result/NTPv2.pcap.out b/tests/cfgs/default/result/NTPv2.pcap.out index 006cefe0c..780f877e9 100644 --- a/tests/cfgs/default/result/NTPv2.pcap.out +++ b/tests/cfgs/default/result/NTPv2.pcap.out @@ -24,4 +24,6 @@ NTP 1 410 1 Acceptable 1 410 1 +System 1 410 1 + 1 UDP 208.104.95.10:123 -> 78.46.76.2:80 [proto: 9/NTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 9/NTP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/410 bytes -> 0 pkts/0 bytes][Goodput ratio: 90/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/NTPv3.pcap.out b/tests/cfgs/default/result/NTPv3.pcap.out index c2c8e0f5e..cc4ac8e02 100644 --- a/tests/cfgs/default/result/NTPv3.pcap.out +++ b/tests/cfgs/default/result/NTPv3.pcap.out @@ -24,4 +24,6 @@ NTP 1 90 1 Acceptable 1 90 1 +System 1 90 1 + 1 UDP 175.144.140.29:123 -> 78.46.76.2:80 [proto: 9/NTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 9/NTP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/90 bytes -> 0 pkts/0 bytes][Goodput ratio: 53/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/NTPv4.pcap.out b/tests/cfgs/default/result/NTPv4.pcap.out index b927075ab..4526ff0d3 100644 --- a/tests/cfgs/default/result/NTPv4.pcap.out +++ b/tests/cfgs/default/result/NTPv4.pcap.out @@ -24,4 +24,6 @@ NTP 1 90 1 Acceptable 1 90 1 +System 1 90 1 + 1 UDP 85.22.62.120:123 -> 78.46.76.11:123 [proto: 9/NTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 9/NTP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/90 bytes -> 0 pkts/0 bytes][Goodput ratio: 53/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/Oscar.pcap.out b/tests/cfgs/default/result/Oscar.pcap.out index cbfb11762..8302a317a 100644 --- a/tests/cfgs/default/result/Oscar.pcap.out +++ b/tests/cfgs/default/result/Oscar.pcap.out @@ -26,4 +26,6 @@ TLS 71 9386 1 Safe 71 9386 1 +Web 71 9386 1 + 1 TCP 10.30.29.3:63357 <-> 178.237.24.249:443 [proto: 91/TLS][IP: 22/VK][Encrypted][Confidence: Match by port][FPC: 22/VK, Confidence: IP address][DPI packets: 19][cat: Web/5][38 pkts/3580 bytes <-> 33 pkts/5806 bytes][Goodput ratio: 42/68][72.45 sec][bytes ratio: -0.237 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2392/2607 58175/58215 10382/11142][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 94/176 369/1414 75/257][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][Plen Bins: 7,58,5,5,0,0,5,2,2,7,0,0,0,0,2,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0] diff --git a/tests/cfgs/default/result/TivoDVR.pcap.out b/tests/cfgs/default/result/TivoDVR.pcap.out index 9655f233b..bdd172ca8 100644 --- a/tests/cfgs/default/result/TivoDVR.pcap.out +++ b/tests/cfgs/default/result/TivoDVR.pcap.out @@ -24,4 +24,6 @@ TiVoConnect 2 422 1 Fun 2 422 1 +Network 2 422 1 + 1 UDP 98.245.242.69:2190 -> 255.255.255.255:2190 [proto: 308/TiVoConnect][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 308/TiVoConnect, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/422 bytes -> 0 pkts/0 bytes][Goodput ratio: 79/0][0.00 sec][UUID: 4d696e69-444c-164e-9d41-1459c099c04][Machine: R7000P][Platform: pc/minidlna][Services: TiVoMediaServer:8200/http][PLAIN TEXT (TiVoConnect)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/WebattackRCE.pcap.out b/tests/cfgs/default/result/WebattackRCE.pcap.out index 2ca499a1b..31c32e4d6 100644 --- a/tests/cfgs/default/result/WebattackRCE.pcap.out +++ b/tests/cfgs/default/result/WebattackRCE.pcap.out @@ -24,6 +24,8 @@ HTTP 797 191003 797 Acceptable 797 191003 797 +Web 797 191003 797 + 1 TCP 127.0.0.1:51184 -> 127.0.0.1:8080 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7/HTTP, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/651 bytes -> 0 pkts/0 bytes][Goodput ratio: 90/0][< 1 sec][Hostname/SNI: 127.0.0.1][URL: 127.0.0.1/vbulletin/ajax/api/hook/decodeArguments?arguments=O%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%00%2A%00db%22%3BO%3A17%3A%22vB_Database_MySQL%22%3A1%3A%7Bs%3A9%3A%22functions%22%3Ba%3A1%3A%7Bs%3A11%3A%22free_result%22%3Bs%3A6%3A%22assert%22%3][Req Content-Type: application/x-www-form-urlencoded][User-Agent: Mozilla/5.00 (Nikto/2.1.6) (Evasions:None) (Test:007058)][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **** Unidirectional Traffic **][Risk Score: 70][Risk Info: No server to client traffic / Found host 127.0.0.1 / Expected on port 80][PLAIN TEXT (GET /vbulletin/ajax/api/hook/de)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:51182 -> 127.0.0.1:8080 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7/HTTP, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/644 bytes -> 0 pkts/0 bytes][Goodput ratio: 90/0][< 1 sec][Hostname/SNI: 127.0.0.1][URL: 127.0.0.1/vb/ajax/api/hook/decodeArguments?arguments=O%3A12%3A%22vB_dB_Result%22%3A2%3A%7Bs%3A5%3A%22%00%2A%00db%22%3BO%3A17%3A%22vB_Database_MySQL%22%3A1%3A%7Bs%3A9%3A%22functions%22%3Ba%3A1%3A%7Bs%3A11%3A%22free_result%22%3Bs%3A6%3A%22assert%22%3B%7D%7D][Req Content-Type: application/x-www-form-urlencoded][User-Agent: Mozilla/5.00 (Nikto/2.1.6) (Evasions:None) (Test:007058)][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **** Unidirectional Traffic **][Risk Score: 70][Risk Info: No server to client traffic / Found host 127.0.0.1 / Expected on port 80][PLAIN TEXT (GET /vb/ajax/api/hook/decodeArg)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 127.0.0.1:50946 -> 127.0.0.1:8080 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7/HTTP, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/387 bytes -> 0 pkts/0 bytes][Goodput ratio: 83/0][< 1 sec][Hostname/SNI: 127.0.0.1][URL: 127.0.0.1/postnuke/html/index.php?Nikto=Forums&file=viewtopic&t=2&rush=%6c%73%20%2d%61%6c&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5f%47%45%54%5f%56%41%52%53%5b%72%75%73%68%5d%29.%2527][User-Agent: Mozilla/5.00 (Nikto/2.1.6) (Evasions:None) (Test:001397)][Risk: ** RCE Injection **** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **** Unidirectional Traffic **][Risk Score: 220][Risk Info: No server to client traffic / Found host 127.0.0.1 / Expected on port 80 / Suspicious URL [/postnuke/html/index.php?Nikto=Foru][PLAIN TEXT (GET /postnuke/html/index.php)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/WebattackSQLinj.pcap.out b/tests/cfgs/default/result/WebattackSQLinj.pcap.out index beb2f8608..9ff39ef0b 100644 --- a/tests/cfgs/default/result/WebattackSQLinj.pcap.out +++ b/tests/cfgs/default/result/WebattackSQLinj.pcap.out @@ -24,6 +24,8 @@ HTTP 94 30008 9 Acceptable 94 30008 9 +Web 94 30008 9 + 1 TCP 172.16.0.1:36212 <-> 192.168.10.50:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][7 pkts/1070 bytes <-> 5 pkts/4487 bytes][Goodput ratio: 56/92][5.01 sec][Hostname/SNI: 205.174.165.68][bytes ratio: -0.615 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1002/3 5000/10 1999/5][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 153/897 666/2767 210/1090][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+null%2C+table_name+from+information_schema.tables%23&Submit=Submit][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.18 (Ubuntu)][User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][Risk: ** SQL Injection **** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Susp Header **][Risk Score: 260][Risk Info: Expected 192.168.10.50, found 205.174.165.68 / Found host 205.174.165.68 / Suspicious URL [/dv/vulnerabilities/sqli/?id=1%27+a][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,33] 2 TCP 172.16.0.1:36202 <-> 192.168.10.50:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][6 pkts/1004 bytes <-> 5 pkts/4487 bytes][Goodput ratio: 60/92][5.09 sec][Hostname/SNI: 205.174.165.68][bytes ratio: -0.634 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/80 1017/40 5004/80 1994/40][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 167/897 666/4215 223/1659][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+null%2C+table_name+from+information_schema.tables%23&Submit=Submit][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.18 (Ubuntu)][User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][Risk: ** SQL Injection **** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Susp Header **][Risk Score: 260][Risk Info: Expected 192.168.10.50, found 205.174.165.68 / Found host 205.174.165.68 / Suspicious URL [/dv/vulnerabilities/sqli/?id=1%27+a][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50] 3 TCP 172.16.0.1:36204 <-> 192.168.10.50:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][5 pkts/937 bytes <-> 5 pkts/2359 bytes][Goodput ratio: 64/86][5.01 sec][Hostname/SNI: 205.174.165.68][bytes ratio: -0.431 (Download)][IAT c2s/s2c min/avg/max/stddev: 5/0 1251/1 5000/4 2164/2][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 187/472 665/2087 239/808][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+user%2C+password+from+users%23&Submit=Submit][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.18 (Ubuntu)][User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][Risk: ** SQL Injection **** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Susp Header **][Risk Score: 260][Risk Info: Expected 192.168.10.50, found 205.174.165.68 / Found host 205.174.165.68 / Suspicious URL [/dv/vulnerabilities/sqli/?id=1%27+a][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50] diff --git a/tests/cfgs/default/result/WebattackXSS.pcap.out b/tests/cfgs/default/result/WebattackXSS.pcap.out index ff39b6574..150d01145 100644 --- a/tests/cfgs/default/result/WebattackXSS.pcap.out +++ b/tests/cfgs/default/result/WebattackXSS.pcap.out @@ -27,6 +27,8 @@ HTTP 9374 4721148 661 Acceptable 9374 4721148 661 +Web 9374 4721148 661 + 1 TCP 172.16.0.1:59042 <-> 192.168.10.50:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][214 pkts/62915 bytes <-> 107 pkts/190654 bytes][Goodput ratio: 78/96][68.07 sec][Hostname/SNI: 205.174.165.68][bytes ratio: -0.504 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 340/680 4821/4822 530/629][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 294/1782 651/1935 251/393][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.18 (Ubuntu)][User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][Risk: ** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Susp Header **][Risk Score: 110][Risk Info: Expected 192.168.10.50, found 205.174.165.68 / Found host 205.174.165.68][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (GET /dv/vulnerabilities/xss)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,49] 2 TCP 172.16.0.1:56306 <-> 192.168.10.50:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][205 pkts/62321 bytes <-> 115 pkts/191204 bytes][Goodput ratio: 78/96][68.15 sec][Hostname/SNI: 205.174.165.68][bytes ratio: -0.508 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 354/600 4804/4805 540/628][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 304/1663 651/1936 252/500][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.18 (Ubuntu)][User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][Risk: ** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Susp Header **][Risk Score: 110][Risk Info: Expected 192.168.10.50, found 205.174.165.68 / Found host 205.174.165.68][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (GET /dv/vulnerabilities/xss)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,23,0,5,0,0,0,0,23,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,42] 3 TCP 172.16.0.1:58360 <-> 192.168.10.50:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][210 pkts/62853 bytes <-> 105 pkts/190635 bytes][Goodput ratio: 78/96][67.29 sec][Hostname/SNI: 205.174.165.68][bytes ratio: -0.504 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/2 346/635 3808/3809 494/543][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 299/1816 651/1936 252/351][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27MRVS1VO9FLO4CFA5FLJ13I9GULOFH69WHOJQ0PH0OKE2FMG3MQ%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.18 (Ubuntu)][User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][Risk: ** XSS Attack **** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Susp Header **][Risk Score: 260][Risk Info: Expected 192.168.10.50, found 205.174.165.68 / Found host 205.174.165.68 / Suspicious URL [/dv/vulnerabilities/xss_r/?name=%3C][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (GET /dv/vulnerabilities/xss)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,24,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50] diff --git a/tests/cfgs/default/result/activision.pcap.out b/tests/cfgs/default/result/activision.pcap.out index 1a40f6e22..8daa676c4 100644 --- a/tests/cfgs/default/result/activision.pcap.out +++ b/tests/cfgs/default/result/activision.pcap.out @@ -24,6 +24,8 @@ Activision 60 3904 4 Fun 60 3904 4 +Game 60 3904 4 + 1 UDP 192.168.2.100:3074 <-> 45.63.112.54:34741 [proto: 258/Activision][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 258/Activision, Confidence: DPI][DPI packets: 1][cat: Game/8][8 pkts/491 bytes <-> 7 pkts/485 bytes][Goodput ratio: 32/39][0.88 sec][bytes ratio: 0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 79/66 130/134 202/202 51/56][Pkt Len c2s/s2c min/avg/max/stddev: 60/69 61/69 71/71 4/1][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:3074 <-> 108.61.235.31:33441 [proto: 258/Activision][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 258/Activision, Confidence: DPI][DPI packets: 1][cat: Game/8][8 pkts/491 bytes <-> 7 pkts/485 bytes][Goodput ratio: 32/39][1.58 sec][bytes ratio: 0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 198/198 212/214 274/269 28/28][Pkt Len c2s/s2c min/avg/max/stddev: 60/69 61/69 71/71 4/1][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:3074 <-> 148.72.173.162:34311 [proto: 258/Activision][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 258/Activision, Confidence: DPI][DPI packets: 1][cat: Game/8][8 pkts/491 bytes <-> 7 pkts/485 bytes][Goodput ratio: 32/39][1.42 sec][bytes ratio: 0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 200/198 203/200 213/202 5/1][Pkt Len c2s/s2c min/avg/max/stddev: 60/69 61/69 71/71 4/1][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/adult_content.pcap.out b/tests/cfgs/default/result/adult_content.pcap.out index 7f5674819..9c04c8252 100644 --- a/tests/cfgs/default/result/adult_content.pcap.out +++ b/tests/cfgs/default/result/adult_content.pcap.out @@ -24,4 +24,6 @@ STUN 25 7972 1 Acceptable 25 7972 1 +AdultContent 25 7972 1 + 1 UDP 192.168.1.199:42759 <-> 31.220.27.69:80 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: AdultContent/34][11 pkts/3593 bytes <-> 14 pkts/4379 bytes][Goodput ratio: 87/87][0.22 sec][Hostname/SNI: b-eu14.stripcdn.com][bytes ratio: -0.099 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 16/14 55/54 17/17][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 327/313 1246/1418 350/353][Mapped IP/Port: 93.35.171.161:59534][Peer IP/Port: 31.220.27.69:13304][Relayed IP/Port: 127.0.0.254:46990][Rsp Origin IP/Port: 31.220.27.69:80][Other IP/Port: 127.0.0.249:2083][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (NurOKA)][Plen Bins: 8,8,12,24,8,16,0,0,4,0,0,0,0,0,0,0,4,0,0,0,4,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,4,0,0,0,0] diff --git a/tests/cfgs/default/result/afp.pcap.out b/tests/cfgs/default/result/afp.pcap.out index b2d5949a5..5df27a48b 100644 --- a/tests/cfgs/default/result/afp.pcap.out +++ b/tests/cfgs/default/result/afp.pcap.out @@ -24,4 +24,6 @@ AFP 16 1218 1 Acceptable 16 1218 1 +DataTransfer 16 1218 1 + 1 TCP 192.168.27.57:64987 <-> 192.168.27.139:548 [proto: 97/AFP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 97/AFP, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][12 pkts/836 bytes <-> 4 pkts/382 bytes][Goodput ratio: 5/31][1.09 sec][bytes ratio: 0.373 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 109/0 1086/0 326/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 70/96 88/116 8/21][Plen Bins: 60,40,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/agora-sd-rtn.pcap.out b/tests/cfgs/default/result/agora-sd-rtn.pcap.out index 8bcb8b83f..0e8cd32b0 100644 --- a/tests/cfgs/default/result/agora-sd-rtn.pcap.out +++ b/tests/cfgs/default/result/agora-sd-rtn.pcap.out @@ -24,6 +24,8 @@ SD-RTN 403 112365 26 Acceptable 403 112365 26 +Media 403 112365 26 + 1 UDP 192.168.2.100:55322 <-> 104.166.161.75:8130 [proto: 171/SD-RTN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 171/SD-RTN, Confidence: DPI][DPI packets: 1][cat: Media/1][24 pkts/5221 bytes <-> 6 pkts/3204 bytes][Goodput ratio: 81/92][730.23 sec][Hostname/SNI: 104-166-161-75.edge.agora.io][bytes ratio: 0.239 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 34770/0 730075/0 155475/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 218/534 986/534 191/0][PLAIN TEXT (75.edge.agora.ioPDMD)][Plen Bins: 20,0,0,20,3,0,10,20,0,0,0,0,0,3,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:46798 <-> 23.248.186.179:8130 [proto: 171/SD-RTN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 171/SD-RTN, Confidence: DPI][DPI packets: 1][cat: Media/1][11 pkts/2008 bytes <-> 4 pkts/5044 bytes][Goodput ratio: 77/97][< 1 sec][Hostname/SNI: 23-248-186-179.edge.agora.io][bytes ratio: -0.431 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 13/0 92/0 29/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/1261 183/1261 367/1261 98/0][PLAIN TEXT (179.edge.agora.ioPDMD)][Plen Bins: 20,0,0,13,13,0,0,20,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,26,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:47805 -> 199.190.44.135:8130 [proto: 171/SD-RTN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 171/SD-RTN, Confidence: DPI][DPI packets: 1][cat: Media/1][18 pkts/4968 bytes -> 0 pkts/0 bytes][Goodput ratio: 85/0][904.29 sec][Hostname/SNI: 199-190-44-135.edge.agora.io][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 58186/0 927866/0 224551/0][Pkt Len c2s/s2c min/avg/max/stddev: 276/0 276/0 276/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (135.edge.agora.ioPDMD)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ah.pcapng.out b/tests/cfgs/default/result/ah.pcapng.out index 8e88fd10c..7f13eedd2 100644 --- a/tests/cfgs/default/result/ah.pcapng.out +++ b/tests/cfgs/default/result/ah.pcapng.out @@ -26,5 +26,7 @@ AH 2 276 1 Safe 6 1768 2 +VPN 6 1768 2 + 1 UDP 10.2.3.2:500 <-> 10.3.4.4:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 79/IPSec, Confidence: DPI][DPI packets: 1][cat: VPN/2][2 pkts/770 bytes <-> 2 pkts/722 bytes][Goodput ratio: 89/88][0.02 sec][PLAIN TEXT (DELETE)][Plen Bins: 0,0,0,0,0,0,0,0,25,0,25,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 AH 10.2.3.2:0 <-> 10.3.4.4:0 [proto: 116/AH][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 116/AH, Confidence: DPI][DPI packets: 1][cat: VPN/2][1 pkts/138 bytes <-> 1 pkts/138 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ajp.pcap.out b/tests/cfgs/default/result/ajp.pcap.out index 7e06f4739..f02d64df0 100644 --- a/tests/cfgs/default/result/ajp.pcap.out +++ b/tests/cfgs/default/result/ajp.pcap.out @@ -24,5 +24,7 @@ AJP 26 4446 2 Acceptable 26 4446 2 +Web 26 4446 2 + 1 TCP 172.29.9.146:38856 <-> 172.29.9.147:8009 [VLAN: 7][proto: 139/AJP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][7 pkts/1554 bytes <-> 6 pkts/669 bytes][Goodput ratio: 68/36][0.17 sec][bytes ratio: 0.398 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 222/112 896/300 286/84][TCP Fingerprint: 2_64_14600_2e3cee914fc1/Unknown][PLAIN TEXT (HTTP/1.1)][Plen Bins: 50,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.29.9.146:38856 <-> 172.29.9.147:8010 [VLAN: 7][proto: 139/AJP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][7 pkts/1554 bytes <-> 6 pkts/669 bytes][Goodput ratio: 68/36][< 1 sec][bytes ratio: 0.398 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 222/112 896/300 286/84][TCP Fingerprint: 2_64_14600_2e3cee914fc1/Unknown][PLAIN TEXT (HTTP/1.1)][Plen Bins: 50,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/alexa-app.pcapng.out b/tests/cfgs/default/result/alexa-app.pcapng.out index 1e69ece82..dc125d5d2 100644 --- a/tests/cfgs/default/result/alexa-app.pcapng.out +++ b/tests/cfgs/default/result/alexa-app.pcapng.out @@ -45,6 +45,14 @@ Safe 136 23093 12 Acceptable 2919 1140556 147 Tracker_Ads 19 6096 1 +Web 1530 685327 56 +Cloud 373 141134 14 +Network 81 8859 39 +SoftwareUpdate 19 7852 1 +ConnCheck 14 1498 2 +VirtAssistant 1038 318979 47 +Advertisement 19 6096 1 + JA Host Stats: IP Address # JA4C 1 172.16.42.216 8 diff --git a/tests/cfgs/default/result/alicloud.pcap.out b/tests/cfgs/default/result/alicloud.pcap.out index 44719ac1d..32f2d771f 100644 --- a/tests/cfgs/default/result/alicloud.pcap.out +++ b/tests/cfgs/default/result/alicloud.pcap.out @@ -24,6 +24,8 @@ AliCloud 225 22986 15 Acceptable 225 22986 15 +Cloud 225 22986 15 + 1 TCP 192.168.2.100:45094 <-> 8.209.76.194:8999 [proto: 306/AliCloud][IP: 274/Alibaba][Encrypted][Confidence: DPI][FPC: 274/Alibaba, Confidence: IP address][DPI packets: 4][cat: Cloud/13][7 pkts/822 bytes <-> 8 pkts/832 bytes][Goodput ratio: 43/36][0.49 sec][bytes ratio: -0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/1 17/67 23/322 7/115][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 117/104 274/250 77/60][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 28,28,0,0,14,14,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.2.100:51774 <-> 8.209.77.36:8999 [proto: 306/AliCloud][IP: 274/Alibaba][Encrypted][Confidence: DPI][FPC: 274/Alibaba, Confidence: IP address][DPI packets: 4][cat: Cloud/13][7 pkts/822 bytes <-> 8 pkts/832 bytes][Goodput ratio: 43/36][0.46 sec][bytes ratio: -0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 3/0 14/64 20/318 7/114][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 117/104 274/250 77/60][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 28,28,0,0,14,14,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.100:57322 <-> 8.209.107.122:8999 [proto: 306/AliCloud][IP: 274/Alibaba][Encrypted][Confidence: DPI][FPC: 274/Alibaba, Confidence: IP address][DPI packets: 4][cat: Cloud/13][7 pkts/822 bytes <-> 8 pkts/832 bytes][Goodput ratio: 43/36][0.33 sec][bytes ratio: -0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/0 16/41 24/166 9/57][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 117/104 274/250 77/60][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 28,28,0,0,14,14,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/among_us.pcap.out b/tests/cfgs/default/result/among_us.pcap.out index d22090274..5dbf4e22e 100644 --- a/tests/cfgs/default/result/among_us.pcap.out +++ b/tests/cfgs/default/result/among_us.pcap.out @@ -24,4 +24,6 @@ AmongUs 1 57 1 Fun 1 57 1 +Game 1 57 1 + 1 UDP 10.0.0.1:64260 -> 172.105.251.170:22023 [proto: 69/AmongUs][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 69/AmongUs, Confidence: DPI][DPI packets: 1][cat: Game/8][1 pkts/57 bytes -> 0 pkts/0 bytes][Goodput ratio: 26/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/amqp.pcap.out b/tests/cfgs/default/result/amqp.pcap.out index e6109ce59..1d4f6c28f 100644 --- a/tests/cfgs/default/result/amqp.pcap.out +++ b/tests/cfgs/default/result/amqp.pcap.out @@ -24,6 +24,8 @@ AMQP 160 23514 3 Acceptable 160 23514 3 +RPC 160 23514 3 + 1 TCP 127.0.0.1:44205 <-> 127.0.1.1:5672 [proto: 192/AMQP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 192/AMQP, Confidence: DPI][DPI packets: 1][cat: RPC/16][54 pkts/10859 bytes <-> 54 pkts/3564 bytes][Goodput ratio: 67/0][4.12 sec][bytes ratio: 0.506 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 85/85 2001/2001 341/341][Pkt Len c2s/s2c min/avg/max/stddev: 103/66 201/66 395/66 103/0][PLAIN TEXT (celeryev)][Plen Bins: 0,33,0,33,0,0,9,0,9,5,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.1.1:5672 <-> 127.0.0.1:44204 [proto: 192/AMQP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: RPC/16][13 pkts/4327 bytes <-> 9 pkts/699 bytes][Goodput ratio: 80/15][4.12 sec][bytes ratio: 0.722 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/3 407/588 2001/2001 623/729][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 333/78 514/87 211/10][PLAIN TEXT (celeryev)][Plen Bins: 38,0,0,0,0,0,0,0,0,0,0,0,0,38,23,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 127.0.0.1:44206 <-> 127.0.1.1:5672 [proto: 192/AMQP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 192/AMQP, Confidence: DPI][DPI packets: 1][cat: RPC/16][15 pkts/3075 bytes <-> 15 pkts/990 bytes][Goodput ratio: 68/0][1.04 sec][bytes ratio: 0.513 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 87/87 540/540 182/182][Pkt Len c2s/s2c min/avg/max/stddev: 97/66 205/66 312/66 88/0][PLAIN TEXT (default)][Plen Bins: 33,0,0,0,33,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/android.pcap.out b/tests/cfgs/default/result/android.pcap.out index 874bbfc56..f0a7e78b0 100644 --- a/tests/cfgs/default/result/android.pcap.out +++ b/tests/cfgs/default/result/android.pcap.out @@ -47,6 +47,14 @@ Safe 115 33651 10 Acceptable 258 73115 46 Fun 102 25188 7 +Web 276 77333 21 +Cloud 3 1656 1 +Network 67 9636 30 +System 4 516 3 +SoftwareUpdate 79 29045 4 +Music 3 258 1 +ConnCheck 43 13510 3 + JA Host Stats: IP Address # JA4C 1 192.168.2.16 7 diff --git a/tests/cfgs/default/result/anyconnect-vpn.pcap.out b/tests/cfgs/default/result/anyconnect-vpn.pcap.out index d50fd1fb4..487d9ff0b 100644 --- a/tests/cfgs/default/result/anyconnect-vpn.pcap.out +++ b/tests/cfgs/default/result/anyconnect-vpn.pcap.out @@ -45,6 +45,14 @@ Safe 357 93023 14 Acceptable 209 36536 53 Unrated 19 1054 2 +Unspecified 19 1054 2 +VPN 3 198 1 +Web 383 97857 18 +Network 94 12819 35 +Collaborative 27 4825 1 +System 30 7167 10 +ConnCheck 29 6693 2 + JA Host Stats: IP Address # JA4C 1 10.0.0.227 5 diff --git a/tests/cfgs/default/result/anydesk.pcapng.out b/tests/cfgs/default/result/anydesk.pcapng.out index be7537cd5..d30fc403b 100644 --- a/tests/cfgs/default/result/anydesk.pcapng.out +++ b/tests/cfgs/default/result/anydesk.pcapng.out @@ -28,6 +28,10 @@ AnyDesk 150 44008 4 Safe 20 1717 1 Acceptable 154 44400 6 +Web 20 1717 1 +RemoteAccess 150 44008 4 +Network 4 392 2 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 1 diff --git a/tests/cfgs/default/result/armagetron.pcapng.out b/tests/cfgs/default/result/armagetron.pcapng.out index fe95eb361..0bae08e8b 100644 --- a/tests/cfgs/default/result/armagetron.pcapng.out +++ b/tests/cfgs/default/result/armagetron.pcapng.out @@ -24,6 +24,8 @@ Armagetron 305 35674 50 Fun 305 35674 50 +Game 305 35674 50 + 1 UDP 192.168.1.183:56325 <-> 150.136.145.224:4533 [proto: 104/Armagetron][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 104/Armagetron, Confidence: DPI][DPI packets: 1][cat: Game/8][30 pkts/2096 bytes <-> 31 pkts/5848 bytes][Goodput ratio: 40/78][1.97 sec][bytes ratio: -0.472 (Download)][IAT c2s/s2c min/avg/max/stddev: 3/0 68/56 425/407 86/87][Pkt Len c2s/s2c min/avg/max/stddev: 52/60 70/189 94/338 16/114][PLAIN TEXT (393..571.112)][Plen Bins: 46,25,1,0,8,0,0,1,9,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.183:4534 <-> 95.111.241.79:4533 [proto: 104/Armagetron][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 104/Armagetron, Confidence: DPI][DPI packets: 1][cat: Game/8][23 pkts/1480 bytes <-> 14 pkts/1142 bytes][Goodput ratio: 35/48][2.50 sec][bytes ratio: 0.129 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 124/229 1023/1416 305/431][Pkt Len c2s/s2c min/avg/max/stddev: 52/60 64/82 86/180 12/28][PLAIN TEXT (393..571.112)][Plen Bins: 73,24,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.183:4534 <-> 150.136.145.224:4533 [proto: 104/Armagetron][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 104/Armagetron, Confidence: DPI][DPI packets: 1][cat: Game/8][23 pkts/1480 bytes <-> 14 pkts/1142 bytes][Goodput ratio: 35/48][3.13 sec][bytes ratio: 0.129 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 147/268 1026/1366 299/407][Pkt Len c2s/s2c min/avg/max/stddev: 52/60 64/82 86/180 12/28][PLAIN TEXT (393..571.112)][Plen Bins: 73,24,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/atg.pcap.out b/tests/cfgs/default/result/atg.pcap.out index 5aa722a3e..b48b4c93b 100644 --- a/tests/cfgs/default/result/atg.pcap.out +++ b/tests/cfgs/default/result/atg.pcap.out @@ -24,5 +24,7 @@ ATG 31 2976 2 Acceptable 31 2976 2 +IoT-Scada 31 2976 2 + 1 TCP 192.168.0.105:3148 <-> 20.108.25.119:10001 [proto: 423/ATG][IP: 276/Azure][ClearText][Confidence: DPI][FPC: 276/Azure, Confidence: IP address][DPI packets: 4][cat: IoT-Scada/31][14 pkts/986 bytes <-> 8 pkts/1304 bytes][Goodput ratio: 5/59][157.76 sec][bytes ratio: -0.139 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 256/2 12561/20187 58945/59439 18236/20472][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 70/163 75/509 4/160][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (08/19/2024 02)][Plen Bins: 83,0,0,0,0,0,0,0,0,8,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.0.105:3134 -> 20.108.25.119:10001 [proto: 423/ATG][IP: 276/Azure][ClearText][Confidence: DPI][FPC: 423/ATG, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][9 pkts/686 bytes -> 0 pkts/0 bytes][Goodput ratio: 13/0][74.58 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 979/0 9322/0 37119/0 11869/0][Pkt Len c2s/s2c min/avg/max/stddev: 71/0 76/0 80/0 3/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/avast.pcap.out b/tests/cfgs/default/result/avast.pcap.out index f78a89155..714fa7f4d 100644 --- a/tests/cfgs/default/result/avast.pcap.out +++ b/tests/cfgs/default/result/avast.pcap.out @@ -24,6 +24,8 @@ AVAST 142 9433 10 Safe 142 9433 10 +Network 142 9433 10 + 1 TCP 192.168.2.100:62741 <-> 5.62.53.131:80 [proto: 307/AVAST][IP: 307/AVAST][Encrypted][Confidence: DPI][FPC: 307/AVAST, Confidence: IP address][DPI packets: 4][cat: Network/14][8 pkts/543 bytes <-> 7 pkts/512 bytes][Goodput ratio: 18/20][569.69 sec][bytes ratio: 0.029 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 63304/75961 189840/189839 89445/92978][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 68/73 150/140 31/28][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][Plen Bins: 67,0,16,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.2.100:64903 <-> 5.62.53.53:80 [proto: 307/AVAST][IP: 307/AVAST][Encrypted][Confidence: DPI][FPC: 307/AVAST, Confidence: IP address][DPI packets: 4][cat: Network/14][8 pkts/583 bytes <-> 7 pkts/432 bytes][Goodput ratio: 24/4][1385.80 sec][bytes ratio: 0.149 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 171484/205784 356850/356863 172007/168697][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 73/62 150/70 32/3][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][Plen Bins: 67,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.100:49532 <-> 5.62.54.89:80 [proto: 307/AVAST][IP: 307/AVAST][Encrypted][Confidence: DPI][FPC: 307/AVAST, Confidence: IP address][DPI packets: 4][cat: Network/14][8 pkts/544 bytes <-> 7 pkts/432 bytes][Goodput ratio: 18/4][797.30 sec][bytes ratio: 0.115 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 99700/119575 199551/199551 99662/97621][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 68/62 150/70 31/3][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][Plen Bins: 83,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/avast_securedns.pcapng.out b/tests/cfgs/default/result/avast_securedns.pcapng.out index 0471549c3..2195ce931 100644 --- a/tests/cfgs/default/result/avast_securedns.pcapng.out +++ b/tests/cfgs/default/result/avast_securedns.pcapng.out @@ -24,6 +24,8 @@ AVASTSecureDNS 77 11443 39 Safe 77 11443 39 +Network 77 11443 39 + 1 UDP 192.168.2.100:49152 <-> 181.214.35.149:443 [proto: 263/AVASTSecureDNS][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 263/AVASTSecureDNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/81 bytes <-> 1 pkts/218 bytes][Goodput ratio: 48/80][0.12 sec][PLAIN TEXT (sEcUREdNS)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:49704 <-> 181.214.35.149:443 [proto: 263/AVASTSecureDNS][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 263/AVASTSecureDNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/81 bytes <-> 1 pkts/218 bytes][Goodput ratio: 48/80][0.12 sec][PLAIN TEXT (SECurEdnS)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:49737 <-> 181.214.35.149:443 [proto: 263/AVASTSecureDNS][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 263/AVASTSecureDNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/81 bytes <-> 1 pkts/218 bytes][Goodput ratio: 48/80][0.12 sec][PLAIN TEXT (sEcUREdNs)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bacnet.pcap.out b/tests/cfgs/default/result/bacnet.pcap.out index 1332f195b..c8d847006 100644 --- a/tests/cfgs/default/result/bacnet.pcap.out +++ b/tests/cfgs/default/result/bacnet.pcap.out @@ -24,6 +24,8 @@ BACnet 23 1373 10 Safe 23 1373 10 +IoT-Scada 23 1373 10 + 1 UDP 204.172.177.255:47808 -> 204.172.177.159:47808 [proto: 334/BACnet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 334/BACnet, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][14 pkts/833 bytes -> 0 pkts/0 bytes][Goodput ratio: 29/0][221.21 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1387/0 17424/0 43334/0 13696/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 60/0 67/0 5/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 64.62.197.26:36992 -> 90.147.69.221:47808 [proto: 334/BACnet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 334/BACnet, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/60 bytes -> 0 pkts/0 bytes][Goodput ratio: 28/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 64.62.197.166:36664 -> 90.147.69.213:47808 [proto: 334/BACnet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 334/BACnet, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/60 bytes -> 0 pkts/0 bytes][Goodput ratio: 28/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bad-dns-traffic.pcap.out b/tests/cfgs/default/result/bad-dns-traffic.pcap.out index e816f662e..efa2b8d2b 100644 --- a/tests/cfgs/default/result/bad-dns-traffic.pcap.out +++ b/tests/cfgs/default/result/bad-dns-traffic.pcap.out @@ -24,6 +24,8 @@ DNS 382 99374 3 Acceptable 382 99374 3 +Network 382 99374 3 + 1 UDP 192.168.43.91:56354 <-> 4.2.2.4:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 6][cat: Network/14][203 pkts/51588 bytes <-> 146 pkts/43285 bytes][Goodput ratio: 83/86][92.47 sec][Hostname/SNI: c75900fdf525320021636f6d6d616e64202873697276696d65732900.skullseclabs.org][0.0.0.0][DNS Id: 0x16b8][bytes ratio: 0.088 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 6/15 482/284 1046/2080 456/471][Pkt Len c2s/s2c min/avg/max/stddev: 95/95 254/296 290/325 74/65][Risk: ** Susp DGA Domain name **** Susp DNS Traffic **** Risky Domain Name **][Risk Score: 200][Risk Info: DGA Name Query with no Error Code / Long DNS host name / 244300fdf525320021636f6d6d616e64202873697276696d65732900.skullseclabs][PLAIN TEXT (8244300)][Plen Bins: 0,5,5,0,0,0,0,50,39,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.43.91:35966 <-> 4.2.2.4:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 3][cat: Network/14][10 pkts/1125 bytes <-> 9 pkts/1293 bytes][Goodput ratio: 63/71][7.51 sec][Hostname/SNI: 958700a621c3620001636f6e736f6c65202873697276696d65732900.skullseclabs.org][0.0.0.0][DNS Id: 0xd20d][bytes ratio: -0.069 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 78/49 782/776 1050/1358 405/481][Pkt Len c2s/s2c min/avg/max/stddev: 95/126 112/144 194/229 31/33][Risk: ** Susp DGA Domain name **** Susp DNS Traffic **** Risky Domain Name **][Risk Score: 200][Risk Info: DGA Name Query with no Error Code / Long DNS host name / 05e100a621c3620001636f6e736f6c65202873697276696d65732900.skullseclabs][PLAIN TEXT (3620001636f)][Plen Bins: 0,36,47,5,5,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.43.91:46961 <-> 4.2.2.4:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][7 pkts/926 bytes <-> 7 pkts/1157 bytes][Goodput ratio: 68/75][3.49 sec][Hostname/SNI: a05700e6da83510001636f6e736f6c65202873697276696d65732900.skullseclabs.org][0.0.0.0][DNS Id: 0xfc7b][bytes ratio: -0.111 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 87/56 668/645 1019/1049 428/481][Pkt Len c2s/s2c min/avg/max/stddev: 95/126 132/165 290/323 66/66][Risk: ** Susp DGA Domain name **** Susp DNS Traffic **** Risky Domain Name **][Risk Score: 200][Risk Info: DGA Name Query with no Error Code / Long DNS host name / a05700e6da83510001636f6e736f6c65202873697276696d65732900.skullseclabs][PLAIN TEXT (da83510001636)][Plen Bins: 0,28,42,14,0,0,0,7,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/beckhoff_ads.pcapng.out b/tests/cfgs/default/result/beckhoff_ads.pcapng.out index fa76451ef..1271b21a4 100644 --- a/tests/cfgs/default/result/beckhoff_ads.pcapng.out +++ b/tests/cfgs/default/result/beckhoff_ads.pcapng.out @@ -24,4 +24,6 @@ BeckhoffADS 50 6032 1 Acceptable 50 6032 1 +IoT-Scada 50 6032 1 + 1 TCP 192.168.1.99:49201 <-> 192.168.1.8:48898 [proto: 365/BeckhoffADS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][26 pkts/2788 bytes <-> 24 pkts/3244 bytes][Goodput ratio: 49/60][26.29 sec][bytes ratio: -0.076 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1250/1381 25613/25812 5448/5759][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 107/135 150/762 31/139][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][PLAIN TEXT (Device 5 )][Plen Bins: 0,76,15,4,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bets.pcapng.out b/tests/cfgs/default/result/bets.pcapng.out index adcd1763f..0fefcfbcc 100644 --- a/tests/cfgs/default/result/bets.pcapng.out +++ b/tests/cfgs/default/result/bets.pcapng.out @@ -24,6 +24,8 @@ TLS 33 9228 1 Safe 33 9228 1 +Gambling 33 9228 1 + JA Host Stats: IP Address # JA4C 1 192.168.10.2 1 diff --git a/tests/cfgs/default/result/bfcp.pcapng.out b/tests/cfgs/default/result/bfcp.pcapng.out index 28575d3e7..801762963 100644 --- a/tests/cfgs/default/result/bfcp.pcapng.out +++ b/tests/cfgs/default/result/bfcp.pcapng.out @@ -25,6 +25,8 @@ BFCP 65 4458 3 Acceptable 65 4458 3 +Video 65 4458 3 + 1 UDP 10.0.200.73:3238 <-> 10.0.102.79:36633 [proto: 32/BFCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 32/BFCP, Confidence: DPI][DPI packets: 1][cat: Video/26][15 pkts/1170 bytes <-> 18 pkts/1064 bytes][Goodput ratio: 46/29][30.22 sec][Conference Id: 1][User Id: 2][bytes ratio: 0.047 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 53/53 2043/1956 3945/5000 1050/1401][Pkt Len c2s/s2c min/avg/max/stddev: 58/54 78/59 94/94 12/12][Plen Bins: 60,39,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:58984 <-> 127.0.0.1:5070 [proto: 32/BFCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Video/26][10 pkts/704 bytes <-> 6 pkts/512 bytes][Goodput ratio: 5/21][123.11 sec][Conference Id: 1927653396][User Id: 2055][bytes ratio: 0.158 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 12579/31975 92304/92304 30186/42684][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 70/85 78/150 5/29][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][Plen Bins: 83,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.3.134:57020 <-> 192.168.9.100:16500 [proto: 32/BFCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 32/BFCP, Confidence: DPI][DPI packets: 1][cat: Video/26][7 pkts/470 bytes <-> 9 pkts/538 bytes][Goodput ratio: 34/30][16.68 sec][Conference Id: 1927653397][User Id: 2056][bytes ratio: -0.067 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/0 102/2377 449/16165 174/5631][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 67/60 90/98 10/14][Plen Bins: 87,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bfd.pcap.out b/tests/cfgs/default/result/bfd.pcap.out index a55a4739c..c70535330 100644 --- a/tests/cfgs/default/result/bfd.pcap.out +++ b/tests/cfgs/default/result/bfd.pcap.out @@ -24,6 +24,8 @@ BFD 11 698 4 Acceptable 11 698 4 +Network 11 698 4 + 1 UDP 155.1.13.1:49152 -> 155.1.13.1:3785 [VLAN: 13][proto: 401/BFD][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 401/BFD, Confidence: DPI][DPI packets: 1][cat: Network/14][4 pkts/232 bytes -> 0 pkts/0 bytes][Goodput ratio: 21/0][0.46 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 155.1.13.3:49152 -> 155.1.13.1:3784 [VLAN: 13][proto: 401/BFD][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 401/BFD, Confidence: DPI][DPI packets: 1][cat: Network/14][3 pkts/210 bytes -> 0 pkts/0 bytes][Goodput ratio: 34/0][0.07 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 155.1.13.1:49152 -> 155.1.13.3:3784 [VLAN: 13][proto: 401/BFD][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 401/BFD, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/140 bytes -> 0 pkts/0 bytes][Goodput ratio: 34/0][0.00 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bitcoin.pcap.out b/tests/cfgs/default/result/bitcoin.pcap.out index d5d08b669..b3f3ffda8 100644 --- a/tests/cfgs/default/result/bitcoin.pcap.out +++ b/tests/cfgs/default/result/bitcoin.pcap.out @@ -24,6 +24,8 @@ BITCOIN 529 426544 6 Acceptable 529 426544 6 +Crypto_Currency 529 426544 6 + 1 TCP 192.168.1.142:55348 <-> 74.89.181.229:8333 [proto: 343/BITCOIN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 343/BITCOIN, Confidence: DPI][DPI packets: 1][cat: Crypto_Currency/106][55 pkts/28663 bytes <-> 117 pkts/134830 bytes][Goodput ratio: 87/94][1491.26 sec][bytes ratio: -0.649 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 21789/4882 100110/64236 26995/11546][Pkt Len c2s/s2c min/avg/max/stddev: 110/86 521/1152 1514/1514 578/589][PLAIN TEXT (version)][Plen Bins: 0,32,0,4,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,59,0,0] 2 TCP 192.168.1.142:55383 <-> 66.68.83.22:8333 [proto: 343/BITCOIN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 343/BITCOIN, Confidence: DPI][DPI packets: 1][cat: Crypto_Currency/106][65 pkts/45271 bytes <-> 96 pkts/70339 bytes][Goodput ratio: 91/91][1337.01 sec][bytes ratio: -0.217 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 18993/12001 134322/105866 27575/21527][Pkt Len c2s/s2c min/avg/max/stddev: 110/86 696/733 1514/1514 637/653][PLAIN TEXT (version)][Plen Bins: 0,47,0,4,0,0,0,0,5,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,40,0,0] 3 TCP 192.168.1.142:55400 <-> 195.218.16.178:8333 [proto: 343/BITCOIN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 343/BITCOIN, Confidence: DPI][DPI packets: 1][cat: Crypto_Currency/106][47 pkts/26824 bytes <-> 72 pkts/55927 bytes][Goodput ratio: 88/92][1107.93 sec][bytes ratio: -0.352 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 22661/13162 91604/95856 25520/24264][Pkt Len c2s/s2c min/avg/max/stddev: 110/86 571/777 1514/1514 606/673][PLAIN TEXT (version)][Plen Bins: 0,53,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,39,0,0] diff --git a/tests/cfgs/default/result/bittorrent.pcap.out b/tests/cfgs/default/result/bittorrent.pcap.out index 0846cac52..815c0272b 100644 --- a/tests/cfgs/default/result/bittorrent.pcap.out +++ b/tests/cfgs/default/result/bittorrent.pcap.out @@ -24,6 +24,8 @@ BitTorrent 299 305728 24 Acceptable 299 305728 24 +Download 299 305728 24 + 1 TCP 192.168.1.3:52915 <-> 198.100.146.9:60163 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][17 pkts/2745 bytes <-> 193 pkts/282394 bytes][Goodput ratio: 59/95][5.77 sec][bytes ratio: -0.981 (Download)][IAT c2s/s2c min/avg/max/stddev: 12/0 319/30 779/919 241/95][Pkt Len c2s/s2c min/avg/max/stddev: 83/80 161/1463 242/1506 58/218][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 51413,53646][BT Hash: dcfcdccfb9e670ccc3dd40c78c161f2bea243126][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 2,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,93,0,0] 2 TCP 192.168.1.3:52895 <-> 83.216.184.241:51413 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][4 pkts/583 bytes <-> 4 pkts/975 bytes][Goodput ratio: 55/73][4.11 sec][bytes ratio: -0.252 (Download)][IAT c2s/s2c min/avg/max/stddev: 132/72 959/2027 1966/3982 760/1955][Pkt Len c2s/s2c min/avg/max/stddev: 80/73 146/244 198/648 44/235][BT Hash: dcfcdccfb9e670ccc3dd40c78c161f2bea243126][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 25,12,25,12,12,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.1.3:52914 <-> 190.103.195.56:46633 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 1][cat: Download/7][4 pkts/640 bytes <-> 3 pkts/910 bytes][Goodput ratio: 59/78][3.54 sec][bytes ratio: -0.174 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 489/661 1178/883 1943/1105 596/222][Pkt Len c2s/s2c min/avg/max/stddev: 75/113 160/303 241/650 62/246][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 51413,53646][BT Hash: dcfcdccfb9e670ccc3dd40c78c161f2bea243126][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 14,14,28,14,0,14,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out b/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out index 0ac070f29..add39c4f0 100644 --- a/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out +++ b/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out @@ -24,4 +24,6 @@ BitTorrent 100 96898 1 Acceptable 100 96898 1 +Download 100 96898 1 + 1 TCP 192.168.122.34:48987 <-> 178.71.206.1:6881 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: Download/7][33 pkts/2895 bytes <-> 67 pkts/94003 bytes][Goodput ratio: 38/96][0.31 sec][bytes ratio: -0.940 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/4 33/64 11/12][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 88/1403 525/1494 98/324][Risk: ** Known Proto on Non Std Port **** Susp Entropy **][Risk Score: 60][Risk Info: Entropy: 7.533 (Encrypted or Random?) / Expected on port 51413,53646][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][BT Hash: 0f6b9cd2b7da4de9b6c846203920e3da49cdb795][PLAIN TEXT (BitTorrent protocol)][Plen Bins: 0,4,1,0,0,0,1,1,0,1,0,1,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,88,0,0] diff --git a/tests/cfgs/default/result/bittorrent_utp.pcap.out b/tests/cfgs/default/result/bittorrent_utp.pcap.out index 0ecb8449b..26c23f9be 100644 --- a/tests/cfgs/default/result/bittorrent_utp.pcap.out +++ b/tests/cfgs/default/result/bittorrent_utp.pcap.out @@ -24,5 +24,7 @@ BitTorrent 92 41870 2 Acceptable 92 41870 2 +Download 92 41870 2 + 1 UDP 82.243.113.43:64969 <-> 192.168.1.5:40959 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 4][cat: Download/7][47 pkts/36653 bytes <-> 39 pkts/4836 bytes][Goodput ratio: 95/66][19.22 sec][bytes ratio: 0.767 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/11 223/425 4392/4641 701/934][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 780/124 1514/519 609/123][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 6771,51413][PLAIN TEXT (hash20)][Plen Bins: 52,1,2,4,0,1,1,1,0,0,5,0,0,0,1,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,6,0,0,0,6,0,0,0,8,0] 2 UDP 127.0.0.1:49861 <-> 127.0.0.1:33333 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 4][cat: Download/7][3 pkts/195 bytes <-> 3 pkts/186 bytes][Goodput ratio: 35/32][2.70 sec][bytes ratio: 0.024 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1205/1205 1348/1348 1492/1492 144/144][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 65/62 67/62 2/0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 6771,51413][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bjnp.pcap.out b/tests/cfgs/default/result/bjnp.pcap.out index 282aeac8b..bb933a1ff 100644 --- a/tests/cfgs/default/result/bjnp.pcap.out +++ b/tests/cfgs/default/result/bjnp.pcap.out @@ -24,6 +24,8 @@ BJNP 10 460 10 Acceptable 10 460 10 +System 10 460 10 + 1 UDP 192.168.185.141:50087 -> 192.168.1.17:8612 [proto: 204/BJNP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 204/BJNP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/46 bytes -> 0 pkts/0 bytes][Goodput ratio: 34/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.185.141:50089 -> 192.168.1.1:8612 [proto: 204/BJNP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 204/BJNP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/46 bytes -> 0 pkts/0 bytes][Goodput ratio: 34/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.185.141:50089 -> 192.168.1.2:8612 [proto: 204/BJNP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 204/BJNP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/46 bytes -> 0 pkts/0 bytes][Goodput ratio: 34/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/blizzard.pcap.out b/tests/cfgs/default/result/blizzard.pcap.out index 04baf3437..87a1be654 100644 --- a/tests/cfgs/default/result/blizzard.pcap.out +++ b/tests/cfgs/default/result/blizzard.pcap.out @@ -26,6 +26,8 @@ Blizzard 175 66112 8 Fun 206 78663 9 +Game 206 78663 9 + 1 TCP 192.168.1.117:60378 <-> 66.40.191.253:3724 [proto: 213/Blizzard][IP: 213/Blizzard][ClearText][Confidence: DPI][FPC: 213/Blizzard, Confidence: IP address][DPI packets: 4][cat: Game/8][11 pkts/1863 bytes <-> 20 pkts/43947 bytes][Goodput ratio: 67/97][0.49 sec][bytes ratio: -0.919 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 40/22 104/81 31/27][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 169/2197 785/29254 227/6289][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 1119][TCP Fingerprint: 2_128_65535_6bb88f5575fd/Windows][PLAIN TEXT (XLBcTjPRO SERVER)][Plen Bins: 20,15,5,0,0,0,0,0,0,0,5,0,0,10,5,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,15,0,0,0,0,0,0,0,0,0,0,20] 2 TCP 192.168.1.117:50015 <-> 66.40.180.215:3724 [proto: 76/WorldOfWarcraft][IP: 213/Blizzard][ClearText][Confidence: DPI][FPC: 213/Blizzard, Confidence: IP address][DPI packets: 4][cat: Game/8][13 pkts/1799 bytes <-> 18 pkts/10752 bytes][Goodput ratio: 60/90][5.71 sec][bytes ratio: -0.713 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 590/152 3386/1606 1107/407][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 138/597 982/5894 244/1339][TCP Fingerprint: 2_128_65535_6bb88f5575fd/Windows][PLAIN TEXT (WORLD OF WARCRAFT CONNECTION )][Plen Bins: 31,12,12,6,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,6,0,0,0,0,0,6,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,6] 3 UDP 192.168.12.67:44282 <-> 34.22.163.26:7521 [proto: 213/Blizzard][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 213/Blizzard, Confidence: DPI][DPI packets: 1][cat: Game/8][8 pkts/3237 bytes <-> 10 pkts/2057 bytes][Goodput ratio: 90/80][0.47 sec][bytes ratio: 0.223 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 46/55 293/316 101/107][Pkt Len c2s/s2c min/avg/max/stddev: 61/61 405/206 542/542 202/220][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 1119][PLAIN TEXT (yTIdpE)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,5,0,0,0,44,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bot.pcap.out b/tests/cfgs/default/result/bot.pcap.out index 4d7f6cfee..4a786a3e9 100644 --- a/tests/cfgs/default/result/bot.pcap.out +++ b/tests/cfgs/default/result/bot.pcap.out @@ -24,4 +24,6 @@ HTTP 402 431124 1 Acceptable 402 431124 1 +Bots 402 431124 1 + 1 TCP 40.77.167.36:64768 <-> 89.31.72.220:80 [VLAN: 77][proto: 7/HTTP][IP: 276/Azure][ClearText][Confidence: DPI][FPC: 276/Azure, Confidence: IP address][DPI packets: 6][cat: Bots/124][115 pkts/7672 bytes <-> 287 pkts/423452 bytes][Goodput ratio: 4/96][5.66 sec][Hostname/SNI: atlanteditorino.it][bytes ratio: -0.964 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 58/3 4532/106 489/16][Pkt Len c2s/s2c min/avg/max/stddev: 64/64 67/1475 374/1498 29/171][URL: atlanteditorino.it/quartieri/img/S.Donato_M.Vittoria1930_B.jpg][StatusCode: 200][Content-Type: image/jpeg][Server: Apache][User-Agent: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)][Risk: ** Crawler/Bot **][Risk Score: 10][Risk Info: UA Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/b][TCP Fingerprint: 194_128_64240_f65176b9e3ec/Unknown][PLAIN TEXT (GET /quartieri/im)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0] diff --git a/tests/cfgs/default/result/bt-dns.pcap.out b/tests/cfgs/default/result/bt-dns.pcap.out index 4a494a7db..af4a5d41a 100644 --- a/tests/cfgs/default/result/bt-dns.pcap.out +++ b/tests/cfgs/default/result/bt-dns.pcap.out @@ -24,4 +24,6 @@ DNS 2 160 1 Acceptable 2 160 1 +Network 2 160 1 + 1 UDP 10.0.2.15:59751 <-> 10.0.2.3:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/72 bytes <-> 1 pkts/88 bytes][Goodput ratio: 41/52][0.00 sec][Hostname/SNI: utorrent.com][98.143.146.7][DNS Id: 0x6ff1][PLAIN TEXT (utorrent)][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bt-http.pcapng.out b/tests/cfgs/default/result/bt-http.pcapng.out index b0b7280af..ef66d78d5 100644 --- a/tests/cfgs/default/result/bt-http.pcapng.out +++ b/tests/cfgs/default/result/bt-http.pcapng.out @@ -24,4 +24,6 @@ BitTorrent 14 1492 1 Acceptable 14 1492 1 +Download 14 1492 1 + 1 TCP 192.168.1.128:46882 <-> 176.31.225.118:80 [proto: 7.37/HTTP.BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: Download/7][12 pkts/1038 bytes <-> 2 pkts/454 bytes][Goodput ratio: 36/75][57.56 sec][Hostname/SNI: tracker.trackerfix.com][bytes ratio: 0.391 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 5384/0 28927/0 8989/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 86/227 424/394 102/167][URL: tracker.trackerfix.com/announce?info_hash=%aa7i%c4S%0d%de%06%24%18s%da%d4%3a%b5%cc%ec%2c%e6%22&peer_id=-TR2940-chho92c56pul&port=51413&uploaded=0&downloaded=0&left=282050560&numwant=80&key=3b5502cc&compact=1&supportcrypto=1&requirecrypto=1&event=started][User-Agent: Transmission/2.94][TCP Fingerprint: 2_64_2920_615eac77f548/Unknown][PLAIN TEXT (GET /announce)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/bt_search.pcap.out b/tests/cfgs/default/result/bt_search.pcap.out index da54d1738..090e1513f 100644 --- a/tests/cfgs/default/result/bt_search.pcap.out +++ b/tests/cfgs/default/result/bt_search.pcap.out @@ -24,4 +24,6 @@ BitTorrent 2 322 1 Acceptable 2 322 1 +Download 2 322 1 + 1 UDP 192.168.0.102:6771 -> 239.192.152.143:6771 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 2][cat: Download/7][2 pkts/322 bytes -> 0 pkts/0 bytes][Goodput ratio: 74/0][300.03 sec][PLAIN TEXT (SEARCH )][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/c1222.pcapng.out b/tests/cfgs/default/result/c1222.pcapng.out index 2d2769640..76328138a 100644 --- a/tests/cfgs/default/result/c1222.pcapng.out +++ b/tests/cfgs/default/result/c1222.pcapng.out @@ -25,5 +25,7 @@ ANSI_C1222 4 571 2 Acceptable 4 571 2 +IoT-Scada 4 571 2 + 1 TCP 192.168.1.101:1577 <-> 192.168.100.124:1153 [proto: 397/ANSI_C1222][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 397/ANSI_C1222, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/139 bytes <-> 1 pkts/177 bytes][Goodput ratio: 52/62][< 1 sec][Plen Bins: 0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.9.3.124:55092 -> 10.208.0.9:1153 [proto: 397/ANSI_C1222][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 397/ANSI_C1222, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][2 pkts/255 bytes -> 0 pkts/0 bytes][Goodput ratio: 67/0][19.07 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/cachefly.pcapng.out b/tests/cfgs/default/result/cachefly.pcapng.out index 2bad17fce..9665db5c8 100644 --- a/tests/cfgs/default/result/cachefly.pcapng.out +++ b/tests/cfgs/default/result/cachefly.pcapng.out @@ -24,6 +24,8 @@ Cachefly 6 6163 1 Acceptable 6 6163 1 +Cloud 6 6163 1 + JA Host Stats: IP Address # JA4C 1 10.10.10.1 1 diff --git a/tests/cfgs/default/result/can.pcap.out b/tests/cfgs/default/result/can.pcap.out index d84475171..b84b6ab0b 100644 --- a/tests/cfgs/default/result/can.pcap.out +++ b/tests/cfgs/default/result/can.pcap.out @@ -24,6 +24,8 @@ Controller_Area_Network 8 696 8 Safe 8 696 8 +System 8 696 8 + 1 UDP 55.97.32.36:56551 -> 61.40.63.42:25353 [proto: 352/Controller_Area_Network][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 352/Controller_Area_Network, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/87 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 103.183.191.240:46565 -> 73.121.85.123:63575 [proto: 352/Controller_Area_Network][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 352/Controller_Area_Network, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/87 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 128.244.36.46:34952 -> 196.77.109.252:11898 [proto: 352/Controller_Area_Network][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 352/Controller_Area_Network, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/87 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/capwap.pcap.out b/tests/cfgs/default/result/capwap.pcap.out index e1bc05ae2..ebb49ed09 100644 --- a/tests/cfgs/default/result/capwap.pcap.out +++ b/tests/cfgs/default/result/capwap.pcap.out @@ -29,6 +29,8 @@ CAPWAP 379 94439 4 Acceptable 392 97607 10 +Network 392 97607 10 + 1 UDP 192.168.10.9:5246 <-> 192.168.10.10:12380 [proto: 247/CAPWAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 247/CAPWAP, Confidence: DPI][DPI packets: 1][cat: Network/14][106 pkts/26144 bytes <-> 111 pkts/37530 bytes][Goodput ratio: 83/88][169.10 sec][bytes ratio: -0.179 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1421/1619 21349/21721 3881/4475][Pkt Len c2s/s2c min/avg/max/stddev: 106/115 247/338 1499/1499 292/381][PLAIN TEXT (Cisco Systems)][Plen Bins: 0,0,30,47,2,6,0,0,2,0,0,0,0,0,1,0,0,1,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,1,0,0] 2 UDP 192.168.10.10:12380 <-> 192.168.10.9:5247 [proto: 247/CAPWAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 247/CAPWAP, Confidence: DPI][DPI packets: 1][cat: Network/14][156 pkts/29830 bytes <-> 1 pkts/168 bytes][Goodput ratio: 78/75][157.99 sec][bytes ratio: 0.989 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/0 1036/0 4999/0 902/0][Pkt Len c2s/s2c min/avg/max/stddev: 93/168 191/168 470/168 70/0][Plen Bins: 0,0,21,27,11,19,5,9,4,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 0.0.0.0:68 -> 255.255.255.255:67 [proto: CAPWAP:18/DHCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 18/DHCP, Confidence: DPI][DPI packets: 1][cat: Network/14][5 pkts/2090 bytes -> 0 pkts/0 bytes][Goodput ratio: 72/0][59.44 sec][Hostname/SNI: kawai-ipad3][DHCP Fingerprint: 1,3,6,15,119,252][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/capwap_data.pcapng.out b/tests/cfgs/default/result/capwap_data.pcapng.out index f55cc4b4e..f730793bd 100644 --- a/tests/cfgs/default/result/capwap_data.pcapng.out +++ b/tests/cfgs/default/result/capwap_data.pcapng.out @@ -24,6 +24,8 @@ GoogleServices 14 2624 3 Acceptable 14 2624 3 +Web 14 2624 3 + JA Host Stats: IP Address # JA4C 1 10.1.3.68 1 diff --git a/tests/cfgs/default/result/cassandra.pcap.out b/tests/cfgs/default/result/cassandra.pcap.out index 5d7dfebc5..14d3e7459 100644 --- a/tests/cfgs/default/result/cassandra.pcap.out +++ b/tests/cfgs/default/result/cassandra.pcap.out @@ -24,6 +24,8 @@ Cassandra 20 1700 3 Acceptable 20 1700 3 +Database 20 1700 3 + 1 TCP 198.18.0.3:37892 <-> 198.18.0.2:9042 [proto: 264/Cassandra][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Database/11][5 pkts/439 bytes <-> 3 pkts/317 bytes][Goodput ratio: 23/35][< 1 sec][bytes ratio: 0.161 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/11 3/6 11/11 5/6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 88/106 158/177 35/51][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (PROTOCOL)][Plen Bins: 33,0,33,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:46536 <-> 127.0.0.1:9042 [proto: 264/Cassandra][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Database/11][5 pkts/378 bytes <-> 3 pkts/267 bytes][Goodput ratio: 11/23][0.01 sec][bytes ratio: 0.172 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5 1/2 5/5 2/2][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 76/89 97/127 11/27][TCP Fingerprint: 2_64_43690_db1b9381215d/Unknown][PLAIN TEXT (COMPRESSION)][Plen Bins: 66,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 198.18.0.2:37184 <-> 198.18.0.3:7000 [proto: 264/Cassandra][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][3 pkts/225 bytes <-> 1 pkts/74 bytes][Goodput ratio: 8/0][< 1 sec][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ceph.pcap.out b/tests/cfgs/default/result/ceph.pcap.out index 2184c4b06..f81611c10 100644 --- a/tests/cfgs/default/result/ceph.pcap.out +++ b/tests/cfgs/default/result/ceph.pcap.out @@ -24,4 +24,6 @@ Ceph 39 13379 1 Acceptable 39 13379 1 +DataTransfer 39 13379 1 + 1 TCP 10.0.3.249:35556 <-> 10.0.3.67:6789 [proto: 381/Ceph][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: DataTransfer/4][20 pkts/2479 bytes <-> 19 pkts/10900 bytes][Goodput ratio: 46/88][0.10 sec][bytes ratio: -0.629 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/0 59/0 16/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 124/574 345/3533 77/1032][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (machine2)][Plen Bins: 20,8,12,12,16,0,0,0,8,4,0,0,0,0,4,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8] diff --git a/tests/cfgs/default/result/check_mk_new.pcap.out b/tests/cfgs/default/result/check_mk_new.pcap.out index 6d03e64ca..de9e14752 100644 --- a/tests/cfgs/default/result/check_mk_new.pcap.out +++ b/tests/cfgs/default/result/check_mk_new.pcap.out @@ -24,4 +24,6 @@ CHECKMK 98 20242 1 Acceptable 98 20242 1 +DataTransfer 98 20242 1 + 1 TCP 192.168.100.22:58998 <-> 192.168.100.50:6556 [proto: 138/CHECKMK][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: DataTransfer/4][49 pkts/3242 bytes <-> 49 pkts/17000 bytes][Goodput ratio: 0/81][0.04 sec][bytes ratio: -0.680 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1/0 4/4 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 66/347 74/4162 1/758][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (k@Version)][Plen Bins: 73,0,4,0,0,4,0,2,2,0,0,0,2,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,2,0,0,0,0,0,0,6] diff --git a/tests/cfgs/default/result/chrome.pcap.out b/tests/cfgs/default/result/chrome.pcap.out index fa483add2..bbc7286da 100644 --- a/tests/cfgs/default/result/chrome.pcap.out +++ b/tests/cfgs/default/result/chrome.pcap.out @@ -24,6 +24,8 @@ TLS 127 68131 6 Safe 127 68131 6 +Web 127 68131 6 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 2 diff --git a/tests/cfgs/default/result/cip_io.pcap.out b/tests/cfgs/default/result/cip_io.pcap.out index c15b13657..0e53f2007 100644 --- a/tests/cfgs/default/result/cip_io.pcap.out +++ b/tests/cfgs/default/result/cip_io.pcap.out @@ -24,4 +24,6 @@ CIP 4 296 1 Acceptable 4 296 1 +IoT-Scada 4 296 1 + 1 UDP 192.168.5.62:2222 <-> 192.168.5.50:2222 [proto: 393/CIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 393/CIP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][2 pkts/144 bytes <-> 2 pkts/152 bytes][Goodput ratio: 41/44][0.01 sec][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/citrix.pcap.out b/tests/cfgs/default/result/citrix.pcap.out index 47fb1612e..1d4110e1b 100644 --- a/tests/cfgs/default/result/citrix.pcap.out +++ b/tests/cfgs/default/result/citrix.pcap.out @@ -24,4 +24,6 @@ Citrix 100 11332 1 Acceptable 100 11332 1 +Network 100 11332 1 + 1 TCP 21.0.0.8:45225 <-> 22.0.0.7:1494 [proto: 132/Citrix][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][75 pkts/8236 bytes <-> 25 pkts/3096 bytes][Goodput ratio: 47/52][1.60 sec][bytes ratio: 0.454 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 24/58 108/222 22/81][Pkt Len c2s/s2c min/avg/max/stddev: 64/64 110/124 913/595 117/118][Risk: ** Malicious Fingerpint **][Risk Score: 100][Risk Info: Unusual TCP fingerprint (scanner detected?)][TCP Fingerprint: 2_128_32768_6bbe28597824/Unknown][PLAIN TEXT (32.EXE)][Plen Bins: 64,22,3,2,1,1,1,0,0,1,1,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/cloudflare-warp.pcap.out b/tests/cfgs/default/result/cloudflare-warp.pcap.out index baca02006..7b1894ef9 100644 --- a/tests/cfgs/default/result/cloudflare-warp.pcap.out +++ b/tests/cfgs/default/result/cloudflare-warp.pcap.out @@ -35,6 +35,10 @@ CloudflareWarp 37 10500 3 Safe 5 294 2 Acceptable 73 14433 7 +VPN 37 10500 3 +Web 24 1858 5 +Chat 17 2369 1 + JA Host Stats: IP Address # JA4C 1 10.8.0.1 3 diff --git a/tests/cfgs/default/result/cnp_ip.pcapng.out b/tests/cfgs/default/result/cnp_ip.pcapng.out index 2583735e7..5ba333a5b 100644 --- a/tests/cfgs/default/result/cnp_ip.pcapng.out +++ b/tests/cfgs/default/result/cnp_ip.pcapng.out @@ -24,4 +24,6 @@ CNP-IP 2 144 1 Acceptable 2 144 1 +IoT-Scada 2 144 1 + 1 UDP 127.0.0.1:39819 -> 127.0.0.1:1628 [proto: 422/CNP-IP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 422/CNP-IP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][2 pkts/144 bytes -> 0 pkts/0 bytes][Goodput ratio: 41/0][0.01 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/coap_mqtt.pcap.out b/tests/cfgs/default/result/coap_mqtt.pcap.out index fa5fb857b..2b605f5bf 100644 --- a/tests/cfgs/default/result/coap_mqtt.pcap.out +++ b/tests/cfgs/default/result/coap_mqtt.pcap.out @@ -28,6 +28,9 @@ MQTT 261 20211 4 Safe 19 1614 8 Acceptable 1061 100887 8 +Cloud 800 80676 4 +RPC 280 21825 12 + 1 UDP 192.168.56.1:50318 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13960 bytes <-> 100 pkts/6260 bytes][Goodput ratio: 70/33][11.19 sec][bytes ratio: 0.381 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 113/112 150/151 11/11][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 140/63 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,13,36,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.56.1:50312 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13947 bytes <-> 100 pkts/6247 bytes][Goodput ratio: 70/33][11.09 sec][bytes ratio: 0.381 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 111/111 154/150 10/9][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 139/62 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,11,38,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.56.1:50319 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13921 bytes <-> 100 pkts/6221 bytes][Goodput ratio: 70/32][10.92 sec][bytes ratio: 0.382 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 110/110 172/164 11/11][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 139/62 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,15,35,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/codm.pcap.out b/tests/cfgs/default/result/codm.pcap.out index bfc62bbca..7b8fd18ca 100644 --- a/tests/cfgs/default/result/codm.pcap.out +++ b/tests/cfgs/default/result/codm.pcap.out @@ -25,6 +25,8 @@ CoD_Mobile 13 3590 3 Fun 13 3590 3 +Game 13 3590 3 + JA Host Stats: IP Address # JA4C 1 10.215.173.1 1 diff --git a/tests/cfgs/default/result/collectd.pcap.out b/tests/cfgs/default/result/collectd.pcap.out index d18ec9da2..9e782f501 100644 --- a/tests/cfgs/default/result/collectd.pcap.out +++ b/tests/cfgs/default/result/collectd.pcap.out @@ -27,6 +27,8 @@ collectd 81 109386 8 Acceptable 81 109386 8 +System 81 109386 8 + 1 UDP 127.0.0.1:35988 -> 127.0.0.1:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 298/collectd, Confidence: DPI][DPI packets: 1][cat: System/18][49 pkts/66012 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][406.49 sec][Hostname/SNI: devlap.fritz.box][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8783/0 10000/0 3188/0][Pkt Len c2s/s2c min/avg/max/stddev: 193/0 1347/0 1388/0 167/0][PLAIN TEXT (devlap.fritz.box)][Plen Bins: 0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,83,10,0,0,0,0,0] 2 UDP 127.0.0.1:36832 -> 127.0.0.1:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 298/collectd, Confidence: DPI][DPI packets: 1][cat: System/18][17 pkts/22755 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][134.67 sec][Hostname/SNI: devlap.fritz.box][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8311/0 10000/0 3518/0][Pkt Len c2s/s2c min/avg/max/stddev: 924/0 1339/0 1384/0 104/0][PLAIN TEXT (devlap.fritz.box)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,5,89,0,0,0,0,0,0] 3 UDP 192.168.178.35:39576 -> 239.192.74.66:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: System/18][6 pkts/8363 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][708570048.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 907/0 141714014208/0 708570000000/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 1274/0 1394/0 1434/0 54/0][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.844 (Encrypted or Random?)][PLAIN TEXT (RmBJSP)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,33,50,0,0,0,0] diff --git a/tests/cfgs/default/result/conncheck.pcap.out b/tests/cfgs/default/result/conncheck.pcap.out index 5a907bf47..dd575a7c8 100644 --- a/tests/cfgs/default/result/conncheck.pcap.out +++ b/tests/cfgs/default/result/conncheck.pcap.out @@ -30,6 +30,9 @@ PlayStore 9 1912 1 Safe 70 12384 7 Acceptable 22 4730 3 +Network 2 305 1 +ConnCheck 90 16809 9 + 1 TCP 10.1.0.60:38024 <-> 92.123.101.121:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: ConnCheck/30][9 pkts/2198 bytes <-> 1 pkts/74 bytes][Goodput ratio: 73/0][7.08 sec][Hostname/SNI: conn-service-eu-04.allawnos.com][bytes ratio: 0.935 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 885/0 3618/0 1162/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/74 244/74 294/74 93/0][URL: conn-service-eu-04.allawnos.com/generate204][User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (nGET /generate204 HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.1.0.60:49674 <-> 142.250.180.163:80 [proto: 7.126/HTTP.Google][IP: 126/Google][ClearText][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 10][cat: ConnCheck/30][9 pkts/2079 bytes <-> 1 pkts/74 bytes][Goodput ratio: 71/0][7.05 sec][Hostname/SNI: www.google.eu][bytes ratio: 0.931 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 881/0 3584/0 1153/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/74 231/74 277/74 86/0][URL: www.google.eu/generate_204][User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (GET /generate)][Plen Bins: 0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.1.0.70:54612 <-> 142.250.180.138:80 [proto: 7.228/HTTP.PlayStore][IP: 126/Google][ClearText][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 9][cat: ConnCheck/30][8 pkts/1838 bytes <-> 1 pkts/74 bytes][Goodput ratio: 71/0][3.67 sec][Hostname/SNI: play.googleapis.com][bytes ratio: 0.923 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 524/0 1824/0 607/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/74 230/74 283/74 92/0][URL: play.googleapis.com/generate_204][User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][PLAIN TEXT (GET /generate)][Plen Bins: 0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/corba.pcap.out b/tests/cfgs/default/result/corba.pcap.out index 4ca4b5831..df54e102c 100644 --- a/tests/cfgs/default/result/corba.pcap.out +++ b/tests/cfgs/default/result/corba.pcap.out @@ -25,5 +25,7 @@ Corba 28 26656 2 Acceptable 28 26656 2 +RPC 28 26656 2 + 1 TCP 127.0.1.1:42717 <-> 127.0.1.1:56899 [proto: 168/Corba][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][11 pkts/19044 bytes <-> 7 pkts/4592 bytes][Goodput ratio: 96/90][2.27 sec][bytes ratio: 0.611 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/30 247/444 1024/1047 412/491][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1731/656 4162/4095 1891/1404][TCP Fingerprint: 2_64_32792_e8fbf9d4563a/Unknown][PLAIN TEXT (pIGIOP)][Plen Bins: 0,0,22,0,0,0,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66] 2 UDP 10.95.28.46:34477 -> 10.95.28.46:15984 [proto: 168/Corba][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 168/Corba, Confidence: DPI][DPI packets: 1][cat: RPC/16][10 pkts/3020 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][0.06 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/0 49/0 15/0][Pkt Len c2s/s2c min/avg/max/stddev: 302/0 302/0 302/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (10.95.28.46)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/cpha.pcap.out b/tests/cfgs/default/result/cpha.pcap.out index 65138dd18..ce4ac78a6 100644 --- a/tests/cfgs/default/result/cpha.pcap.out +++ b/tests/cfgs/default/result/cpha.pcap.out @@ -24,4 +24,6 @@ CPHA 1 96 1 Fun 1 96 1 +Network 1 96 1 + 1 UDP 0.0.0.0:8116 -> 172.21.3.0:8116 [VLAN: 21][proto: 53/CPHA][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 53/CPHA, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/96 bytes -> 0 pkts/0 bytes][Goodput ratio: 52/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/crawler_false_positive.pcapng.out b/tests/cfgs/default/result/crawler_false_positive.pcapng.out index a649bc5be..96034b29d 100644 --- a/tests/cfgs/default/result/crawler_false_positive.pcapng.out +++ b/tests/cfgs/default/result/crawler_false_positive.pcapng.out @@ -24,4 +24,6 @@ OCSP 12 1842 1 Safe 12 1842 1 +Web 12 1842 1 + 1 TCP 192.168.12.156:38291 <-> 93.184.220.29:80 [proto: 7.63/HTTP.OCSP][IP: 288/Edgecast][ClearText][Confidence: DPI][FPC: 288/Edgecast, Confidence: IP address][DPI packets: 8][cat: Web/5][7 pkts/705 bytes <-> 5 pkts/1137 bytes][Goodput ratio: 33/70][0.04 sec][Hostname/SNI: ocsp.digicert.com][bytes ratio: -0.235 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/6 8/10 4/4][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 101/227 284/865 75/319][StatusCode: 200][Req Content-Type: application/ocsp-request][Content-Type: application/ocsp-response][Server: ECS (mil/6CF7)][User-Agent: zbtls http][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (ConnectionTP/1.1)][Plen Bins: 33,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/crossfire.pcapng.out b/tests/cfgs/default/result/crossfire.pcapng.out index 0106d9e35..43f5dc5b2 100644 --- a/tests/cfgs/default/result/crossfire.pcapng.out +++ b/tests/cfgs/default/result/crossfire.pcapng.out @@ -25,6 +25,8 @@ Crossfire 32 31378 3 Fun 32 31378 3 +RPC 32 31378 3 + 1 TCP 192.168.1.15:49797 <-> 67.210.208.31:13008 [proto: 105/Crossfire][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][12 pkts/2025 bytes <-> 11 pkts/28669 bytes][Goodput ratio: 67/98][56.82 sec][bytes ratio: -0.868 (Download)][IAT c2s/s2c min/avg/max/stddev: 187/0 6273/3070 32954/14745 10456/5219][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 169/2606 499/8694 191/3734][TCP Fingerprint: 2_128_65535_6bb88f5575fd/Windows][PLAIN TEXT (test12345)][Plen Bins: 15,0,0,0,0,0,7,0,0,0,0,23,0,23,0,0,0,0,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,23] 2 UDP 192.168.1.15:58790 <-> 67.210.208.40:14037 [proto: 105/Crossfire][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 105/Crossfire, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/154 bytes <-> 1 pkts/215 bytes][Goodput ratio: 45/80][< 1 sec][Plen Bins: 0,66,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.15:51836 <-> 67.210.208.38:12007 [proto: 105/Crossfire][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 105/Crossfire, Confidence: DPI][DPI packets: 1][cat: RPC/16][5 pkts/255 bytes <-> 1 pkts/60 bytes][Goodput ratio: 18/13][< 1 sec][bytes ratio: 0.619 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/0 1/0 4/0 2/0][Pkt Len c2s/s2c min/avg/max/stddev: 51/60 51/60 51/60 0/0][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/crynet.pcap.out b/tests/cfgs/default/result/crynet.pcap.out index bd1914ac7..1a1c65135 100644 --- a/tests/cfgs/default/result/crynet.pcap.out +++ b/tests/cfgs/default/result/crynet.pcap.out @@ -24,6 +24,8 @@ CryNetwork 105 14077 7 Fun 105 14077 7 +Game 105 14077 7 + 1 UDP 192.168.2.100:55460 <-> 78.159.118.143:21931 [proto: 314/CryNetwork][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 314/CryNetwork, Confidence: DPI][DPI packets: 1][cat: Game/8][12 pkts/1562 bytes <-> 3 pkts/525 bytes][Goodput ratio: 68/76][0.94 sec][bytes ratio: 0.497 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/48 88/48 266/48 102/0][Pkt Len c2s/s2c min/avg/max/stddev: 92/175 130/175 267/175 62/0][Plen Bins: 0,33,33,0,20,0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:56970 <-> 84.16.230.222:28665 [proto: 314/CryNetwork][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 314/CryNetwork, Confidence: DPI][DPI packets: 1][cat: Game/8][14 pkts/1901 bytes <-> 1 pkts/175 bytes][Goodput ratio: 69/76][0.77 sec][bytes ratio: 0.831 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 61/0 262/0 85/0][Pkt Len c2s/s2c min/avg/max/stddev: 92/175 136/175 267/175 69/0][Plen Bins: 0,40,33,0,6,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:55645 <-> 78.159.98.94:28375 [proto: 314/CryNetwork][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 314/CryNetwork, Confidence: DPI][DPI packets: 1][cat: Game/8][14 pkts/1881 bytes <-> 1 pkts/175 bytes][Goodput ratio: 69/76][0.49 sec][bytes ratio: 0.830 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 38/0 201/0 51/0][Pkt Len c2s/s2c min/avg/max/stddev: 92/175 134/175 267/175 70/0][Plen Bins: 0,46,26,0,6,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/custom_breed_cat.pcap.out b/tests/cfgs/default/result/custom_breed_cat.pcap.out index 8912181b6..ecd83d5ba 100644 --- a/tests/cfgs/default/result/custom_breed_cat.pcap.out +++ b/tests/cfgs/default/result/custom_breed_cat.pcap.out @@ -29,6 +29,11 @@ Acceptable 2 188 2 Unsafe 1 94 1 Dangerous 1 94 1 +Unspecified 1 94 1 +Email 1 94 1 +Web 1 94 1 +Crypto_Currency 1 94 1 + 1 TCP [2001:db8::1]:33408 -> [2001:db8::c2fd:b817:5ca8:82dd]:16690 [proto: 468/CustomProtocolJ][IP: 468/CustomProtocolJ][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_65476_dc3a5db5296b/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP [2001:db8::2]:33408 -> [2001:db8::cba5:51b2:8733:6d9e]:38542 [proto: 469/CustomProtocolK][IP: 469/CustomProtocolK][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Email/3][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_65476_dc3a5db5296b/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP [2003:db8::3]:33408 -> [2001:db8::cc14:67e6:fcd:b96d]:37464 [proto: 3002/CustomProtocolL][IP: 3002/CustomProtocolL][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_65476_dc3a5db5296b/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/custom_categories.pcapng.out b/tests/cfgs/default/result/custom_categories.pcapng.out index 81417c4f2..352d20da3 100644 --- a/tests/cfgs/default/result/custom_categories.pcapng.out +++ b/tests/cfgs/default/result/custom_categories.pcapng.out @@ -27,6 +27,8 @@ ESP 1 346 1 Safe 1 346 1 Acceptable 84 14188 2 +Malware 85 14534 3 + 1 TCP [2001:db8:1::1]:64720 <-> [2001:db8:200::1]:20868 [proto: 92/SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 17][cat: Malware/100][32 pkts/3639 bytes <-> 30 pkts/6335 bytes][Goodput ratio: 24/59][5.34 sec][Hostname/SNI: SSH-1.5-1.2.26][bytes ratio: -0.270 (Download)][IAT c2s/s2c min/avg/max/stddev: 13/74 184/193 1212/1436 234/283][Pkt Len c2s/s2c min/avg/max/stddev: 86/86 114/211 250/1294 47/257][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 22][TCP Fingerprint: 2_64_8192_781448c930cc/Unknown][Server: SSH-1.5-1.2.26][Plen Bins: 69,6,0,0,11,2,0,0,2,0,0,0,0,0,2,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.26.219.44:58639 <-> 172.30.69.103:22 [proto: 92/SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: Malware/100][11 pkts/2011 bytes <-> 11 pkts/2203 bytes][Goodput ratio: 63/67][0.11 sec][Hostname/SNI: SSH-2.0-OpenSSH_6.1][bytes ratio: -0.046 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/7 39/41 12/13][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 183/200 1026/770 270/223][Risk: ** SSH Obsolete Cli Vers/Cipher **** SSH Obsolete Ser Vers/Cipher **** Client Contacted A Malware Host **][Risk Score: 300][Risk Info: Client contacted malware host / Found cipher arcfour128 / Found cipher arcfour128][TCP Fingerprint: 2_64_14600_2e3cee914fc1/Unknown][HASSH-C: D6593B3202A30B2AA9793A00F8647A0A][Server: SSH-1.99-OpenSSH_4.3][HASSH-S: 500033A73A293E7C36743693D0D4596B][Plen Bins: 31,15,15,0,15,0,0,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 ESP [2a01:e34:ef6f:4340:94be:5dac:c20a:d2a0]:0 -> [2001:1670:8:40a6:a08e:332b:aa69:18dc]:0 [VLAN: 121][proto: 117/ESP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 117/ESP, Confidence: DPI][DPI packets: 1][cat: Malware/100][1 pkts/346 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Susp Entropy **** Unidirectional Traffic **** Client Contacted A Malware Host **][Risk Score: 170][Risk Info: Client contacted malware host / No server to client traffic / Entropy: 7.199 (Encrypted Executable?)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/custom_risk_mask.pcapng.out b/tests/cfgs/default/result/custom_risk_mask.pcapng.out index e71db776e..5a98d595c 100644 --- a/tests/cfgs/default/result/custom_risk_mask.pcapng.out +++ b/tests/cfgs/default/result/custom_risk_mask.pcapng.out @@ -24,5 +24,7 @@ LLMNR 2 184 2 Acceptable 2 184 2 +Network 2 184 2 + 1 UDP [fe80::356b:e047:3695:f741]:16765 -> [ff02::1:3]:5355 [proto: 154/LLMNR][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 154/LLMNR, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/92 bytes -> 0 pkts/0 bytes][Goodput ratio: 32/0][< 1 sec][Hostname/SNI: ????????????][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP [fe80::7c0:e74e:87c3:5d93]:6741 -> [ff02::1:3]:5355 [proto: 154/LLMNR][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 154/LLMNR, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/92 bytes -> 0 pkts/0 bytes][Goodput ratio: 32/0][< 1 sec][Hostname/SNI: ????????????][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/custom_rules_ipv6.pcapng.out b/tests/cfgs/default/result/custom_rules_ipv6.pcapng.out index fdd26a7fb..8e7703d21 100644 --- a/tests/cfgs/default/result/custom_rules_ipv6.pcapng.out +++ b/tests/cfgs/default/result/custom_rules_ipv6.pcapng.out @@ -32,6 +32,8 @@ CustomProtocolI 1 318 1 Acceptable 7 4128 6 Unrated 1 318 1 +Unspecified 8 4446 7 + 1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 2048/CustomProtocolE][IP: 2048/CustomProtocolE][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0] 2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 2049/CustomProtocolF][IP: 2049/CustomProtocolF][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0] 3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 1024/CustomProtocolD][IP: 1024/CustomProtocolD][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out b/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out index 337c80ba8..87011bb25 100644 --- a/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out +++ b/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out @@ -26,6 +26,9 @@ CustomProtocolC 3 222 1 Acceptable 8 592 3 +Unspecified 5 370 2 +Web 3 222 1 + 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.459/TLS.CustomProtocolA][IP: 459/CustomProtocolA][Encrypted][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 800/CustomProtocolC][IP: 800/CustomProtocolC][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 460/CustomProtocolB][IP: 460/CustomProtocolB][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dazn.pcapng.out b/tests/cfgs/default/result/dazn.pcapng.out index 09955b02e..1fb8422ae 100644 --- a/tests/cfgs/default/result/dazn.pcapng.out +++ b/tests/cfgs/default/result/dazn.pcapng.out @@ -24,6 +24,8 @@ Dazn 12 6675 3 Fun 12 6675 3 +Streaming 12 6675 3 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 1 diff --git a/tests/cfgs/default/result/dcerpc.pcap.out b/tests/cfgs/default/result/dcerpc.pcap.out index c54c7b044..bea50fc22 100644 --- a/tests/cfgs/default/result/dcerpc.pcap.out +++ b/tests/cfgs/default/result/dcerpc.pcap.out @@ -24,6 +24,8 @@ PROFINET_IO 16 6866 4 Acceptable 16 6866 4 +IoT-Scada 16 6866 4 + 1 UDP 192.168.1.11:49155 -> 192.168.1.20:34964 [proto: 370.371/DCERPC.PROFINET_IO][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 370.371/DCERPC.PROFINET_IO, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][6 pkts/3706 bytes -> 0 pkts/0 bytes][Goodput ratio: 93/0][0.05 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 10/0 32/0 13/0][Pkt Len c2s/s2c min/avg/max/stddev: 174/0 618/0 995/0 338/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 135][PLAIN TEXT (mrpdomain)][Plen Bins: 0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.20:49161 -> 192.168.1.11:49155 [proto: 370.371/DCERPC.PROFINET_IO][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 370.371/DCERPC.PROFINET_IO, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][6 pkts/2464 bytes -> 0 pkts/0 bytes][Goodput ratio: 90/0][0.07 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 13/0 37/0 17/0][Pkt Len c2s/s2c min/avg/max/stddev: 174/0 411/0 846/0 308/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 135][Plen Bins: 0,0,0,0,33,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.11:49154 -> 192.168.1.20:49162 [proto: 370.371/DCERPC.PROFINET_IO][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 370.371/DCERPC.PROFINET_IO, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][2 pkts/348 bytes -> 0 pkts/0 bytes][Goodput ratio: 76/0][< 1 sec][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 135][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dhcp-fuzz.pcapng.out b/tests/cfgs/default/result/dhcp-fuzz.pcapng.out index b0a9a00d0..ea468b91a 100644 --- a/tests/cfgs/default/result/dhcp-fuzz.pcapng.out +++ b/tests/cfgs/default/result/dhcp-fuzz.pcapng.out @@ -26,4 +26,6 @@ DHCP 1 342 1 Acceptable 1 342 1 +Network 1 342 1 + 1 UDP 192.168.155.104:68 -> 255.255.255.255:67 [proto: 18/DHCP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Network/14][1 pkts/342 bytes -> 0 pkts/0 bytes][Goodput ratio: 87/0][< 1 sec][PLAIN TEXT (MK03862)][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/diameter.pcap.out b/tests/cfgs/default/result/diameter.pcap.out index 2db3e4f4e..319924322 100644 --- a/tests/cfgs/default/result/diameter.pcap.out +++ b/tests/cfgs/default/result/diameter.pcap.out @@ -24,4 +24,6 @@ Diameter 6 1980 1 Acceptable 6 1980 1 +Network 6 1980 1 + 1 TCP 10.201.9.245:50957 <-> 10.201.9.11:3868 [proto: 237/Diameter][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 237/Diameter, Confidence: DPI][DPI packets: 1][cat: Network/14][3 pkts/1174 bytes <-> 3 pkts/806 bytes][Goodput ratio: 86/80][0.09 sec][bytes ratio: 0.186 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 13/12 39/32 65/51 26/20][Pkt Len c2s/s2c min/avg/max/stddev: 362/226 391/269 414/290 22/30][PLAIN TEXT (1263278878147)][Plen Bins: 0,0,0,0,0,16,0,34,0,16,16,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dicom.pcap.out b/tests/cfgs/default/result/dicom.pcap.out index 15a6c83be..c54a81664 100644 --- a/tests/cfgs/default/result/dicom.pcap.out +++ b/tests/cfgs/default/result/dicom.pcap.out @@ -24,6 +24,8 @@ DICOM 6 34720 4 Acceptable 6 34720 4 +Health 6 34720 4 + 1 TCP 127.0.0.1:49541 -> 127.0.0.1:104 [proto: 438/DICOM][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 438/DICOM, Confidence: DPI][DPI packets: 1][cat: Health/108][2 pkts/16621 bytes -> 0 pkts/0 bytes][Goodput ratio: 99/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (testserver testclient )][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50] 2 TCP 127.0.0.1:52180 -> 127.0.0.1:104 [proto: 438/DICOM][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 438/DICOM, Confidence: DPI][DPI packets: 1][cat: Health/108][2 pkts/16621 bytes -> 0 pkts/0 bytes][Goodput ratio: 99/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (testserver testclient )][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50] 3 TCP 127.0.0.1:49531 -> 127.0.0.1:104 [proto: 438/DICOM][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 438/DICOM, Confidence: DPI][DPI packets: 1][cat: Health/108][1 pkts/739 bytes -> 0 pkts/0 bytes][Goodput ratio: 92/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (testserver testclient )][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dingtalk.pcap.out b/tests/cfgs/default/result/dingtalk.pcap.out index 0e555c7a7..0cfad4573 100644 --- a/tests/cfgs/default/result/dingtalk.pcap.out +++ b/tests/cfgs/default/result/dingtalk.pcap.out @@ -24,6 +24,8 @@ DingTalk 16 4890 2 Acceptable 16 4890 2 +Chat 16 4890 2 + JA Host Stats: IP Address # JA4C 1 10.215.173.1 1 diff --git a/tests/cfgs/default/result/discord.pcap.out b/tests/cfgs/default/result/discord.pcap.out index 15c284a7a..1de9e04cd 100644 --- a/tests/cfgs/default/result/discord.pcap.out +++ b/tests/cfgs/default/result/discord.pcap.out @@ -25,6 +25,8 @@ Discord 411 98410 34 Fun 411 98410 34 +Collaborative 411 98410 34 + JA Host Stats: IP Address # JA4C 1 10.0.2.15 1 diff --git a/tests/cfgs/default/result/discord_mid_flow.pcap.out b/tests/cfgs/default/result/discord_mid_flow.pcap.out index 65eb0403f..a8bbecced 100644 --- a/tests/cfgs/default/result/discord_mid_flow.pcap.out +++ b/tests/cfgs/default/result/discord_mid_flow.pcap.out @@ -24,4 +24,6 @@ Discord 40 4040 1 Fun 40 4040 1 +Collaborative 40 4040 1 + 1 UDP 66.22.242.132:50001 <-> 5.36.141.228:54935 [VLAN: 1][proto: 58/Discord][IP: 58/Discord][Encrypted][Confidence: DPI][FPC: 58/Discord, Confidence: IP address][DPI packets: 3][cat: Collaborative/15][30 pkts/3110 bytes <-> 10 pkts/930 bytes][Goodput ratio: 43/37][24.00 sec][bytes ratio: 0.540 (Upload)][IAT c2s/s2c min/avg/max/stddev: 42/77 846/1740 1000/4217 343/1555][Pkt Len c2s/s2c min/avg/max/stddev: 72/68 104/93 110/118 14/25][Plen Bins: 25,75,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dlep.pcapng.out b/tests/cfgs/default/result/dlep.pcapng.out index 019f96fe8..9f9cbc416 100644 --- a/tests/cfgs/default/result/dlep.pcapng.out +++ b/tests/cfgs/default/result/dlep.pcapng.out @@ -25,6 +25,8 @@ DLEP 4 467 3 Acceptable 4 467 3 +Network 4 467 3 + 1 TCP 10.0.0.1:51762 <-> 10.0.0.2:854 [proto: 400/DLEP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 400/DLEP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/106 bytes <-> 1 pkts/211 bytes][Goodput ratio: 37/68][0.00 sec][PLAIN TEXT (emulated)][Plen Bins: 0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.0.0.2:44515 -> 10.0.0.1:854 [proto: 400/DLEP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 400/DLEP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/80 bytes -> 0 pkts/0 bytes][Goodput ratio: 47/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (emulated)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.0.0.1:57060 -> 224.0.0.117:854 [proto: 400/DLEP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 400/DLEP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/70 bytes -> 0 pkts/0 bytes][Goodput ratio: 39/0][< 1 sec][PLAIN TEXT (emulated)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dlms.pcap.out b/tests/cfgs/default/result/dlms.pcap.out index 7d859b329..1a8c4af45 100644 --- a/tests/cfgs/default/result/dlms.pcap.out +++ b/tests/cfgs/default/result/dlms.pcap.out @@ -25,5 +25,7 @@ IEC62056 27 4247 2 Acceptable 27 4247 2 +IoT-Scada 27 4247 2 + 1 TCP 192.168.137.20:60797 <-> 192.168.137.189:4060 [proto: 379/IEC62056][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][10 pkts/2942 bytes <-> 8 pkts/520 bytes][Goodput ratio: 77/6][0.03 sec][bytes ratio: 0.700 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 3/2 13/5 4/2][Pkt Len c2s/s2c min/avg/max/stddev: 66/54 294/65 1514/98 458/14][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 4059][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][Plen Bins: 42,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0] 2 UDP 10.1.1.1:0 -> 10.2.2.2:4059 [proto: 379/IEC62056][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 379/IEC62056, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][9 pkts/785 bytes -> 0 pkts/0 bytes][Goodput ratio: 49/0][< 1 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/0 87/0 181/0 37/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][PLAIN TEXT (01234567)][Plen Bins: 55,22,11,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dlt_ppp.pcap.out b/tests/cfgs/default/result/dlt_ppp.pcap.out index 34a5fba3a..631245ce0 100644 --- a/tests/cfgs/default/result/dlt_ppp.pcap.out +++ b/tests/cfgs/default/result/dlt_ppp.pcap.out @@ -24,6 +24,8 @@ QUIC 1 1230 1 Acceptable 1 1230 1 +Web 1 1230 1 + JA Host Stats: IP Address # JA4C 1 193.167.0.252 1 diff --git a/tests/cfgs/default/result/dnp3.pcap.out b/tests/cfgs/default/result/dnp3.pcap.out index b00446a52..96441fad2 100644 --- a/tests/cfgs/default/result/dnp3.pcap.out +++ b/tests/cfgs/default/result/dnp3.pcap.out @@ -24,6 +24,8 @@ DNP3 543 38754 8 Acceptable 543 38754 8 +IoT-Scada 543 38754 8 + 1 TCP 10.0.0.8:2828 <-> 10.0.0.3:20000 [proto: 244/DNP3][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: IoT-Scada/31][60 pkts/4041 bytes <-> 78 pkts/7164 bytes][Goodput ratio: 17/38][121.83 sec][bytes ratio: -0.279 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 421/302 13044/8439 1926/1115][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 67/92 79/145 5/37][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][Plen Bins: 64,3,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.0.0.9:1080 <-> 10.0.0.3:20000 [proto: 244/DNP3][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: IoT-Scada/31][72 pkts/4659 bytes <-> 63 pkts/4692 bytes][Goodput ratio: 10/27][384.60 sec][bytes ratio: -0.004 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 4732/3049 75028/40127 13787/9968][Pkt Len c2s/s2c min/avg/max/stddev: 60/62 65/74 81/147 7/16][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][Plen Bins: 96,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.0.0.8:1086 <-> 10.0.0.3:20000 [proto: 244/DNP3][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: IoT-Scada/31][57 pkts/3891 bytes <-> 36 pkts/2760 bytes][Goodput ratio: 17/28][70.37 sec][bytes ratio: 0.170 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1467/2686 45001/45233 7093/9611][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 68/77 81/147 8/22][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][Plen Bins: 95,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns-exf.pcap.out b/tests/cfgs/default/result/dns-exf.pcap.out index 8b9c6f260..749c1b4c4 100644 --- a/tests/cfgs/default/result/dns-exf.pcap.out +++ b/tests/cfgs/default/result/dns-exf.pcap.out @@ -24,4 +24,6 @@ DNS 2 342 1 Acceptable 2 342 1 +Network 2 342 1 + 1 UDP 192.168.2.225:45290 <-> 192.168.2.134:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/163 bytes <-> 1 pkts/179 bytes][Goodput ratio: 74/76][0.00 sec][Hostname/SNI: 4sicn03_2qaa3rlc3qudhh0aavjycxwakjehelu5klueow0zjxulgage-.4s2fgaaaa__-.test.txt][0.0.0.0][DNS Id: 0xffd5][Risk: ** Susp DNS Traffic **** Susp Entropy **** Non-Printable/Invalid Chars Detected **** Minor Issues **][Risk Score: 170][Risk Info: DNS Record with zero TTL / Invalid chars detected in domain name / Entropy: 5.224 (Executable?) / Long DNS host name][PLAIN TEXT (sICN03)][Plen Bins: 0,0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns-google-nsid.pcapng.out b/tests/cfgs/default/result/dns-google-nsid.pcapng.out index 87987cbfa..bddd0dc9c 100644 --- a/tests/cfgs/default/result/dns-google-nsid.pcapng.out +++ b/tests/cfgs/default/result/dns-google-nsid.pcapng.out @@ -24,6 +24,8 @@ DNS 14 2170 7 Acceptable 14 2170 7 +Network 14 2170 7 + 1 UDP [2001:b07:a3d:c112:b332:20d:89ab:105e]:41624 <-> [2001:4860:4860::8844]:53 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/106 bytes <-> 1 pkts/314 bytes][Goodput ratio: 41/80][0.01 sec][0.0.0.0][GeoLocation: mil][DNS Id: 0x9151][PLAIN TEXT (servers)][Plen Bins: 0,50,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP [2a03:b0c0:2:d0::360:4001]:44924 <-> [2001:4860:4860::8888]:53 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/123 bytes <-> 1 pkts/256 bytes][Goodput ratio: 49/75][0.20 sec][Hostname/SNI: www.wikipedia.it][18.67.39.58][GeoLocation: ams][DNS Id: 0x2aa0][PLAIN TEXT (wikipedia)][Plen Bins: 0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.29:62500 <-> 8.8.4.4:53 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/91 bytes <-> 1 pkts/234 bytes][Goodput ratio: 53/82][0.27 sec][Hostname/SNI: www.wikipedia.it][108.157.194.28][DNS Id: 0xca11][PLAIN TEXT (wikipedia)][Plen Bins: 0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns-invalid-chars.pcap.out b/tests/cfgs/default/result/dns-invalid-chars.pcap.out index 4edef1ef3..890a4d17f 100644 --- a/tests/cfgs/default/result/dns-invalid-chars.pcap.out +++ b/tests/cfgs/default/result/dns-invalid-chars.pcap.out @@ -24,4 +24,6 @@ DNS 2 196 1 Acceptable 2 196 1 +Network 2 196 1 + 1 UDP 127.0.0.1:35980 <-> 127.0.0.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/90 bytes <-> 1 pkts/106 bytes][Goodput ratio: 53/60][0.00 sec][Hostname/SNI: www.allyourbasesare???ongto.cn][19.185.141.241][DNS Id: 0x9f6c][Risk: ** Non-Printable/Invalid Chars Detected **][Risk Score: 100][Risk Info: Invalid chars detected in domain name][PLAIN TEXT (allyourba)][Plen Bins: 0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns-tunnel-iodine.pcap.out b/tests/cfgs/default/result/dns-tunnel-iodine.pcap.out index ab14df734..5697cfa90 100644 --- a/tests/cfgs/default/result/dns-tunnel-iodine.pcap.out +++ b/tests/cfgs/default/result/dns-tunnel-iodine.pcap.out @@ -24,4 +24,6 @@ DNS 434 70252 1 Acceptable 434 70252 1 +Network 434 70252 1 + 1 UDP 10.0.2.30:44639 <-> 10.0.2.20:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][222 pkts/26136 bytes <-> 212 pkts/44116 bytes][Goodput ratio: 64/80][24.49 sec][Hostname/SNI: vaaaakardli.pirate.sea][0.0.0.0][DNS Id: 0x12b0][bytes ratio: -0.256 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 127/88 4005/4005 543/524][Pkt Len c2s/s2c min/avg/max/stddev: 82/93 118/208 323/1512 67/175][Risk: ** Susp DNS Traffic **** Minor Issues **][Risk Score: 60][Risk Info: DNS Record with zero TTL / Obsolete DNS record type][PLAIN TEXT (vaaaakardli)][Plen Bins: 0,40,1,15,29,3,0,1,8,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns.pcap.out b/tests/cfgs/default/result/dns.pcap.out index 897c122ac..35770a620 100644 --- a/tests/cfgs/default/result/dns.pcap.out +++ b/tests/cfgs/default/result/dns.pcap.out @@ -26,6 +26,8 @@ MDNS 1 371 1 Acceptable 17 3553 4 +Network 17 3553 4 + 1 TCP [2001:b07:a3d:c112:b831:a73f:7974:e604]:49774 <-> [2001:b07:a3d:c112::1]:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][6 pkts/490 bytes <-> 5 pkts/2156 bytes][Goodput ratio: 7/82][0.01 sec][Hostname/SNI: opentracker.io][45.9.60.30][DNS Id: 0x3d73][bytes ratio: -0.630 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2/2 6/5 3/2][Pkt Len c2s/s2c min/avg/max/stddev: 74/74 82/431 108/1294 13/481][TCP Fingerprint: 2_64_65535_108f896b6121/Unknown][PLAIN TEXT (opentracker)][Plen Bins: 0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0] 2 UDP [fe80::a00:27ff:feb3:e62e]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 8/MDNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/371 bytes -> 0 pkts/0 bytes][Goodput ratio: 83/0][< 1 sec][Hostname/SNI: e.2.6.e.3.b.e.f.f.f.7.2.0.0.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa][e.2.6.e.3.b.e.f.f.f.7.2.0.0.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa][PLAIN TEXT (Android)][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 82.178.113.245:47255 <-> 82.178.158.181:53 [VLAN: 785][proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/91 bytes <-> 1 pkts/219 bytes][Goodput ratio: 36/73][0.00 sec][Hostname/SNI: e7.whatsapp.net][169.45.219.235][DNS Id: 0x7843][PLAIN TEXT (whatsapp)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns2.pcap.out b/tests/cfgs/default/result/dns2.pcap.out index d0576e3cd..42c2eabf7 100644 --- a/tests/cfgs/default/result/dns2.pcap.out +++ b/tests/cfgs/default/result/dns2.pcap.out @@ -24,4 +24,6 @@ DNS 4 405 1 Acceptable 4 405 1 +Network 4 405 1 + 1 UDP 192.168.255.251:56550 <-> 8.8.8.8:53 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 3][cat: Network/14][2 pkts/148 bytes <-> 2 pkts/257 bytes][Goodput ratio: 43/67][0.03 sec][Hostname/SNI: www.github.com][0.0.0.0][DNS Id: 0xeaef][PLAIN TEXT (github)][Plen Bins: 0,75,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns2tcp_tunnel.pcap.out b/tests/cfgs/default/result/dns2tcp_tunnel.pcap.out index 1549ac362..02bfe167c 100644 --- a/tests/cfgs/default/result/dns2tcp_tunnel.pcap.out +++ b/tests/cfgs/default/result/dns2tcp_tunnel.pcap.out @@ -24,6 +24,8 @@ TLS 50 8960 1 Safe 50 8960 1 +Web 50 8960 1 + JA Host Stats: IP Address # JA4C 1 192.168.20.211 1 diff --git a/tests/cfgs/default/result/dns_ambiguous_names.pcap.out b/tests/cfgs/default/result/dns_ambiguous_names.pcap.out index 232519d52..caaa57c8f 100644 --- a/tests/cfgs/default/result/dns_ambiguous_names.pcap.out +++ b/tests/cfgs/default/result/dns_ambiguous_names.pcap.out @@ -24,6 +24,8 @@ DNS 20 2787 10 Acceptable 20 2787 10 +Network 20 2787 10 + 1 UDP 10.200.2.11:57632 <-> 8.8.8.8:53 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/97 bytes <-> 1 pkts/377 bytes][Goodput ratio: 56/89][0.03 sec][Hostname/SNI: android.clients.google.com][108.177.14.101][DNS Id: 0xc953][PLAIN TEXT (android)][Plen Bins: 0,50,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.200.2.11:48375 <-> 8.8.8.8:53 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/96 bytes <-> 1 pkts/318 bytes][Goodput ratio: 56/87][0.04 sec][Hostname/SNI: 41-courier.push.apple.com][17.57.146.139][DNS Id: 0x6631][PLAIN TEXT (courier)][Plen Bins: 0,50,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.200.2.11:57051 <-> 8.8.8.8:53 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/90 bytes <-> 1 pkts/221 bytes][Goodput ratio: 53/81][0.03 sec][Hostname/SNI: api.teams.skype.com][52.113.194.131][DNS Id: 0xdbbb][PLAIN TEXT (trafficmanager)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns_doh.pcap.out b/tests/cfgs/default/result/dns_doh.pcap.out index fe8145f02..a67f88807 100644 --- a/tests/cfgs/default/result/dns_doh.pcap.out +++ b/tests/cfgs/default/result/dns_doh.pcap.out @@ -24,6 +24,8 @@ DoH_DoT 142 20362 1 Acceptable 142 20362 1 +Network 142 20362 1 + JA Host Stats: IP Address # JA4C 1 172.20.10.4 1 diff --git a/tests/cfgs/default/result/dns_dot.pcap.out b/tests/cfgs/default/result/dns_dot.pcap.out index ee00f7547..bbe9909fe 100644 --- a/tests/cfgs/default/result/dns_dot.pcap.out +++ b/tests/cfgs/default/result/dns_dot.pcap.out @@ -24,6 +24,8 @@ DoH_DoT 24 5869 1 Acceptable 24 5869 1 +Network 24 5869 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.185 1 diff --git a/tests/cfgs/default/result/dns_exfiltration.pcap.out b/tests/cfgs/default/result/dns_exfiltration.pcap.out index 445e9bc1b..e442826e9 100644 --- a/tests/cfgs/default/result/dns_exfiltration.pcap.out +++ b/tests/cfgs/default/result/dns_exfiltration.pcap.out @@ -24,4 +24,6 @@ DNS 300 73545 1 Acceptable 300 73545 1 +Network 300 73545 1 + 1 UDP 192.168.220.56:56373 <-> 192.168.203.167:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][150 pkts/32419 bytes <-> 150 pkts/41126 bytes][Goodput ratio: 81/85][59.99 sec][Hostname/SNI: e1aa8f8fdb1bbe8d5e04952141f7d4f82c7e3b06dcc8b87fad7a.19e4d098dc8c618f8d81cfeb02][0.0.0.0][DNS Id: 0x391d][bytes ratio: -0.118 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/1 398/397 1035/1015 491/489][Pkt Len c2s/s2c min/avg/max/stddev: 101/148 216/274 300/386 97/97][Risk: ** Susp DGA Domain name **** Risky Domain Name **][Risk Score: 150][Risk Info: DGA Name Query with no Error Code / e1aa8f8fdb1bbe8d5e04952141f7d4f82c7e3b06dcc8b87fad7a.19e4d098dc8c618f8d81cfeb02][PLAIN TEXT (dnscat)][Plen Bins: 0,24,0,23,0,0,0,0,26,26,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns_fragmented.pcap.out b/tests/cfgs/default/result/dns_fragmented.pcap.out index 8892baaca..af1f9abef 100644 --- a/tests/cfgs/default/result/dns_fragmented.pcap.out +++ b/tests/cfgs/default/result/dns_fragmented.pcap.out @@ -25,6 +25,8 @@ DNS 59 21695 21 Acceptable 59 21695 21 +Network 59 21695 21 + 1 TCP [2001:470:1f0b:16b0:20c:29ff:fe7c:a4cb]:57089 <-> [2001:470:1f0b:16b0::a26:53]:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][6 pkts/578 bytes <-> 4 pkts/2084 bytes][Goodput ratio: 9/83][0.00 sec][Hostname/SNI: weberlab.de][0.0.0.0][DNS Id: 0x80e4][bytes ratio: -0.566 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 1/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 86/86 96/521 140/1818 20/749][TCP Fingerprint: 2_64_24400_d58d7a51674b/Unknown][PLAIN TEXT (weberlab)][Plen Bins: 0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50] 2 TCP 194.247.5.6:39005 <-> 194.247.5.14:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][6 pkts/458 bytes <-> 4 pkts/2004 bytes][Goodput ratio: 12/86][0.00 sec][Hostname/SNI: weberlab.de][0.0.0.0][DNS Id: 0x06da][bytes ratio: -0.628 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 76/501 120/1798 20/749][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (weberlab)][Plen Bins: 0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50] 3 UDP [2001:470:1f0b:16b0:20c:29ff:fe7c:a4cb]:55729 <-> [2001:470:765b::a25:53]:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 3][cat: Network/14][2 pkts/228 bytes <-> 1 pkts/1494 bytes][Goodput ratio: 45/95][5.01 sec][Hostname/SNI: weberlab.de][0.0.0.0][DNS Id: 0xc2a0][Risk: ** Large DNS Packet (512+ bytes) **** Fragmented DNS Message **][Risk Score: 100][Risk Info: 1424 Bytes DNS Packet][PLAIN TEXT (weberlab)][Plen Bins: 0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0] diff --git a/tests/cfgs/default/result/dns_invert_query.pcapng.out b/tests/cfgs/default/result/dns_invert_query.pcapng.out index 014c71f58..55f07251f 100644 --- a/tests/cfgs/default/result/dns_invert_query.pcapng.out +++ b/tests/cfgs/default/result/dns_invert_query.pcapng.out @@ -24,4 +24,6 @@ DNS 2 134 1 Acceptable 2 134 1 +Network 2 134 1 + 1 UDP 173.147.108.174:18427 <-> 244.187.95.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/78 bytes <-> 1 pkts/56 bytes][Goodput ratio: 46/21][0.00 sec][Hostname/SNI: 216.58.202.4][0.0.0.0][DNS Id: 0x77fc][Risk: ** Error Code **][Risk Score: 10][Risk Info: DNS Error Code NOTIMP][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns_long_domainname.pcap.out b/tests/cfgs/default/result/dns_long_domainname.pcap.out index c087c1635..8258de7e1 100644 --- a/tests/cfgs/default/result/dns_long_domainname.pcap.out +++ b/tests/cfgs/default/result/dns_long_domainname.pcap.out @@ -24,4 +24,6 @@ DNS 2 262 1 Acceptable 2 262 1 +Network 2 262 1 + 1 UDP 192.168.1.168:65311 <-> 8.8.8.8:53 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/103 bytes <-> 1 pkts/159 bytes][Goodput ratio: 59/73][0.02 sec][Hostname/SNI: gmr02c.16.0.fhkfhsdkfhsk.tunnel.example.com][0.0.0.0][DNS Id: 0x8b54][Risk: ** Error Code **][Risk Score: 10][Risk Info: DNS Error Code NXDOMAIN][PLAIN TEXT (fhkfhsdkfhsk)][Plen Bins: 0,50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns_lots_of_answers.pcapng.out b/tests/cfgs/default/result/dns_lots_of_answers.pcapng.out index a6c0f41c5..4bc6a25f8 100644 --- a/tests/cfgs/default/result/dns_lots_of_answers.pcapng.out +++ b/tests/cfgs/default/result/dns_lots_of_answers.pcapng.out @@ -25,5 +25,7 @@ DNS 16 2200 2 Acceptable 16 2200 2 +Network 16 2200 2 + 1 TCP 192.168.12.169:4026 <-> 192.168.12.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 9][cat: Network/14][8 pkts/586 bytes <-> 6 pkts/1118 bytes][Goodput ratio: 7/62][3.17 sec][Hostname/SNI: bstream.hzmklvdieo.com][169.197.119.239][DNS Id: 0x474c][bytes ratio: -0.312 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/2 443/359 1056/716 375/357][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 73/186 108/764 14/258][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (bstream)][Plen Bins: 0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.156:54660 <-> 192.168.12.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/91 bytes <-> 1 pkts/405 bytes][Goodput ratio: 53/89][0.32 sec][Hostname/SNI: dinamicx.alibabausercontent.com][163.181.50.229][DNS Id: 0x0c54][PLAIN TEXT (dinamic)][Plen Bins: 0,50,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns_multiple_transactions_same_flow.pcap.out b/tests/cfgs/default/result/dns_multiple_transactions_same_flow.pcap.out index 456bf30d8..1bcf290dc 100644 --- a/tests/cfgs/default/result/dns_multiple_transactions_same_flow.pcap.out +++ b/tests/cfgs/default/result/dns_multiple_transactions_same_flow.pcap.out @@ -24,4 +24,6 @@ DNS 80 10969 1 Acceptable 80 10969 1 +Network 80 10969 1 + 1 UDP 192.168.1.204:50234 <-> 192.168.1.253:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][40 pkts/3152 bytes <-> 40 pkts/7817 bytes][Goodput ratio: 47/78][403.67 sec][Hostname/SNI: www.google.com][142.251.209.36][DNS Id: 0x1655][bytes ratio: -0.425 (Download)][IAT c2s/s2c min/avg/max/stddev: 23/9 11635/11637 110617/110608 23370/23370][Pkt Len c2s/s2c min/avg/max/stddev: 68/68 79/195 94/356 9/104][PLAIN TEXT (google)][Plen Bins: 27,36,6,8,0,1,5,2,6,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns_response_only.pcap.out b/tests/cfgs/default/result/dns_response_only.pcap.out index 0d5e6163f..6abc4f212 100644 --- a/tests/cfgs/default/result/dns_response_only.pcap.out +++ b/tests/cfgs/default/result/dns_response_only.pcap.out @@ -24,4 +24,6 @@ DNS 1 104 1 Acceptable 1 104 1 +Network 1 104 1 + 1 UDP 8.8.8.8:53 -> 192.168.255.251:56550 [proto: 5/DNS][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/104 bytes -> 0 pkts/0 bytes][Goodput ratio: 59/0][< 1 sec][Hostname/SNI: www.github.com][140.82.121.4][DNS Id: 0xdeec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][PLAIN TEXT (github)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dns_retransmissions.pcap.out b/tests/cfgs/default/result/dns_retransmissions.pcap.out index 0862d57e4..c5a428520 100644 --- a/tests/cfgs/default/result/dns_retransmissions.pcap.out +++ b/tests/cfgs/default/result/dns_retransmissions.pcap.out @@ -24,4 +24,6 @@ DNS 4 450 1 Acceptable 4 450 1 +Network 4 450 1 + 1 UDP 37.41.101.140:11892 <-> 208.67.222.222:53 [VLAN: 103][proto: 5/DNS][IP: 225/OpenDNS][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 3][cat: Network/14][2 pkts/150 bytes <-> 2 pkts/300 bytes][Goodput ratio: 38/69][0.20 sec][Hostname/SNI: api.msn.com][204.79.197.203][DNS Id: 0xb8e2][PLAIN TEXT (msedge)][Plen Bins: 50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dnscrypt-v1-and-resolver-pings.pcap.out b/tests/cfgs/default/result/dnscrypt-v1-and-resolver-pings.pcap.out index e1d713682..c50ba7cd0 100644 --- a/tests/cfgs/default/result/dnscrypt-v1-and-resolver-pings.pcap.out +++ b/tests/cfgs/default/result/dnscrypt-v1-and-resolver-pings.pcap.out @@ -24,6 +24,8 @@ DNScrypt 488 309562 245 Acceptable 488 309562 245 +Network 488 309562 245 + 1 UDP 10.0.0.1:35228 <-> 149.56.228.45:443 [proto: 208/DNScrypt][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 208/DNScrypt, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/3028 bytes <-> 2 pkts/452 bytes][Goodput ratio: 97/81][3600.11 sec][PLAIN TEXT (DDDDDDffffff)][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0] 2 UDP 10.0.0.1:35495 <-> 149.56.228.45:443 [proto: 208/DNScrypt][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 208/DNScrypt, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/3028 bytes <-> 2 pkts/452 bytes][Goodput ratio: 97/81][3600.11 sec][PLAIN TEXT (DDDDDDffffff)][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0] 3 UDP 10.0.0.1:45722 <-> 149.56.228.45:443 [proto: 208/DNScrypt][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 208/DNScrypt, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/3028 bytes <-> 2 pkts/452 bytes][Goodput ratio: 97/81][3600.11 sec][PLAIN TEXT (DDDDDDffffff)][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0] diff --git a/tests/cfgs/default/result/dnscrypt-v2-doh.pcap.out b/tests/cfgs/default/result/dnscrypt-v2-doh.pcap.out index 0eebc2e3b..1b0ebe2d1 100644 --- a/tests/cfgs/default/result/dnscrypt-v2-doh.pcap.out +++ b/tests/cfgs/default/result/dnscrypt-v2-doh.pcap.out @@ -24,6 +24,8 @@ DoH_DoT 577 216583 34 Acceptable 577 216583 34 +Network 577 216583 34 + JA Host Stats: IP Address # JA4C 1 10.0.0.1 1 diff --git a/tests/cfgs/default/result/dnscrypt-v2.pcap.out b/tests/cfgs/default/result/dnscrypt-v2.pcap.out index cfab43a1f..ede6af182 100644 --- a/tests/cfgs/default/result/dnscrypt-v2.pcap.out +++ b/tests/cfgs/default/result/dnscrypt-v2.pcap.out @@ -24,6 +24,8 @@ DNScrypt 6 4300 3 Acceptable 6 4300 3 +Network 6 4300 3 + 1 UDP 127.0.0.1:50893 <-> 127.0.0.2:5353 [proto: 208/DNScrypt][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: Network/14][1 pkts/1130 bytes <-> 1 pkts/410 bytes][Goodput ratio: 96/90][0.01 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 127.0.0.1:38650 <-> 127.0.0.2:5353 [proto: 208/DNScrypt][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: Network/14][1 pkts/1130 bytes <-> 1 pkts/282 bytes][Goodput ratio: 96/85][0.01 sec][Plen Bins: 0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 127.0.0.1:42883 <-> 127.0.0.2:5353 [proto: 208/DNScrypt][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: Network/14][1 pkts/1130 bytes <-> 1 pkts/218 bytes][Goodput ratio: 96/80][0.01 sec][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dnscrypt_skype_false_positive.pcapng.out b/tests/cfgs/default/result/dnscrypt_skype_false_positive.pcapng.out index 1bfbc7ec0..0d07d153c 100644 --- a/tests/cfgs/default/result/dnscrypt_skype_false_positive.pcapng.out +++ b/tests/cfgs/default/result/dnscrypt_skype_false_positive.pcapng.out @@ -24,4 +24,6 @@ DNScrypt 6 2380 1 Acceptable 6 2380 1 +Network 6 2380 1 + 1 UDP 192.168.2.100:46858 <-> 212.47.228.136:443 [proto: 208/DNScrypt][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: Network/14][3 pkts/1662 bytes <-> 3 pkts/718 bytes][Goodput ratio: 92/82][5137.13 sec][bytes ratio: 0.397 (Upload)][IAT c2s/s2c min/avg/max/stddev: 300005/300005 2568548/2568547 4837091/4837089 2268543/2268542][Pkt Len c2s/s2c min/avg/max/stddev: 554/154 554/239 554/282 0/60][PLAIN TEXT (OYy Tp)][Plen Bins: 0,0,0,16,0,0,0,33,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dofus.pcap.out b/tests/cfgs/default/result/dofus.pcap.out index a5b41f26f..ecb2303e7 100644 --- a/tests/cfgs/default/result/dofus.pcap.out +++ b/tests/cfgs/default/result/dofus.pcap.out @@ -24,6 +24,8 @@ Dofus 73 27258 5 Fun 73 27258 5 +Game 73 27258 5 + JA Host Stats: IP Address # JA4C 1 10.215.173.1 1 diff --git a/tests/cfgs/default/result/doh.pcapng.out b/tests/cfgs/default/result/doh.pcapng.out index 8aeb4809a..cec602c58 100644 --- a/tests/cfgs/default/result/doh.pcapng.out +++ b/tests/cfgs/default/result/doh.pcapng.out @@ -24,6 +24,8 @@ TLS 120 14592 1 Safe 120 14592 1 +Web 120 14592 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.253 1 diff --git a/tests/cfgs/default/result/doq.pcapng.out b/tests/cfgs/default/result/doq.pcapng.out index 1cc801305..e63943b48 100644 --- a/tests/cfgs/default/result/doq.pcapng.out +++ b/tests/cfgs/default/result/doq.pcapng.out @@ -26,6 +26,8 @@ DoH_DoT 14 4788 1 Acceptable 20 5958 2 +Network 20 5958 2 + JA Host Stats: IP Address # JA4C 1 ::1 1 diff --git a/tests/cfgs/default/result/doq_adguard.pcapng.out b/tests/cfgs/default/result/doq_adguard.pcapng.out index 2e2d46a1c..88f03faa8 100644 --- a/tests/cfgs/default/result/doq_adguard.pcapng.out +++ b/tests/cfgs/default/result/doq_adguard.pcapng.out @@ -24,6 +24,8 @@ DoH_DoT 296 44445 1 Acceptable 296 44445 1 +Network 296 44445 1 + JA Host Stats: IP Address # JA4C 1 192.168.12.169 1 diff --git a/tests/cfgs/default/result/dos_win98_smb_netbeui.pcap.out b/tests/cfgs/default/result/dos_win98_smb_netbeui.pcap.out index 10749d425..433229ad5 100644 --- a/tests/cfgs/default/result/dos_win98_smb_netbeui.pcap.out +++ b/tests/cfgs/default/result/dos_win98_smb_netbeui.pcap.out @@ -28,6 +28,9 @@ ICMP 1 60 1 Acceptable 47 5120 3 Dangerous 15 3447 1 +Network 1 60 1 +System 61 8507 3 + 1 UDP 192.168.239.129:137 -> 192.168.239.255:137 [proto: 10/NetBIOS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 10/NetBIOS, Confidence: DPI][DPI packets: 1][cat: System/18][32 pkts/3520 bytes -> 0 pkts/0 bytes][Goodput ratio: 62/0][131.29 sec][Hostname/SNI: mdjr98][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1218/0 22000/0 4015/0][Pkt Len c2s/s2c min/avg/max/stddev: 110/0 110/0 110/0 0/0][PLAIN TEXT ( ENEEEKFCDJ)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.239.129:138 -> 192.168.239.255:138 [proto: 10.16/NetBIOS.SMBv1][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 10.16/NetBIOS.SMBv1, Confidence: DPI][DPI packets: 1][cat: System/18][15 pkts/3447 bytes -> 0 pkts/0 bytes][Goodput ratio: 82/0][115.76 sec][Hostname/SNI: mdjr98][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8826/0 43984/0 11228/0][Pkt Len c2s/s2c min/avg/max/stddev: 219/0 230/0 249/0 10/0][PLAIN TEXT ( ENEEEKFCDJ)][Plen Bins: 0,0,0,0,0,73,26,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.239.129:137 -> 192.168.239.2:137 [proto: 10/NetBIOS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 10/NetBIOS, Confidence: DPI][DPI packets: 1][cat: System/18][14 pkts/1540 bytes -> 0 pkts/0 bytes][Goodput ratio: 62/0][130.51 sec][Hostname/SNI: mdjr98][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 10750/0 98690/0 27314/0][Pkt Len c2s/s2c min/avg/max/stddev: 110/0 110/0 110/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT ( ENEEEKFCDJ)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dotenv.pcap.out b/tests/cfgs/default/result/dotenv.pcap.out index e0e1ecbc8..b99462941 100644 --- a/tests/cfgs/default/result/dotenv.pcap.out +++ b/tests/cfgs/default/result/dotenv.pcap.out @@ -24,4 +24,6 @@ HTTP 10 993 1 Acceptable 10 993 1 +Download 10 993 1 + 1 TCP 192.168.2.198:51327 <-> 89.31.76.10:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Download/7][6 pkts/490 bytes <-> 4 pkts/503 bytes][Goodput ratio: 17/46][0.12 sec][Hostname/SNI: sevenpitaly.com][bytes ratio: -0.013 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 24/22 45/43 20/22][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 82/126 148/297 30/99][URL: sevenpitaly.com/.env][StatusCode: 406][Content-Type: application/octet-stream][Server: openresty][User-Agent: curl/8.4.0][Risk: ** Possible Exploit Attempt **** Error Code **** Binary File/Data Transfer (Attempt) **][Risk Score: 210][Risk Info: Found binary mime octet-stream (attempt) / HTTP Error Code 406 / URL starting with dot [/.env]][TCP Fingerprint: 2_64_65535_d29295416479/macOS][PLAIN TEXT (GET /.env HTTP/1.1)][Plen Bins: 0,0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/drda_db2.pcap.out b/tests/cfgs/default/result/drda_db2.pcap.out index 5e413fd1f..58a496aec 100644 --- a/tests/cfgs/default/result/drda_db2.pcap.out +++ b/tests/cfgs/default/result/drda_db2.pcap.out @@ -24,4 +24,6 @@ DRDA 38 6691 1 Acceptable 38 6691 1 +Database 38 6691 1 + 1 TCP 192.168.106.1:4847 <-> 192.168.106.128:50000 [proto: 227/DRDA][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][20 pkts/3169 bytes <-> 18 pkts/3522 bytes][Goodput ratio: 66/72][38.46 sec][bytes ratio: -0.053 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 2371/2905 17828/17986 5833/6422][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 158/196 717/684 169/193][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][PLAIN TEXT (@@@@@@@@@@@)][Plen Bins: 25,20,4,4,0,4,0,8,8,0,4,0,8,0,4,0,0,0,0,4,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dropbox.pcap.out b/tests/cfgs/default/result/dropbox.pcap.out index 3bf8a9735..28d68cd89 100644 --- a/tests/cfgs/default/result/dropbox.pcap.out +++ b/tests/cfgs/default/result/dropbox.pcap.out @@ -25,6 +25,9 @@ Dropbox 824 86010 10 Acceptable 848 90532 15 +Cloud 824 86010 10 +Network 24 4522 5 + 1 UDP 192.168.56.1:50318 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13960 bytes <-> 100 pkts/6260 bytes][Goodput ratio: 70/33][11.19 sec][bytes ratio: 0.381 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 113/112 150/151 11/11][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 140/63 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,13,36,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.56.1:50312 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13947 bytes <-> 100 pkts/6247 bytes][Goodput ratio: 70/33][11.09 sec][bytes ratio: 0.381 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 111/111 154/150 10/9][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 139/62 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,11,38,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.56.1:50319 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13921 bytes <-> 100 pkts/6221 bytes][Goodput ratio: 70/32][10.92 sec][bytes ratio: 0.382 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 110/110 172/164 11/11][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 139/62 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,15,35,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dtls.pcap.out b/tests/cfgs/default/result/dtls.pcap.out index d3571251f..3b679b22f 100644 --- a/tests/cfgs/default/result/dtls.pcap.out +++ b/tests/cfgs/default/result/dtls.pcap.out @@ -24,6 +24,8 @@ DTLS 24 8508 3 Safe 24 8508 3 +Web 24 8508 3 + JA Host Stats: IP Address # JA4C 1 10.191.227.13 1 diff --git a/tests/cfgs/default/result/dtls2.pcap.out b/tests/cfgs/default/result/dtls2.pcap.out index eea3998d8..6ab6f7443 100644 --- a/tests/cfgs/default/result/dtls2.pcap.out +++ b/tests/cfgs/default/result/dtls2.pcap.out @@ -24,6 +24,8 @@ RockstarGames 30 4991 1 Fun 30 4991 1 +Game 30 4991 1 + JA Host Stats: IP Address # JA4C 1 61.68.110.153 1 diff --git a/tests/cfgs/default/result/dtls_certificate.pcapng.out b/tests/cfgs/default/result/dtls_certificate.pcapng.out index 4968497b5..80b2f57a8 100644 --- a/tests/cfgs/default/result/dtls_certificate.pcapng.out +++ b/tests/cfgs/default/result/dtls_certificate.pcapng.out @@ -24,6 +24,8 @@ WindowsUpdate 1 1486 1 Safe 1 1486 1 +SoftwareUpdate 1 1486 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/dtls_certificate_fragments.pcap.out b/tests/cfgs/default/result/dtls_certificate_fragments.pcap.out index 52fc68af0..9e93f1d53 100644 --- a/tests/cfgs/default/result/dtls_certificate_fragments.pcap.out +++ b/tests/cfgs/default/result/dtls_certificate_fragments.pcap.out @@ -26,6 +26,9 @@ Discord 6 4215 1 Safe 20 5978 1 Fun 6 4215 1 +Web 20 5978 1 +Collaborative 6 4215 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.26 1 diff --git a/tests/cfgs/default/result/dtls_mid_sessions.pcapng.out b/tests/cfgs/default/result/dtls_mid_sessions.pcapng.out index 67372c6ab..44d560953 100644 --- a/tests/cfgs/default/result/dtls_mid_sessions.pcapng.out +++ b/tests/cfgs/default/result/dtls_mid_sessions.pcapng.out @@ -24,6 +24,8 @@ DTLS 91 37868 4 Safe 91 37868 4 +Web 91 37868 4 + 1 UDP 170.151.105.215:443 <-> 121.152.255.238:8460 [proto: 30/DTLS][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 30/DTLS, Confidence: DPI][DPI packets: 1][cat: Web/5][17 pkts/16320 bytes <-> 13 pkts/2086 bytes][Goodput ratio: 96/74][0.55 sec][bytes ratio: 0.773 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 31/24 152/154 51/46][Pkt Len c2s/s2c min/avg/max/stddev: 135/135 960/160 1495/352 623/62][Plen Bins: 0,0,44,6,3,0,3,0,3,3,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,30,0,0] 2 UDP 170.151.105.215:443 <-> 72.102.179.218:62811 [proto: 30/DTLS][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 30/DTLS, Confidence: DPI][DPI packets: 1][cat: Web/5][13 pkts/6283 bytes <-> 17 pkts/3803 bytes][Goodput ratio: 91/81][3.28 sec][bytes ratio: 0.246 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 240/212 1725/941 499/287][Pkt Len c2s/s2c min/avg/max/stddev: 135/135 483/224 1495/833 556/172][Plen Bins: 0,0,34,20,13,0,6,3,3,3,0,3,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0] 3 UDP 135.215.56.198:443 -> 124.73.140.89:61189 [proto: 30/DTLS][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 30/DTLS, Confidence: DPI][DPI packets: 1][cat: Web/5][30 pkts/9241 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][0.27 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/0 28/0 7/0][Pkt Len c2s/s2c min/avg/max/stddev: 120/0 308/0 1381/0 280/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][PLAIN TEXT (q/SCmS.)][Plen Bins: 0,0,20,3,13,0,41,0,3,0,3,3,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,3,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dtls_old_version.pcapng.out b/tests/cfgs/default/result/dtls_old_version.pcapng.out index 8036d04ea..d4f9ee117 100644 --- a/tests/cfgs/default/result/dtls_old_version.pcapng.out +++ b/tests/cfgs/default/result/dtls_old_version.pcapng.out @@ -24,6 +24,8 @@ DTLS 7 994 1 Safe 7 994 1 +Web 7 994 1 + JA Host Stats: IP Address # JA4C 1 37.188.4.115 1 diff --git a/tests/cfgs/default/result/dtls_session_id_and_coockie_both.pcap.out b/tests/cfgs/default/result/dtls_session_id_and_coockie_both.pcap.out index 15a6afc2b..45458cfa9 100644 --- a/tests/cfgs/default/result/dtls_session_id_and_coockie_both.pcap.out +++ b/tests/cfgs/default/result/dtls_session_id_and_coockie_both.pcap.out @@ -24,6 +24,8 @@ DTLS 4 604 1 Safe 4 604 1 +Web 4 604 1 + JA Host Stats: IP Address # JA4C 1 185.196.113.239 1 diff --git a/tests/cfgs/default/result/edonkey.pcap.out b/tests/cfgs/default/result/edonkey.pcap.out index 2a857b7ca..5948b5ad0 100644 --- a/tests/cfgs/default/result/edonkey.pcap.out +++ b/tests/cfgs/default/result/edonkey.pcap.out @@ -24,4 +24,6 @@ eDonkey 17 2016 1 Unsafe 17 2016 1 +Download 17 2016 1 + 1 TCP 201.15.177.227:1754 <-> 135.192.214.240:7551 [proto: 36/eDonkey][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Download/7][6 pkts/598 bytes <-> 11 pkts/1418 bytes][Goodput ratio: 41/56][57.40 sec][bytes ratio: -0.407 (Download)][IAT c2s/s2c min/avg/max/stddev: 5/91 5347/4749 12107/12106 5400/4962][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 100/129 178/186 55/63][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_128_65535_f65176b9e3ec/Unknown][PLAIN TEXT (VeryCD)][Plen Bins: 0,0,0,25,75,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/egd.pcapng.out b/tests/cfgs/default/result/egd.pcapng.out index 72c854e65..f62417e3f 100644 --- a/tests/cfgs/default/result/egd.pcapng.out +++ b/tests/cfgs/default/result/egd.pcapng.out @@ -24,4 +24,6 @@ EthernetGlobalData 5 505 1 Acceptable 5 505 1 +IoT-Scada 5 505 1 + 1 UDP 192.168.8.77:18246 -> 192.168.8.169:18246 [proto: 149/EthernetGlobalData][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 149/EthernetGlobalData, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][5 pkts/505 bytes -> 0 pkts/0 bytes][Goodput ratio: 58/0][4.00 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/elasticsearch.pcap.out b/tests/cfgs/default/result/elasticsearch.pcap.out index 9b0faa467..e6902b6cb 100644 --- a/tests/cfgs/default/result/elasticsearch.pcap.out +++ b/tests/cfgs/default/result/elasticsearch.pcap.out @@ -24,6 +24,8 @@ Elasticsearch 47 12739 7 Acceptable 47 12739 7 +System 47 12739 7 + 1 TCP 172.16.16.107:33288 <-> 172.16.17.102:9300 [proto: 330/Elasticsearch][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: System/18][13 pkts/3821 bytes <-> 2 pkts/140 bytes][Goodput ratio: 77/0][16.06 sec][bytes ratio: 0.929 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/16030 1460/16030 16003/16030 4599/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 294/70 335/74 95/4][TCP Fingerprint: 2_64_62720_ac6c0b5dcfcf/Unknown][PLAIN TEXT (security)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.16.17.102:48038 <-> 172.16.16.106:9300 [proto: 330/Elasticsearch][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: System/18][8 pkts/2596 bytes <-> 7 pkts/1323 bytes][Goodput ratio: 79/64][760.45 sec][bytes ratio: 0.325 (Upload)][IAT c2s/s2c min/avg/max/stddev: 26/1 126431/145462 725343/725412 268113/289976][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 324/189 930/441 348/155][TCP Fingerprint: 2_64_62720_ac6c0b5dcfcf/Unknown][PLAIN TEXT (security)][Plen Bins: 0,0,0,0,16,0,0,0,0,0,16,16,0,0,16,0,0,0,0,0,0,0,0,16,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 172.16.16.107:9300 -> 172.16.17.102:40342 [proto: 330/Elasticsearch][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 330/Elasticsearch, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/1824 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (security)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100] diff --git a/tests/cfgs/default/result/elf.pcap.out b/tests/cfgs/default/result/elf.pcap.out index 7a2206d28..e023dd448 100644 --- a/tests/cfgs/default/result/elf.pcap.out +++ b/tests/cfgs/default/result/elf.pcap.out @@ -25,6 +25,8 @@ Unknown 12 62824 2 Unrated 12 62824 2 +Unspecified 12 62824 2 + Undetected flows: diff --git a/tests/cfgs/default/result/emotet.pcap.out b/tests/cfgs/default/result/emotet.pcap.out index 299d6bedb..30cb96af8 100644 --- a/tests/cfgs/default/result/emotet.pcap.out +++ b/tests/cfgs/default/result/emotet.pcap.out @@ -27,6 +27,10 @@ TLS 32 10095 2 Safe 32 10095 2 Acceptable 137 89149 4 +Email 50 18605 1 +Web 90 60310 3 +Download 29 20329 2 + JA Host Stats: IP Address # JA4C 1 10.4.25.101 1 diff --git a/tests/cfgs/default/result/encrypted_sni.pcap.out b/tests/cfgs/default/result/encrypted_sni.pcap.out index b22350607..b6388b49e 100644 --- a/tests/cfgs/default/result/encrypted_sni.pcap.out +++ b/tests/cfgs/default/result/encrypted_sni.pcap.out @@ -24,6 +24,8 @@ TLS 3 2310 3 Safe 3 2310 3 +Web 3 2310 3 + JA Host Stats: IP Address # JA4C 1 192.168.1.12 1 diff --git a/tests/cfgs/default/result/epicgames.pcapng.out b/tests/cfgs/default/result/epicgames.pcapng.out index cf20492bf..ba64daa7c 100644 --- a/tests/cfgs/default/result/epicgames.pcapng.out +++ b/tests/cfgs/default/result/epicgames.pcapng.out @@ -24,6 +24,8 @@ EpicGames 81 11186 4 Fun 81 11186 4 +Game 81 11186 4 + 1 UDP 192.168.12.156:39322 <-> 18.157.15.184:9011 [proto: 340/EpicGames][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 2][cat: Game/8][10 pkts/4805 bytes <-> 9 pkts/772 bytes][Goodput ratio: 91/51][0.62 sec][bytes ratio: 0.723 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 43/76 163/199 53/74][Pkt Len c2s/s2c min/avg/max/stddev: 81/55 480/86 994/119 424/18][Plen Bins: 10,53,10,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,21,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.156:37989 <-> 18.157.15.184:15011 [proto: 340/EpicGames][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 2][cat: Game/8][11 pkts/1143 bytes <-> 13 pkts/1296 bytes][Goodput ratio: 60/58][1.01 sec][bytes ratio: -0.063 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 19/0 116/76 455/433 133/121][Pkt Len c2s/s2c min/avg/max/stddev: 81/55 104/100 146/192 25/40][Plen Bins: 8,63,12,8,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.156:47446 <-> 18.157.15.184:15011 [proto: 340/EpicGames][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Game/8][11 pkts/911 bytes <-> 8 pkts/680 bytes][Goodput ratio: 49/51][4.23 sec][bytes ratio: 0.145 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 384/285 1029/741 372/304][Pkt Len c2s/s2c min/avg/max/stddev: 54/55 83/85 135/98 25/17][Plen Bins: 31,63,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/esp.pcapng.out b/tests/cfgs/default/result/esp.pcapng.out index 6cadd63cd..bb83baede 100644 --- a/tests/cfgs/default/result/esp.pcapng.out +++ b/tests/cfgs/default/result/esp.pcapng.out @@ -26,5 +26,7 @@ ESP 2 332 1 Safe 6 1856 2 +VPN 6 1856 2 + 1 UDP 10.2.3.2:500 <-> 10.3.4.4:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 79/IPSec, Confidence: DPI][DPI packets: 1][cat: VPN/2][2 pkts/786 bytes <-> 2 pkts/738 bytes][Goodput ratio: 89/88][0.02 sec][PLAIN TEXT (DELETE)][Plen Bins: 0,0,0,0,0,0,0,0,0,25,25,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 ESP 10.2.3.2:0 <-> 10.3.4.4:0 [proto: 117/ESP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 117/ESP, Confidence: DPI][DPI packets: 1][cat: VPN/2][1 pkts/166 bytes <-> 1 pkts/166 bytes][Goodput ratio: 0/0][0.00 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ethereum.pcap.out b/tests/cfgs/default/result/ethereum.pcap.out index f06ea0672..7dbb1273e 100644 --- a/tests/cfgs/default/result/ethereum.pcap.out +++ b/tests/cfgs/default/result/ethereum.pcap.out @@ -28,6 +28,8 @@ ETHEREUM 2000 216111 74 Acceptable 2000 216111 74 +Crypto_Currency 2000 216111 74 + 1 TCP 192.168.1.184:56626 <-> 178.128.195.220:30303 [proto: 354/ETHEREUM][IP: 442/DigitalOcean][ClearText][Confidence: DPI][FPC: 442/DigitalOcean, Confidence: IP address][DPI packets: 4][cat: Crypto_Currency/106][32 pkts/3294 bytes <-> 37 pkts/3156 bytes][Goodput ratio: 36/21][0.16 sec][bytes ratio: 0.021 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 2/4 42/62 8/14][Pkt Len c2s/s2c min/avg/max/stddev: 66/60 103/85 612/470 105/69][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][Plen Bins: 62,21,0,3,3,0,0,0,3,0,0,0,3,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.184:56638 <-> 209.250.240.205:30303 [proto: 354/ETHEREUM][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Crypto_Currency/106][34 pkts/3347 bytes <-> 28 pkts/2774 bytes][Goodput ratio: 34/32][0.15 sec][bytes ratio: 0.094 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/3 43/41 12/10][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 98/99 481/560 79/95][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][Plen Bins: 43,29,0,14,3,3,0,0,0,0,0,0,3,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.1.184:56660 <-> 51.161.23.12:30303 [proto: 354/ETHEREUM][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Crypto_Currency/106][36 pkts/3241 bytes <-> 29 pkts/2723 bytes][Goodput ratio: 29/31][0.57 sec][bytes ratio: 0.087 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 10/9 147/141 36/34][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/94 639/487 96/81][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][Plen Bins: 63,21,3,3,3,0,0,0,0,0,0,0,0,3,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ethernetIP.pcap.out b/tests/cfgs/default/result/ethernetIP.pcap.out index e7ef7f46f..62838ca35 100644 --- a/tests/cfgs/default/result/ethernetIP.pcap.out +++ b/tests/cfgs/default/result/ethernetIP.pcap.out @@ -24,6 +24,8 @@ EthernetIP 100 17384 4 Acceptable 100 17384 4 +Network 100 17384 4 + 1 TCP 141.81.0.10:50275 <-> 141.81.0.83:44818 [proto: 278/EthernetIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 278/EthernetIP, Confidence: DPI][DPI packets: 1][cat: Network/14][12 pkts/2716 bytes <-> 16 pkts/2580 bytes][Goodput ratio: 76/66][0.70 sec][bytes ratio: 0.026 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 72/38 231/232 96/75][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 226/161 1258/406 330/99][PLAIN TEXT (99999999359)][Plen Bins: 0,20,45,0,10,0,0,5,0,5,0,5,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0] 2 TCP 141.81.0.63:44818 <-> 141.81.0.10:52593 [proto: 278/EthernetIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 278/EthernetIP, Confidence: DPI][DPI packets: 1][cat: Network/14][16 pkts/2150 bytes <-> 13 pkts/2566 bytes][Goodput ratio: 58/73][0.78 sec][bytes ratio: -0.088 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 30/60 190/197 55/74][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 134/197 406/528 92/158][PLAIN TEXT (99999999356)][Plen Bins: 0,15,43,0,5,0,10,5,0,0,5,5,5,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 141.81.0.10:52594 <-> 141.81.0.43:44818 [proto: 278/EthernetIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 278/EthernetIP, Confidence: DPI][DPI packets: 1][cat: Network/14][9 pkts/1978 bytes <-> 12 pkts/1784 bytes][Goodput ratio: 75/62][0.66 sec][bytes ratio: 0.052 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 61/33 196/185 73/56][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 220/149 528/406 163/113][PLAIN TEXT (rWKIm.)][Plen Bins: 0,14,35,0,7,0,14,0,0,7,0,7,7,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ethersbus.pcap.out b/tests/cfgs/default/result/ethersbus.pcap.out index cea31ac4c..e3b561514 100644 --- a/tests/cfgs/default/result/ethersbus.pcap.out +++ b/tests/cfgs/default/result/ethersbus.pcap.out @@ -24,4 +24,6 @@ Ether-S-Bus 20 1260 1 Acceptable 20 1260 1 +IoT-Scada 20 1260 1 + 1 UDP 172.16.1.120:2467 <-> 172.16.1.135:5050 [proto: 368/Ether-S-Bus][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 368/Ether-S-Bus, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][10 pkts/582 bytes <-> 10 pkts/678 bytes][Goodput ratio: 28/34][0.10 sec][bytes ratio: -0.076 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 7/8 10/10 22/20 5/4][Pkt Len c2s/s2c min/avg/max/stddev: 55/60 58/68 67/94 3/13][PLAIN TEXT (Modell )][Plen Bins: 90,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ethersio.pcap.out b/tests/cfgs/default/result/ethersio.pcap.out index 74ea0cb2f..4a0d157bc 100644 --- a/tests/cfgs/default/result/ethersio.pcap.out +++ b/tests/cfgs/default/result/ethersio.pcap.out @@ -24,4 +24,6 @@ EtherSIO 36 3226 1 Acceptable 36 3226 1 +IoT-Scada 36 3226 1 + 1 UDP 172.23.2.27:1024 -> 172.23.2.15:6060 [proto: 363/EtherSIO][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 363/EtherSIO, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][36 pkts/3226 bytes -> 0 pkts/0 bytes][Goodput ratio: 53/0][3.39 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 94/0 100/0 111/0 6/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 90/0 91/0 6/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 5,94,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/exe_download.pcap.out b/tests/cfgs/default/result/exe_download.pcap.out index 10b3125ba..a06539222 100644 --- a/tests/cfgs/default/result/exe_download.pcap.out +++ b/tests/cfgs/default/result/exe_download.pcap.out @@ -24,4 +24,6 @@ HTTP 20 14869 1 Acceptable 20 14869 1 +Download 20 14869 1 + 1 TCP 10.9.25.101:49165 <-> 144.91.69.195:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Download/7][8 pkts/597 bytes <-> 12 pkts/14272 bytes][Goodput ratio: 26/95][0.76 sec][Hostname/SNI: 144.91.69.195][bytes ratio: -0.920 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 125/33 319/298 134/89][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 75/1189 207/1514 50/510][URL: 144.91.69.195/solar.php][StatusCode: 200][Content-Type: application/octet-stream][Server: nginx/1.10.3][User-Agent: pwtyyEKzNtGatwnJjmCcBLbOveCVpc][Filename: phn34ycjtghm.exe][Risk: ** Binary App Transfer **** HTTP Susp User-Agent **** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Obsolete Server **** Binary File/Data Transfer (Attempt) **][Risk Score: 360][Risk Info: Found binary mime octet-stream / Obsolete nginx server 1.10.3 / Found host 144.91.69.195 / UA pwtyyEKzNtGatwnJjmCcBLbOveCVpc /][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (GET /solar.php HTTP/1.1)][Plen Bins: 0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,18,0,0,54,0,0,18,0,0] diff --git a/tests/cfgs/default/result/exe_download_as_png.pcap.out b/tests/cfgs/default/result/exe_download_as_png.pcap.out index 481b8b7bc..c0b551758 100644 --- a/tests/cfgs/default/result/exe_download_as_png.pcap.out +++ b/tests/cfgs/default/result/exe_download_as_png.pcap.out @@ -24,4 +24,6 @@ HTTP 100 94225 1 Acceptable 100 94225 1 +Web 100 94225 1 + 1 TCP 10.9.25.101:49197 <-> 185.98.87.185:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][33 pkts/1943 bytes <-> 67 pkts/92282 bytes][Goodput ratio: 8/96][1.90 sec][Hostname/SNI: 185.98.87.185][bytes ratio: -0.959 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 53/14 613/612 145/81][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 59/1377 203/1514 26/239][URL: 185.98.87.185/tablone.png][StatusCode: 200][Content-Type: image/png][Server: nginx/1.10.3][User-Agent: WinHTTP loader/1.0][Risk: ** Binary App Transfer **** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Obsolete Server **][Risk Score: 210][Risk Info: Obsolete nginx server 1.10.3 / Found host 185.98.87.185 / Found DOS/Windows Exe][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (GET /tablone.png HTTP/1.1)][Plen Bins: 0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,6,0,0,73,0,0,15,0,0] diff --git a/tests/cfgs/default/result/facebook.pcap.out b/tests/cfgs/default/result/facebook.pcap.out index 3e7fee308..86212c6c8 100644 --- a/tests/cfgs/default/result/facebook.pcap.out +++ b/tests/cfgs/default/result/facebook.pcap.out @@ -24,6 +24,8 @@ Facebook 60 30511 2 Fun 60 30511 2 +SocialNetwork 60 30511 2 + JA Host Stats: IP Address # JA4C 1 192.168.43.18 2 diff --git a/tests/cfgs/default/result/false_positives.pcapng.out b/tests/cfgs/default/result/false_positives.pcapng.out index 22b740492..99ea8debe 100644 --- a/tests/cfgs/default/result/false_positives.pcapng.out +++ b/tests/cfgs/default/result/false_positives.pcapng.out @@ -30,6 +30,11 @@ WebSocket 4 973 1 Acceptable 119 21853 6 Unrated 6 460 1 +Unspecified 6 460 1 +Media 110 19309 4 +Web 4 973 1 +RemoteAccess 5 1571 1 + JA Host Stats: IP Address # JA4C 1 91.238.181.21 1 diff --git a/tests/cfgs/default/result/fastcgi.pcap.out b/tests/cfgs/default/result/fastcgi.pcap.out index cefeab29c..6c763b71a 100644 --- a/tests/cfgs/default/result/fastcgi.pcap.out +++ b/tests/cfgs/default/result/fastcgi.pcap.out @@ -24,4 +24,6 @@ FastCGI 102 72243 1 Safe 102 72243 1 +Network 102 72243 1 + 1 TCP 10.0.0.9:38254 <-> 10.0.0.11:9000 [proto: 310/FastCGI][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][48 pkts/4271 bytes <-> 54 pkts/67972 bytes][Goodput ratio: 26/95][3.42 sec][Hostname/SNI: api.openstreetmap.org][Url: /api/0.6/map][User-agent: dummy_agent dummy_agent][bytes ratio: -0.882 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 38/81 1257/2019 204/358][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 89/1259 1121/1514 151/523][TCP Fingerprint: 2_64_5840_8c07a80cc645/Unknown][PLAIN TEXT (SCRIPT)][Plen Bins: 7,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,85,0,0] diff --git a/tests/cfgs/default/result/fins.pcap.out b/tests/cfgs/default/result/fins.pcap.out index 346a2853e..c3b16a7c1 100644 --- a/tests/cfgs/default/result/fins.pcap.out +++ b/tests/cfgs/default/result/fins.pcap.out @@ -25,6 +25,8 @@ FINS 257 17841 3 Acceptable 257 17841 3 +IoT-Scada 257 17841 3 + 1 UDP 10.4.14.102:58722 -> 10.130.130.130:9600 [proto: 362/FINS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 362/FINS, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][245 pkts/16887 bytes -> 0 pkts/0 bytes][Goodput ratio: 39/0][0.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 69/0 582/0 46/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (filename.exeaaaaaaaaaaaaaaaaaaa)][Plen Bins: 89,6,1,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.1.1.173:17134 <-> 10.1.1.164:9600 [proto: 362/FINS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][6 pkts/385 bytes <-> 4 pkts/366 bytes][Goodput ratio: 13/40][0.59 sec][bytes ratio: 0.025 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/145 117/151 158/157 58/6][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 64/92 83/176 11/50][TCP Fingerprint: 2_128_8192_4697958db063/Windows][PLAIN TEXT (EL20DR)][Plen Bins: 75,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.1.1.173:54855 <-> 10.1.1.164:9600 [proto: 362/FINS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 362/FINS, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/55 bytes <-> 1 pkts/148 bytes][Goodput ratio: 23/71][0.16 sec][PLAIN TEXT (EL20DR)][Plen Bins: 50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/firefox.pcap.out b/tests/cfgs/default/result/firefox.pcap.out index 22b46e7c5..6d02da84d 100644 --- a/tests/cfgs/default/result/firefox.pcap.out +++ b/tests/cfgs/default/result/firefox.pcap.out @@ -24,6 +24,8 @@ TLS 129 60233 6 Safe 129 60233 6 +Web 129 60233 6 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 2 diff --git a/tests/cfgs/default/result/fix.pcap.out b/tests/cfgs/default/result/fix.pcap.out index 718c19d1b..5c53bd792 100644 --- a/tests/cfgs/default/result/fix.pcap.out +++ b/tests/cfgs/default/result/fix.pcap.out @@ -24,6 +24,8 @@ FIX 1261 115514 12 Safe 1261 115514 12 +RPC 1261 115514 12 + 1 TCP 208.245.107.3:4000 <-> 192.168.0.20:45578 [proto: 230/FIX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 230/FIX, Confidence: DPI][DPI packets: 1][cat: RPC/16][228 pkts/26333 bytes <-> 228 pkts/13920 bytes][Goodput ratio: 53/2][22.80 sec][bytes ratio: 0.308 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/0 100/100 850/850 127/126][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 115/61 511/140 54/9][PLAIN TEXT (FIX.4.1)][Plen Bins: 35,41,10,8,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 8.17.22.31:4000 <-> 192.168.0.20:47968 [proto: 230/FIX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 230/FIX, Confidence: DPI][DPI packets: 1][cat: RPC/16][201 pkts/21246 bytes <-> 200 pkts/13460 bytes][Goodput ratio: 38/2][22.86 sec][bytes ratio: 0.224 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 110/109 501/500 86/84][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 106/67 169/153 15/11][PLAIN TEXT (FIX.4.1)][Plen Bins: 23,67,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 8.17.22.31:4000 <-> 192.168.0.20:43594 [proto: 230/FIX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 230/FIX, Confidence: DPI][DPI packets: 1][cat: RPC/16][111 pkts/16881 bytes <-> 111 pkts/7680 bytes][Goodput ratio: 57/5][22.65 sec][bytes ratio: 0.375 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 202/199 265/291 96/98][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 152/69 288/164 42/17][PLAIN TEXT (FIX.4.1)][Plen Bins: 3,25,31,28,10,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/fix2.pcap.out b/tests/cfgs/default/result/fix2.pcap.out index 573485860..959338cab 100644 --- a/tests/cfgs/default/result/fix2.pcap.out +++ b/tests/cfgs/default/result/fix2.pcap.out @@ -24,5 +24,7 @@ FIX 3046 246540 2 Safe 3046 246540 2 +RPC 3046 246540 2 + 1 TCP 10.101.0.2:34962 <-> 10.102.0.2:1024 [proto: 230/FIX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][683 pkts/53501 bytes <-> 1304 pkts/102844 bytes][Goodput ratio: 25/25][0.01 sec][bytes ratio: -0.316 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 78/79 160/174 35/38][TCP Fingerprint: 2_128_32769_7704c7190476/Unknown][PLAIN TEXT (FIXT.1.1)][Plen Bins: 0,0,46,53,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.101.0.2:34963 <-> 10.102.0.9:1024 [proto: 230/FIX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][411 pkts/34812 bytes <-> 648 pkts/55383 bytes][Goodput ratio: 31/32][0.01 sec][bytes ratio: -0.228 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 85/85 160/174 39/42][TCP Fingerprint: 2_128_32769_7704c7190476/Unknown][PLAIN TEXT (FIXT.1.1)][Plen Bins: 0,0,47,52,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/flow_risk_lists.pcapng.out b/tests/cfgs/default/result/flow_risk_lists.pcapng.out index d8f9568ff..47b831026 100644 --- a/tests/cfgs/default/result/flow_risk_lists.pcapng.out +++ b/tests/cfgs/default/result/flow_risk_lists.pcapng.out @@ -28,5 +28,7 @@ TLS 1 94 1 Safe 1 94 1 Acceptable 1 74 1 +Web 2 168 2 + 1 TCP [2a02:26f7:d198:400::1]:44878 -> [2001:db8:200::1]:443 [proto: 91/TLS][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Anonymous Subscriber **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_65320_5c453b01be6e/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 23.98.142.176:53684 -> 8.8.8.8:80 [proto: 7/HTTP][IP: 126/Google][ClearText][Confidence: Match by port][FPC: 126/Google, Confidence: IP address][DPI packets: 1][cat: Web/5][1 pkts/74 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Crawler/Bot **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/flute.pcapng.out b/tests/cfgs/default/result/flute.pcapng.out index 79adf81b5..9b8c678d0 100644 --- a/tests/cfgs/default/result/flute.pcapng.out +++ b/tests/cfgs/default/result/flute.pcapng.out @@ -24,4 +24,6 @@ FLUTE 4 1347 1 Acceptable 4 1347 1 +Download 4 1347 1 + 1 UDP 192.168.88.231:40717 -> 238.1.1.95:40085 [proto: 406/FLUTE][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 406/FLUTE, Confidence: DPI][DPI packets: 1][cat: Download/7][4 pkts/1347 bytes -> 0 pkts/0 bytes][Goodput ratio: 87/0][4.99 sec][PLAIN TEXT (xml version)][Plen Bins: 25,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/forticlient.pcap.out b/tests/cfgs/default/result/forticlient.pcap.out index c07ae9f7c..cc81b0373 100644 --- a/tests/cfgs/default/result/forticlient.pcap.out +++ b/tests/cfgs/default/result/forticlient.pcap.out @@ -25,6 +25,8 @@ FortiClient 2000 430931 5 Safe 2000 430931 5 +VPN 2000 430931 5 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 2 diff --git a/tests/cfgs/default/result/ftp-start-tls.pcap.out b/tests/cfgs/default/result/ftp-start-tls.pcap.out index d6900e15f..80aaab4cd 100644 --- a/tests/cfgs/default/result/ftp-start-tls.pcap.out +++ b/tests/cfgs/default/result/ftp-start-tls.pcap.out @@ -24,6 +24,8 @@ Huawei 51 7510 1 Acceptable 51 7510 1 +Web 51 7510 1 + JA Host Stats: IP Address # JA4C 1 10.238.26.36 1 diff --git a/tests/cfgs/default/result/ftp.pcap.out b/tests/cfgs/default/result/ftp.pcap.out index ba16ce6ed..effedf33c 100644 --- a/tests/cfgs/default/result/ftp.pcap.out +++ b/tests/cfgs/default/result/ftp.pcap.out @@ -29,6 +29,9 @@ Acceptable 9 1819 1 Unsafe 68 5571 1 Unrated 132 118184 1 +Unspecified 132 118184 1 +Download 77 7390 2 + 1 TCP 192.168.1.212:50694 <-> 90.130.70.73:21 [proto: 1/FTP_CONTROL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 12][cat: Download/7][41 pkts/2892 bytes <-> 27 pkts/2679 bytes][Goodput ratio: 6/33][8.48 sec][User: anonymous][Pwd: NcFTP@][bytes ratio: 0.038 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 236/108 4743/1377 849/305][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 71/99 96/307 7/45][Risk: ** Unsafe Protocol **** Clear-Text Credentials **][Risk Score: 110][Risk Info: Found FTP username (anonymous)][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][PLAIN TEXT (vsFTPd 3.0.3)][Plen Bins: 74,18,5,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.212:50695 <-> 90.130.70.73:25685 [proto: 175/FTP_DATA][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Download/7][5 pkts/342 bytes <-> 4 pkts/1477 bytes][Goodput ratio: 0/82][0.09 sec][bytes ratio: -0.624 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/28 14/28 29/29 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/369 78/1271 5/521][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][PLAIN TEXT ( 1 0 0 1073741)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ftp_failed.pcap.out b/tests/cfgs/default/result/ftp_failed.pcap.out index af36d1db4..35fa72016 100644 --- a/tests/cfgs/default/result/ftp_failed.pcap.out +++ b/tests/cfgs/default/result/ftp_failed.pcap.out @@ -24,4 +24,6 @@ FTP_CONTROL 18 1700 1 Unsafe 18 1700 1 +Download 18 1700 1 + 1 TCP [2a00:d40:1:3:192:12:193:11]:44724 <-> [2a00:800:1010::1]:21 [proto: 1/FTP_CONTROL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: Download/7][10 pkts/892 bytes <-> 8 pkts/808 bytes][Goodput ratio: 3/14][7.24 sec][User: hello][Pwd: ][Auth Failed][bytes ratio: 0.049 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 896/1442 5304/5318 1757/2052][Pkt Len c2s/s2c min/avg/max/stddev: 86/86 89/101 98/126 4/15][Risk: ** Unsafe Protocol **** Clear-Text Credentials **][Risk Score: 110][Risk Info: Found FTP username (hello)][TCP Fingerprint: 2_64_28800_83b2f9a5576c/Unknown][PLAIN TEXT (vsFTPd 3.0.3)][Plen Bins: 71,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out b/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out index f7aaa85b8..2772df259 100644 --- a/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out +++ b/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out @@ -41,6 +41,13 @@ Unsafe 36 2569 12 Dangerous 6 1377 3 Unrated 33 4066 33 +Unspecified 33 4066 33 +Media 5 1070 1 +Download 36 2569 12 +VoIP 82 37904 15 +Network 291 26520 156 +System 109 10824 29 + 1 UDP 212.242.33.35:5060 <-> 192.168.1.2:5060 [proto: 100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 100/SIP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][23 pkts/11772 bytes <-> 34 pkts/13107 bytes][Goodput ratio: 91/89][1521.43 sec][SIP From: <sip:voi18063@sip.cyQercity.dk>;tag=903df0a][SIP To: <sip:voi18063@sip.cybercity.dk.;tag=00-04092-1701af62-120c67172][bytes ratio: -0.054 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 13/227 35489/46479 167478/304738 41896/60093][Pkt Len c2s/s2c min/avg/max/stddev: 344/47 512/386 711/1118 86/355][PLAIN TEXT (SIP/2.0 401 Unauthorized)][Plen Bins: 29,0,0,0,0,0,0,0,0,3,7,0,3,7,8,14,1,0,3,0,1,14,0,0,0,3,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.2:5060 <-> 200.68.120.81:5060 [proto: 100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: VoIP/10][9 pkts/4647 bytes <-> 3 pkts/1944 bytes][Goodput ratio: 92/93][66.58 sec][SIP From: "arik" <sip:816666@voip.brurjula.net>;tag=6433ef9][SIP To: <sip:97239287044@voip.brujula.net>][bytes ratio: 0.410 (Upload)][IAT c2s/s2c min/avg/max/stddev: 507/34556 8170/34556 32608/34556 10578/0][Pkt Len c2s/s2c min/avg/max/stddev: 417/637 516/648 864/656 186/8][PLAIN TEXT (INVITEKsip)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,59,0,0,0,0,0,0,8,16,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.2:137 -> 192.168.1.255:137 [proto: 10/NetBIOS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 10/NetBIOS, Confidence: DPI][DPI packets: 1][cat: System/18][69 pkts/6348 bytes -> 0 pkts/0 bytes][Goodput ratio: 54/0][1527.12 sec][Hostname/SNI: eci_domain][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 741/0 21619/0 93225/0 24386/0][Pkt Len c2s/s2c min/avg/max/stddev: 92/0 92/0 92/0 0/0][PLAIN TEXT ( EFEDEJ)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out b/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out index 2277b3562..68dc16b32 100644 --- a/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out +++ b/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out @@ -32,6 +32,9 @@ HTTP 114 28288 36 Acceptable 114 28288 36 Unrated 3 655 3 +Unspecified 3 655 3 +Web 114 28288 36 + 1 TCP 172.20.3.13:80 <-> 172.20.3.5:2601 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 11][cat: Web/5][3 pkts/166 bytes <-> 8 pkts/6283 bytes][Goodput ratio: 0/93][11.25 sec][bytes ratio: -0.949 (Download)][IAT c2s/s2c min/avg/max/stddev: 104/0 5626/0 11147/0 5522/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 55/785 58/1514 2/725][Req Content-Type: application/vnd.wap.mms-message][User-Agent: SonyEricssonT68/R201A][PLAIN TEXT (POST /servlets/mms HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0] 2 TCP 172.20.3.5:2606 <-> 172.20.3.13:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 12][cat: Web/5][8 pkts/2287 bytes <-> 5 pkts/2963 bytes][Goodput ratio: 80/91][11.18 sec][Hostname/SNI: 172.20.3.13][bytes ratio: -0.129 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 58/58 177/172 83/81][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 286/593 1514/1514 478/662][URL: 172.20.3.13/servlets/mms?message-id=189301][Risk: ** HTTP Susp User-Agent **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 110][Risk Info: Found host 172.20.3.13 / Empty or missing User-Agent][TCP Fingerprint: 2_128_8192_6bbe28597824/Unknown][PLAIN TEXT (GET /servlets/mms)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,50,0,0] 3 TCP 172.20.3.5:2604 <-> 172.20.3.13:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][5 pkts/1754 bytes <-> 4 pkts/583 bytes][Goodput ratio: 83/62][11.17 sec][Hostname/SNI: 172.20.3.13][bytes ratio: 0.501 (Upload)][IAT c2s/s2c min/avg/max/stddev: 307/81 2793/3724 10864/10997 4662/5143][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 351/146 1514/417 582/157][URL: 172.20.3.13/servlets/mms?message-id=189001][StatusCode: 200][Server: Resin/2.0.1][User-Agent: SonyEricssonT68/R201A][Risk: ** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 10][Risk Info: Found host 172.20.3.13][TCP Fingerprint: 2_128_8192_6bbe28597824/Unknown][PLAIN TEXT (GET /servlets/mms)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0] diff --git a/tests/cfgs/default/result/fuzz-2020-02-16-11740.pcap.out b/tests/cfgs/default/result/fuzz-2020-02-16-11740.pcap.out index ae6ada395..76f98701c 100644 --- a/tests/cfgs/default/result/fuzz-2020-02-16-11740.pcap.out +++ b/tests/cfgs/default/result/fuzz-2020-02-16-11740.pcap.out @@ -32,6 +32,9 @@ Radius 279 134650 54 Acceptable 280 135375 55 Unrated 19 6603 19 +Unspecified 19 6603 19 +Network 280 135375 55 + 1 UDP 10.12.64.30:29200 <-> 198.226.25.53:1812 [proto: 146/Radius][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 146/Radius, Confidence: DPI][DPI packets: 1][cat: Network/14][104 pkts/75532 bytes <-> 96 pkts/22500 bytes][Goodput ratio: 93/82][2575.21 sec][bytes ratio: 0.541 (Upload)][IAT c2s/s2c min/avg/max/stddev: 21/154 27212/31886 612411/452627 80876/72012][Pkt Len c2s/s2c min/avg/max/stddev: 697/179 726/234 745/318 21/53][PLAIN TEXT (50311480271516480@wlan.mnc480.m)][Plen Bins: 0,0,0,0,13,13,10,0,12,0,0,0,0,0,0,0,0,0,0,0,14,36,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.12.64.30:29200 <-> 198.226.25.62:1812 [proto: 146/Radius][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 146/Radius, Confidence: DPI][DPI packets: 1][cat: Network/14][12 pkts/8682 bytes <-> 6 pkts/1365 bytes][Goodput ratio: 94/81][1507.26 sec][bytes ratio: 0.728 (Upload)][IAT c2s/s2c min/avg/max/stddev: 195/217 150274/201744 597367/597234 204869/243404][Pkt Len c2s/s2c min/avg/max/stddev: 660/165 724/228 745/318 27/65][PLAIN TEXT (50311480281501589@wlan.mnc480.m)][Plen Bins: 0,0,0,5,11,5,0,0,11,0,0,0,0,0,0,0,0,0,0,5,16,45,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.12.64.30:29200 <-> 198.226.25.53:1813 [proto: 146/Radius][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 146/Radius, Confidence: DPI][DPI packets: 1][cat: Network/14][6 pkts/3539 bytes <-> 4 pkts/620 bytes][Goodput ratio: 93/73][2002.35 sec][bytes ratio: 0.702 (Upload)][IAT c2s/s2c min/avg/max/stddev: 6131/15399 400469/467937 1165850/1229729 441254/541835][Pkt Len c2s/s2c min/avg/max/stddev: 251/147 590/155 876/179 230/14][PLAIN TEXT (50311480073638072@wlan.mnc400.m)][Plen Bins: 0,0,0,30,10,0,10,0,10,0,0,0,0,0,0,0,0,0,0,10,10,10,0,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out b/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out index ace19c667..301a4b42e 100644 --- a/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out +++ b/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out @@ -24,6 +24,8 @@ Unknown 1 197 1 Unrated 1 197 1 +Unspecified 1 197 1 + Undetected flows: diff --git a/tests/cfgs/default/result/gaijin_mobile_mixed.pcap.out b/tests/cfgs/default/result/gaijin_mobile_mixed.pcap.out index cd598e275..37911b514 100644 --- a/tests/cfgs/default/result/gaijin_mobile_mixed.pcap.out +++ b/tests/cfgs/default/result/gaijin_mobile_mixed.pcap.out @@ -25,6 +25,8 @@ GaijinEntertainment 18 10554 3 Fun 18 10554 3 +Game 18 10554 3 + JA Host Stats: IP Address # JA4C 1 10.215.173.1 2 diff --git a/tests/cfgs/default/result/gaijin_warthunder.pcap.out b/tests/cfgs/default/result/gaijin_warthunder.pcap.out index 9c7570e59..45049f1e7 100644 --- a/tests/cfgs/default/result/gaijin_warthunder.pcap.out +++ b/tests/cfgs/default/result/gaijin_warthunder.pcap.out @@ -24,5 +24,7 @@ GaijinEntertainment 10 1373 2 Fun 10 1373 2 +Game 10 1373 2 + 1 UDP 192.168.88.231:37333 -> 95.211.246.178:20011 [proto: 396/GaijinEntertainment][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 396/GaijinEntertainment, Confidence: DPI][DPI packets: 1][cat: Game/8][5 pkts/908 bytes -> 0 pkts/0 bytes][Goodput ratio: 77/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (app.start)][Plen Bins: 0,0,0,20,60,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.88.231:36929 <-> 185.253.20.249:20021 [proto: 396/GaijinEntertainment][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 396/GaijinEntertainment, Confidence: DPI][DPI packets: 1][cat: Game/8][3 pkts/315 bytes <-> 2 pkts/150 bytes][Goodput ratio: 60/38][0.05 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 20011][PLAIN TEXT (Steve Hurley)][Plen Bins: 40,40,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gearman.pcap.out b/tests/cfgs/default/result/gearman.pcap.out index 17453a42b..b9b92bb04 100644 --- a/tests/cfgs/default/result/gearman.pcap.out +++ b/tests/cfgs/default/result/gearman.pcap.out @@ -24,4 +24,6 @@ Gearman 8 494 1 Acceptable 8 494 1 +RPC 8 494 1 + 1 TCP 192.168.80.1:23405 <-> 192.168.80.128:4730 [proto: 394/Gearman][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][4 pkts/254 bytes <-> 4 pkts/240 bytes][Goodput ratio: 10/5][0.00 sec][bytes ratio: 0.028 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/1 0/2 0/1][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 64/60 68/66 6/6][TCP Fingerprint: 2_128_32768_5a9ef1c58d0b/Windows][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gearup_booster.pcap.out b/tests/cfgs/default/result/gearup_booster.pcap.out index 14bd5355c..9dc9057f2 100644 --- a/tests/cfgs/default/result/gearup_booster.pcap.out +++ b/tests/cfgs/default/result/gearup_booster.pcap.out @@ -29,6 +29,9 @@ GearUP_Booster 418 38397 191 Acceptable 424 41506 192 +VPN 418 38397 191 +Web 6 3109 1 + JA Host Stats: IP Address # JA4C 1 192.168.3.23 3 diff --git a/tests/cfgs/default/result/geforcenow.pcapng.out b/tests/cfgs/default/result/geforcenow.pcapng.out index 1a4bcd4b3..059c5a9c0 100644 --- a/tests/cfgs/default/result/geforcenow.pcapng.out +++ b/tests/cfgs/default/result/geforcenow.pcapng.out @@ -25,6 +25,8 @@ GeForceNow 108 69000 2 Fun 108 69000 2 +Game 108 69000 2 + JA Host Stats: IP Address # JA4C 1 192.168.1.245 2 diff --git a/tests/cfgs/default/result/genshin-impact.pcap.out b/tests/cfgs/default/result/genshin-impact.pcap.out index c3152540c..b77060656 100644 --- a/tests/cfgs/default/result/genshin-impact.pcap.out +++ b/tests/cfgs/default/result/genshin-impact.pcap.out @@ -25,6 +25,8 @@ GenshinImpact 90 18405 6 Fun 90 18405 6 +Game 90 18405 6 + 1 UDP 192.168.2.100:58766 <-> 47.245.143.85:22101 [proto: 257/GenshinImpact][IP: 274/Alibaba][ClearText][Confidence: DPI][FPC: 257/GenshinImpact, Confidence: DPI][DPI packets: 1][cat: Game/8][7 pkts/1369 bytes <-> 8 pkts/3568 bytes][Goodput ratio: 78/91][1.63 sec][bytes ratio: -0.445 (Download)][IAT c2s/s2c min/avg/max/stddev: 9/0 312/266 818/750 343/309][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 196/446 648/1223 192/449][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 22102][Plen Bins: 20,13,0,6,13,20,0,0,0,6,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,13,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:52575 <-> 8.209.69.191:22101 [proto: 257/GenshinImpact][IP: 274/Alibaba][ClearText][Confidence: DPI][FPC: 257/GenshinImpact, Confidence: DPI][DPI packets: 1][cat: Game/8][7 pkts/1975 bytes <-> 8 pkts/1300 bytes][Goodput ratio: 85/74][2.27 sec][bytes ratio: 0.206 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/10 409/181 1044/710 455/239][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 282/162 648/396 240/102][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 22102][Plen Bins: 20,26,0,6,0,20,6,0,0,0,0,6,0,0,0,0,0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.100:39686 <-> 49.51.181.168:80 [proto: 257/GenshinImpact][IP: 285/Tencent][ClearText][Confidence: DPI][FPC: 285/Tencent, Confidence: IP address][DPI packets: 4][cat: Game/8][9 pkts/2327 bytes <-> 6 pkts/535 bytes][Goodput ratio: 78/35][0.71 sec][bytes ratio: 0.626 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 76/88 176/176 86/87][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 259/89 1468/138 434/29][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (194946781)][Plen Bins: 0,50,25,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0] diff --git a/tests/cfgs/default/result/git.pcap.out b/tests/cfgs/default/result/git.pcap.out index bd84611b4..7254ec411 100644 --- a/tests/cfgs/default/result/git.pcap.out +++ b/tests/cfgs/default/result/git.pcap.out @@ -24,4 +24,6 @@ Git 90 74005 1 Safe 90 74005 1 +Collaborative 90 74005 1 + 1 TCP 192.168.0.77:47991 <-> 5.153.231.21:9418 [proto: 226/Git][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Collaborative/15][41 pkts/3319 bytes <-> 49 pkts/70686 bytes][Goodput ratio: 18/95][1.11 sec][bytes ratio: -0.910 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 31/25 558/607 98/96][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 81/1443 593/2946 82/706][TCP Fingerprint: 2_64_29200_d876f498b09e/Unknown][PLAIN TEXT (0045git)][Plen Bins: 4,0,2,0,0,0,2,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,75,0,12] diff --git a/tests/cfgs/default/result/glbp.pcapng.out b/tests/cfgs/default/result/glbp.pcapng.out index e40795242..2870a2022 100644 --- a/tests/cfgs/default/result/glbp.pcapng.out +++ b/tests/cfgs/default/result/glbp.pcapng.out @@ -24,6 +24,8 @@ GLBP 4 312 3 Acceptable 4 312 3 +Network 4 312 3 + 1 UDP 192.168.0.30:3222 <-> 192.168.0.10:3222 [proto: 452/GLBP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 452/GLBP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/74 bytes <-> 1 pkts/74 bytes][Goodput ratio: 43/43][0.01 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.0.10:3222 -> 224.0.0.102:3222 [proto: 452/GLBP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 452/GLBP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/82 bytes -> 0 pkts/0 bytes][Goodput ratio: 48/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.0.30:3222 -> 224.0.0.102:3222 [proto: 452/GLBP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 452/GLBP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/82 bytes -> 0 pkts/0 bytes][Goodput ratio: 48/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gnutella.pcap.out b/tests/cfgs/default/result/gnutella.pcap.out index e407fe0ce..6ab3b774d 100644 --- a/tests/cfgs/default/result/gnutella.pcap.out +++ b/tests/cfgs/default/result/gnutella.pcap.out @@ -45,6 +45,13 @@ Potentially_Dangerous 3374 495188 634 Dangerous 5 1215 1 Unrated 298 19232 86 +Unspecified 298 19232 86 +Media 21 10027 2 +Web 21 4395 1 +Download 3353 485161 632 +Network 123 46960 29 +System 66 11715 10 + JA Host Stats: IP Address # JA4C 1 10.0.2.15 1 diff --git a/tests/cfgs/default/result/google_chat.pcapng.out b/tests/cfgs/default/result/google_chat.pcapng.out index 577bcbc04..99739cf8a 100644 --- a/tests/cfgs/default/result/google_chat.pcapng.out +++ b/tests/cfgs/default/result/google_chat.pcapng.out @@ -24,6 +24,8 @@ GoogleChat 6 3875 1 Acceptable 6 3875 1 +Chat 6 3875 1 + JA Host Stats: IP Address # JA4C 1 192.168.88.231 1 diff --git a/tests/cfgs/default/result/google_meet.pcapng.out b/tests/cfgs/default/result/google_meet.pcapng.out index ea1cd265f..1d57ee79e 100644 --- a/tests/cfgs/default/result/google_meet.pcapng.out +++ b/tests/cfgs/default/result/google_meet.pcapng.out @@ -25,6 +25,8 @@ GoogleMeet 12 8888 2 Acceptable 12 8888 2 +Chat 12 8888 2 + JA Host Stats: IP Address # JA4C 1 192.168.88.231 2 diff --git a/tests/cfgs/default/result/google_ssl.pcap.out b/tests/cfgs/default/result/google_ssl.pcap.out index 82ebc4397..5d7960a2e 100644 --- a/tests/cfgs/default/result/google_ssl.pcap.out +++ b/tests/cfgs/default/result/google_ssl.pcap.out @@ -26,4 +26,6 @@ TLS 28 9108 1 Safe 28 9108 1 +Web 28 9108 1 + 1 TCP 172.31.3.224:42835 <-> 216.58.212.100:443 [proto: 91/TLS][IP: 126/Google][Encrypted][Confidence: Match by port][FPC: 126/Google, Confidence: IP address][DPI packets: 22][cat: Web/5][16 pkts/1512 bytes <-> 12 pkts/7596 bytes][Goodput ratio: 43/91][6.67 sec][bytes ratio: -0.668 (Download)][IAT c2s/s2c min/avg/max/stddev: 76/66 422/544 1185/1213 376/402][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 94/633 368/1484 87/622][TCP Fingerprint: 2_64_5840_6bbe28597824/Unknown][Plen Bins: 8,8,0,8,0,8,0,0,0,25,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0] diff --git a/tests/cfgs/default/result/googledns_android10.pcap.out b/tests/cfgs/default/result/googledns_android10.pcap.out index 1b27cc053..b68190b89 100644 --- a/tests/cfgs/default/result/googledns_android10.pcap.out +++ b/tests/cfgs/default/result/googledns_android10.pcap.out @@ -29,6 +29,8 @@ DoH_DoT 528 132502 7 Acceptable 532 132894 8 +Network 532 132894 8 + JA Host Stats: IP Address # JA4C 1 192.168.1.159 2 diff --git a/tests/cfgs/default/result/gquic.pcap.out b/tests/cfgs/default/result/gquic.pcap.out index 41a012eca..c196b0a7f 100644 --- a/tests/cfgs/default/result/gquic.pcap.out +++ b/tests/cfgs/default/result/gquic.pcap.out @@ -24,4 +24,6 @@ Google 1 1392 1 Acceptable 1 1392 1 +Web 1 1392 1 + 1 UDP 10.44.5.25:61097 -> 216.58.213.163:443 [proto: 188.126/QUIC.Google][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 188.126/QUIC.Google, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/1392 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Hostname/SNI: www.gstatic.com][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][QUIC ver: Q050][Idle Timeout: 30][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gquic_only_from_server.pcap.out b/tests/cfgs/default/result/gquic_only_from_server.pcap.out index 9181be424..c0b7706be 100644 --- a/tests/cfgs/default/result/gquic_only_from_server.pcap.out +++ b/tests/cfgs/default/result/gquic_only_from_server.pcap.out @@ -24,4 +24,6 @@ QUIC 30 39740 1 Acceptable 30 39740 1 +Web 30 39740 1 + 1 UDP 213.202.7.26:443 -> 10.189.122.71:60524 [VLAN: 1508][proto: 188/QUIC][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 1][cat: Web/5][30 pkts/39740 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][0.09 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 3/0 59/0 11/0][Pkt Len c2s/s2c min/avg/max/stddev: 69/0 1325/0 1396/0 275/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][PLAIN TEXT (AESGCC20)][Plen Bins: 3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,93,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gre.pcapng.out b/tests/cfgs/default/result/gre.pcapng.out index f85bb718a..01308fcee 100644 --- a/tests/cfgs/default/result/gre.pcapng.out +++ b/tests/cfgs/default/result/gre.pcapng.out @@ -24,4 +24,6 @@ SIP 1 384 1 Acceptable 1 384 1 +VoIP 1 384 1 + 1 UDP 192.168.10.210:5060 -> 192.168.103.40:5060 [VLAN: 142][proto: GRE:100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 100/SIP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][1 pkts/384 bytes -> 0 pkts/0 bytes][Goodput ratio: 77/0][< 1 sec][SIP From: <sip:281@192.168.103.40>;tag=AICCF805E578CE6403][SIP To: <sip:271@192.168.10.210>][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (SIP/2.0 100 Trying)][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gtp.pcap.out b/tests/cfgs/default/result/gtp.pcap.out index 9ce2ae5c4..19b0ffeb7 100644 --- a/tests/cfgs/default/result/gtp.pcap.out +++ b/tests/cfgs/default/result/gtp.pcap.out @@ -24,6 +24,8 @@ GTP_U 7 438 6 Acceptable 7 438 6 +Network 7 438 6 + 1 UDP 10.132.109.23:2152 <-> 10.238.71.40:2152 [VLAN: 808][proto: 152.271/GTP.GTP_U][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 152.271/GTP.GTP_U, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/78 bytes <-> 1 pkts/60 bytes][Goodput ratio: 41/13][585.72 sec][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.132.76.6:2152 -> 10.238.71.40:2152 [VLAN: 808][proto: 152.271/GTP.GTP_U][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 152.271/GTP.GTP_U, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/60 bytes -> 0 pkts/0 bytes][Goodput ratio: 20/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.238.19.137:2152 -> 10.238.71.40:2152 [VLAN: 508][proto: 152.271/GTP.GTP_U][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 152.271/GTP.GTP_U, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/60 bytes -> 0 pkts/0 bytes][Goodput ratio: 20/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gtp_c.pcap.out b/tests/cfgs/default/result/gtp_c.pcap.out index 5460d62e0..c3f7664c2 100644 --- a/tests/cfgs/default/result/gtp_c.pcap.out +++ b/tests/cfgs/default/result/gtp_c.pcap.out @@ -24,4 +24,6 @@ GTP_C 4 684 1 Acceptable 4 684 1 +Network 4 684 1 + 1 UDP 10.101.0.2:1024 <-> 10.102.0.2:2123 [proto: 152.272/GTP.GTP_C][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 152.272/GTP.GTP_C, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/365 bytes <-> 2 pkts/319 bytes][Goodput ratio: 77/73][0.00 sec][PLAIN TEXT (internet)][Plen Bins: 25,25,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gtp_false_positive.pcapng.out b/tests/cfgs/default/result/gtp_false_positive.pcapng.out index 17a8d537f..504b91f3c 100644 --- a/tests/cfgs/default/result/gtp_false_positive.pcapng.out +++ b/tests/cfgs/default/result/gtp_false_positive.pcapng.out @@ -29,6 +29,9 @@ GTP 2 424 2 Acceptable 2 424 2 Unrated 5 428 1 +Unspecified 5 428 1 +Network 2 424 2 + 1 UDP 119.185.190.173:2123 -> 66.86.98.114:50140 [proto: 152/GTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Network/14][1 pkts/368 bytes -> 0 pkts/0 bytes][Goodput ratio: 88/0][< 1 sec][Risk: ** Susp Entropy **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Entropy: 6.121 (Executable?)][PLAIN TEXT (autoAlgo)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 50.7.111.134:17000 -> 103.225.103.159:2123 [proto: 152/GTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Network/14][1 pkts/56 bytes -> 0 pkts/0 bytes][Goodput ratio: 14/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/gtp_prime.pcapng.out b/tests/cfgs/default/result/gtp_prime.pcapng.out index 24b940d10..215e3e88e 100644 --- a/tests/cfgs/default/result/gtp_prime.pcapng.out +++ b/tests/cfgs/default/result/gtp_prime.pcapng.out @@ -24,4 +24,6 @@ GTP_PRIME 1 300 1 Acceptable 1 300 1 +Network 1 300 1 + 1 UDP 10.10.54.1:64580 -> 10.10.39.10:3386 [VLAN: 103][proto: 152.273/GTP.GTP_PRIME][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 152.273/GTP.GTP_PRIME, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/300 bytes -> 0 pkts/0 bytes][Goodput ratio: 83/0][< 1 sec][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 2152,2123][PLAIN TEXT (NODE01)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/guildwars2.pcapng.out b/tests/cfgs/default/result/guildwars2.pcapng.out index 4aeed767d..c90a82311 100644 --- a/tests/cfgs/default/result/guildwars2.pcapng.out +++ b/tests/cfgs/default/result/guildwars2.pcapng.out @@ -24,4 +24,6 @@ GuildWars2 28 3895 1 Fun 28 3895 1 +Game 28 3895 1 + 1 TCP 192.168.1.17:33959 <-> 3.64.34.254:6112 [proto: 109/GuildWars2][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Game/8][15 pkts/1798 bytes <-> 13 pkts/2097 bytes][Goodput ratio: 44/59][3.15 sec][bytes ratio: -0.077 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 258/307 2662/2633 730/779][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 120/161 351/921 82/224][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (P /Sts/Connect STS/1.0)][Plen Bins: 25,31,12,0,6,12,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/h323-overflow.pcap.out b/tests/cfgs/default/result/h323-overflow.pcap.out index 38aac7fd0..a1242ae81 100644 --- a/tests/cfgs/default/result/h323-overflow.pcap.out +++ b/tests/cfgs/default/result/h323-overflow.pcap.out @@ -24,6 +24,8 @@ Unknown 1 58 1 Unrated 1 58 1 +Unspecified 1 58 1 + Undetected flows: diff --git a/tests/cfgs/default/result/h323.pcap.out b/tests/cfgs/default/result/h323.pcap.out index e77d33ea5..af4701a35 100644 --- a/tests/cfgs/default/result/h323.pcap.out +++ b/tests/cfgs/default/result/h323.pcap.out @@ -25,6 +25,8 @@ H323 75 7998 6 Acceptable 75 7998 6 +VoIP 75 7998 6 + 1 TCP 10.1.3.143:32803 <-> 10.1.6.18:1720 [proto: 158/H323][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: VoIP/10][11 pkts/934 bytes <-> 10 pkts/1018 bytes][Goodput ratio: 34/44][1.05 sec][bytes ratio: -0.043 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 103/149 627/627 206/209][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 85/102 214/151 61/35][TCP Fingerprint: 2_64_5840_615eac77f548/Unknown][PLAIN TEXT (m.jemec)][Plen Bins: 0,0,50,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.47.208.204:1719 <-> 10.47.208.50:1719 [proto: 158/H323][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 158/H323, Confidence: DPI][DPI packets: 1][cat: VoIP/10][3 pkts/1137 bytes <-> 2 pkts/592 bytes][Goodput ratio: 89/86][60.24 sec][PLAIN TEXT (Tandberg)][Plen Bins: 0,0,0,0,0,0,0,40,0,0,60,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 17.2.0.124:2034 <-> 17.2.0.161:1719 [proto: 158/H323][IP: 140/Apple][ClearText][Confidence: DPI][FPC: 158/H323, Confidence: DPI][DPI packets: 1][cat: VoIP/10][3 pkts/665 bytes <-> 7 pkts/853 bytes][Goodput ratio: 81/65][80.21 sec][bytes ratio: -0.124 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 247/336 288/13362 330/70142 42/25418][Pkt Len c2s/s2c min/avg/max/stddev: 80/67 222/122 411/176 139/48][PLAIN TEXT (@333333330)][Plen Bins: 20,20,10,10,30,0,0,0,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hamachi.pcapng.out b/tests/cfgs/default/result/hamachi.pcapng.out index 77a92cb09..1e98223bf 100644 --- a/tests/cfgs/default/result/hamachi.pcapng.out +++ b/tests/cfgs/default/result/hamachi.pcapng.out @@ -25,6 +25,8 @@ Hamachi 18 2896 3 Acceptable 18 2896 3 +VPN 18 2896 3 + JA Host Stats: IP Address # JA4C 1 192.168.1.30 1 diff --git a/tests/cfgs/default/result/haproxy.pcap.out b/tests/cfgs/default/result/haproxy.pcap.out index d1ede6405..040f4468a 100644 --- a/tests/cfgs/default/result/haproxy.pcap.out +++ b/tests/cfgs/default/result/haproxy.pcap.out @@ -24,4 +24,6 @@ HAProxy 1 375 1 Safe 1 375 1 +Web 1 375 1 + 1 TCP 1.1.1.1:48502 -> 2.2.2.2:443 [proto: 350/HAProxy][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 350/HAProxy, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/375 bytes -> 0 pkts/0 bytes][Goodput ratio: 82/0][< 1 sec][Risk: ** Susp Entropy **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Entropy: 5.968 (Executable?)][PLAIN TEXT (PROXY TCP)][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hart_ip.pcap.out b/tests/cfgs/default/result/hart_ip.pcap.out index 1eb4d9fc8..151409bf8 100644 --- a/tests/cfgs/default/result/hart_ip.pcap.out +++ b/tests/cfgs/default/result/hart_ip.pcap.out @@ -25,6 +25,8 @@ HART-IP 65 4413 3 Acceptable 65 4413 3 +IoT-Scada 65 4413 3 + 1 TCP 192.168.0.101:49559 <-> 192.168.0.10:5094 [proto: 72/HART-IP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][27 pkts/1652 bytes <-> 14 pkts/1156 bytes][Goodput ratio: 11/33][34.10 sec][bytes ratio: 0.177 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/6 1547/3394 30003/30004 6255/8934][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 61/83 75/110 8/16][TCP Fingerprint: 2_64_5840_488af9f42101/Unknown][PLAIN TEXT (wihartgw)][Plen Bins: 70,29,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.0.10:5095 <-> 192.168.0.101:49905 [proto: 72/HART-IP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 72/HART-IP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][12 pkts/915 bytes <-> 11 pkts/635 bytes][Goodput ratio: 42/27][34.71 sec][bytes ratio: 0.181 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 46/51 516/3796 4241/30007 1317/9907][Pkt Len c2s/s2c min/avg/max/stddev: 60/50 76/58 98/63 13/4][PLAIN TEXT (wihartgw)][Plen Bins: 69,30,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.0.101:49905 -> 192.168.0.10:5094 [proto: 72/HART-IP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 72/HART-IP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/55 bytes -> 0 pkts/0 bytes][Goodput ratio: 23/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hcl_notes.pcapng.out b/tests/cfgs/default/result/hcl_notes.pcapng.out index 8672fb63b..421d82f9f 100644 --- a/tests/cfgs/default/result/hcl_notes.pcapng.out +++ b/tests/cfgs/default/result/hcl_notes.pcapng.out @@ -24,4 +24,6 @@ HCL_Notes 7 1528 1 Acceptable 7 1528 1 +Collaborative 7 1528 1 + 1 TCP 192.168.1.31:49779 <-> 192.168.1.30:1352 [proto: 150/HCL_Notes][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Collaborative/15][4 pkts/832 bytes <-> 3 pkts/696 bytes][Goodput ratio: 73/75][0.01 sec][bytes ratio: 0.089 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 4/7 13/13 6/6][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 208/232 440/450 160/161][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (TestServer/O)][Plen Bins: 0,0,0,25,0,0,25,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/heuristic_tcp_ack_payload.pcap.out b/tests/cfgs/default/result/heuristic_tcp_ack_payload.pcap.out index df5c4aef8..54bac6438 100644 --- a/tests/cfgs/default/result/heuristic_tcp_ack_payload.pcap.out +++ b/tests/cfgs/default/result/heuristic_tcp_ack_payload.pcap.out @@ -29,6 +29,10 @@ Safe 137 38048 4 Acceptable 78 40807 1 Fun 88 34448 1 +Web 196 76217 4 +SocialNetwork 88 34448 1 +SoftwareUpdate 19 2638 1 + JA Host Stats: IP Address # JA4C 1 194.226.199.103 1 diff --git a/tests/cfgs/default/result/hislip.pcap.out b/tests/cfgs/default/result/hislip.pcap.out index a0f6638bd..f1b927887 100644 --- a/tests/cfgs/default/result/hislip.pcap.out +++ b/tests/cfgs/default/result/hislip.pcap.out @@ -24,6 +24,8 @@ HiSLIP 184 12204 4 Acceptable 184 12204 4 +IoT-Scada 184 12204 4 + 1 TCP 10.64.0.127:51056 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][39 pkts/2432 bytes <-> 23 pkts/1584 bytes][Goodput ratio: 12/20][214.30 sec][bytes ratio: 0.211 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 5039/8986 25879/26093 6570/7043][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 62/69 108/78 11/4][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (582390DAF)][Plen Bins: 97,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.64.0.127:51055 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][27 pkts/1765 bytes <-> 20 pkts/1466 bytes][Goodput ratio: 14/23][214.32 sec][bytes ratio: 0.093 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9060/14014 30021/30224 11869/12472][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 65/73 80/95 11/13][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (Query INTERRUPTED)][Plen Bins: 88,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.64.0.127:51054 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][23 pkts/1460 bytes <-> 16 pkts/1064 bytes][Goodput ratio: 11/15][246.85 sec][bytes ratio: 0.157 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9131/16221 30014/30221 11397/11595][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 63/66 108/78 12/6][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (582390DAF)][Plen Bins: 95,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hl7.pcap.out b/tests/cfgs/default/result/hl7.pcap.out index 4595bf11d..c6aff40e1 100644 --- a/tests/cfgs/default/result/hl7.pcap.out +++ b/tests/cfgs/default/result/hl7.pcap.out @@ -24,6 +24,8 @@ HL7 47 7319 3 Acceptable 47 7319 3 +Health 47 7319 3 + 1 TCP 10.0.0.155:49242 <-> 10.0.0.126:6661 [proto: 380/HL7][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: Health/108][15 pkts/2331 bytes <-> 12 pkts/1188 bytes][Goodput ratio: 61/42][0.04 sec][bytes ratio: 0.325 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 3/3 31/11 9/5][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 155/99 531/222 188/71][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 2575][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (SENDING)][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.0.0.155:49252 <-> 10.0.0.126:6661 [proto: 380/HL7][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Health/108][6 pkts/2133 bytes <-> 5 pkts/404 bytes][Goodput ratio: 83/30][0.03 sec][bytes ratio: 0.682 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/4 6/8 20/15 8/5][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 356/81 1514/176 530/48][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 2575][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (SendingApp)][Plen Bins: 0,0,0,33,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0] 3 TCP 10.0.0.155:49250 <-> 10.0.0.126:6661 [proto: 380/HL7][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Health/108][5 pkts/913 bytes <-> 4 pkts/350 bytes][Goodput ratio: 67/35][0.02 sec][bytes ratio: 0.446 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/4 4/9 17/14 7/5][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 183/88 667/176 242/51][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 2575][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (SendingApp)][Plen Bins: 0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hls.pcapng.out b/tests/cfgs/default/result/hls.pcapng.out index 6fcc12f39..8358b3e61 100644 --- a/tests/cfgs/default/result/hls.pcapng.out +++ b/tests/cfgs/default/result/hls.pcapng.out @@ -24,4 +24,6 @@ HLS 13 1019 1 Fun 13 1019 1 +Web 13 1019 1 + 1 TCP 10.215.173.1:41644 <-> 192.168.88.231:8080 [proto: 7.418/HTTP.HLS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][7 pkts/448 bytes <-> 6 pkts/571 bytes][Goodput ratio: 33/56][5.34 sec][Hostname/SNI: 192.168.88.231][bytes ratio: -0.121 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1060/0 5298/1 2119/0][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 64/95 188/246 51/80][URL: 192.168.88.231:8080/output.m3u8][StatusCode: 200][Content-Type: application/vnd.apple.mpegurl][Server: SimpleHTTP/0.6 Python/3.11.4][User-Agent: VLC/3.0.18 LibVLC/3.0.18][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 60][Risk Info: Found host 192.168.88.231 / Expected on port 80][TCP Fingerprint: 2_64_65535_b8d6cf600040/Unknown][PLAIN TEXT (GET /output.m)][Plen Bins: 0,0,0,33,33,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hots.pcapng.out b/tests/cfgs/default/result/hots.pcapng.out index 51227bf3a..67fb05ec8 100644 --- a/tests/cfgs/default/result/hots.pcapng.out +++ b/tests/cfgs/default/result/hots.pcapng.out @@ -24,6 +24,8 @@ Heroes_of_the_Storm 100 10145 3 Fun 100 10145 3 +Game 100 10145 3 + 1 UDP 24.105.57.16:3724 -> 192.168.0.73:50609 [proto: 336/Heroes_of_the_Storm][IP: 213/Blizzard][ClearText][Confidence: DPI][FPC: 336/Heroes_of_the_Storm, Confidence: DPI][DPI packets: 1][cat: Game/8][40 pkts/4753 bytes -> 0 pkts/0 bytes][Goodput ratio: 65/0][1.26 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 32/0 62/0 18/0][Pkt Len c2s/s2c min/avg/max/stddev: 62/0 119/0 164/0 34/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 22,0,47,30,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 24.105.57.183:1119 -> 192.168.0.73:50609 [proto: 336/Heroes_of_the_Storm][IP: 213/Blizzard][ClearText][Confidence: DPI][FPC: 336/Heroes_of_the_Storm, Confidence: DPI][DPI packets: 1][cat: Game/8][25 pkts/2978 bytes -> 0 pkts/0 bytes][Goodput ratio: 65/0][0.94 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 6/0 38/0 63/0 22/0][Pkt Len c2s/s2c min/avg/max/stddev: 62/0 119/0 158/0 21/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 4,24,40,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.0.73:54598 <-> 24.105.56.13:3724 [proto: 336/Heroes_of_the_Storm][IP: 213/Blizzard][ClearText][Confidence: DPI][FPC: 336/Heroes_of_the_Storm, Confidence: DPI][DPI packets: 1][cat: Game/8][14 pkts/908 bytes <-> 21 pkts/1506 bytes][Goodput ratio: 35/41][92.43 sec][bytes ratio: -0.248 (Download)][IAT c2s/s2c min/avg/max/stddev: 3/17 42/51 66/63 22/16][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 65/72 66/74 2/5][Plen Bins: 51,48,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hpvirtgrp.pcap.out b/tests/cfgs/default/result/hpvirtgrp.pcap.out index 89d4504f3..23a5e3926 100644 --- a/tests/cfgs/default/result/hpvirtgrp.pcap.out +++ b/tests/cfgs/default/result/hpvirtgrp.pcap.out @@ -24,6 +24,8 @@ HP_VIRTGRP 135 12739 9 Acceptable 135 12739 9 +Network 135 12739 9 + 1 TCP 192.168.2.100:40152 <-> 160.44.194.66:5223 [proto: 256/HP_VIRTGRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][7 pkts/1019 bytes <-> 8 pkts/613 bytes][Goodput ratio: 61/26][1.18 sec][bytes ratio: 0.249 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 92/192 380/409 144/135][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 146/77 217/106 74/17][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 0,50,0,0,12,37,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.2.100:35634 <-> 160.44.194.66:5223 [proto: 256/HP_VIRTGRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][8 pkts/945 bytes <-> 7 pkts/524 bytes][Goodput ratio: 52/23][233.89 sec][bytes ratio: 0.287 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/0 38973/46772 233376/233402 86940/93315][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 118/75 217/106 70/18][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 0,57,0,0,14,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.100:49838 <-> 160.44.194.66:5223 [proto: 256/HP_VIRTGRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Network/14][9 pkts/1019 bytes <-> 6 pkts/435 bytes][Goodput ratio: 48/20][129.59 sec][bytes ratio: 0.402 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 18430/32235 128357/128902 44878/55811][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 113/72 217/106 68/18][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 0,50,0,0,16,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hsrp0.pcap.out b/tests/cfgs/default/result/hsrp0.pcap.out index 025b585c1..6c6de5c0a 100644 --- a/tests/cfgs/default/result/hsrp0.pcap.out +++ b/tests/cfgs/default/result/hsrp0.pcap.out @@ -24,6 +24,8 @@ HSRP 4 264 4 Acceptable 4 264 4 +Network 4 264 4 + 1 UDP 10.28.168.252:1985 -> 224.0.0.2:1985 [VLAN: 10][proto: 282/HSRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 282/HSRP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/66 bytes -> 0 pkts/0 bytes][Goodput ratio: 30/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.28.168.253:1985 -> 224.0.0.2:1985 [VLAN: 10][proto: 282/HSRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 282/HSRP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/66 bytes -> 0 pkts/0 bytes][Goodput ratio: 30/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.28.170.253:1985 -> 224.0.0.2:1985 [VLAN: 12][proto: 282/HSRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 282/HSRP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/66 bytes -> 0 pkts/0 bytes][Goodput ratio: 30/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hsrp2.pcap.out b/tests/cfgs/default/result/hsrp2.pcap.out index 01d66bf6e..3e47f54e2 100644 --- a/tests/cfgs/default/result/hsrp2.pcap.out +++ b/tests/cfgs/default/result/hsrp2.pcap.out @@ -24,5 +24,7 @@ HSRP 2 188 2 Acceptable 2 188 2 +Network 2 188 2 + 1 UDP 10.52.220.125:1985 -> 224.0.0.102:1985 [proto: 282/HSRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 282/HSRP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 55/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.52.253.125:1985 -> 224.0.0.102:1985 [proto: 282/HSRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 282/HSRP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 55/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/hsrp2_ipv6.pcapng.out b/tests/cfgs/default/result/hsrp2_ipv6.pcapng.out index 78314ecf2..fb81caafa 100644 --- a/tests/cfgs/default/result/hsrp2_ipv6.pcapng.out +++ b/tests/cfgs/default/result/hsrp2_ipv6.pcapng.out @@ -24,5 +24,7 @@ HSRP 36 4374 2 Acceptable 36 4374 2 +Network 36 4374 2 + 1 UDP [fe80::1]:2029 -> [ff02::66]:2029 [VLAN: 16][proto: 282/HSRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 282/HSRP, Confidence: DPI][DPI packets: 1][cat: Network/14][18 pkts/2286 bytes -> 0 pkts/0 bytes][Goodput ratio: 48/0][138.56 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8110/0 21092/0 4624/0][Pkt Len c2s/s2c min/avg/max/stddev: 72/0 127/0 138/0 25/0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 1985][Plen Bins: 16,0,83,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP [fe80::2]:2029 -> [ff02::66]:2029 [VLAN: 16][proto: 282/HSRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 282/HSRP, Confidence: DPI][DPI packets: 1][cat: Network/14][18 pkts/2088 bytes -> 0 pkts/0 bytes][Goodput ratio: 43/0][131.58 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 73/0 7611/0 21554/0 5305/0][Pkt Len c2s/s2c min/avg/max/stddev: 72/0 116/0 138/0 31/0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 1985][Plen Bins: 33,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http-basic-auth.pcap.out b/tests/cfgs/default/result/http-basic-auth.pcap.out index fe6beb928..ecebeb17c 100644 --- a/tests/cfgs/default/result/http-basic-auth.pcap.out +++ b/tests/cfgs/default/result/http-basic-auth.pcap.out @@ -27,6 +27,8 @@ HTTP 688 353898 25 Acceptable 688 353898 25 +Web 688 353898 25 + 1 TCP 192.168.0.4:54340 <-> 192.254.189.169:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][58 pkts/9591 bytes <-> 74 pkts/74782 bytes][Goodput ratio: 60/93][20.90 sec][Username: test][Password: test][Hostname/SNI: browserspy.dk][bytes ratio: -0.773 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 397/166 4647/4811 1045/722][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 165/1011 805/1514 248/628][URL: browserspy.dk/theme/default.css][StatusCode: 304][Server: Apache][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36][Risk: ** Clear-Text Credentials **][Risk Score: 100][Risk Info: Found credentials in HTTP Auth Line][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (GET /theme/default.css HTTP/1.1)][Plen Bins: 0,0,5,0,4,0,4,2,2,2,0,1,0,0,0,0,0,2,1,0,0,0,8,2,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,63,0,0] 2 TCP 192.168.0.4:54338 <-> 192.254.189.169:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: Web/5][31 pkts/4999 bytes <-> 40 pkts/37974 bytes][Goodput ratio: 59/93][17.45 sec][Username: test][Password: fail3][Hostname/SNI: browserspy.dk][bytes ratio: -0.767 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 716/350 5396/5591 1514/1171][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 161/949 805/1514 246/645][URL: browserspy.dk/password-ok.php][StatusCode: 401][Content-Type: text/html][Server: Apache][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36][Risk: ** Clear-Text Credentials **** Error Code **][Risk Score: 110][Risk Info: HTTP Error Code 401 / Found credentials in HTTP Auth Line][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (GET /password)][Plen Bins: 0,0,5,0,5,0,5,0,2,2,0,0,0,0,0,2,0,0,0,2,0,0,5,5,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,62,0,0] 3 TCP 192.168.0.4:54584 <-> 192.254.189.169:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][27 pkts/3947 bytes <-> 36 pkts/37139 bytes][Goodput ratio: 55/94][15.57 sec][Username: test][Password: test][Hostname/SNI: browserspy.dk][bytes ratio: -0.808 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 502/211 4249/2440 1050/592][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 146/1032 797/1514 225/628][URL: browserspy.dk/pics/logo.png][StatusCode: 304][Server: Apache][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36][Risk: ** Clear-Text Credentials **][Risk Score: 100][Risk Info: Found credentials in HTTP Auth Line][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (GET /pics/logo.png HTTP/1.1)][Plen Bins: 0,0,6,0,3,0,3,0,3,0,0,0,0,0,0,0,0,3,0,0,0,0,12,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0] diff --git a/tests/cfgs/default/result/http-crash-content-disposition.pcap.out b/tests/cfgs/default/result/http-crash-content-disposition.pcap.out index b75900e59..a2ad1875b 100644 --- a/tests/cfgs/default/result/http-crash-content-disposition.pcap.out +++ b/tests/cfgs/default/result/http-crash-content-disposition.pcap.out @@ -24,4 +24,6 @@ HTTP 9 3328 1 Acceptable 9 3328 1 +Web 9 3328 1 + 1 TCP 192.168.0.103:51171 <-> 174.129.0.10:80 [proto: 7/HTTP][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 8][cat: Web/5][4 pkts/691 bytes <-> 5 pkts/2637 bytes][Goodput ratio: 69/90][0.31 sec][Hostname/SNI: khu.sh][bytes ratio: -0.585 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 48/50 125/145 55/59][Pkt Len c2s/s2c min/avg/max/stddev: 52/52 173/527 480/1492 178/601][URL: khu.sh/imessages.php?songify_a=3h248fIbwJ&new][StatusCode: 200][Req Content-Type: text/plain][Content-Type: text/html][Server: nginx][User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)][TCP Fingerprint: 2_64_14600_8c07a80cc645/Linux][PLAIN TEXT (POST /imessages.php)][Plen Bins: 0,25,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0] diff --git a/tests/cfgs/default/result/http-lines-split.pcap.out b/tests/cfgs/default/result/http-lines-split.pcap.out index 54bf3ebe0..36758f3ed 100644 --- a/tests/cfgs/default/result/http-lines-split.pcap.out +++ b/tests/cfgs/default/result/http-lines-split.pcap.out @@ -24,4 +24,6 @@ HTTP 14 2503 1 Acceptable 14 2503 1 +Web 14 2503 1 + 1 TCP 192.168.0.1:39236 <-> 192.168.0.20:31337 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: Web/5][7 pkts/481 bytes <-> 7 pkts/2022 bytes][Goodput ratio: 14/81][0.00 sec][Hostname/SNI: toni.lan][bytes ratio: -0.616 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/1 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 69/289 92/1514 12/503][URL: toni.lan:31337/][StatusCode: 200][User-Agent: uclient-fetch][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 80][TCP Fingerprint: 2_128_64240_488af9f42101/Unknown][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 40,20,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0] diff --git a/tests/cfgs/default/result/http-manipulated.pcap.out b/tests/cfgs/default/result/http-manipulated.pcap.out index 9ac75aa6e..b78cf0172 100644 --- a/tests/cfgs/default/result/http-manipulated.pcap.out +++ b/tests/cfgs/default/result/http-manipulated.pcap.out @@ -24,5 +24,7 @@ HTTP 40 45063 2 Acceptable 40 45063 2 +Web 40 45063 2 + 1 TCP 192.168.0.20:33684 <-> 192.168.0.7:8080 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][15 pkts/1543 bytes <-> 15 pkts/42291 bytes][Goodput ratio: 47/98][0.07 sec][Hostname/SNI: www.lan][bytes ratio: -0.930 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/6 72/73 20/20][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 103/2819 440/5894 123/2007][URL: www.lan:8080/aaaaaaaaaaaaaaaaaaaaaaaa_very_long_uri][StatusCode: 200][Content-Type: text/html][Server: gamma_httpd][User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:81.0) Gecko/20100101 Firefox/81.0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 80][TCP Fingerprint: 2_192_64240_565ad129ac37/Unknown][PLAIN TEXT (GET /aaaaaaaaa)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,7,0,7,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,64] 2 TCP 192.168.0.20:33632 <-> 192.168.0.7:8080 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][6 pkts/412 bytes <-> 4 pkts/817 bytes][Goodput ratio: 18/71][0.00 sec][Hostname/SNI: wwww.lan][bytes ratio: -0.330 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 69/204 130/631 28/246][URL: wwww.lan:8080/][StatusCode: 200][Content-Type: text/html][Server: gamma_httpd][User-Agent: curl/7.64.0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 80][TCP Fingerprint: 2_192_64240_565ad129ac37/Unknown][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http-proxy.pcapng.out b/tests/cfgs/default/result/http-proxy.pcapng.out index c14f4ccde..46366a96d 100644 --- a/tests/cfgs/default/result/http-proxy.pcapng.out +++ b/tests/cfgs/default/result/http-proxy.pcapng.out @@ -24,4 +24,6 @@ HTTP_Proxy 11 1652 1 Acceptable 11 1652 1 +Web 11 1652 1 + 1 TCP 192.168.1.103:1241 <-> 192.168.1.146:8080 [proto: 131/HTTP_Proxy][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][6 pkts/654 bytes <-> 5 pkts/998 bytes][Goodput ratio: 45/72][5.24 sec][Hostname/SNI: http.com][bytes ratio: -0.208 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/2 1048/118 4958/234 1958/116][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 109/200 348/770 107/285][URL: http://http.com/][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.41 (Ubuntu)][User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 5.285 (Executable?)][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (GET http)][Plen Bins: 0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http-pwd.pcapng.out b/tests/cfgs/default/result/http-pwd.pcapng.out index 6a3cdb41b..b9cf6399e 100644 --- a/tests/cfgs/default/result/http-pwd.pcapng.out +++ b/tests/cfgs/default/result/http-pwd.pcapng.out @@ -24,4 +24,6 @@ ntop 14 1805 1 Safe 14 1805 1 +Web 14 1805 1 + 1 TCP 127.0.0.1:56451 <-> 127.0.0.1:3000 [proto: 7.26/HTTP.ntop][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 9][cat: Web/5][7 pkts/1151 bytes <-> 7 pkts/654 bytes][Goodput ratio: 65/38][0.00 sec][Username: admin][Password: adminpwd][Hostname/SNI: localhost][bytes ratio: 0.275 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/4 1/1 4/4 2/2][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 164/93 747/306 239/87][URL: localhost:3000/authorize.html][StatusCode: 302][Req Content-Type: application/x-www-form-urlencoded][Server: ntopng 6.3.241001 (arm64)][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15][Risk: ** Clear-Text Credentials **][Risk Score: 100][Risk Info: Found password][TCP Fingerprint: 2_64_65535_99a660d3e328/macOS][PLAIN TEXT (XPOST /authorize.html HTTP/1.1)][Plen Bins: 0,33,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http.pcapng.out b/tests/cfgs/default/result/http.pcapng.out index b7ebcd98b..38894ba4c 100644 --- a/tests/cfgs/default/result/http.pcapng.out +++ b/tests/cfgs/default/result/http.pcapng.out @@ -24,4 +24,6 @@ Google 10 1278 1 Acceptable 10 1278 1 +Web 10 1278 1 + 1 TCP 192.168.1.128:42170 <-> 216.58.208.142:80 [proto: 7.126/HTTP.Google][IP: 126/Google][ClearText][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 6][cat: Web/5][6 pkts/478 bytes <-> 4 pkts/800 bytes][Goodput ratio: 15/66][0.04 sec][Hostname/SNI: google.com][bytes ratio: -0.252 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/7 8/14 28/20 10/6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 80/200 140/594 27/227][URL: google.com/][StatusCode: 301][Content-Type: text/html][Server: gws][User-Agent: curl/7.68.0][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http2.pcapng.out b/tests/cfgs/default/result/http2.pcapng.out index 67e9256aa..3a208ce08 100644 --- a/tests/cfgs/default/result/http2.pcapng.out +++ b/tests/cfgs/default/result/http2.pcapng.out @@ -24,4 +24,6 @@ HTTP2 10 1271 1 Safe 10 1271 1 +Web 10 1271 1 + 1 TCP 127.0.0.1:37824 <-> 127.0.0.1:29518 [proto: 349/HTTP2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 349/HTTP2, Confidence: DPI][DPI packets: 1][cat: Web/5][4 pkts/591 bytes <-> 6 pkts/680 bytes][Goodput ratio: 54/40][0.00 sec][bytes ratio: -0.070 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 0/0 1/1 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 77/81 148/113 212/163 50/35][PLAIN TEXT ( HTTP/2.0)][Plen Bins: 40,10,30,10,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http_asymmetric.pcapng.out b/tests/cfgs/default/result/http_asymmetric.pcapng.out index a8272aa6b..f2ffca9b7 100644 --- a/tests/cfgs/default/result/http_asymmetric.pcapng.out +++ b/tests/cfgs/default/result/http_asymmetric.pcapng.out @@ -24,5 +24,7 @@ HTTP 23 9961 2 Acceptable 23 9961 2 +Web 23 9961 2 + 1 TCP 192.168.1.146:80 -> 192.168.1.103:1044 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 11][cat: Web/5][13 pkts/8357 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][5.11 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 464/0 5000/0 1435/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/0 643/0 1514/0 626/0][StatusCode: 404][Content-Type: text/html][Server: Apache/2.4.41 (Ubuntu)][Risk: ** HTTP Susp User-Agent **** Susp Entropy **** Error Code **** Unidirectional Traffic **][Risk Score: 130][Risk Info: No client to server traffic / HTTP Error Code 404 / Entropy: 7.815 (Encrypted or Random?) / Empty or missing User-Agent][PLAIN TEXT (HTTP/1.1 200 OK)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,14,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,57,0,0] 2 TCP 192.168.0.1:1044 -> 10.10.10.1:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: Web/5][10 pkts/1604 bytes -> 0 pkts/0 bytes][Goodput ratio: 66/0][5.11 sec][Hostname/SNI: proxy.wiresharkfest.acropolis.local][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 567/0 4951/0 1550/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 160/0 418/0 160/0][URL: proxy.wiresharkfest.acropolis.local/favicon.ico][User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,66,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http_auth.pcap.out b/tests/cfgs/default/result/http_auth.pcap.out index eb9bb1026..6a3e237f9 100644 --- a/tests/cfgs/default/result/http_auth.pcap.out +++ b/tests/cfgs/default/result/http_auth.pcap.out @@ -24,4 +24,6 @@ HTTP 33 20574 1 Acceptable 33 20574 1 +Web 33 20574 1 + 1 TCP 192.168.0.4:54337 <-> 192.254.189.169:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][14 pkts/1675 bytes <-> 19 pkts/18899 bytes][Goodput ratio: 44/93][7.10 sec][Username: test][Password: fail2][Hostname/SNI: browserspy.dk][bytes ratio: -0.837 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 204/31 1269/206 376/69][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 120/995 805/1514 190/642][URL: browserspy.dk/password-ok.php][StatusCode: 401][Content-Type: text/html][Server: Apache][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36][Risk: ** Clear-Text Credentials **** Error Code **][Risk Score: 110][Risk Info: HTTP Error Code 401 / Found credentials in HTTP Auth Line][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (GET /password)][Plen Bins: 0,0,6,0,0,0,6,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,6,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,69,0,0] diff --git a/tests/cfgs/default/result/http_connect.pcap.out b/tests/cfgs/default/result/http_connect.pcap.out index 4fcfd9803..bdee63354 100644 --- a/tests/cfgs/default/result/http_connect.pcap.out +++ b/tests/cfgs/default/result/http_connect.pcap.out @@ -28,6 +28,9 @@ HTTP_Connect 40 26841 1 Safe 58 36496 1 Acceptable 42 27019 2 +Web 98 63337 2 +Network 2 178 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.146 1 diff --git a/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out b/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out index 21d7c0739..5f0783ae4 100644 --- a/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out +++ b/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out @@ -26,4 +26,6 @@ POP3 1 123 1 Unsafe 1 123 1 +Email 1 123 1 + 1 TCP 170.33.13.5:110 -> 192.168.0.1:179 [proto: 2/POP3][IP: 274/Alibaba][ClearText][Confidence: Match by port][FPC: 274/Alibaba, Confidence: IP address][DPI packets: 1][cat: Email/3][1 pkts/123 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unsafe Protocol **** Susp Entropy **** Unidirectional Traffic **** TCP Connection Issues **** Probing Attempt **][Risk Score: 130][Risk Info: TCP probing attempt / Connection refused / No client to server traffic / Entropy: 5.038 (Executable?)][PLAIN TEXT (6 HTTP/1.1)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http_invalid_server.pcap.out b/tests/cfgs/default/result/http_invalid_server.pcap.out index 56ec9cb3d..cbb9bed86 100644 --- a/tests/cfgs/default/result/http_invalid_server.pcap.out +++ b/tests/cfgs/default/result/http_invalid_server.pcap.out @@ -24,4 +24,6 @@ OCSP 12 1301 1 Safe 12 1301 1 +Network 12 1301 1 + 1 TCP 192.168.1.29:51536 <-> 143.204.14.183:80 [proto: 7.63/HTTP.OCSP][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 6][cat: Network/14][7 pkts/556 bytes <-> 5 pkts/745 bytes][Goodput ratio: 15/55][0.04 sec][Hostname/SNI: ocsp.rootg2.amazontrust.com][bytes ratio: -0.145 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/4 12/12 6/6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 79/149 148/468 28/160][URL: ocsp.rootg2.amazontrust.com/][StatusCode: 200][Content-Type: application/ocsp-response][Server: ¯\_(ツ)_/¯][User-Agent: **][Risk: ** HTTP Susp User-Agent **** HTTP Susp Header **][Risk Score: 200][Risk Info: Suspicious Agent [¯\_(ツ)_/¯] / Suspicious Log4J][TCP Fingerprint: 2_64_65535_d29295416479/macOS][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 33,0,33,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http_ipv6.pcap.out b/tests/cfgs/default/result/http_ipv6.pcap.out index 357bf7fd0..e80cdaca7 100644 --- a/tests/cfgs/default/result/http_ipv6.pcap.out +++ b/tests/cfgs/default/result/http_ipv6.pcap.out @@ -34,6 +34,10 @@ Safe 106 39646 11 Acceptable 65 16479 2 Fun 22 10202 2 +Web 91 19724 9 +SocialNetwork 22 10202 2 +Network 80 36401 4 + JA Host Stats: IP Address # JA4C 1 2a00:d40:1:3:7aac:c0ff:fea7:d4c 1 diff --git a/tests/cfgs/default/result/http_on_sip_port.pcap.out b/tests/cfgs/default/result/http_on_sip_port.pcap.out index 88f829fd7..d289fcbfd 100644 --- a/tests/cfgs/default/result/http_on_sip_port.pcap.out +++ b/tests/cfgs/default/result/http_on_sip_port.pcap.out @@ -24,4 +24,6 @@ HTTP 4 1831 1 Acceptable 4 1831 1 +Web 4 1831 1 + 1 TCP 82.178.111.221:5060 <-> 45.58.148.2:8888 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][2 pkts/351 bytes <-> 2 pkts/1480 bytes][Goodput ratio: 63/92][0.32 sec][Hostname/SNI: 45.58.148.2][URL: 45.58.148.2/star-123456/index.m3u8?token=89b198b8844824ca15b8b379c26fc1b7dfcba368-5KUJTJ5Y73AGIAOV-1618753174-1618742374][StatusCode: 403][Server: Flussonic][User-Agent: exoplayer-codelab][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **** Error Code **][Risk Score: 70][Risk Info: HTTP Error Code 403 / Found host 45.58.148.2 / Expected on port 80][TCP Fingerprint: 2_64_65535_f41c12e593f9/Unknown][PLAIN TEXT (GET /star)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http_origin_different_than_host.pcap.out b/tests/cfgs/default/result/http_origin_different_than_host.pcap.out index 73f0bb029..e89f1fa57 100644 --- a/tests/cfgs/default/result/http_origin_different_than_host.pcap.out +++ b/tests/cfgs/default/result/http_origin_different_than_host.pcap.out @@ -24,4 +24,6 @@ WebSocket 4 1229 1 Acceptable 4 1229 1 +Web 4 1229 1 + 1 TCP 10.140.206.74:34536 <-> 18.135.206.102:80 [VLAN: 113][proto: GTP:7.251/HTTP.WebSocket][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Web/5][2 pkts/835 bytes <-> 2 pkts/394 bytes][Goodput ratio: 73/42][0.35 sec][Hostname/SNI: csb.performgroup.io][URL: csb.performgroup.io/?topreferer=optawidgets.365scores.com][StatusCode: 101][User-Agent: Mozilla/5.0 (Linux; Android 9; JKM-LX1 Build/HUAWEIJKM-LX1; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/106.0.5249.118 Mobile Safari/537.36][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][PLAIN TEXT (topreferer)][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/http_starting_with_reply.pcapng.out b/tests/cfgs/default/result/http_starting_with_reply.pcapng.out index 442409873..57a2922b2 100644 --- a/tests/cfgs/default/result/http_starting_with_reply.pcapng.out +++ b/tests/cfgs/default/result/http_starting_with_reply.pcapng.out @@ -24,4 +24,6 @@ HTTP 18 9297 1 Acceptable 18 9297 1 +Web 18 9297 1 + 1 TCP 192.168.1.146:80 <-> 192.168.1.103:1044 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7/HTTP, Confidence: DPI][DPI packets: 7][cat: Web/5][11 pkts/8231 bytes <-> 7 pkts/1066 bytes][Goodput ratio: 92/64][5.11 sec][Hostname/SNI: proxy.wiresharkfest.acropolis.local][bytes ratio: 0.771 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 566/1272 5000/4951 1568/2124][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 748/152 1514/403 625/155][URL: proxy.wiresharkfest.acropolis.local/icons/ubuntu-logo.png][StatusCode: 200][Content-Type: image/png][Server: Apache/2.4.41 (Ubuntu)][User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.815 (Encrypted or Random?)][PLAIN TEXT (HTTP/1.1 200 OK)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,22,0,0,0,0,0,11,11,0,0,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,44,0,0] diff --git a/tests/cfgs/default/result/http_ua_splitted_in_two_pkts.pcapng.out b/tests/cfgs/default/result/http_ua_splitted_in_two_pkts.pcapng.out index b8deff0ae..a6bdae2c1 100644 --- a/tests/cfgs/default/result/http_ua_splitted_in_two_pkts.pcapng.out +++ b/tests/cfgs/default/result/http_ua_splitted_in_two_pkts.pcapng.out @@ -24,4 +24,6 @@ HTTP 115 76310 1 Acceptable 115 76310 1 +Web 115 76310 1 + 1 TCP 254.125.135.128:21359 <-> 66.152.103.45:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Web/5][76 pkts/67448 bytes <-> 39 pkts/8862 bytes][Goodput ratio: 93/71][386.83 sec][Hostname/SNI: va.origin.startappservice.com][bytes ratio: 0.768 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/234 4719/10214 59840/59845 10187/13183][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 887/227 1454/424 557/96][StatusCode: 200][User-Agent: Mozil][TCP Fingerprint: 2_64_65535_f6101b157c46/Unknown][PLAIN TEXT (WGET /tracking/adImpression)][Plen Bins: 0,0,0,2,26,0,6,1,13,1,4,6,0,1,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,35,0,0,0,0] diff --git a/tests/cfgs/default/result/i3d.pcap.out b/tests/cfgs/default/result/i3d.pcap.out index 6ababa0be..940e990b5 100644 --- a/tests/cfgs/default/result/i3d.pcap.out +++ b/tests/cfgs/default/result/i3d.pcap.out @@ -24,6 +24,8 @@ i3D 60 36502 4 Fun 60 36502 4 +Game 60 36502 4 + 1 UDP 192.168.2.100:62461 <-> 213.163.87.47:50004 [proto: 301/i3D][IP: 58/Discord][ClearText][Confidence: DPI][FPC: 301/i3D, Confidence: DPI][DPI packets: 1][cat: Game/8][14 pkts/16467 bytes <-> 1 pkts/116 bytes][Goodput ratio: 96/63][0.05 sec][bytes ratio: 0.986 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 4/0 36/0 10/0][Pkt Len c2s/s2c min/avg/max/stddev: 116/116 1176/116 1258/116 294/0][PLAIN TEXT (90.186.132.133)][Plen Bins: 0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,66,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:55205 <-> 213.163.87.47:50004 [proto: 301/i3D][IP: 58/Discord][ClearText][Confidence: DPI][FPC: 301/i3D, Confidence: DPI][DPI packets: 1][cat: Game/8][14 pkts/11517 bytes <-> 1 pkts/116 bytes][Goodput ratio: 95/63][0.11 sec][bytes ratio: 0.980 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 9/0 31/0 10/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/116 823/116 1209/116 456/0][PLAIN TEXT (90.186.132.133)][Plen Bins: 0,6,13,0,0,0,0,0,0,0,0,26,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,54,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:62620 <-> 213.163.87.47:50004 [proto: 301/i3D][IP: 58/Discord][ClearText][Confidence: DPI][FPC: 301/i3D, Confidence: DPI][DPI packets: 1][cat: Game/8][14 pkts/5099 bytes <-> 1 pkts/116 bytes][Goodput ratio: 88/63][0.25 sec][bytes ratio: 0.956 (Upload)][IAT c2s/s2c min/avg/max/stddev: 6/0 19/0 36/0 7/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/116 364/116 1252/116 258/0][PLAIN TEXT (90.186.132.133)][Plen Bins: 0,6,13,0,0,0,0,0,47,26,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/iax.pcap.out b/tests/cfgs/default/result/iax.pcap.out index 7860e830d..00dea5661 100644 --- a/tests/cfgs/default/result/iax.pcap.out +++ b/tests/cfgs/default/result/iax.pcap.out @@ -24,4 +24,6 @@ IAX 50 9172 1 Acceptable 50 9172 1 +VoIP 50 9172 1 + 1 UDP 82.110.36.84:4569 <-> 192.168.2.120:4566 [proto: 95/IAX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 95/IAX, Confidence: DPI][DPI packets: 1][cat: VoIP/10][28 pkts/5240 bytes <-> 22 pkts/3932 bytes][Goodput ratio: 77/76][0.53 sec][bytes ratio: 0.143 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 18/5 43/51 10/13][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 187/179 214/214 48/59][PLAIN TEXT (442088205155)][Plen Bins: 14,0,2,0,0,84,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/icmp-tunnel.pcap.out b/tests/cfgs/default/result/icmp-tunnel.pcap.out index bbb55aca6..907edcb20 100644 --- a/tests/cfgs/default/result/icmp-tunnel.pcap.out +++ b/tests/cfgs/default/result/icmp-tunnel.pcap.out @@ -24,4 +24,6 @@ ICMP 863 190810 1 Acceptable 863 190810 1 +Network 863 190810 1 + 1 ICMP 192.168.154.131:0 <-> 192.168.154.132:0 [proto: 81/ICMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 81/ICMP, Confidence: DPI][DPI packets: 1][cat: Network/14][448 pkts/98566 bytes <-> 415 pkts/92244 bytes][Goodput ratio: 81/81][1122.51 sec][bytes ratio: 0.033 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 2578/2731 145505/145505 9091/9494][Pkt Len c2s/s2c min/avg/max/stddev: 74/74 220/222 1075/1070 245/245][Risk: ** Malformed Packet **** Susp Entropy **][Risk Score: 20][Risk Info: No server to client traffic / Entropy: 5.703 (Executable?) / Invalid ICMP checksum][PLAIN TEXT (OpenSSH5)][Plen Bins: 0,32,24,24,7,3,3,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/iec60780-5-104.pcap.out b/tests/cfgs/default/result/iec60780-5-104.pcap.out index 2564610ea..26a8ac222 100644 --- a/tests/cfgs/default/result/iec60780-5-104.pcap.out +++ b/tests/cfgs/default/result/iec60780-5-104.pcap.out @@ -24,6 +24,8 @@ IEC60870 147 9033 6 Acceptable 147 9033 6 +IoT-Scada 147 9033 6 + 1 TCP 172.27.248.109:1578 <-> 172.27.248.79:2404 [proto: 245/IEC60870][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][28 pkts/1758 bytes <-> 19 pkts/1297 bytes][Goodput ratio: 9/20][235.18 sec][bytes ratio: 0.151 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/4 9106/11905 32485/32516 10297/10287][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 63/68 76/118 5/15][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][Plen Bins: 96,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.27.248.109:1568 <-> 172.27.248.79:2404 [proto: 245/IEC60870][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][17 pkts/1040 bytes <-> 12 pkts/674 bytes][Goodput ratio: 7/3][160.96 sec][bytes ratio: 0.214 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 9874/10029 38294/26906 11815/8997][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 61/56 68/62 2/3][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 172.27.248.109:1572 <-> 172.27.248.79:2404 [proto: 245/IEC60870][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][15 pkts/940 bytes <-> 10 pkts/572 bytes][Goodput ratio: 9/4][191.16 sec][bytes ratio: 0.243 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 12850/21996 59783/60001 22023/25276][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 63/57 76/62 5/3][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ieee_c37118.pcap.out b/tests/cfgs/default/result/ieee_c37118.pcap.out index 1c1c2cef9..228b1fe7d 100644 --- a/tests/cfgs/default/result/ieee_c37118.pcap.out +++ b/tests/cfgs/default/result/ieee_c37118.pcap.out @@ -25,5 +25,7 @@ IEEE-C37118 778 74034 2 Acceptable 778 74034 2 +IoT-Scada 778 74034 2 + 1 TCP 192.168.0.20:36835 <-> 192.168.0.241:4712 [proto: 367/IEEE-C37118][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][159 pkts/10556 bytes <-> 258 pkts/30782 bytes][Goodput ratio: 1/45][5.04 sec][bytes ratio: -0.489 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 30/19 56/52 18/4][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 66/119 84/200 3/9][TCP Fingerprint: 2_64_5840_8c07a80cc645/Unknown][PLAIN TEXT (Blue PMU )][Plen Bins: 1,98,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.0.10:4712 <-> 192.168.0.60:4713 [proto: 367/IEEE-C37118][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 367/IEEE-C37118, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][4 pkts/240 bytes <-> 357 pkts/32456 bytes][Goodput ratio: 30/54][7.49 sec][bytes ratio: -0.985 (Download)][IAT c2s/s2c min/avg/max/stddev: 54/19 185/20 316/59 131/2][Pkt Len c2s/s2c min/avg/max/stddev: 60/90 60/91 60/416 0/17][PLAIN TEXT (1 )][Plen Bins: 1,98,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/imap-starttls.pcap.out b/tests/cfgs/default/result/imap-starttls.pcap.out index 58b1b016b..1e1eeeaaa 100644 --- a/tests/cfgs/default/result/imap-starttls.pcap.out +++ b/tests/cfgs/default/result/imap-starttls.pcap.out @@ -24,6 +24,8 @@ IMAPS 32 7975 1 Safe 32 7975 1 +Email 32 7975 1 + JA Host Stats: IP Address # JA4C 1 192.168.17.53 1 diff --git a/tests/cfgs/default/result/imap.pcap.out b/tests/cfgs/default/result/imap.pcap.out index dabd9c2bc..87c64d320 100644 --- a/tests/cfgs/default/result/imap.pcap.out +++ b/tests/cfgs/default/result/imap.pcap.out @@ -24,4 +24,6 @@ IMAP 33 3774 1 Unsafe 33 3774 1 +Email 33 3774 1 + 1 TCP 10.40.4.2:46045 <-> 10.40.3.2:143 [proto: 4/IMAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 11][cat: Email/3][20 pkts/1507 bytes <-> 13 pkts/2267 bytes][Goodput ratio: 12/62][4.57 sec][User: samir][Pwd: pfres][bytes ratio: -0.201 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/17 39/39 15/16][Pkt Len c2s/s2c min/avg/max/stddev: 66/74 75/174 139/762 17/181][Risk: ** Unsafe Protocol **** Clear-Text Credentials **][Risk Score: 110][Risk Info: Found IMAP username (samir)][TCP Fingerprint: 2_64_5840_2e3cee914fc1/Unknown][PLAIN TEXT ( OK IMAP4)][Plen Bins: 51,22,11,5,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/imaps.pcap.out b/tests/cfgs/default/result/imaps.pcap.out index 566edb5d6..bb562016f 100644 --- a/tests/cfgs/default/result/imaps.pcap.out +++ b/tests/cfgs/default/result/imaps.pcap.out @@ -25,6 +25,8 @@ IMAPS 8 4378 1 Safe 28 9574 2 +Email 28 9574 2 + JA Host Stats: IP Address # JA4C 1 192.168.0.1 1 diff --git a/tests/cfgs/default/result/imo.pcap.out b/tests/cfgs/default/result/imo.pcap.out index b50f088ad..207c0a216 100644 --- a/tests/cfgs/default/result/imo.pcap.out +++ b/tests/cfgs/default/result/imo.pcap.out @@ -24,5 +24,7 @@ IMO 100 35380 2 Acceptable 100 35380 2 +VoIP 100 35380 2 + 1 UDP 192.168.12.169:49207 <-> 93.33.47.58:57604 [proto: 216/IMO][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VoIP/10][28 pkts/7889 bytes <-> 37 pkts/13060 bytes][Goodput ratio: 85/88][3.22 sec][bytes ratio: -0.247 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 122/89 962/721 250/181][Pkt Len c2s/s2c min/avg/max/stddev: 43/43 282/353 1094/1081 414/430][Plen Bins: 63,0,0,4,1,1,0,3,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,6,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.169:49207 <-> 185.155.137.30:36535 [proto: 216/IMO][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: VoIP/10][19 pkts/13028 bytes <-> 16 pkts/1403 bytes][Goodput ratio: 94/52][3.19 sec][bytes ratio: 0.806 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 140/171 1003/1002 308/343][Pkt Len c2s/s2c min/avg/max/stddev: 224/52 686/88 1266/266 496/60][PLAIN TEXT (/Q/MpI )][Plen Bins: 32,0,2,8,0,5,18,5,0,2,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,23,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/instagram.pcap.out b/tests/cfgs/default/result/instagram.pcap.out index 90420f5d8..a471b6f40 100644 --- a/tests/cfgs/default/result/instagram.pcap.out +++ b/tests/cfgs/default/result/instagram.pcap.out @@ -39,6 +39,12 @@ Acceptable 173 133082 14 Fun 569 390301 18 Unrated 1 66 1 +Unspecified 1 66 1 +Web 259 193369 12 +SocialNetwork 569 390301 18 +Cloud 5 725 2 +Network 12 1585 5 + JA Host Stats: IP Address # JA4C 1 192.168.0.103 1 diff --git a/tests/cfgs/default/result/ip_fragmented_garbage.pcap.out b/tests/cfgs/default/result/ip_fragmented_garbage.pcap.out index 830ac200c..036069376 100644 --- a/tests/cfgs/default/result/ip_fragmented_garbage.pcap.out +++ b/tests/cfgs/default/result/ip_fragmented_garbage.pcap.out @@ -24,6 +24,8 @@ Unknown 4 216 1 Unrated 4 216 1 +Unspecified 4 216 1 + Undetected flows: diff --git a/tests/cfgs/default/result/iphone.pcap.out b/tests/cfgs/default/result/iphone.pcap.out index e64cab51b..4bc556033 100644 --- a/tests/cfgs/default/result/iphone.pcap.out +++ b/tests/cfgs/default/result/iphone.pcap.out @@ -43,6 +43,14 @@ Safe 132 53116 8 Acceptable 290 144365 40 Fun 64 23471 3 +Web 332 178040 12 +Cloud 2 1104 1 +Network 77 16560 32 +Streaming 62 23299 2 +System 2 336 2 +Music 2 172 1 +ConnCheck 9 1441 1 + JA Host Stats: IP Address # JA4C 1 192.168.2.17 3 diff --git a/tests/cfgs/default/result/ipp.pcap.out b/tests/cfgs/default/result/ipp.pcap.out index a906b8915..915cc2dfa 100644 --- a/tests/cfgs/default/result/ipp.pcap.out +++ b/tests/cfgs/default/result/ipp.pcap.out @@ -24,6 +24,8 @@ IPP 277 248554 3 Acceptable 277 248554 3 +System 277 248554 3 + 1 TCP 10.10.10.49:55342 <-> 10.10.10.251:631 [proto: 7.6/HTTP.IPP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: System/18][150 pkts/237529 bytes <-> 84 pkts/5922 bytes][Goodput ratio: 96/6][1.20 sec][Hostname/SNI: 10.10.10.251][bytes ratio: 0.951 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 6/11 218/212 27/30][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1584/70 2962/267 978/27][URL: 10.10.10.251/ipp/][StatusCode: 100][Req Content-Type: application/ipp][User-Agent: CUPS/1.3.4][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 60][Risk Info: Found host 10.10.10.251 / Expected on port 80][TCP Fingerprint: 2_64_5840_2e3cee914fc1/Unknown][PLAIN TEXT (POST /ipp/ HTTP/1.1)][Plen Bins: 1,1,0,0,3,2,1,1,0,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0,0,1,0,1,2,0,0,0,0,2,0,68] 2 TCP 10.10.10.49:55343 <-> 10.10.10.251:631 [proto: 7.6/HTTP.IPP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: System/18][14 pkts/1662 bytes <-> 11 pkts/1306 bytes][Goodput ratio: 44/44][0.06 sec][Hostname/SNI: 10.10.10.251][bytes ratio: 0.120 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 5/7 44/40 12/13][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 119/119 294/333 85/82][URL: 10.10.10.251/ipp/][StatusCode: 100][Req Content-Type: application/ipp][User-Agent: CUPS/1.3.4][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 60][Risk Info: Found host 10.10.10.251 / Expected on port 80][TCP Fingerprint: 2_64_5840_2e3cee914fc1/Unknown][PLAIN TEXT (POST /ipp/ HTTP/1.1)][Plen Bins: 30,0,0,10,30,0,10,10,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.10.10.49:55341 <-> 10.10.10.251:631 [proto: 7.6/HTTP.IPP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: System/18][10 pkts/1098 bytes <-> 8 pkts/1037 bytes][Goodput ratio: 39/48][0.02 sec][Hostname/SNI: 10.10.10.251][bytes ratio: 0.029 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1/1 4/3 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 110/130 355/393 92/110][URL: 10.10.10.251/ipp/][StatusCode: 100][Req Content-Type: application/ipp][User-Agent: CUPS/1.3.4][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 60][Risk Info: Found host 10.10.10.251 / Expected on port 80][TCP Fingerprint: 2_64_5840_2e3cee914fc1/Unknown][PLAIN TEXT (POST /ipp/ HTTP/1.1)][Plen Bins: 33,0,0,0,33,0,0,0,0,16,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out b/tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out index 57e8dffa8..cf84ea246 100644 --- a/tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out +++ b/tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out @@ -24,6 +24,8 @@ IPSec 834 451722 24 Safe 834 451722 24 +VPN 834 451722 24 + 1 UDP 192.168.2.100:14500 <-> 109.237.187.130:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 79/IPSec, Confidence: DPI][DPI packets: 1][cat: VPN/2][37 pkts/23230 bytes <-> 53 pkts/36862 bytes][Goodput ratio: 93/94][< 1 sec][bytes ratio: -0.227 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 51181/32575 761601/761794 163164/132507][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 628/696 1374/1374 489/539][PLAIN TEXT (H.P.RE)][Plen Bins: 0,0,6,13,20,0,6,0,0,0,0,0,0,6,0,0,0,0,1,0,0,0,0,0,0,6,0,0,0,0,0,0,12,0,0,0,0,0,0,0,6,20,0,0,0,0,0,0] 2 UDP 192.168.2.100:10500 <-> 109.237.187.227:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 79/IPSec, Confidence: DPI][DPI packets: 1][cat: VPN/2][54 pkts/44820 bytes <-> 53 pkts/11118 bytes][Goodput ratio: 95/80][< 1 sec][bytes ratio: 0.602 (Upload)][IAT c2s/s2c min/avg/max/stddev: 28/27 689892/698588 12245747/12245747 1998175/2019137][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/210 842/330 12/118][PLAIN TEXT (rMpKau6)][Plen Bins: 0,25,0,0,0,0,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:14500 <-> 109.237.187.195:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 79/IPSec, Confidence: DPI][DPI packets: 1][cat: VPN/2][42 pkts/30020 bytes <-> 48 pkts/21472 bytes][Goodput ratio: 94/91][15275.72 sec][bytes ratio: 0.166 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 85008/72283 1429414/1429546 288620/266457][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 715/447 1374/1374 518/432][PLAIN TEXT (@yIwAf)][Plen Bins: 0,0,8,13,26,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,4,2,0,0,0,6,0,0,0,0,0,0,0,0,19,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ipv6_in_gtp.pcap.out b/tests/cfgs/default/result/ipv6_in_gtp.pcap.out index df5c88979..d9274a96b 100644 --- a/tests/cfgs/default/result/ipv6_in_gtp.pcap.out +++ b/tests/cfgs/default/result/ipv6_in_gtp.pcap.out @@ -28,6 +28,9 @@ ESP 1 166 1 Safe 1 166 1 Unrated 1 150 1 +Unspecified 1 150 1 +VPN 1 166 1 + 1 ESP [2a01:4c8:c014:144e:1:2:945b:6761]:0 -> [2a01:4c8:f000:f49::4]:0 [VLAN: 2][proto: GTP:117/ESP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 117/ESP, Confidence: DPI][DPI packets: 1][cat: VPN/2][1 pkts/166 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/iqiyi.pcap.out b/tests/cfgs/default/result/iqiyi.pcap.out index fdd82078d..4b4479f29 100644 --- a/tests/cfgs/default/result/iqiyi.pcap.out +++ b/tests/cfgs/default/result/iqiyi.pcap.out @@ -24,4 +24,6 @@ iQIYI 2 327 1 Fun 2 327 1 +Streaming 2 327 1 + 1 UDP 10.215.173.1:50412 <-> 116.211.199.199:16600 [proto: 54/iQIYI][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 54/iQIYI, Confidence: DPI][DPI packets: 1][cat: Streaming/17][1 pkts/163 bytes <-> 1 pkts/164 bytes][Goodput ratio: 82/82][0.44 sec][PLAIN TEXT (PPStream)][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/irc.pcap.out b/tests/cfgs/default/result/irc.pcap.out index 89eff0e56..ab955badb 100644 --- a/tests/cfgs/default/result/irc.pcap.out +++ b/tests/cfgs/default/result/irc.pcap.out @@ -24,4 +24,6 @@ IRC 29 8945 1 Unsafe 29 8945 1 +Chat 29 8945 1 + 1 TCP 10.180.156.249:45921 <-> 38.229.70.20:8000 [proto: 65/IRC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: Chat/9][14 pkts/1046 bytes <-> 15 pkts/7899 bytes][Goodput ratio: 11/87][14.57 sec][bytes ratio: -0.766 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1314/1206 8864/8864 2852/2736][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 75/527 107/1514 14/611][Risk: ** Known Proto on Non Std Port **** Unsafe Protocol **** Clear-Text Credentials **][Risk Score: 160][Risk Info: Found IRC username (xxxxx) / Expected on port 194][TCP Fingerprint: 2_64_14600_2e3cee914fc1/Unknown][PLAIN TEXT (USER xx)][Plen Bins: 13,41,6,0,0,0,0,0,6,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,26,0,0] diff --git a/tests/cfgs/default/result/iso9506-1-mms.pcap.out b/tests/cfgs/default/result/iso9506-1-mms.pcap.out index 4c177cf85..ff3e834ad 100644 --- a/tests/cfgs/default/result/iso9506-1-mms.pcap.out +++ b/tests/cfgs/default/result/iso9506-1-mms.pcap.out @@ -24,4 +24,6 @@ ISO9506-1-MMS 22 1907 1 Acceptable 22 1907 1 +IoT-Scada 22 1907 1 + 1 TCP 172.16.0.101:1345 <-> 172.16.202.5:102 [proto: 366/ISO9506-1-MMS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: IoT-Scada/31][11 pkts/1000 bytes <-> 11 pkts/907 bytes][Goodput ratio: 37/31][0.61 sec][bytes ratio: 0.049 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 63/28 218/100 83/42][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 91/82 221/200 47/39][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][Plen Bins: 51,16,16,0,8,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ja3_lots_of_cipher_suites.pcap.out b/tests/cfgs/default/result/ja3_lots_of_cipher_suites.pcap.out index 679a6148e..ec5f04862 100644 --- a/tests/cfgs/default/result/ja3_lots_of_cipher_suites.pcap.out +++ b/tests/cfgs/default/result/ja3_lots_of_cipher_suites.pcap.out @@ -24,6 +24,8 @@ TLS 11 5132 1 Safe 11 5132 1 +Web 11 5132 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/ja3_lots_of_cipher_suites_2_anon.pcap.out b/tests/cfgs/default/result/ja3_lots_of_cipher_suites_2_anon.pcap.out index 3d748ec2e..5f138c9ce 100644 --- a/tests/cfgs/default/result/ja3_lots_of_cipher_suites_2_anon.pcap.out +++ b/tests/cfgs/default/result/ja3_lots_of_cipher_suites_2_anon.pcap.out @@ -24,6 +24,8 @@ TLS 27 6966 1 Safe 27 6966 1 +Web 27 6966 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/jabber.pcap.out b/tests/cfgs/default/result/jabber.pcap.out index 0f39a8f5f..1edc1f8ae 100644 --- a/tests/cfgs/default/result/jabber.pcap.out +++ b/tests/cfgs/default/result/jabber.pcap.out @@ -24,6 +24,8 @@ Jabber 358 61304 12 Acceptable 358 61304 12 +Web 358 61304 12 + 1 TCP 172.16.0.62:57094 <-> 172.16.1.138:5222 [proto: 67/Jabber][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][44 pkts/5701 bytes <-> 42 pkts/13807 bytes][Goodput ratio: 49/80][2.17 sec][bytes ratio: -0.416 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 36/39 611/611 109/111][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 130/329 559/1514 104/415][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (xml version)][Plen Bins: 2,4,2,24,9,13,4,6,9,0,2,2,2,0,0,4,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0] 2 TCP 172.16.0.62:57122 <-> 172.16.1.138:5222 [proto: 67/Jabber][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][44 pkts/5701 bytes <-> 42 pkts/13806 bytes][Goodput ratio: 49/80][2.16 sec][bytes ratio: -0.415 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 36/39 521/520 99/101][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 130/329 677/1514 116/415][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (xml version)][Plen Bins: 2,4,2,22,9,15,4,7,9,0,2,2,2,0,0,2,0,0,0,2,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0] 3 TCP 172.16.0.62:57149 <-> 172.16.1.138:5222 [proto: 67/Jabber][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 67/Jabber, Confidence: DPI][DPI packets: 1][cat: Web/5][21 pkts/2752 bytes <-> 17 pkts/3414 bytes][Goodput ratio: 50/67][656.22 sec][bytes ratio: -0.107 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 35858/700 600484/4996 141164/1575][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 131/201 305/529 77/137][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: No server to client traffic / Entropy: 5.068 (Executable?)][PLAIN TEXT (presence to)][Plen Bins: 0,18,0,22,18,9,18,4,0,0,0,0,4,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/jrmi.pcap.out b/tests/cfgs/default/result/jrmi.pcap.out index 02f550efc..765418ed0 100644 --- a/tests/cfgs/default/result/jrmi.pcap.out +++ b/tests/cfgs/default/result/jrmi.pcap.out @@ -24,4 +24,6 @@ JRMI 19 1708 1 Acceptable 19 1708 1 +RPC 19 1708 1 + 1 TCP 127.0.0.1:34450 <-> 127.0.1.1:1099 [proto: 416/JRMI][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][12 pkts/898 bytes <-> 7 pkts/810 bytes][Goodput ratio: 11/42][0.16 sec][bytes ratio: 0.052 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 9/32 63/105 18/43][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 75/116 126/389 16/112][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][PLAIN TEXT (127.0.0.1)][Plen Bins: 75,12,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/jsonrpc.pcap.out b/tests/cfgs/default/result/jsonrpc.pcap.out index b88e08db4..ad1562c4f 100644 --- a/tests/cfgs/default/result/jsonrpc.pcap.out +++ b/tests/cfgs/default/result/jsonrpc.pcap.out @@ -24,5 +24,7 @@ JSON-RPC 16 2815 2 Acceptable 16 2815 2 +RPC 16 2815 2 + 1 TCP 192.168.8.251:51084 <-> 179.99.210.200:80 [proto: 7.375/HTTP.JSON-RPC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: RPC/16][4 pkts/1322 bytes <-> 4 pkts/843 bytes][Goodput ratio: 81/73][< 1 sec][Hostname/SNI: mdotti.dyndns.org][bytes ratio: 0.221 (Upload)][IAT c2s/s2c min/avg/max/stddev: 102/0 34/34 102/101 48/48][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 330/211 1124/566 458/209][URL: mdotti.dyndns.org/zabbix/jsrpc.php?output=json-rpc][StatusCode: 200][Req Content-Type: application/json-rpc][Content-Type: application/json-rpc][Server: Apache/2.2.16 (Debian)][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36][Risk: ** HTTP Obsolete Server **][Risk Score: 50][Risk Info: Obsolete Apache server 2.2.16][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (POST /zabbix/jsrpc.php)][Plen Bins: 0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:36646 <-> 127.0.0.1:8080 [proto: 375/JSON-RPC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][4 pkts/378 bytes <-> 4 pkts/272 bytes][Goodput ratio: 28/0][0.01 sec][bytes ratio: 0.163 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 10/0 3/0 10/0 5/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 94/68 172/74 45/3][TCP Fingerprint: 2_64_33280_db1b9381215d/Unknown][PLAIN TEXT (sonrpc)][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/kafka.pcapng.out b/tests/cfgs/default/result/kafka.pcapng.out index ba0317074..136a37b17 100644 --- a/tests/cfgs/default/result/kafka.pcapng.out +++ b/tests/cfgs/default/result/kafka.pcapng.out @@ -27,6 +27,8 @@ Kafka 41 7067 9 Acceptable 41 7067 9 +RPC 41 7067 9 + 1 TCP 127.0.0.1:46136 <-> 127.0.0.1:9092 [proto: 377/Kafka][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][12 pkts/1107 bytes <-> 7 pkts/1130 bytes][Goodput ratio: 28/58][13.63 sec][bytes ratio: -0.010 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 800/288 6849/1049 2039/441][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 92/161 206/512 42/149][TCP Fingerprint: 2_64_16640_7ca16a4596dd/Unknown][PLAIN TEXT (console)][Plen Bins: 12,38,12,12,12,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.16.17.101:38176 <-> 172.30.0.237:9092 [proto: 377/Kafka][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 377/Kafka, Confidence: DPI][DPI packets: 1][cat: RPC/16][3 pkts/1408 bytes <-> 2 pkts/254 bytes][Goodput ratio: 86/48][0.58 sec][PLAIN TEXT (timestamp)][Plen Bins: 0,40,0,0,0,0,0,0,0,0,0,40,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 172.30.0.237:9092 <-> 172.16.17.101:58052 [proto: 377/Kafka][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: RPC/16][4 pkts/974 bytes <-> 1 pkts/110 bytes][Goodput ratio: 73/40][599.70 sec][PLAIN TEXT (172.30.0.237)][Plen Bins: 0,20,0,60,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/kcp.pcap.out b/tests/cfgs/default/result/kcp.pcap.out index 083b60a8a..1d316f766 100644 --- a/tests/cfgs/default/result/kcp.pcap.out +++ b/tests/cfgs/default/result/kcp.pcap.out @@ -24,6 +24,8 @@ KCP 50 36284 7 Acceptable 50 36284 7 +Network 50 36284 7 + 1 UDP [::1]:47356 <-> [::1]:8000 [proto: 385/KCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 385/KCP, Confidence: DPI][DPI packets: 1][cat: Network/14][27 pkts/21210 bytes <-> 17 pkts/5870 bytes][Goodput ratio: 92/82][5.99 sec][bytes ratio: 0.566 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 240/323 999/999 333/401][Pkt Len c2s/s2c min/avg/max/stddev: 86/86 786/345 1534/1534 699/502][PLAIN TEXT (./0123456789)][Plen Bins: 4,60,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,31,0] 2 UDP [::1]:14077 -> [::1]:32425 [proto: 385/KCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 385/KCP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/1534 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (./0123456789)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0] 3 UDP [::1]:43926 -> [::1]:41488 [proto: 385/KCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 385/KCP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/1534 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (./0123456789)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0] diff --git a/tests/cfgs/default/result/kerberos-error.pcap.out b/tests/cfgs/default/result/kerberos-error.pcap.out index 87f0f370a..535f6cf97 100644 --- a/tests/cfgs/default/result/kerberos-error.pcap.out +++ b/tests/cfgs/default/result/kerberos-error.pcap.out @@ -24,4 +24,6 @@ Kerberos 2 481 1 Acceptable 2 481 1 +Network 2 481 1 + 1 UDP 148.151.79.183:34473 <-> 144.199.10.233:88 [VLAN: 2008][proto: 111/Kerberos][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 111/Kerberos, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/333 bytes <-> 1 pkts/148 bytes][Goodput ratio: 86/68][0.36 sec][linux.shell.com\mus-n-cj0709][PLAIN TEXT (LINUX.SHELL.COM)][Plen Bins: 0,0,0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/kerberos-login.pcap.out b/tests/cfgs/default/result/kerberos-login.pcap.out index 1b2b8579b..8b0719124 100644 --- a/tests/cfgs/default/result/kerberos-login.pcap.out +++ b/tests/cfgs/default/result/kerberos-login.pcap.out @@ -25,6 +25,8 @@ Kerberos 39 37272 13 Acceptable 39 37272 13 +Network 39 37272 13 + 1 TCP 192.168.10.12:44256 <-> 192.168.10.3:88 [proto: 111/Kerberos][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 11][cat: Network/14][9 pkts/3720 bytes <-> 6 pkts/3520 bytes][Goodput ratio: 84/88][0.00 sec][testbed1.ca\ubuntu64a][bytes ratio: 0.028 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 413/587 1621/1620 646/731][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (TESTBED)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100] 2 UDP 10.1.12.2:1074 <-> 10.5.3.1:88 [proto: 111/Kerberos][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 111/Kerberos, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/1275 bytes <-> 1 pkts/1279 bytes][Goodput ratio: 97/97][< 1 sec][denydc.com][PLAIN TEXT (DENYDC.COM)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0] 3 UDP 10.1.12.2:1092 <-> 10.5.3.1:88 [proto: 111/Kerberos][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 111/Kerberos, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/1277 bytes <-> 1 pkts/1270 bytes][Goodput ratio: 97/97][< 1 sec][denydc.com][PLAIN TEXT (DENYDC.COM)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/kerberos.pcap.out b/tests/cfgs/default/result/kerberos.pcap.out index 8bbebef28..3055cb238 100644 --- a/tests/cfgs/default/result/kerberos.pcap.out +++ b/tests/cfgs/default/result/kerberos.pcap.out @@ -32,6 +32,10 @@ LDAP 14 4152 7 Acceptable 68 25260 34 Unrated 9 3031 2 +Unspecified 9 3031 2 +Network 48 19194 24 +System 20 6066 10 + 1 TCP 172.16.8.201:49171 <-> 172.16.8.8:88 [proto: 111/Kerberos][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 111/Kerberos, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/1486 bytes <-> 1 pkts/1506 bytes][Goodput ratio: 96/96][0.00 sec][happycraft.org\johnson-pc][PLAIN TEXT (HAPPYCRAFT.ORG)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,50,0,0] 2 TCP 172.16.8.201:49160 <-> 172.16.8.8:88 [proto: 111/Kerberos][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 111/Kerberos, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/1485 bytes <-> 1 pkts/1498 bytes][Goodput ratio: 96/96][< 1 sec][happycraft.org\johnson-pc][PLAIN TEXT (HAPPYCRAFT.ORG)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,50,0,0] 3 TCP 172.16.8.201:49176 <-> 172.16.8.8:88 [proto: 111/Kerberos][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 111/Kerberos, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/1485 bytes <-> 1 pkts/1498 bytes][Goodput ratio: 96/96][0.00 sec][happycraft.org\johnson-pc][PLAIN TEXT (HAPPYCRAFT.ORG)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,50,0,0] diff --git a/tests/cfgs/default/result/kerberos_fuzz.pcapng.out b/tests/cfgs/default/result/kerberos_fuzz.pcapng.out index 30bb246d4..43e5488f3 100644 --- a/tests/cfgs/default/result/kerberos_fuzz.pcapng.out +++ b/tests/cfgs/default/result/kerberos_fuzz.pcapng.out @@ -24,4 +24,6 @@ Kerberos 1 288 1 Acceptable 1 288 1 +Network 1 288 1 + 1 TCP 126.4.1.0:88 -> 19.0.0.0:53646 [proto: 111/Kerberos][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 111/Kerberos, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/288 bytes -> 0 pkts/0 bytes][Goodput ratio: 90/0][< 1 sec][r1i???ca???????]*??0p??????_???????ea?id;?????o\??????][PLAIN TEXT (/S.2T )][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/kismet.pcap.out b/tests/cfgs/default/result/kismet.pcap.out index 180b2195c..12ba149cf 100644 --- a/tests/cfgs/default/result/kismet.pcap.out +++ b/tests/cfgs/default/result/kismet.pcap.out @@ -24,4 +24,6 @@ Kismet 35 4871 1 Acceptable 35 4871 1 +Network 35 4871 1 + 1 TCP 127.0.0.1:34065 <-> 127.0.0.1:2501 [proto: 309/Kismet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][18 pkts/2029 bytes <-> 17 pkts/2842 bytes][Goodput ratio: 51/67][14.61 sec][bytes ratio: -0.167 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 399/399 857/870 1099/1099 407/366][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 113/167 1099/253 239/52][TCP Fingerprint: 2_128_32767_5e02decdfab9/Unknown][PLAIN TEXT (KISMET)][Plen Bins: 6,0,6,0,75,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/knxip.pcapng.out b/tests/cfgs/default/result/knxip.pcapng.out index 4b8e7e9e4..b09041c6e 100644 --- a/tests/cfgs/default/result/knxip.pcapng.out +++ b/tests/cfgs/default/result/knxip.pcapng.out @@ -25,5 +25,7 @@ KNXnet_IP 3 200 2 Acceptable 3 200 2 +IoT-Scada 3 200 2 + 1 UDP 192.168.88.231:41343 -> 224.0.23.12:3671 [proto: 410/KNXnet_IP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 410/KNXnet_IP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][2 pkts/118 bytes -> 0 pkts/0 bytes][Goodput ratio: 29/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.28:3671 -> 192.168.1.24:54445 [proto: 410/KNXnet_IP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 410/KNXnet_IP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/82 bytes -> 0 pkts/0 bytes][Goodput ratio: 34/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/lagofast.pcap.out b/tests/cfgs/default/result/lagofast.pcap.out index 3a6f2a3c2..c9be67e5b 100644 --- a/tests/cfgs/default/result/lagofast.pcap.out +++ b/tests/cfgs/default/result/lagofast.pcap.out @@ -28,6 +28,10 @@ LagoFast 20 5732 20 Safe 5 6130 5 Acceptable 25 6140 25 +VPN 20 5732 20 +Web 5 6130 5 +Network 5 408 5 + JA Host Stats: IP Address # JA4C 1 180.239.121.250 1 diff --git a/tests/cfgs/default/result/ldp.pcap.out b/tests/cfgs/default/result/ldp.pcap.out index df8020fd5..2888e0753 100644 --- a/tests/cfgs/default/result/ldp.pcap.out +++ b/tests/cfgs/default/result/ldp.pcap.out @@ -25,6 +25,8 @@ LDP 7 946 3 Acceptable 7 946 3 +Network 7 946 3 + 1 TCP 10.0.1.1:45334 <-> 10.0.0.6:646 [proto: 409/LDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 409/LDP, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/366 bytes <-> 2 pkts/352 bytes][Goodput ratio: 70/69][0.13 sec][Plen Bins: 0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.0.0.2:646 -> 224.0.0.2:646 [proto: 409/LDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 409/LDP, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/152 bytes -> 0 pkts/0 bytes][Goodput ratio: 44/0][4.08 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.0.0.1:646 -> 224.0.0.2:646 [proto: 409/LDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 409/LDP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/76 bytes -> 0 pkts/0 bytes][Goodput ratio: 44/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/line.pcap.out b/tests/cfgs/default/result/line.pcap.out index bf0b8ef6a..d75678cfc 100644 --- a/tests/cfgs/default/result/line.pcap.out +++ b/tests/cfgs/default/result/line.pcap.out @@ -28,6 +28,10 @@ LineCall 181 42253 3 Safe 72 11499 1 Acceptable 218 51733 4 +Web 72 11499 1 +Chat 37 9480 1 +VoIP 181 42253 3 + JA Host Stats: IP Address # JA4C 1 10.200.3.125 1 diff --git a/tests/cfgs/default/result/linecall_falsepositve.pcap.out b/tests/cfgs/default/result/linecall_falsepositve.pcap.out index f56465db9..9d4fb93ab 100644 --- a/tests/cfgs/default/result/linecall_falsepositve.pcap.out +++ b/tests/cfgs/default/result/linecall_falsepositve.pcap.out @@ -24,6 +24,8 @@ Unknown 42 16442 1 Unrated 42 16442 1 +Unspecified 42 16442 1 + Undetected flows: diff --git a/tests/cfgs/default/result/lisp_registration.pcap.out b/tests/cfgs/default/result/lisp_registration.pcap.out index b986ff3c5..0c11e8c21 100644 --- a/tests/cfgs/default/result/lisp_registration.pcap.out +++ b/tests/cfgs/default/result/lisp_registration.pcap.out @@ -25,6 +25,8 @@ LISP 30 5266 4 Acceptable 30 5266 4 +Cloud 30 5266 4 + 1 TCP 10.0.123.3:52995 <-> 10.0.123.1:4342 [proto: 236/LISP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Cloud/13][4 pkts/894 bytes <-> 3 pkts/715 bytes][Goodput ratio: 74/76][0.36 sec][bytes ratio: 0.111 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/1 120/73 213/145 88/72][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 224/238 714/586 283/246][TCP Fingerprint: 2_255_16384_6bbe28597824/Unknown][Plen Bins: 33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.0.123.2:15373 <-> 10.0.123.1:4342 [proto: 236/LISP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Cloud/13][4 pkts/682 bytes <-> 3 pkts/635 bytes][Goodput ratio: 66/73][0.36 sec][bytes ratio: 0.036 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/2 118/74 208/146 87/72][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 170/212 502/506 191/208][TCP Fingerprint: 2_255_16384_6bbe28597824/Unknown][Plen Bins: 33,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.0.123.3:4342 <-> 10.0.123.1:4342 [proto: 236/LISP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 236/LISP, Confidence: DPI][DPI packets: 1][cat: Cloud/13][4 pkts/636 bytes <-> 4 pkts/568 bytes][Goodput ratio: 73/70][0.01 sec][bytes ratio: 0.056 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/2 0/5 0/2][Pkt Len c2s/s2c min/avg/max/stddev: 142/130 159/142 182/154 15/8][Plen Bins: 0,0,12,75,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out b/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out index 6fb044ab5..48404b0fe 100644 --- a/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out +++ b/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out @@ -28,6 +28,11 @@ LDAP 32 2796 2 Acceptable 66 9537 5 Unrated 356 25081 2 +Unspecified 356 25081 2 +Web 9 1497 1 +Download 25 5244 2 +System 32 2796 2 + 1 TCP 172.16.238.10:48534 <-> 172.16.238.11:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Download/7][7 pkts/692 bytes <-> 6 pkts/1964 bytes][Goodput ratio: 30/79][0.00 sec][Hostname/SNI: 172.16.238.11][bytes ratio: -0.479 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 1/1 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 68/68 99/327 276/1420 72/494][URL: 172.16.238.11/Exploit.class][StatusCode: 200][Content-Type: application/java-vm][Server: SimpleHTTP/0.6 Python/3.4.2][User-Agent: Java/1.8.0_51][Risk: ** Binary App Transfer **** HTTP/TLS/QUIC Numeric Hostname/SNI **** Possible Exploit Attempt **][Risk Score: 310][Risk Info: Suspicious Log4J / Found host 172.16.238.11 / Found mime exe java-vm][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (GET /Exploit.class HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0] 2 TCP 172.16.238.10:48444 <-> 172.16.238.11:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Download/7][6 pkts/624 bytes <-> 6 pkts/1964 bytes][Goodput ratio: 33/79][0.01 sec][Hostname/SNI: 172.16.238.11][bytes ratio: -0.518 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1/2 3/3 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 68/68 104/327 276/1420 77/494][URL: 172.16.238.11/Exploit.class][StatusCode: 200][Content-Type: application/java-vm][Server: SimpleHTTP/0.6 Python/3.4.2][User-Agent: Java/1.8.0_51][Risk: ** Binary App Transfer **** HTTP/TLS/QUIC Numeric Hostname/SNI **** Possible Exploit Attempt **][Risk Score: 310][Risk Info: Suspicious Log4J / Found host 172.16.238.11 / Found mime exe java-vm][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (GGET /Exploit.class HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0] 3 TCP 172.16.238.1:1984 <-> 172.16.238.10:8080 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: Web/5][5 pkts/994 bytes <-> 4 pkts/503 bytes][Goodput ratio: 65/44][19.29 sec][Hostname/SNI: 192.168.13.31][bytes ratio: 0.328 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/7 4822/6428 10256/10256 4838/4568][Pkt Len c2s/s2c min/avg/max/stddev: 68/68 199/126 714/291 258/95][URL: 192.168.13.31:8080/log4shell/login][StatusCode: 200][Req Content-Type: application/x-www-form-urlencoded][Content-Type: text/html][User-Agent: jndi:ldap://172.16.238.11:1389/a][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Susp Header **** Possible Exploit Attempt **][Risk Score: 310][Risk Info: Suspicious Log4J / Expected 172.16.238.10, found 192.168.13.31 / Found host 192.168.13.31 / Expected on port 80][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (POST /log)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/lol_wild_rift_udp.pcap.out b/tests/cfgs/default/result/lol_wild_rift_udp.pcap.out index 9248c9eea..99bc7a5c6 100644 --- a/tests/cfgs/default/result/lol_wild_rift_udp.pcap.out +++ b/tests/cfgs/default/result/lol_wild_rift_udp.pcap.out @@ -24,6 +24,8 @@ LoLWildRift 8 1552 5 Fun 8 1552 5 +Game 8 1552 5 + 1 UDP 10.215.173.1:43686 <-> 13.51.213.131:15007 [proto: 407/LoLWildRift][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 2][cat: Game/8][1 pkts/97 bytes <-> 1 pkts/387 bytes][Goodput ratio: 70/93][0.03 sec][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.215.173.1:46702 <-> 51.20.230.207:15007 [proto: 407/LoLWildRift][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 2][cat: Game/8][1 pkts/97 bytes <-> 1 pkts/387 bytes][Goodput ratio: 70/93][0.08 sec][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.215.173.1:47462 <-> 51.20.230.207:15004 [proto: 407/LoLWildRift][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 2][cat: Game/8][1 pkts/97 bytes <-> 1 pkts/387 bytes][Goodput ratio: 70/93][0.09 sec][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/long_tls_certificate.pcap.out b/tests/cfgs/default/result/long_tls_certificate.pcap.out index 94e7f03a8..f11e3f767 100644 --- a/tests/cfgs/default/result/long_tls_certificate.pcap.out +++ b/tests/cfgs/default/result/long_tls_certificate.pcap.out @@ -24,6 +24,8 @@ Alibaba 47 14812 1 Acceptable 47 14812 1 +Web 47 14812 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.60 1 diff --git a/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out b/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out index 46f516804..1a4ee599e 100644 --- a/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out +++ b/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out @@ -29,6 +29,10 @@ Cloudflare 9 8862 3 Acceptable 88 20854 12 +Web 9 8862 3 +Download 25 4546 5 +VoIP 54 7446 4 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/lustre.pcapng.out b/tests/cfgs/default/result/lustre.pcapng.out index 4ea96dc49..16f1b320b 100644 --- a/tests/cfgs/default/result/lustre.pcapng.out +++ b/tests/cfgs/default/result/lustre.pcapng.out @@ -24,5 +24,7 @@ Lustre 22 7236 2 Acceptable 22 7236 2 +DataTransfer 22 7236 2 + 1 TCP 192.168.88.118:1023 <-> 192.168.88.119:988 [proto: 425/Lustre][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 425/Lustre, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][8 pkts/4040 bytes <-> 6 pkts/2524 bytes][Goodput ratio: 87/84][0.00 sec][bytes ratio: 0.231 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 162/66 505/421 682/578 165/166][PLAIN TEXT (78fb09f)][Plen Bins: 0,0,0,7,0,0,0,0,0,0,0,30,0,30,0,0,7,0,0,23,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.88.132:1022 <-> 192.168.88.131:988 [proto: 425/Lustre][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: DataTransfer/4][4 pkts/344 bytes <-> 4 pkts/328 bytes][Goodput ratio: 21/17][< 1 sec][bytes ratio: 0.024 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 86/82 122/122 22/23][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][Plen Bins: 33,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/malformed_dns.pcap.out b/tests/cfgs/default/result/malformed_dns.pcap.out index e09fcb6e6..959730e79 100644 --- a/tests/cfgs/default/result/malformed_dns.pcap.out +++ b/tests/cfgs/default/result/malformed_dns.pcap.out @@ -24,4 +24,6 @@ DNS 6 5860 1 Acceptable 6 5860 1 +Network 6 5860 1 + 1 UDP 127.0.0.1:50435 <-> 127.0.0.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][2 pkts/140 bytes <-> 4 pkts/5720 bytes][Goodput ratio: 40/97][5.03 sec][Hostname/SNI: www.xt.com][66.66.66.66][DNS Id: 0x84b4][bytes ratio: -0.952 (Download)][IAT c2s/s2c min/avg/max/stddev: 4999/13 4999/1670 4999/4983 0/2343][Pkt Len c2s/s2c min/avg/max/stddev: 70/1430 70/1430 70/1430 0/0][Risk: ** Malformed Packet **** Large DNS Packet (512+ bytes) **** Minor Issues **][Risk Score: 70][Risk Info: DNS Record with zero TTL / 1388 Bytes DNS Packet / Invalid DNS Query Lenght][PLAIN TEXT (AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA)][Plen Bins: 33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0] diff --git a/tests/cfgs/default/result/malformed_icmp.pcap.out b/tests/cfgs/default/result/malformed_icmp.pcap.out index f70315839..56971a885 100644 --- a/tests/cfgs/default/result/malformed_icmp.pcap.out +++ b/tests/cfgs/default/result/malformed_icmp.pcap.out @@ -24,4 +24,6 @@ ICMP 1 42 1 Acceptable 1 42 1 +Network 1 42 1 + 1 ICMP 218.152.179.213:0 -> 218.152.179.54:0 [proto: 81/ICMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 81/ICMP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/42 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Malformed Packet **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Invalid type (165)/code(0)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/malware.pcap.out b/tests/cfgs/default/result/malware.pcap.out index c61b0e26e..5ee6f2b23 100644 --- a/tests/cfgs/default/result/malware.pcap.out +++ b/tests/cfgs/default/result/malware.pcap.out @@ -33,6 +33,10 @@ TLS 94 60194 2 Safe 94 60194 2 Acceptable 6 861 4 +Web 74 53054 1 +Network 2 216 1 +Malware 24 7785 4 + JA Host Stats: IP Address # JA4C 1 192.168.0.20 1 diff --git a/tests/cfgs/default/result/massscan.pcap.out b/tests/cfgs/default/result/massscan.pcap.out index 2d53b6456..2f6f757de 100644 --- a/tests/cfgs/default/result/massscan.pcap.out +++ b/tests/cfgs/default/result/massscan.pcap.out @@ -26,6 +26,8 @@ HTTP 10 540 10 Acceptable 10 540 10 +Web 10 540 10 + 1 TCP 192.168.2.61:43895 -> 192.168.2.1:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/54 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Malicious Fingerpint **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No server to client traffic / Massive scanner detected (probably masscan)][TCP Fingerprint: 2_255_1024_e3b0c44298fc/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.2.61:43895 -> 192.168.2.9:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/54 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Malicious Fingerpint **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No server to client traffic / Massive scanner detected (probably masscan)][TCP Fingerprint: 2_255_1024_e3b0c44298fc/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.61:43895 -> 192.168.2.39:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/54 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Malicious Fingerpint **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No server to client traffic / Massive scanner detected (probably masscan)][TCP Fingerprint: 2_255_1024_e3b0c44298fc/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/melsec.pcapng.out b/tests/cfgs/default/result/melsec.pcapng.out index 37d43210d..7525fd94a 100644 --- a/tests/cfgs/default/result/melsec.pcapng.out +++ b/tests/cfgs/default/result/melsec.pcapng.out @@ -25,6 +25,8 @@ MELSEC 13 1040 3 Acceptable 13 1040 3 +IoT-Scada 13 1040 3 + 1 TCP 172.17.0.158:40260 <-> 172.17.0.134:5007 [proto: 75/MELSEC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: IoT-Scada/31][6 pkts/411 bytes <-> 5 pkts/415 bytes][Goodput ratio: 18/31][0.01 sec][bytes ratio: -0.005 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/3 3/4 5/5 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 68/83 125/153 26/36][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (PU )][Plen Bins: 50,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.3.250:5560 -> 255.255.255.255:49156 [proto: 75/MELSEC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 75/MELSEC, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/119 bytes -> 0 pkts/0 bytes][Goodput ratio: 64/0][< 1 sec][PLAIN TEXT (32MT/ES)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.3.101:49156 -> 255.255.255.255:5560 [proto: 75/MELSEC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 75/MELSEC, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/95 bytes -> 0 pkts/0 bytes][Goodput ratio: 55/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/memcached.cap.out b/tests/cfgs/default/result/memcached.cap.out index 865432b7c..e2abed836 100644 --- a/tests/cfgs/default/result/memcached.cap.out +++ b/tests/cfgs/default/result/memcached.cap.out @@ -24,4 +24,6 @@ Memcached 10 1711 1 Acceptable 10 1711 1 +Network 10 1711 1 + 1 TCP 127.0.0.1:59604 <-> 127.0.0.1:11211 [proto: 40/Memcached][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][6 pkts/411 bytes <-> 4 pkts/1300 bytes][Goodput ratio: 2/79][< 1 sec][bytes ratio: -0.520 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/325 74/1094 4/444][TCP Fingerprint: 2_64_43690_db1b9381215d/Unknown][PLAIN TEXT (STAT pid 8837)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/merakicloud.pcapng.out b/tests/cfgs/default/result/merakicloud.pcapng.out index c77b477ab..f43099be0 100644 --- a/tests/cfgs/default/result/merakicloud.pcapng.out +++ b/tests/cfgs/default/result/merakicloud.pcapng.out @@ -24,4 +24,6 @@ MerakiCloud 44 6049 1 Acceptable 44 6049 1 +Network 44 6049 1 + 1 UDP 2.36.234.133:47301 <-> 209.206.59.34:7351 [proto: 66/MerakiCloud][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 66/MerakiCloud, Confidence: DPI][DPI packets: 1][cat: Network/14][22 pkts/3603 bytes <-> 22 pkts/2446 bytes][Goodput ratio: 74/62][400.21 sec][bytes ratio: 0.191 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 198/199 19165/19166 25000/25010 10520/10521][Pkt Len c2s/s2c min/avg/max/stddev: 154/88 164/111 197/190 18/43][Plen Bins: 0,38,0,38,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mgcp.pcap.out b/tests/cfgs/default/result/mgcp.pcap.out index 7ad2dc6d6..8f35e5c43 100644 --- a/tests/cfgs/default/result/mgcp.pcap.out +++ b/tests/cfgs/default/result/mgcp.pcap.out @@ -24,6 +24,8 @@ MGCP 23 2731 5 Acceptable 23 2731 5 +VoIP 23 2731 5 + 1 UDP 10.10.228.72:2427 <-> 10.10.244.2:2427 [proto: 94/MGCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 94/MGCP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][6 pkts/1254 bytes <-> 6 pkts/418 bytes][Goodput ratio: 79/40][6.26 sec][Hostname/SNI: vg224][bytes ratio: 0.500 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 884/884 3523/3523 1524/1523][Pkt Len c2s/s2c min/avg/max/stddev: 60/57 209/70 846/104 285/19][PLAIN TEXT (RSIP 262662134 )][Plen Bins: 41,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 172.16.1.116:2427 <-> 172.16.1.119:2427 [proto: 94/MGCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 94/MGCP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][4 pkts/370 bytes <-> 4 pkts/395 bytes][Goodput ratio: 54/57][80.75 sec][Hostname/SNI: gateway44.myplace.com][bytes ratio: -0.033 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 9/36 26914/26914 76721/76695 35257/35238][Pkt Len c2s/s2c min/avg/max/stddev: 61/98 92/99 103/101 18/1][PLAIN TEXT (RQNT 1 )][Plen Bins: 12,87,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 67.232.180.250:38238 -> 186.112.128.179:2427 [proto: 94/MGCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 94/MGCP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][1 pkts/98 bytes -> 0 pkts/0 bytes][Goodput ratio: 57/0][< 1 sec][Hostname/SNI: gateway44.myplace.com][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (RQNT 1 )][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mikrotik_mndp.pcap.out b/tests/cfgs/default/result/mikrotik_mndp.pcap.out index 631e6c806..1a853e2f6 100644 --- a/tests/cfgs/default/result/mikrotik_mndp.pcap.out +++ b/tests/cfgs/default/result/mikrotik_mndp.pcap.out @@ -24,6 +24,8 @@ Mikrotik 3 601 3 Acceptable 3 601 3 +Network 3 601 3 + 1 UDP 192.168.2.106:5678 -> 255.255.255.255:5678 [proto: 437/Mikrotik][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 437/Mikrotik, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/219 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (MikroTik Ax)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP [fe80::4e5e:cff:feea:365]:5678 -> [ff02::1]:5678 [proto: 437/Mikrotik][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 437/Mikrotik, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/197 bytes -> 0 pkts/0 bytes][Goodput ratio: 68/0][< 1 sec][PLAIN TEXT (6.35.1 )][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP [fe80::4e5e:cff:fe9a:ec54]:5678 -> [ff02::1]:5678 [proto: 437/Mikrotik][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 437/Mikrotik, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/185 bytes -> 0 pkts/0 bytes][Goodput ratio: 66/0][< 1 sec][PLAIN TEXT (6.35.1 )][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mining.pcapng.out b/tests/cfgs/default/result/mining.pcapng.out index 3e9c18edd..21387a285 100644 --- a/tests/cfgs/default/result/mining.pcapng.out +++ b/tests/cfgs/default/result/mining.pcapng.out @@ -24,6 +24,8 @@ Mining 673 219078 4 Unsafe 673 219078 4 +Mining 673 219078 4 + 1 TCP 192.168.2.148:46838 <-> 94.23.199.191:3333 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Mining/99][159 pkts/143155 bytes <-> 113 pkts/13204 bytes][Goodput ratio: 93/43][1091.42 sec][currency: ZCash][bytes ratio: 0.831 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 7234/8131 71734/71815 15224/15291][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 900/117 1514/376 709/99][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (method)][Plen Bins: 28,2,0,1,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,29,29,0,0] 2 TCP 147.229.13.222:49307 <-> 185.71.66.39:9999 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Mining/99][112 pkts/10941 bytes <-> 97 pkts/20817 bytes][Goodput ratio: 45/74][295.93 sec][currency: Ethereum][bytes ratio: -0.311 (Download)][IAT c2s/s2c min/avg/max/stddev: 8/0 2992/2893 9784/10017 3265/3384][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 98/215 259/297 57/112][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_128_8192_4697958db063/Windows][PLAIN TEXT (worker)][Plen Bins: 0,1,28,0,12,0,0,58,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.92:55190 <-> 178.32.196.217:9050 [proto: 42/Mining][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Mining/99][83 pkts/11785 bytes <-> 62 pkts/8859 bytes][Goodput ratio: 53/53][1154.54 sec][currency: ZCash/Monero][bytes ratio: 0.142 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 15953/19141 60205/60205 20621/20751][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 142/143 326/369 91/88][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (method)][Plen Bins: 0,40,0,0,0,44,0,13,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/modbus.pcap.out b/tests/cfgs/default/result/modbus.pcap.out index 341fc280a..16ed05907 100644 --- a/tests/cfgs/default/result/modbus.pcap.out +++ b/tests/cfgs/default/result/modbus.pcap.out @@ -24,4 +24,6 @@ Modbus 102 6681 1 Acceptable 102 6681 1 +IoT-Scada 102 6681 1 + 1 TCP 192.168.110.131:2074 <-> 192.168.110.138:502 [proto: 44/Modbus][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 44/Modbus, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][51 pkts/3366 bytes <-> 51 pkts/3315 bytes][Goodput ratio: 18/17][23.11 sec][bytes ratio: 0.008 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 477/477 1073/1074 501/501][Pkt Len c2s/s2c min/avg/max/stddev: 66/65 66/65 66/65 0/0][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/monero.pcap.out b/tests/cfgs/default/result/monero.pcap.out index d1b6358af..069b69d4c 100644 --- a/tests/cfgs/default/result/monero.pcap.out +++ b/tests/cfgs/default/result/monero.pcap.out @@ -24,6 +24,8 @@ Monero 60 61276 4 Acceptable 60 61276 4 +Crypto_Currency 60 61276 4 + 1 TCP 192.168.2.100:48882 <-> 159.69.36.66:18080 [proto: 369/Monero][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Crypto_Currency/106][10 pkts/907 bytes <-> 5 pkts/14808 bytes][Goodput ratio: 32/98][0.05 sec][bytes ratio: -0.885 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/6 25/19 10/8][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 91/2962 349/7314 86/2751][TCP Fingerprint: 2_192_64240_565ad129ac37/Unknown][PLAIN TEXT (network)][Plen Bins: 0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,75] 2 TCP 192.168.2.100:39378 <-> 78.56.22.89:18080 [proto: 369/Monero][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Crypto_Currency/106][7 pkts/709 bytes <-> 8 pkts/14970 bytes][Goodput ratio: 42/97][0.11 sec][bytes ratio: -0.910 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 21/9 54/50 26/18][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 101/1871 349/2958 101/1201][TCP Fingerprint: 2_192_64240_565ad129ac37/Unknown][PLAIN TEXT (network)][Plen Bins: 0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,28,0,57] 3 TCP 192.168.2.100:38004 <-> 100.42.27.58:18085 [proto: 369/Monero][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Crypto_Currency/106][5 pkts/577 bytes <-> 10 pkts/15078 bytes][Goodput ratio: 51/96][0.23 sec][bytes ratio: -0.926 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 75/14 115/110 53/36][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 115/1508 349/2958 117/915][TCP Fingerprint: 2_192_64240_565ad129ac37/Unknown][PLAIN TEXT (network)][Plen Bins: 0,0,0,0,0,0,0,0,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,22] diff --git a/tests/cfgs/default/result/mongo_false_positive.pcapng.out b/tests/cfgs/default/result/mongo_false_positive.pcapng.out index 16a2b65db..ad143b27d 100644 --- a/tests/cfgs/default/result/mongo_false_positive.pcapng.out +++ b/tests/cfgs/default/result/mongo_false_positive.pcapng.out @@ -26,4 +26,6 @@ TLS 26 12163 1 Safe 26 12163 1 +Web 26 12163 1 + 1 TCP 188.75.184.20:49542 <-> 251.182.120.32:443 [proto: 91/TLS][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 13][cat: Web/5][13 pkts/9962 bytes <-> 13 pkts/2201 bytes][Goodput ratio: 93/67][84.45 sec][bytes ratio: 0.638 (Upload)][IAT c2s/s2c min/avg/max/stddev: 186/186 7406/5844 21467/15787 7157/5701][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 766/169 1328/189 433/46][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.766 (Encrypted or Random?)][TCP Fingerprint: 2_128_8192_5e2eda046ca7/Unknown][Plen Bins: 0,0,0,0,51,0,0,0,0,9,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,9,9,0,0,0,4,0,0,4,0,4,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mongodb.pcap.out b/tests/cfgs/default/result/mongodb.pcap.out index 8a89e67da..a5215d569 100644 --- a/tests/cfgs/default/result/mongodb.pcap.out +++ b/tests/cfgs/default/result/mongodb.pcap.out @@ -30,6 +30,9 @@ MongoDB 24 2510 7 Acceptable 24 2510 7 Unrated 3 230 1 +Unspecified 3 230 1 +Database 24 2510 7 + 1 TCP 10.10.10.16:51358 <-> 10.10.10.17:27017 [VLAN: 100][proto: 60/MongoDB][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][3 pkts/491 bytes <-> 1 pkts/78 bytes][Goodput ratio: 55/0][0.00 sec][TCP Fingerprint: 2_64_65535_37c89335710b/Unknown][PLAIN TEXT (admin.)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.10.10.10:51822 <-> 10.10.10.11:27017 [VLAN: 300][proto: 60/MongoDB][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][3 pkts/469 bytes <-> 1 pkts/78 bytes][Goodput ratio: 53/0][0.34 sec][TCP Fingerprint: 2_64_65535_d761c040be70/Unknown][PLAIN TEXT (admin.)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.10.10.18:64566 <-> 10.10.10.19:30000 [VLAN: 300][proto: 60/MongoDB][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][3 pkts/295 bytes <-> 1 pkts/78 bytes][Goodput ratio: 25/0][0.10 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 27017][TCP Fingerprint: 2_64_65535_d761c040be70/Unknown][PLAIN TEXT (InactiveUserIdentity.)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mpeg-dash.pcap.out b/tests/cfgs/default/result/mpeg-dash.pcap.out index 62f906818..98bac158a 100644 --- a/tests/cfgs/default/result/mpeg-dash.pcap.out +++ b/tests/cfgs/default/result/mpeg-dash.pcap.out @@ -24,6 +24,8 @@ MpegDash 13 4669 4 Fun 13 4669 4 +Media 13 4669 4 + 1 TCP 10.84.1.81:60926 <-> 166.248.152.10:80 [proto: 7.291/HTTP.MpegDash][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Media/1][2 pkts/456 bytes <-> 2 pkts/1520 bytes][Goodput ratio: 72/92][0.30 sec][Hostname/SNI: gdl.news-cdn.site][URL: gdl.news-cdn.site/as/bigo-ad-creatives/3s3/2lOTA7.mp4][StatusCode: 200][Content-Type: video/mp4][Server: openresty][User-Agent: Mozilla/5.0 (Linux; Android 11; SM-A715F Build/RP1A.200720.012; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/89.0.4389.105 Mobile Safari/537.36][TCP Fingerprint: 2_64_65535_d876f498b09e/Android][PLAIN TEXT (GET /as/bigo)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0] 2 TCP 54.161.101.85:80 <-> 192.168.2.105:59144 [proto: 7.291/HTTP.MpegDash][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 7.291/HTTP.MpegDash, Confidence: DPI][DPI packets: 4][cat: Media/1][2 pkts/1649 bytes <-> 2 pkts/323 bytes][Goodput ratio: 92/59][0.01 sec][Hostname/SNI: livesim.dashif.org][URL: livesim.dashif.org/livesim/sts_1652783809/sid_40c11e12/chunkdur_1/ato_7/testpic4_8s/V2400/206598098.m4s][User-Agent: VLC/3.0.16 LibVLC/3.0.16][PLAIN TEXT (OHTTP/1.1 200 OK)][Plen Bins: 0,0,33,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0] 3 TCP 192.168.2.105:59142 <-> 54.161.101.85:80 [proto: 7.291/HTTP.MpegDash][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Media/1][3 pkts/390 bytes <-> 1 pkts/74 bytes][Goodput ratio: 47/0][0.10 sec][Hostname/SNI: livesim.dashif.org][URL: livesim.dashif.org/livesim/sts_1652783809/sid_40c11e12/chunkdur_1/ato_7/testpic4_8s/A48/init.mp4][User-Agent: VLC/3.0.16 LibVLC/3.0.16][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (IGET /livesim/sts)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mpeg.pcap.out b/tests/cfgs/default/result/mpeg.pcap.out index 3bfac3bce..e907a6e90 100644 --- a/tests/cfgs/default/result/mpeg.pcap.out +++ b/tests/cfgs/default/result/mpeg.pcap.out @@ -24,4 +24,6 @@ ntop 19 10643 1 Safe 19 10643 1 +Media 19 10643 1 + 1 TCP 192.168.80.160:55804 <-> 46.101.157.119:80 [proto: 7.26/HTTP.ntop][IP: 442/DigitalOcean][ClearText][Confidence: DPI][FPC: 442/DigitalOcean, Confidence: IP address][DPI packets: 6][cat: Media/1][9 pkts/754 bytes <-> 10 pkts/9889 bytes][Goodput ratio: 20/93][0.18 sec][Hostname/SNI: luca.ntop.org][bytes ratio: -0.858 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 25/6 77/41 28/14][Pkt Len c2s/s2c min/avg/max/stddev: 66/68 84/989 214/1502 46/649][URL: luca.ntop.org/0.mp3][StatusCode: 200][Content-Type: audio/mpeg][Server: Apache/2.4.7 (Ubuntu)][User-Agent: Wget/1.16.3 (darwin14.1.0)][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][PLAIN TEXT (GET /0.mp)][Plen Bins: 0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,75,0,0,0] diff --git a/tests/cfgs/default/result/mpegts.pcap.out b/tests/cfgs/default/result/mpegts.pcap.out index 1336c24aa..abef1254b 100644 --- a/tests/cfgs/default/result/mpegts.pcap.out +++ b/tests/cfgs/default/result/mpegts.pcap.out @@ -24,4 +24,6 @@ MPEG_TS 1 1362 1 Fun 1 1362 1 +Media 1 1362 1 + 1 UDP 10.1.16.48:40737 -> 230.200.201.23:1234 [VLAN: 3359][proto: 198/MPEG_TS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 198/MPEG_TS, Confidence: DPI][DPI packets: 1][cat: Media/1][1 pkts/1362 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mqtt.pcap.out b/tests/cfgs/default/result/mqtt.pcap.out index e182905f9..d1bf7910a 100644 --- a/tests/cfgs/default/result/mqtt.pcap.out +++ b/tests/cfgs/default/result/mqtt.pcap.out @@ -24,5 +24,7 @@ MQTT 9 1481 2 Acceptable 9 1481 2 +RPC 9 1481 2 + 1 TCP 10.10.10.1:1883 <-> 192.168.0.1:41892 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: RPC/16][4 pkts/370 bytes <-> 4 pkts/756 bytes][Goodput ratio: 26/65][1.69 sec][bytes ratio: -0.343 (Download)][IAT c2s/s2c min/avg/max/stddev: 79/80 261/561 618/1000 253/377][Pkt Len c2s/s2c min/avg/max/stddev: 70/68 92/189 155/458 36/157][PLAIN TEXT (bbbbbaaaaab)][Plen Bins: 42,14,28,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 100.67.35.238:35035 -> 51.137.28.239:1883 [VLAN: 1008][proto: 222/MQTT][IP: 276/Azure][ClearText][Confidence: DPI][FPC: 222/MQTT, Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/355 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (Jiotazewpmlithub.azure)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/msdo.pcapng.out b/tests/cfgs/default/result/msdo.pcapng.out index 6bf65aef0..c43bc599a 100644 --- a/tests/cfgs/default/result/msdo.pcapng.out +++ b/tests/cfgs/default/result/msdo.pcapng.out @@ -24,4 +24,6 @@ MSDO 10 746 1 Safe 10 746 1 +SoftwareUpdate 10 746 1 + 1 TCP 192.168.1.31:49741 <-> 192.168.1.30:7680 [proto: 448/MSDO][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: SoftwareUpdate/19][6 pkts/424 bytes <-> 4 pkts/322 bytes][Goodput ratio: 21/27][0.00 sec][bytes ratio: 0.137 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 1/1 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 71/80 129/129 27/28][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (Swarm protocol)][Plen Bins: 50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mssql_tds.pcap.out b/tests/cfgs/default/result/mssql_tds.pcap.out index 10f732d73..045673116 100644 --- a/tests/cfgs/default/result/mssql_tds.pcap.out +++ b/tests/cfgs/default/result/mssql_tds.pcap.out @@ -27,6 +27,8 @@ MsSQL-TDS 38 16260 12 Acceptable 38 16260 12 +Database 38 16260 12 + 1 TCP 10.111.111.111:6666 -> 10.0.0.1:1433 [proto: 114/MsSQL-TDS][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: Database/11][7 pkts/8717 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 393/0 1245/0 1514/0 436/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,71,0,0] 2 TCP 10.111.111.111:5555 <-> 10.0.0.1:1433 [proto: 114/MsSQL-TDS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 114/MsSQL-TDS, Confidence: DPI][DPI packets: 1][cat: Database/11][10 pkts/1552 bytes <-> 7 pkts/1521 bytes][Goodput ratio: 64/75][7.22 sec][bytes ratio: 0.010 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 31/28 867/1024 1890/2071 763/864][Pkt Len c2s/s2c min/avg/max/stddev: 60/88 155/217 307/492 90/169][PLAIN TEXT (first )][Plen Bins: 0,42,7,14,0,7,0,14,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.111.111.111:1111 <-> 10.0.0.1:1433 [proto: 114/MsSQL-TDS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 114/MsSQL-TDS, Confidence: DPI][DPI packets: 1][cat: Database/11][2 pkts/614 bytes <-> 2 pkts/524 bytes][Goodput ratio: 78/75][0.14 sec][Plen Bins: 0,25,0,0,0,25,0,0,0,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mullvad_dns.pcap.out b/tests/cfgs/default/result/mullvad_dns.pcap.out index 2c7190804..f65633929 100644 --- a/tests/cfgs/default/result/mullvad_dns.pcap.out +++ b/tests/cfgs/default/result/mullvad_dns.pcap.out @@ -24,4 +24,6 @@ DNS 2 214 1 Acceptable 2 214 1 +Network 2 214 1 + 1 UDP 192.168.122.11:51696 <-> 9.9.9.9:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/98 bytes <-> 1 pkts/116 bytes][Goodput ratio: 57/63][0.05 sec][Hostname/SNI: www.mullvad.net][45.83.223.209][DNS Id: 0x5986][PLAIN TEXT (mullvad)][Plen Bins: 0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mullvad_wireguard.pcap.out b/tests/cfgs/default/result/mullvad_wireguard.pcap.out index 31b3e02fc..15e45b43c 100644 --- a/tests/cfgs/default/result/mullvad_wireguard.pcap.out +++ b/tests/cfgs/default/result/mullvad_wireguard.pcap.out @@ -24,4 +24,6 @@ Mullvad 10 1924 1 Acceptable 10 1924 1 +VPN 10 1924 1 + 1 UDP 192.168.122.11:22595 <-> 198.54.131.98:5060 [proto: 206.348/WireGuard.Mullvad][IP: 348/Mullvad][Encrypted][Confidence: DPI][FPC: 348/Mullvad, Confidence: IP address][DPI packets: 3][cat: VPN/2][6 pkts/828 bytes <-> 4 pkts/1096 bytes][Goodput ratio: 69/85][0.97 sec][bytes ratio: -0.139 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/234 193/239 470/248 177/6][Pkt Len c2s/s2c min/avg/max/stddev: 122/122 138/274 202/714 29/254][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 51820][Plen Bins: 0,0,60,20,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mumble.pcapng.out b/tests/cfgs/default/result/mumble.pcapng.out index f711cb5ee..54e7de0d7 100644 --- a/tests/cfgs/default/result/mumble.pcapng.out +++ b/tests/cfgs/default/result/mumble.pcapng.out @@ -25,6 +25,8 @@ Mumble 10 2551 3 Fun 10 2551 3 +VoIP 10 2551 3 + JA Host Stats: IP Address # JA4C 1 192.168.88.208 1 diff --git a/tests/cfgs/default/result/munin.pcap.out b/tests/cfgs/default/result/munin.pcap.out index 8d8a50058..1f96a6c88 100644 --- a/tests/cfgs/default/result/munin.pcap.out +++ b/tests/cfgs/default/result/munin.pcap.out @@ -24,6 +24,8 @@ Munin 60 5422 4 Acceptable 60 5422 4 +System 60 5422 4 + 1 TCP 172.16.16.108:59958 <-> 172.16.17.1:4949 [proto: 329/Munin][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: System/18][8 pkts/592 bytes <-> 7 pkts/835 bytes][Goodput ratio: 9/44][0.22 sec][Hostname/SNI: gw-ct][bytes ratio: -0.170 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 18/24 30/35 13/12][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 74/119 93/349 10/95][TCP Fingerprint: 2_64_62720_ac6c0b5dcfcf/Unknown][PLAIN TEXT ( munin node at gw)][Plen Bins: 75,12,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.16.16.108:55256 <-> 172.16.17.102:4949 [proto: 329/Munin][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: System/18][8 pkts/602 bytes <-> 7 pkts/737 bytes][Goodput ratio: 11/36][0.23 sec][Hostname/SNI: elastic-node02][bytes ratio: -0.101 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 20/27 34/47 14/15][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 75/105 93/251 10/61][TCP Fingerprint: 2_64_62720_ac6c0b5dcfcf/Unknown][PLAIN TEXT ( munin node at elastic)][Plen Bins: 87,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 172.16.16.108:45654 <-> 172.16.17.103:4949 [proto: 329/Munin][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: System/18][8 pkts/596 bytes <-> 7 pkts/732 bytes][Goodput ratio: 10/36][0.25 sec][Hostname/SNI: kibana-node01][bytes ratio: -0.102 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 21/29 42/50 15/17][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 74/105 93/251 10/61][TCP Fingerprint: 2_64_62720_ac6c0b5dcfcf/Unknown][PLAIN TEXT ( munin node at kibana)][Plen Bins: 87,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mysql.pcapng.out b/tests/cfgs/default/result/mysql.pcapng.out index 8345b0f6f..52a4cb830 100644 --- a/tests/cfgs/default/result/mysql.pcapng.out +++ b/tests/cfgs/default/result/mysql.pcapng.out @@ -24,5 +24,7 @@ MySQL 41 7009 2 Acceptable 41 7009 2 +Database 41 7009 2 + 1 TCP 192.168.88.231:36272 <-> 192.168.88.200:3306 [proto: 20/MySQL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][15 pkts/1822 bytes <-> 11 pkts/3715 bytes][Goodput ratio: 45/80][2.47 sec][bytes ratio: -0.342 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 202/6 2386/24 659/9][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 121/338 388/2284 94/622][TCP Fingerprint: 2_64_32120_2e3cee914fc1/Linux][PLAIN TEXT (8.0.36)][Plen Bins: 21,21,7,14,0,0,0,21,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,7] 2 TCP 192.168.88.231:36732 <-> 192.168.88.201:3306 [proto: 20/MySQL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][9 pkts/862 bytes <-> 6 pkts/610 bytes][Goodput ratio: 30/34][2.27 sec][bytes ratio: 0.171 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 318/0 2222/1 777/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 96/102 284/176 67/44][TCP Fingerprint: 2_64_32120_2e3cee914fc1/Linux][PLAIN TEXT (10.6.12)][Plen Bins: 34,16,16,16,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/nano.pcapng.out b/tests/cfgs/default/result/nano.pcapng.out index dda2cd0b8..79e6039b7 100644 --- a/tests/cfgs/default/result/nano.pcapng.out +++ b/tests/cfgs/default/result/nano.pcapng.out @@ -24,4 +24,6 @@ Nano 6 652 1 Acceptable 6 652 1 +Crypto_Currency 6 652 1 + 1 TCP 192.168.88.231:59642 <-> 37.120.187.138:7075 [proto: 420/Nano][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Crypto_Currency/106][3 pkts/246 bytes <-> 3 pkts/406 bytes][Goodput ratio: 16/49][0.11 sec][bytes ratio: -0.245 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 26/27 51/54 26/27][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 82/135 106/266 17/92][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/natpmp.pcap.out b/tests/cfgs/default/result/natpmp.pcap.out index 6bf141707..09129d86f 100644 --- a/tests/cfgs/default/result/natpmp.pcap.out +++ b/tests/cfgs/default/result/natpmp.pcap.out @@ -24,6 +24,8 @@ NAT-PMP 11 586 4 Acceptable 11 586 4 +Network 11 586 4 + 1 UDP 192.168.1.128:36852 <-> 192.168.1.254:5351 [proto: 312/NAT-PMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 312/NAT-PMP, Confidence: DPI][DPI packets: 4][cat: Network/14][2 pkts/98 bytes <-> 2 pkts/120 bytes][Goodput ratio: 14/23][8.37 sec][Result: 0][Internal Port: 51413][External Port: 51413][External Address: 10.201.213.174][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:35763 -> 192.168.2.1:5351 [proto: 312/NAT-PMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 312/NAT-PMP, Confidence: DPI][DPI packets: 4][cat: Network/14][4 pkts/216 bytes -> 0 pkts/0 bytes][Goodput ratio: 22/0][< 1 sec][Result: 0][Internal Port: 22000][External Port: 20216][External Address: 0.0.0.0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:59817 -> 192.168.2.1:5351 [proto: 312/NAT-PMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 312/NAT-PMP, Confidence: DPI][DPI packets: 2][cat: Network/14][2 pkts/108 bytes -> 0 pkts/0 bytes][Goodput ratio: 22/0][0.25 sec][Result: 0][Internal Port: 22000][External Port: 6243][External Address: 0.0.0.0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/nats.pcap.out b/tests/cfgs/default/result/nats.pcap.out index db0656fae..0c337aa42 100644 --- a/tests/cfgs/default/result/nats.pcap.out +++ b/tests/cfgs/default/result/nats.pcap.out @@ -24,5 +24,7 @@ Nats 27 2460 2 Acceptable 27 2460 2 +RPC 27 2460 2 + 1 TCP 127.0.0.1:54821 <-> 127.0.0.1:4222 [proto: 68/Nats][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: RPC/16][7 pkts/545 bytes <-> 7 pkts/725 bytes][Goodput ratio: 26/44][2.20 sec][bytes ratio: -0.142 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1/1 3/3 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 78/104 191/365 46/107][TCP Fingerprint: 2_64_65535_73816777065d/Unknown][PLAIN TEXT (rINFO )][Plen Bins: 60,0,0,0,20,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:54820 <-> 127.0.0.1:4222 [proto: 68/Nats][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: RPC/16][7 pkts/527 bytes <-> 6 pkts/663 bytes][Goodput ratio: 26/47][0.01 sec][bytes ratio: -0.114 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 2/2 7/7 3/3][Pkt Len c2s/s2c min/avg/max/stddev: 44/56 75/110 191/365 48/114][TCP Fingerprint: 2_64_65535_73816777065d/Unknown][PLAIN TEXT (bINFO )][Plen Bins: 33,0,0,0,33,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/naver.pcap.out b/tests/cfgs/default/result/naver.pcap.out index 47922fa76..a4b3b29da 100644 --- a/tests/cfgs/default/result/naver.pcap.out +++ b/tests/cfgs/default/result/naver.pcap.out @@ -24,6 +24,8 @@ Naver 22 13795 3 Safe 22 13795 3 +Web 22 13795 3 + JA Host Stats: IP Address # JA4C 1 10.215.173.1 2 diff --git a/tests/cfgs/default/result/ndpi_match_string_subprotocol__error.pcapng.out b/tests/cfgs/default/result/ndpi_match_string_subprotocol__error.pcapng.out index 50a00796a..e3e47b1a0 100644 --- a/tests/cfgs/default/result/ndpi_match_string_subprotocol__error.pcapng.out +++ b/tests/cfgs/default/result/ndpi_match_string_subprotocol__error.pcapng.out @@ -24,4 +24,6 @@ SOAP 13 2935 1 Acceptable 13 2935 1 +RPC 13 2935 1 + 1 TCP 10.3.9.19:40632 <-> 10.68.137.118:8091 [proto: 7.253/HTTP.SOAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: RPC/16][7 pkts/1546 bytes <-> 6 pkts/1389 bytes][Goodput ratio: 73/76][3438.13 sec][Hostname/SNI: 10.68.137.118][bytes ratio: 0.053 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 7/29 687620/24940 3382709/49851 1347715/24911][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 221/232 1180/739 392/263][URL: 10.68.137.118:8091/Apcn/ApcRemoteService][StatusCode: 200][User-Agent: Jakarta Commons-HttpClient/3.0.1][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 60][Risk Info: Found host 10.68.137.118 / Expected on port 80][TCP Fingerprint: 2_64_49640_8fe4205fb587/Unknown][PLAIN TEXT (POST /Apcn/ApcRemoteService HTT)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/nest_log_sink.pcap.out b/tests/cfgs/default/result/nest_log_sink.pcap.out index 0517b500a..226b9d546 100644 --- a/tests/cfgs/default/result/nest_log_sink.pcap.out +++ b/tests/cfgs/default/result/nest_log_sink.pcap.out @@ -29,6 +29,9 @@ NestLogSink 759 116848 13 Acceptable 774 118460 14 +Cloud 759 116848 13 +Network 15 1612 1 + 1 TCP 192.168.242.15:63342 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 284/GoogleCloud, Confidence: IP address][DPI packets: 8][cat: Cloud/13][37 pkts/14650 bytes <-> 35 pkts/4115 bytes][Goodput ratio: 86/54][4.71 sec][bytes ratio: 0.561 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/0 142/150 1347/1490 251/290][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 396/118 585/733 192/108][TCP Fingerprint: 2_255_4608_287a07a47787/Unknown][PLAIN TEXT (05CA02AC4414028)][Plen Bins: 0,50,1,1,0,0,0,0,0,0,0,0,0,0,45,0,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.242.15:63345 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 284/GoogleCloud, Confidence: IP address][DPI packets: 8][cat: Cloud/13][36 pkts/14613 bytes <-> 35 pkts/4114 bytes][Goodput ratio: 86/54][4.14 sec][bytes ratio: 0.561 (Upload)][IAT c2s/s2c min/avg/max/stddev: 11/0 132/134 1166/1477 229/290][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 406/118 584/732 185/107][TCP Fingerprint: 2_255_4608_287a07a47787/Unknown][PLAIN TEXT (05CA02AC4414028)][Plen Bins: 0,50,1,0,1,0,0,0,0,0,0,0,0,0,45,0,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.242.15:63351 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 284/GoogleCloud, Confidence: IP address][DPI packets: 8][cat: Cloud/13][25 pkts/9229 bytes <-> 24 pkts/2916 bytes][Goodput ratio: 85/55][3.56 sec][bytes ratio: 0.520 (Upload)][IAT c2s/s2c min/avg/max/stddev: 5/0 164/174 1319/1484 293/350][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 369/122 584/733 204/130][TCP Fingerprint: 2_255_4608_287a07a47787/Unknown][PLAIN TEXT (05CA02AC4414028)][Plen Bins: 0,50,2,0,0,0,0,0,0,0,0,2,0,0,41,0,2,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/netbios.pcap.out b/tests/cfgs/default/result/netbios.pcap.out index 4b8d3689f..dea76321f 100644 --- a/tests/cfgs/default/result/netbios.pcap.out +++ b/tests/cfgs/default/result/netbios.pcap.out @@ -30,6 +30,8 @@ SMBv1 2 486 2 Acceptable 259 24326 14 Dangerous 2 486 2 +System 261 24812 16 + 1 UDP 10.0.4.131:137 -> 10.0.5.255:137 [proto: 10/NetBIOS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 10/NetBIOS, Confidence: DPI][DPI packets: 1][cat: System/18][181 pkts/16652 bytes -> 0 pkts/0 bytes][Goodput ratio: 54/0][59.62 sec][Hostname/SNI: xstream_hy][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 10/0 328/0 929/0 225/0][Pkt Len c2s/s2c min/avg/max/stddev: 92/0 92/0 92/0 0/0][PLAIN TEXT ( FIFDFEFCEFEBENFPEIFJ)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.0.5.233:137 -> 10.0.5.255:137 [proto: 10/NetBIOS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 10/NetBIOS, Confidence: DPI][DPI packets: 1][cat: System/18][59 pkts/5428 bytes -> 0 pkts/0 bytes][Goodput ratio: 54/0][57.96 sec][Hostname/SNI: ozi][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 749/0 1008/0 1515/0 361/0][Pkt Len c2s/s2c min/avg/max/stddev: 92/0 92/0 92/0 0/0][PLAIN TEXT ( EPFKEJ)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.0.5.233:137 <-> 10.0.4.24:137 [proto: 10/NetBIOS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 10/NetBIOS, Confidence: DPI][DPI packets: 1][cat: System/18][2 pkts/184 bytes <-> 2 pkts/434 bytes][Goodput ratio: 54/80][10.00 sec][Hostname/SNI: *][PLAIN TEXT ( CKAAAAAAAAAAAAAAAAAAAAAAAAAAAA)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/netbios_wildcard_dns_query.pcap.out b/tests/cfgs/default/result/netbios_wildcard_dns_query.pcap.out index 1e64fa295..044529476 100644 --- a/tests/cfgs/default/result/netbios_wildcard_dns_query.pcap.out +++ b/tests/cfgs/default/result/netbios_wildcard_dns_query.pcap.out @@ -24,4 +24,6 @@ DNS 1 92 1 Acceptable 1 92 1 +Network 1 92 1 + 1 UDP 10.1.67.250:41335 -> 10.1.66.20:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/92 bytes -> 0 pkts/0 bytes][Goodput ratio: 54/0][< 1 sec][Hostname/SNI: ckaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa][0.0.0.0][DNS Id: 0x80f0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT ( CKAAAAAAAAAAAAAAAAAAAAAAAAAAAA)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/netease_games.pcapng.out b/tests/cfgs/default/result/netease_games.pcapng.out index a35cb6c97..5c28ea22a 100644 --- a/tests/cfgs/default/result/netease_games.pcapng.out +++ b/tests/cfgs/default/result/netease_games.pcapng.out @@ -27,6 +27,9 @@ NetEaseGames 16 2090 4 Acceptable 4 572 1 Fun 16 2090 4 +Game 16 2090 4 +Network 4 572 1 + JA Host Stats: IP Address # JA4C 1 192.168.88.231 1 diff --git a/tests/cfgs/default/result/netflix.pcap.out b/tests/cfgs/default/result/netflix.pcap.out index 6363c4277..cdfcffb29 100644 --- a/tests/cfgs/default/result/netflix.pcap.out +++ b/tests/cfgs/default/result/netflix.pcap.out @@ -36,6 +36,12 @@ Safe 2 126 1 Acceptable 859 502126 32 Fun 932 504164 28 +Web 2 126 1 +Download 814 494949 18 +Network 29 4529 13 +System 16 2648 1 +Video 932 504164 28 + JA Host Stats: IP Address # JA4C 1 192.168.1.7 5 diff --git a/tests/cfgs/default/result/netflow-fritz.pcap.out b/tests/cfgs/default/result/netflow-fritz.pcap.out index 514167799..45b194d2e 100644 --- a/tests/cfgs/default/result/netflow-fritz.pcap.out +++ b/tests/cfgs/default/result/netflow-fritz.pcap.out @@ -24,4 +24,6 @@ NetFlow 1 222 1 Acceptable 1 222 1 +Network 1 222 1 + 1 UDP 192.168.0.1:23384 -> 192.168.1.1:2055 [proto: 128/NetFlow][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 128/NetFlow, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 81/0][< 1 sec][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/netflowv9.pcap.out b/tests/cfgs/default/result/netflowv9.pcap.out index f885aaedd..7bdde10e4 100644 --- a/tests/cfgs/default/result/netflowv9.pcap.out +++ b/tests/cfgs/default/result/netflowv9.pcap.out @@ -24,4 +24,6 @@ NetFlow 10 13888 1 Acceptable 10 13888 1 +Network 10 13888 1 + 1 UDP 192.168.2.134:48629 -> 192.168.2.222:2057 [proto: 128/NetFlow][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 128/NetFlow, Confidence: DPI][DPI packets: 1][cat: Network/14][10 pkts/13888 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][0.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 1362/0 1389/0 1418/0 23/0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 2055][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,30,20,0,0,0,0] diff --git a/tests/cfgs/default/result/nexon.pcapng.out b/tests/cfgs/default/result/nexon.pcapng.out index 9ca88fc5b..bda7adb2d 100644 --- a/tests/cfgs/default/result/nexon.pcapng.out +++ b/tests/cfgs/default/result/nexon.pcapng.out @@ -24,5 +24,7 @@ Nexon 128 13740 2 Fun 128 13740 2 +Game 128 13740 2 + 1 TCP 192.168.12.67:46824 <-> 54.64.252.215:9995 [proto: 113/Nexon][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Game/8][50 pkts/7428 bytes <-> 48 pkts/3212 bytes][Goodput ratio: 55/1][199.97 sec][bytes ratio: 0.396 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 4456/4681 46914/46915 10741/10973][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 149/67 290/94 46/4][TCP Fingerprint: 2_64_65535_685ad951a756/Android][Plen Bins: 6,16,50,0,25,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.12.67:39908 <-> 18.185.38.147:7500 [proto: 113/Nexon][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Game/8][17 pkts/1307 bytes <-> 13 pkts/1793 bytes][Goodput ratio: 28/60][13.45 sec][bytes ratio: -0.157 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 957/1201 5759/5709 1612/1783][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 77/138 325/891 63/219][TCP Fingerprint: 2_64_65535_685ad951a756/Android][Plen Bins: 75,6,6,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/nfsv2.pcap.out b/tests/cfgs/default/result/nfsv2.pcap.out index cbe5e4833..31301c0dc 100644 --- a/tests/cfgs/default/result/nfsv2.pcap.out +++ b/tests/cfgs/default/result/nfsv2.pcap.out @@ -24,6 +24,8 @@ NFS 156 23144 7 Acceptable 156 23144 7 +DataTransfer 156 23144 7 + 1 UDP 139.25.22.2:1023 <-> 139.25.22.102:2049 [proto: 11/NFS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 11/NFS, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][72 pkts/12640 bytes <-> 72 pkts/9284 bytes][Goodput ratio: 76/67][0.35 sec][bytes ratio: 0.153 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/4 40/40 7/7][Pkt Len c2s/s2c min/avg/max/stddev: 166/70 176/129 214/198 12/42][PLAIN TEXT (werrmsche)][Plen Bins: 13,2,0,30,49,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 139.25.22.2:671 <-> 139.25.22.102:1048 [proto: 11/NFS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 11/NFS, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][1 pkts/158 bytes <-> 1 pkts/102 bytes][Goodput ratio: 73/58][0.02 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No client to server traffic / Expected on port 2049][PLAIN TEXT (werrmsche)][Plen Bins: 0,50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 139.25.22.2:686 <-> 139.25.22.102:1048 [proto: 11/NFS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 11/NFS, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][1 pkts/158 bytes <-> 1 pkts/66 bytes][Goodput ratio: 73/36][< 1 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No client to server traffic / Expected on port 2049][PLAIN TEXT (werrmsche)][Plen Bins: 50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/nfsv3.pcap.out b/tests/cfgs/default/result/nfsv3.pcap.out index bb5c68971..0ef44f0bf 100644 --- a/tests/cfgs/default/result/nfsv3.pcap.out +++ b/tests/cfgs/default/result/nfsv3.pcap.out @@ -24,6 +24,8 @@ NFS 128 22816 8 Acceptable 128 22816 8 +DataTransfer 128 22816 8 + 1 UDP 139.25.22.2:1022 <-> 139.25.22.102:2049 [proto: 11/NFS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 11/NFS, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][57 pkts/10398 bytes <-> 57 pkts/11038 bytes][Goodput ratio: 77/78][0.29 sec][bytes ratio: -0.030 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/5 50/50 9/9][Pkt Len c2s/s2c min/avg/max/stddev: 170/74 182/194 226/342 15/82][PLAIN TEXT (werrmsche)][Plen Bins: 0,10,0,11,52,10,0,12,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 139.25.22.2:706 <-> 139.25.22.102:1048 [proto: 11/NFS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 11/NFS, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][1 pkts/158 bytes <-> 1 pkts/114 bytes][Goodput ratio: 73/63][0.02 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No client to server traffic / Expected on port 2049][PLAIN TEXT (werrmsche)][Plen Bins: 0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 139.25.22.2:722 <-> 139.25.22.102:1048 [proto: 11/NFS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 11/NFS, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][1 pkts/158 bytes <-> 1 pkts/66 bytes][Goodput ratio: 73/36][< 1 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No client to server traffic / Expected on port 2049][PLAIN TEXT (werrmsche)][Plen Bins: 50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/nintendo.pcap.out b/tests/cfgs/default/result/nintendo.pcap.out index 658f14e23..f424093c5 100644 --- a/tests/cfgs/default/result/nintendo.pcap.out +++ b/tests/cfgs/default/result/nintendo.pcap.out @@ -36,6 +36,11 @@ Safe 56 8595 2 Acceptable 62 5866 10 Fun 878 318692 9 +Web 56 8595 2 +Game 878 318692 9 +Cloud 20 2216 5 +Network 42 3650 5 + JA Host Stats: IP Address # JA4C 1 192.168.12.114 1 diff --git a/tests/cfgs/default/result/nntp.pcap.out b/tests/cfgs/default/result/nntp.pcap.out index 694f3dfc2..284095825 100644 --- a/tests/cfgs/default/result/nntp.pcap.out +++ b/tests/cfgs/default/result/nntp.pcap.out @@ -24,4 +24,6 @@ Usenet 32 7037 1 Acceptable 32 7037 1 +Web 32 7037 1 + 1 TCP 192.168.190.20:55630 <-> 192.168.190.5:119 [proto: 93/Usenet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][19 pkts/1363 bytes <-> 13 pkts/5674 bytes][Goodput ratio: 8/85][67.36 sec][bytes ratio: -0.613 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2775/4125 19518/19565 5508/6659][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 72/436 97/1514 10/556][TCP Fingerprint: 2_64_5840_8c07a80cc645/Unknown][PLAIN TEXT (200 Leafnode NNTP Daemon)][Plen Bins: 48,17,0,11,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,11,0,0] diff --git a/tests/cfgs/default/result/no_sni.pcap.out b/tests/cfgs/default/result/no_sni.pcap.out index 277933ac4..c447f31da 100644 --- a/tests/cfgs/default/result/no_sni.pcap.out +++ b/tests/cfgs/default/result/no_sni.pcap.out @@ -26,6 +26,9 @@ DoH_DoT 268 31882 1 Safe 174 50253 7 Acceptable 268 31882 1 +Web 174 50253 7 +Network 268 31882 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.119 4 diff --git a/tests/cfgs/default/result/nomachine.pcapng.out b/tests/cfgs/default/result/nomachine.pcapng.out index 777bc1811..d754b89d9 100644 --- a/tests/cfgs/default/result/nomachine.pcapng.out +++ b/tests/cfgs/default/result/nomachine.pcapng.out @@ -25,5 +25,7 @@ NoMachine 73 7085 2 Acceptable 73 7085 2 +RemoteAccess 73 7085 2 + 1 TCP 192.168.88.231:48084 <-> 192.168.88.208:4000 [proto: 378/NoMachine][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RemoteAccess/12][25 pkts/1903 bytes <-> 24 pkts/3906 bytes][Goodput ratio: 28/66][10.47 sec][bytes ratio: -0.345 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 442/486 7610/7654 1659/1752][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 76/163 184/1295 42/246][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found NoMachine][TCP Fingerprint: 2_64_32120_2e3cee914fc1/Linux][PLAIN TEXT (NoMachine)][Plen Bins: 14,45,11,18,3,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.88.231:56019 <-> 192.168.88.208:4000 [proto: 378/NoMachine][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 378/NoMachine, Confidence: DPI][DPI packets: 1][cat: RemoteAccess/12][11 pkts/584 bytes <-> 13 pkts/692 bytes][Goodput ratio: 21/21][0.49 sec][bytes ratio: -0.085 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 20/3 38/38 166/133 48/33][Pkt Len c2s/s2c min/avg/max/stddev: 52/52 53/53 60/64 2/3][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: No server to client traffic / Found NoMachine][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/nordvpn.pcap.out b/tests/cfgs/default/result/nordvpn.pcap.out index 33be1dea8..16bd6b715 100644 --- a/tests/cfgs/default/result/nordvpn.pcap.out +++ b/tests/cfgs/default/result/nordvpn.pcap.out @@ -31,6 +31,9 @@ NordVPN 90 31147 3 Safe 53 15226 1 Acceptable 90 31147 3 +VPN 90 31147 3 +Email 53 15226 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.204 1 diff --git a/tests/cfgs/default/result/ocs.pcap.out b/tests/cfgs/default/result/ocs.pcap.out index 224da7e11..81ce33839 100644 --- a/tests/cfgs/default/result/ocs.pcap.out +++ b/tests/cfgs/default/result/ocs.pcap.out @@ -37,6 +37,12 @@ Safe 25 3056 2 Acceptable 61 6957 14 Fun 860 57372 4 +Media 860 57372 4 +DataTransfer 20 2715 1 +Web 52 6407 6 +Cloud 6 360 1 +Network 8 531 8 + JA Host Stats: IP Address # JA4C 1 192.168.180.2 4 diff --git a/tests/cfgs/default/result/ocsp.pcapng.out b/tests/cfgs/default/result/ocsp.pcapng.out index 5ad6a0964..9efb14a54 100644 --- a/tests/cfgs/default/result/ocsp.pcapng.out +++ b/tests/cfgs/default/result/ocsp.pcapng.out @@ -24,6 +24,9 @@ OCSP 344 73647 10 Safe 344 73647 10 +Web 23 10871 1 +Network 321 62776 9 + 1 TCP 192.168.1.128:49034 <-> 23.12.96.145:80 [proto: 7.63/HTTP.OCSP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][24 pkts/3999 bytes <-> 22 pkts/8476 bytes][Goodput ratio: 29/69][117.30 sec][Hostname/SNI: ocsp.entrust.net][bytes ratio: -0.359 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 5094/5187 10241/10241 4906/5058][Pkt Len c2s/s2c min/avg/max/stddev: 118/118 167/385 505/1566 128/500][URL: ocsp.entrust.net/][StatusCode: 200][Req Content-Type: application/ocsp-request][Content-Type: application/ocsp-response][User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (BHPOST / HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0] 2 TCP 192.168.1.227:49813 <-> 109.70.240.130:80 [proto: 7.63/HTTP.OCSP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][10 pkts/2245 bytes <-> 13 pkts/8626 bytes][Goodput ratio: 51/84][65.14 sec][Hostname/SNI: ocsp07.actalis.it][bytes ratio: -0.587 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 16/8 28/36 10/15][Pkt Len c2s/s2c min/avg/max/stddev: 112/112 224/664 491/1566 171/540][URL: ocsp07.actalis.it/VA/AUTH-ROOT/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSw4x5v4bTlizjNRmTdkYSy7q0R9gQUUtiIOsifeGbtifN7OHCUyQICNtACEEWXMtjzGMt1k6L0aA%2BQ6tk%3D][StatusCode: 200][Content-Type: application/ocsp-response][Server: nginx][User-Agent: Microsoft-CryptoAPI/10.0][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (GET /VA/AUTH)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,41,8,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0] 3 TCP 192.168.1.128:47904 <-> 93.184.220.29:80 [proto: 7.63/HTTP.OCSP][IP: 288/Edgecast][ClearText][Confidence: DPI][FPC: 288/Edgecast, Confidence: IP address][DPI packets: 6][cat: Network/14][27 pkts/4355 bytes <-> 23 pkts/5119 bytes][Goodput ratio: 27/47][166.99 sec][Hostname/SNI: ocsp.digicert.com][bytes ratio: -0.081 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/0 6194/7858 10240/10240 4838/4216][Pkt Len c2s/s2c min/avg/max/stddev: 118/118 161/223 505/917 122/269][URL: ocsp.digicert.com/][StatusCode: 200][Req Content-Type: application/ocsp-request][Content-Type: application/ocsp-response][Server: ECS (mil/6CEA)][User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (POST / HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/oicq.pcap.out b/tests/cfgs/default/result/oicq.pcap.out index 530859054..a034a8a4c 100644 --- a/tests/cfgs/default/result/oicq.pcap.out +++ b/tests/cfgs/default/result/oicq.pcap.out @@ -24,6 +24,8 @@ OICQ 29 2542 29 Acceptable 29 2542 29 +Chat 29 2542 29 + 1 UDP 90.147.69.210:54233 -> 58.60.10.45:8000 [proto: 335/OICQ][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 335/OICQ, Confidence: DPI][DPI packets: 1][cat: Chat/9][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 55/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 90.147.69.210:59802 -> 58.60.10.45:8000 [proto: 335/OICQ][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 335/OICQ, Confidence: DPI][DPI packets: 1][cat: Chat/9][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 55/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 90.147.69.210:60434 -> 58.60.10.45:8000 [proto: 335/OICQ][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 335/OICQ, Confidence: DPI][DPI packets: 1][cat: Chat/9][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 55/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ookla.pcap.out b/tests/cfgs/default/result/ookla.pcap.out index f6d568bec..17110a990 100644 --- a/tests/cfgs/default/result/ookla.pcap.out +++ b/tests/cfgs/default/result/ookla.pcap.out @@ -28,6 +28,9 @@ Ookla 113 38411 6 Safe 113 38411 6 +Web 29 23166 1 +Network 84 15245 5 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 2 diff --git a/tests/cfgs/default/result/opc-ua.pcap.out b/tests/cfgs/default/result/opc-ua.pcap.out index aa4422396..7dd2717cb 100644 --- a/tests/cfgs/default/result/opc-ua.pcap.out +++ b/tests/cfgs/default/result/opc-ua.pcap.out @@ -24,4 +24,6 @@ OPC-UA 381 45578 1 Acceptable 381 45578 1 +IoT-Scada 381 45578 1 + 1 TCP 127.0.0.1:57420 <-> 127.0.0.1:4840 [proto: 360/OPC-UA][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: IoT-Scada/31][191 pkts/23255 bytes <-> 190 pkts/22323 bytes][Goodput ratio: 54/52][0.01 sec][bytes ratio: 0.020 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 122/117 222/664 68/84][TCP Fingerprint: 2_64_65535_99a660d3e328/macOS][PLAIN TEXT (opc.tcp)][Plen Bins: 0,0,26,23,45,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/openflow.pcap.out b/tests/cfgs/default/result/openflow.pcap.out index 078d7c982..c60b1fd19 100644 --- a/tests/cfgs/default/result/openflow.pcap.out +++ b/tests/cfgs/default/result/openflow.pcap.out @@ -24,4 +24,6 @@ OpenFlow 21 1826 1 Acceptable 21 1826 1 +Network 21 1826 1 + 1 TCP 107.110.12.153:49234 <-> 107.110.12.153:6653 [proto: 374/OpenFlow][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][11 pkts/1066 bytes <-> 10 pkts/760 bytes][Goodput ratio: 31/12][0.06 sec][bytes ratio: 0.168 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/8 31/31 10/11][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 97/76 298/94 65/10][TCP Fingerprint: 2_64_43690_531765ea86ce/Unknown][Plen Bins: 72,18,0,0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/openvpn-tlscrypt.pcap.out b/tests/cfgs/default/result/openvpn-tlscrypt.pcap.out index 264b50207..050bcdbdd 100644 --- a/tests/cfgs/default/result/openvpn-tlscrypt.pcap.out +++ b/tests/cfgs/default/result/openvpn-tlscrypt.pcap.out @@ -24,4 +24,6 @@ OpenVPN 13 5354 1 Acceptable 13 5354 1 +VPN 13 5354 1 + 1 UDP [::1]:56256 <-> [::1]:1194 [proto: 159/OpenVPN][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VPN/2][7 pkts/3253 bytes <-> 6 pkts/2101 bytes][Goodput ratio: 89/85][0.02 sec][bytes ratio: 0.215 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 3/3 11/9 4/4][Pkt Len c2s/s2c min/avg/max/stddev: 114/114 465/350 1228/1033 382/314][Plen Bins: 0,31,7,0,0,0,7,15,0,0,0,7,0,0,0,0,7,0,0,0,7,0,0,0,0,0,0,0,0,0,7,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/openvpn.pcap.out b/tests/cfgs/default/result/openvpn.pcap.out index 509371a42..b4d245a08 100644 --- a/tests/cfgs/default/result/openvpn.pcap.out +++ b/tests/cfgs/default/result/openvpn.pcap.out @@ -26,6 +26,8 @@ NordVPN 15 7962 1 Acceptable 706 139146 10 +VPN 706 139146 10 + 1 UDP 192.168.43.18:13680 <-> 139.59.151.137:13680 [proto: 159/OpenVPN][IP: 442/DigitalOcean][Encrypted][Confidence: DPI][FPC: 442/DigitalOcean, Confidence: IP address][DPI packets: 3][cat: VPN/2][62 pkts/11508 bytes <-> 58 pkts/16664 bytes][Goodput ratio: 77/85][19.24 sec][bytes ratio: -0.183 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 289/106 3994/2456 764/365][Pkt Len c2s/s2c min/avg/max/stddev: 84/92 186/287 1214/1287 193/325][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 1194][PLAIN TEXT (160727093158Z)][Plen Bins: 0,33,19,9,29,0,0,2,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,1,0,0,0,0,0,0,0,0,0] 2 TCP 10.181.235.122:39772 <-> 10.251.71.30:1194 [proto: 159/OpenVPN][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: VPN/2][100 pkts/13594 bytes <-> 95 pkts/13987 bytes][Goodput ratio: 51/55][32.02 sec][bytes ratio: -0.014 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 245/317 3842/9253 675/1172][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 136/147 472/542 78/90][TCP Fingerprint: 2_64_14600_d227986fac6c/Unknown][PLAIN TEXT (121031022835Z)][Plen Bins: 35,13,1,39,1,0,0,8,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 3.111.166.78:51146 <-> 85.134.13.165:1194 [proto: 159/OpenVPN][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 2][cat: VPN/2][51 pkts/7057 bytes <-> 49 pkts/8409 bytes][Goodput ratio: 70/76][17.72 sec][bytes ratio: -0.087 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 343/338 4127/4124 897/934][Pkt Len c2s/s2c min/avg/max/stddev: 60/64 138/172 168/1242 35/312][PLAIN TEXT (New York1)][Plen Bins: 48,4,1,40,0,0,0,2,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/openvpn_nohmac.pcapng.out b/tests/cfgs/default/result/openvpn_nohmac.pcapng.out index a482e9c2b..aecace3e8 100644 --- a/tests/cfgs/default/result/openvpn_nohmac.pcapng.out +++ b/tests/cfgs/default/result/openvpn_nohmac.pcapng.out @@ -24,4 +24,6 @@ OpenVPN 944 303931 1 Acceptable 944 303931 1 +VPN 944 303931 1 + 1 UDP 3.111.166.78:51146 <-> 85.134.13.165:1194 [proto: 159/OpenVPN][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 2][cat: VPN/2][594 pkts/138399 bytes <-> 350 pkts/165532 bytes][Goodput ratio: 82/91][73.25 sec][bytes ratio: -0.089 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 101/181 5093/5107 502/713][Pkt Len c2s/s2c min/avg/max/stddev: 60/64 233/473 1490/1487 273/526][PLAIN TEXT (New York1)][Plen Bins: 18,1,1,72,3,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out b/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out index 331c62164..1011275e2 100644 --- a/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out +++ b/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out @@ -24,4 +24,6 @@ OpenVPN 195 27581 1 Acceptable 195 27581 1 +VPN 195 27581 1 + 1 TCP 10.181.235.122:39772 <-> 10.251.71.30:1194 [proto: 159/OpenVPN][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: VPN/2][100 pkts/13594 bytes <-> 95 pkts/13987 bytes][Goodput ratio: 51/55][32.02 sec][bytes ratio: -0.014 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 245/317 3842/9253 675/1172][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 136/147 472/542 78/90][TCP Fingerprint: 2_64_14600_d227986fac6c/Unknown][PLAIN TEXT (121031022835Z)][Plen Bins: 35,13,1,39,1,0,0,8,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/openvpn_obfuscated.pcapng.out b/tests/cfgs/default/result/openvpn_obfuscated.pcapng.out index 24a425eb6..9933d1755 100644 --- a/tests/cfgs/default/result/openvpn_obfuscated.pcapng.out +++ b/tests/cfgs/default/result/openvpn_obfuscated.pcapng.out @@ -31,6 +31,10 @@ NordVPN 30 10598 1 Safe 147 42691 2 Acceptable 30 10598 1 +VPN 30 10598 1 +Email 60 17222 1 +Web 87 25469 1 + 1 TCP 107.161.86.131:443 <-> 192.168.12.156:48072 [proto: 91/TLS][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 14][cat: Web/5][40 pkts/9272 bytes <-> 47 pkts/16197 bytes][Goodput ratio: 70/81][3.15 sec][bytes ratio: -0.272 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 57/52 212/303 66/79][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 232/345 1514/1090 370/406][Plen Bins: 35,3,3,15,1,1,0,0,1,3,5,1,0,1,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,18,0,0,0,0,0,0,0,0,0,1,0,0,3,0,0] 2 TCP 192.168.12.156:37976 <-> 185.128.25.99:465 [proto: 29/SMTPS][IP: 426/NordVPN][Encrypted][Confidence: Match by port][FPC: 426/NordVPN, Confidence: IP address][DPI packets: 20][cat: Email/3][29 pkts/7410 bytes <-> 31 pkts/9812 bytes][Goodput ratio: 74/79][1.73 sec][bytes ratio: -0.139 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 66/26 1019/153 204/31][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 256/317 1090/1514 256/424][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.132 (Compressed Executable?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (HrFTzP)][Plen Bins: 0,0,14,30,14,2,0,2,5,0,5,5,2,0,0,2,0,0,0,0,0,2,0,2,0,2,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,7,0,0] 3 UDP 192.168.12.156:47128 <-> 149.102.238.108:1214 [proto: 426/NordVPN][IP: 426/NordVPN][Encrypted][Confidence: Match by IP][FPC: 426/NordVPN, Confidence: IP address][DPI packets: 9][cat: VPN/2][19 pkts/3629 bytes <-> 11 pkts/6969 bytes][Goodput ratio: 78/93][1.26 sec][bytes ratio: -0.315 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 78/132 1156/1023 278/337][Pkt Len c2s/s2c min/avg/max/stddev: 115/136 191/634 782/1158 153/438][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 6.051 (Executable?)][PLAIN TEXT (SFhAFI)][Plen Bins: 0,0,23,41,3,0,0,0,3,0,3,6,0,0,0,0,0,0,0,0,0,0,0,3,0,3,0,0,0,0,0,0,0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/openwire.pcapng.out b/tests/cfgs/default/result/openwire.pcapng.out index 3c2eb35ff..6fd691b60 100644 --- a/tests/cfgs/default/result/openwire.pcapng.out +++ b/tests/cfgs/default/result/openwire.pcapng.out @@ -24,4 +24,6 @@ OpenWire 43 5203 1 Acceptable 43 5203 1 +RPC 43 5203 1 + 1 TCP [::1]:51157 <-> [::1]:61616 [proto: 421/OpenWire][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][22 pkts/2807 bytes <-> 21 pkts/2396 bytes][Goodput ratio: 49/43][1.07 sec][bytes ratio: 0.079 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 63/71 1067/1067 251/266][Pkt Len c2s/s2c min/avg/max/stddev: 64/64 128/114 348/592 83/130][TCP Fingerprint: 2_128_65535_1a552c74ca50/Unknown][PLAIN TEXT (ActiveM)][Plen Bins: 28,0,28,5,5,11,5,0,5,0,5,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/opera-vpn.pcapng.out b/tests/cfgs/default/result/opera-vpn.pcapng.out index f8bf7dc40..b606e07ea 100644 --- a/tests/cfgs/default/result/opera-vpn.pcapng.out +++ b/tests/cfgs/default/result/opera-vpn.pcapng.out @@ -29,6 +29,9 @@ OperaVPN 3197 1398676 61 Safe 3 206 1 Acceptable 3197 1398676 61 +VPN 3197 1398676 61 +Web 3 206 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.29 2 diff --git a/tests/cfgs/default/result/oracle12.pcapng.out b/tests/cfgs/default/result/oracle12.pcapng.out index 932dd5b1c..0c054fc75 100644 --- a/tests/cfgs/default/result/oracle12.pcapng.out +++ b/tests/cfgs/default/result/oracle12.pcapng.out @@ -24,4 +24,6 @@ Oracle 20 2518 1 Acceptable 20 2518 1 +Database 20 2518 1 + 1 TCP 10.0.2.15:40226 <-> 10.0.72.139:1521 [proto: 167/Oracle][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][9 pkts/1447 bytes <-> 11 pkts/1071 bytes][Goodput ratio: 65/41][0.03 sec][bytes ratio: 0.149 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/3 20/19 7/6][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 161/97 287/293 93/71][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (DESCRIPTION)][Plen Bins: 18,18,9,9,0,9,18,18,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/os_detected.pcapng.out b/tests/cfgs/default/result/os_detected.pcapng.out index 29f496e92..1952cc85d 100644 --- a/tests/cfgs/default/result/os_detected.pcapng.out +++ b/tests/cfgs/default/result/os_detected.pcapng.out @@ -24,6 +24,8 @@ QUIC 1 1294 1 Acceptable 1 1294 1 +Web 1 1294 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 1 diff --git a/tests/cfgs/default/result/ospfv2_add_new_prefix.pcap.out b/tests/cfgs/default/result/ospfv2_add_new_prefix.pcap.out index 00926a0ed..4bc0e145e 100644 --- a/tests/cfgs/default/result/ospfv2_add_new_prefix.pcap.out +++ b/tests/cfgs/default/result/ospfv2_add_new_prefix.pcap.out @@ -24,4 +24,6 @@ IP_OSPF 2 200 1 Acceptable 2 200 1 +Network 2 200 1 + 1 OSPF 10.1.10.10:0 <-> 10.1.10.1:0 [proto: 85/IP_OSPF][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 85/IP_OSPF, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/122 bytes <-> 1 pkts/78 bytes][Goodput ratio: 0/0][2.51 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out index 5939feb45..e24367044 100644 --- a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out +++ b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out @@ -33,6 +33,10 @@ Safe 8 2487 1 Fun 4 200 4 Unrated 9 638 5 +Unspecified 9 638 5 +Game 4 200 4 +Network 8 2487 1 + 1 UDP 127.0.0.1:1119 -> 127.0.0.1:1120 [proto: 353/Protobuf][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][8 pkts/2487 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][204.53 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 8008/0 29219/0 105424/0 32476/0][Pkt Len c2s/s2c min/avg/max/stddev: 48/0 311/0 576/0 250/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 37,0,12,0,0,0,0,0,0,0,0,0,0,0,0,12,0,37,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.128:1 -> 12.129.206.130:1119 [proto: 213/Blizzard][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Game/8][1 pkts/50 bytes -> 0 pkts/0 bytes][Goodput ratio: 20/0][< 1 sec][Risk: ** Unidirectional Traffic **** TCP Connection Issues **][Risk Score: 60][Risk Info: TCP NULL scan / No client to server traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.1.128:1 -> 12.129.236.254:1119 [proto: 213/Blizzard][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Game/8][1 pkts/50 bytes -> 0 pkts/0 bytes][Goodput ratio: 20/0][< 1 sec][Risk: ** Unidirectional Traffic **** TCP Connection Issues **][Risk Score: 60][Risk Info: TCP NULL scan / No client to server traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out index 653559fe3..713b8068b 100644 --- a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out +++ b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out @@ -32,6 +32,12 @@ WireGuard 4 592 2 Acceptable 101 35154 8 +VPN 4 592 2 +Web 12 1099 2 +VoIP 16 1326 2 +Database 10 689 1 +RemoteAccess 59 31448 1 + 1 TCP 192.168.0.1:8787 <-> 10.10.10.1:32177 [proto: 148/TeamViewer][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 12][cat: RemoteAccess/12][25 pkts/14755 bytes <-> 34 pkts/16693 bytes][Goodput ratio: 90/89][2.12 sec][bytes ratio: -0.062 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 79/59 277/257 105/90][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 590/491 1514/1514 585/593][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 5938][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (XDsiBZ)][Plen Bins: 0,19,2,5,2,0,0,0,0,0,0,5,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,2,15,5,0,2,2,2,0,0,0,0,0,0,29,0,0] 2 TCP 172.16.20.244:59038 <-> 172.16.20.75:5432 [proto: 19/PostgreSQL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Database/11][6 pkts/416 bytes <-> 4 pkts/273 bytes][Goodput ratio: 2/0][0.02 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/9 17/18 7/9][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 69/68 78/74 5/3][TCP Fingerprint: 194_64_65535_d29295416479/macOS][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 127.0.0.1:54898 <-> 127.0.0.1:1299 [proto: 101/TruPhone][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VoIP/10][5 pkts/457 bytes <-> 3 pkts/206 bytes][Goodput ratio: 26/0][8.94 sec][bytes ratio: 0.379 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/7477 2235/7477 7477/7477 3085/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 91/69 185/74 47/4][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][PLAIN TEXT (stream)][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_4.pcapng.out b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_4.pcapng.out index 15a86951c..732c6e187 100644 --- a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_4.pcapng.out +++ b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_4.pcapng.out @@ -24,6 +24,8 @@ Unknown 2 68 1 Unrated 2 68 1 +Unspecified 2 68 1 + Undetected flows: diff --git a/tests/cfgs/default/result/paltalk.pcapng.out b/tests/cfgs/default/result/paltalk.pcapng.out index 3f8a4a7c5..307010ebe 100644 --- a/tests/cfgs/default/result/paltalk.pcapng.out +++ b/tests/cfgs/default/result/paltalk.pcapng.out @@ -24,6 +24,8 @@ Paltalk 17 3511 4 Acceptable 17 3511 4 +Chat 17 3511 4 + JA Host Stats: IP Address # JA4C 1 192.168.88.208 1 diff --git a/tests/cfgs/default/result/path_of_exile.pcapng.out b/tests/cfgs/default/result/path_of_exile.pcapng.out index 5f87732c2..8b88a278a 100644 --- a/tests/cfgs/default/result/path_of_exile.pcapng.out +++ b/tests/cfgs/default/result/path_of_exile.pcapng.out @@ -24,6 +24,8 @@ PathofExile 16 1208 4 Fun 16 1208 4 +Game 16 1208 4 + 1 TCP 192.168.88.231:36262 <-> 198.50.120.150:6112 [proto: 403/PathofExile][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Game/8][3 pkts/237 bytes <-> 1 pkts/74 bytes][Goodput ratio: 13/0][0.14 sec][TCP Fingerprint: 2_64_32120_2e3cee914fc1/Linux][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.13:36492 <-> 203.57.83.5:21360 [proto: 403/PathofExile][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Game/8][3 pkts/225 bytes <-> 1 pkts/74 bytes][Goodput ratio: 8/0][0.06 sec][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.1.13:49554 <-> 91.206.197.210:21360 [proto: 403/PathofExile][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Game/8][3 pkts/225 bytes <-> 1 pkts/74 bytes][Goodput ratio: 8/0][0.01 sec][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/pfcp.pcapng.out b/tests/cfgs/default/result/pfcp.pcapng.out index cfe1a846f..003b60531 100644 --- a/tests/cfgs/default/result/pfcp.pcapng.out +++ b/tests/cfgs/default/result/pfcp.pcapng.out @@ -24,4 +24,6 @@ PFCP 11 2703 1 Acceptable 11 2703 1 +Network 11 2703 1 + 1 UDP 127.0.0.1:8805 -> 127.0.0.2:8805 [proto: 405/PFCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 405/PFCP, Confidence: DPI][DPI packets: 1][cat: Network/14][11 pkts/2703 bytes -> 0 pkts/0 bytes][Goodput ratio: 89/0][0.04 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 3/0 7/0 2/0][Pkt Len c2s/s2c min/avg/max/stddev: 52/0 246/0 542/0 145/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (hukfxpu)][Plen Bins: 18,9,0,0,0,18,0,27,0,9,0,0,9,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/pgm.pcap.out b/tests/cfgs/default/result/pgm.pcap.out index 0ad63a727..0855f6646 100644 --- a/tests/cfgs/default/result/pgm.pcap.out +++ b/tests/cfgs/default/result/pgm.pcap.out @@ -24,4 +24,6 @@ PGM 1000 196302 1 Acceptable 1000 196302 1 +Network 1000 196302 1 + 1 PGM 10.244.64.154:0 -> 235.0.1.47:0 [proto: 296/PGM][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 296/PGM, Confidence: DPI][DPI packets: 1][cat: Network/14][1000 pkts/196302 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][78.91 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 78/0 1479/0 169/0][Pkt Len c2s/s2c min/avg/max/stddev: 70/0 196/0 1344/0 201/0][PLAIN TEXT (PORTFOLIO)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/pgsql.pcap.out b/tests/cfgs/default/result/pgsql.pcap.out index 9a5f6e911..e4614cad5 100644 --- a/tests/cfgs/default/result/pgsql.pcap.out +++ b/tests/cfgs/default/result/pgsql.pcap.out @@ -24,6 +24,8 @@ PostgreSQL 88 8913 6 Acceptable 88 8913 6 +Database 88 8913 6 + 1 TCP 127.0.0.1:45930 <-> 127.0.0.1:5432 [proto: 19/PostgreSQL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Database/11][12 pkts/1366 bytes <-> 12 pkts/1664 bytes][Goodput ratio: 41/52][15.40 sec][bytes ratio: -0.098 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1002/1011 8826/8907 2767/2792][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 114/139 327/348 73/104][TCP Fingerprint: 2_64_32767_579a084b1ead/Unknown][PLAIN TEXT (database)][Plen Bins: 8,41,0,16,0,8,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.16.20.244:59039 <-> 172.16.20.75:5432 [proto: 19/PostgreSQL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Database/11][10 pkts/924 bytes <-> 6 pkts/911 bytes][Goodput ratio: 27/56][0.01 sec][bytes ratio: 0.007 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 1/2 3/7 1/3][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 92/152 175/455 38/139][TCP Fingerprint: 194_64_65535_d29295416479/macOS][PLAIN TEXT (database)][Plen Bins: 37,12,25,12,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 127.0.0.1:45931 <-> 127.0.0.1:5432 [proto: 19/PostgreSQL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Database/11][7 pkts/705 bytes <-> 8 pkts/974 bytes][Goodput ratio: 33/45][0.12 sec][bytes ratio: -0.160 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/14 45/40 18/16][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 101/122 222/251 52/72][TCP Fingerprint: 2_64_32767_579a084b1ead/Unknown][PLAIN TEXT (database)][Plen Bins: 14,28,14,0,14,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/pgsql2.pcapng.out b/tests/cfgs/default/result/pgsql2.pcapng.out index 1c6807f35..bbd2f611c 100644 --- a/tests/cfgs/default/result/pgsql2.pcapng.out +++ b/tests/cfgs/default/result/pgsql2.pcapng.out @@ -24,4 +24,6 @@ PostgreSQL 19 3076 1 Acceptable 19 3076 1 +Database 19 3076 1 + 1 TCP 10.220.20.67:58574 <-> 10.220.20.67:60102 [proto: 19/PostgreSQL][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Database/11][10 pkts/1252 bytes <-> 9 pkts/1824 bytes][Goodput ratio: 64/78][0.01 sec][bytes ratio: -0.186 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1/1 2/2 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 44/44 125/203 372/1360 119/410][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 5432][TCP Fingerprint: 2_128_65535_7eab44e4c8df/Unknown][Plen Bins: 25,0,12,25,0,0,0,0,0,12,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/pia.pcap.out b/tests/cfgs/default/result/pia.pcap.out index 5aeb5bebf..8e4cb74c0 100644 --- a/tests/cfgs/default/result/pia.pcap.out +++ b/tests/cfgs/default/result/pia.pcap.out @@ -24,6 +24,8 @@ PrivateInternetAccess 9 3842 1 Acceptable 9 3842 1 +VPN 9 3842 1 + JA Host Stats: IP Address # JA4C 1 192.168.88.3 1 diff --git a/tests/cfgs/default/result/pim.pcap.out b/tests/cfgs/default/result/pim.pcap.out index c10daacbf..ce0c94646 100644 --- a/tests/cfgs/default/result/pim.pcap.out +++ b/tests/cfgs/default/result/pim.pcap.out @@ -24,4 +24,6 @@ IP_PIM 10 920 1 Acceptable 10 920 1 +Network 10 920 1 + 1 PIM 192.168.203.234:0 -> 224.0.0.13:0 [proto: 297/IP_PIM][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 297/IP_PIM, Confidence: DPI][DPI packets: 1][cat: Network/14][10 pkts/920 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][9.01 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 999/0 1001/0 1006/0 2/0][Pkt Len c2s/s2c min/avg/max/stddev: 88/0 92/0 108/0 8/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/pinterest.pcap.out b/tests/cfgs/default/result/pinterest.pcap.out index fa3bb30ae..9007f0d8b 100644 --- a/tests/cfgs/default/result/pinterest.pcap.out +++ b/tests/cfgs/default/result/pinterest.pcap.out @@ -35,6 +35,11 @@ Acceptable 383 161216 6 Fun 323 193395 11 Tracker_Ads 48 23075 1 +Media 34 17966 1 +Web 445 181748 23 +SocialNetwork 323 193395 11 +Advertisement 109 53186 2 + JA Host Stats: IP Address # JA4C 1 2a01:cb01:2049:8b07:991d:ec85:28df:f629 1 diff --git a/tests/cfgs/default/result/pluralsight.pcap.out b/tests/cfgs/default/result/pluralsight.pcap.out index 994e3e009..7cbfeda55 100644 --- a/tests/cfgs/default/result/pluralsight.pcap.out +++ b/tests/cfgs/default/result/pluralsight.pcap.out @@ -24,6 +24,8 @@ Pluralsight 44 29652 6 Fun 44 29652 6 +Streaming 44 29652 6 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 1 diff --git a/tests/cfgs/default/result/pop3.pcap.out b/tests/cfgs/default/result/pop3.pcap.out index be374c2a0..5be7a1692 100644 --- a/tests/cfgs/default/result/pop3.pcap.out +++ b/tests/cfgs/default/result/pop3.pcap.out @@ -24,6 +24,8 @@ POP3 144 31172 6 Unsafe 144 31172 6 +Email 144 31172 6 + 1 TCP 192.168.0.4:26383 <-> 212.227.15.166:110 [proto: 2/POP3][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 16][cat: Email/3][22 pkts/1338 bytes <-> 30 pkts/21359 bytes][Goodput ratio: 10/92][1.26 sec][bytes ratio: -0.882 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 59/41 97/111 37/39][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 61/712 120/1514 14/680][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_128_8192_4697958db063/Windows][PLAIN TEXT (OK POP server ready H mimap)][Plen Bins: 47,5,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,2,0,0,2,0,0,0,0,0,0,0,30,0,0] 2 TCP 143.225.229.181:35287 <-> 74.208.5.28:110 [proto: 2/POP3][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: Email/3][18 pkts/1269 bytes <-> 13 pkts/2646 bytes][Goodput ratio: 6/67][27.32 sec][User: cicciopernacchio@mail.com][Pwd: pippozzo][bytes ratio: -0.352 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1792/2973 5526/5668 2204/2427][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 70/204 98/1514 8/379][Risk: ** Unsafe Protocol **** Clear-Text Credentials **][Risk Score: 110][Risk Info: Found username (cicciopernacchio@mail.com)][TCP Fingerprint: 2_64_5840_8c07a80cc645/Unknown][PLAIN TEXT (OK POP server ready H migmxus)][Plen Bins: 60,20,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0] 3 TCP 192.168.0.4:26308 <-> 212.227.15.166:110 [proto: 2/POP3][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 16][cat: Email/3][9 pkts/594 bytes <-> 10 pkts/881 bytes][Goodput ratio: 16/34][0.59 sec][bytes ratio: -0.195 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 29/0 64/64 81/88 18/29][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 66/88 120/145 20/32][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_128_8192_4697958db063/Windows][PLAIN TEXT (OK POP server ready H mimap)][Plen Bins: 63,9,27,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/pop3_stls.pcap.out b/tests/cfgs/default/result/pop3_stls.pcap.out index e64e6b82a..96da36e69 100644 --- a/tests/cfgs/default/result/pop3_stls.pcap.out +++ b/tests/cfgs/default/result/pop3_stls.pcap.out @@ -24,6 +24,8 @@ POPS 53 11189 1 Safe 53 11189 1 +Email 53 11189 1 + JA Host Stats: IP Address # JA4C 1 192.168.20.18 1 diff --git a/tests/cfgs/default/result/pops.pcapng.out b/tests/cfgs/default/result/pops.pcapng.out index b4f9fcff6..0aff60e3c 100644 --- a/tests/cfgs/default/result/pops.pcapng.out +++ b/tests/cfgs/default/result/pops.pcapng.out @@ -24,6 +24,8 @@ POPS 5 2998 1 Safe 5 2998 1 +Email 5 2998 1 + JA Host Stats: IP Address # JA4C 1 192.168.0.1 1 diff --git a/tests/cfgs/default/result/portable_executable.pcap.out b/tests/cfgs/default/result/portable_executable.pcap.out index 32602a825..f7cfde4b5 100644 --- a/tests/cfgs/default/result/portable_executable.pcap.out +++ b/tests/cfgs/default/result/portable_executable.pcap.out @@ -29,5 +29,8 @@ DigitalOcean 15 12160 1 Safe 15 12160 1 Acceptable 15 12154 1 +Web 15 12160 1 +Network 15 12154 1 + 1 TCP 172.16.99.201:1732 <-> 64.227.107.71:4444 [proto: 442/DigitalOcean][IP: 442/DigitalOcean][Encrypted][Confidence: Match by IP][FPC: 442/DigitalOcean, Confidence: IP address][DPI packets: 15][cat: Web/5][4 pkts/246 bytes <-> 11 pkts/11914 bytes][Goodput ratio: 0/95][0.73 sec][bytes ratio: -0.960 (Download)][IAT c2s/s2c min/avg/max/stddev: 329/0 364/45 398/398 34/125][Pkt Len c2s/s2c min/avg/max/stddev: 60/58 62/1083 66/1310 3/481][Risk: ** Binary App Transfer **** Susp Entropy **][Risk Score: 160][Risk Info: Entropy: 6.154 (Executable?) / Portable Executable (PE32/PE32+) found][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (This program cannot be run in D)][Plen Bins: 10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,90,0,0,0,0,0,0,0,0] 2 TCP 64.227.107.71:53 <-> 172.16.99.10:49652 [proto: 5/DNS][IP: 442/DigitalOcean][ClearText][Confidence: Match by port][FPC: 442/DigitalOcean, Confidence: IP address][DPI packets: 15][cat: Network/14][11 pkts/11914 bytes <-> 4 pkts/240 bytes][Goodput ratio: 95/0][0.37 sec][0.0.0.0][bytes ratio: 0.961 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 40/182 362/364 114/182][Pkt Len c2s/s2c min/avg/max/stddev: 58/60 1083/60 1310/60 481/0][Risk: ** Binary App Transfer **** Susp Entropy **][Risk Score: 160][Risk Info: Entropy: 5.990 (Executable?) / Portable Executable (PE32/PE32+) found][PLAIN TEXT (This program cannot be run in D)][Plen Bins: 10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,90,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/pptp.pcap.out b/tests/cfgs/default/result/pptp.pcap.out index 746a1ea6e..9e7afe092 100644 --- a/tests/cfgs/default/result/pptp.pcap.out +++ b/tests/cfgs/default/result/pptp.pcap.out @@ -24,4 +24,6 @@ PPTP 24 2328 1 Acceptable 24 2328 1 +VPN 24 2328 1 + 1 TCP 192.168.43.22:41366 <-> 191.101.61.1:1723 [proto: 115/PPTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VPN/2][13 pkts/1210 bytes <-> 11 pkts/1118 bytes][Goodput ratio: 29/34][5.43 sec][bytes ratio: 0.040 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/7 389/463 1680/1179 503/373][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 93/102 234/222 58/56][TCP Fingerprint: 2_64_29200_d876f498b09e/Unknown][PLAIN TEXT (cananian)][Plen Bins: 44,11,0,0,33,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/profinet-io-le.pcap.out b/tests/cfgs/default/result/profinet-io-le.pcap.out index 732ead602..eaeea1349 100644 --- a/tests/cfgs/default/result/profinet-io-le.pcap.out +++ b/tests/cfgs/default/result/profinet-io-le.pcap.out @@ -24,4 +24,6 @@ PROFINET_IO 2 516 1 Acceptable 2 516 1 +IoT-Scada 2 516 1 + 1 UDP 10.10.0.150:1566 <-> 10.10.0.129:34964 [proto: 370.371/DCERPC.PROFINET_IO][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 370.371/DCERPC.PROFINET_IO, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/206 bytes <-> 1 pkts/310 bytes][Goodput ratio: 79/86][0.00 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 135][Plen Bins: 0,0,0,0,0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/protobuf.pcap.out b/tests/cfgs/default/result/protobuf.pcap.out index fb27cbc70..768447bd3 100644 --- a/tests/cfgs/default/result/protobuf.pcap.out +++ b/tests/cfgs/default/result/protobuf.pcap.out @@ -24,6 +24,8 @@ Protobuf 60 4446 5 Safe 60 4446 5 +Network 60 4446 5 + 1 TCP 127.0.0.1:52392 <-> 127.0.0.1:12345 [proto: 353/Protobuf][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][11 pkts/890 bytes <-> 9 pkts/498 bytes][Goodput ratio: 32/0][70.00 sec][bytes ratio: 0.282 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/10000 6667/8333 10000/10000 4714/3727][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 81/55 122/66 31/4][TCP Fingerprint: 2_192_65495_c65f0625e065/Unknown][PLAIN TEXT (AAAABBBBX)][Plen Bins: 42,0,57,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:39786 <-> 127.0.0.1:12345 [proto: 353/Protobuf][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][5 pkts/832 bytes <-> 3 pkts/174 bytes][Goodput ratio: 66/0][10.00 sec][bytes ratio: 0.654 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 2500/0 10000/0 4330/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 166/58 604/66 219/6][TCP Fingerprint: 2_255_65495_c65f0625e065/Unknown][PLAIN TEXT (Lorem ipsum dolor sit amet)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 127.0.0.1:51680 <-> 127.0.0.1:12345 [proto: 353/Protobuf][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: Network/14][9 pkts/588 bytes <-> 7 pkts/390 bytes][Goodput ratio: 15/0][50.00 sec][bytes ratio: 0.202 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/10000 5714/7500 10000/10000 4949/4330][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 65/56 72/66 8/4][TCP Fingerprint: 2_192_65495_c65f0625e065/Unknown][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/protonvpn.pcap.out b/tests/cfgs/default/result/protonvpn.pcap.out index 517a368f6..e1f72c51e 100644 --- a/tests/cfgs/default/result/protonvpn.pcap.out +++ b/tests/cfgs/default/result/protonvpn.pcap.out @@ -31,6 +31,9 @@ ProtonVPN 26 8061 1 Safe 1 74 1 Acceptable 40 10121 2 +VPN 40 10121 2 +Web 1 74 1 + JA Host Stats: IP Address # JA4C 1 10.0.2.15 1 diff --git a/tests/cfgs/default/result/psiphon3.pcap.out b/tests/cfgs/default/result/psiphon3.pcap.out index 29bac2245..f4b3c047d 100644 --- a/tests/cfgs/default/result/psiphon3.pcap.out +++ b/tests/cfgs/default/result/psiphon3.pcap.out @@ -24,6 +24,8 @@ Psiphon 62 11818 1 Acceptable 62 11818 1 +VPN 62 11818 1 + JA Host Stats: IP Address # JA4C 1 192.168.0.103 1 diff --git a/tests/cfgs/default/result/ptpv2.pcap.out b/tests/cfgs/default/result/ptpv2.pcap.out index 6cab00c6f..da6ad5d03 100644 --- a/tests/cfgs/default/result/ptpv2.pcap.out +++ b/tests/cfgs/default/result/ptpv2.pcap.out @@ -24,6 +24,8 @@ PTPv2 14 1664 3 Acceptable 14 1664 3 +System 14 1664 3 + 1 UDP [fe80::20:9400:d]:320 <-> [fe80::2b0:aeff:fe01:f921]:320 [proto: 358/PTPv2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 358/PTPv2, Confidence: DPI][DPI packets: 1][cat: System/18][3 pkts/354 bytes <-> 4 pkts/488 bytes][Goodput ratio: 47/49][0.26 sec][bytes ratio: -0.159 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 0/50 0/149 0/70][Pkt Len c2s/s2c min/avg/max/stddev: 118/120 118/122 118/128 0/3][Plen Bins: 0,85,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP [fe80::20:9400:e]:320 <-> [fe80::2b0:aeff:fe01:f921]:320 [proto: 358/PTPv2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 358/PTPv2, Confidence: DPI][DPI packets: 1][cat: System/18][3 pkts/354 bytes <-> 3 pkts/360 bytes][Goodput ratio: 47/48][0.11 sec][bytes ratio: -0.008 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 0/1 0/1 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 118/120 118/120 118/120 0/0][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP [fe80::2b0:aeff:fe01:f921]:319 -> [fe80::20:9400:d]:319 [proto: 358/PTPv2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 358/PTPv2, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/108 bytes -> 0 pkts/0 bytes][Goodput ratio: 42/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/punycode-idn.pcap.out b/tests/cfgs/default/result/punycode-idn.pcap.out index d61033cef..e543cff35 100644 --- a/tests/cfgs/default/result/punycode-idn.pcap.out +++ b/tests/cfgs/default/result/punycode-idn.pcap.out @@ -26,6 +26,9 @@ HTTP 12 1597 1 Acceptable 16 1956 3 +Web 12 1597 1 +Network 4 359 2 + 1 TCP 192.168.2.140:56011 <-> 170.33.9.230:80 [proto: 7/HTTP][IP: 274/Alibaba][ClearText][Confidence: DPI][FPC: 274/Alibaba, Confidence: IP address][DPI packets: 8][cat: Web/5][7 pkts/568 bytes <-> 5 pkts/1029 bytes][Goodput ratio: 29/69][0.57 sec][Hostname/SNI: www.love.xn--55qx5d][bytes ratio: -0.289 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 77/122 222/352 90/163][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 81/206 137/765 36/280][URL: www.love.xn--55qx5d/][StatusCode: 403][Content-Type: text/html][User-Agent: curl/7.77.0][Risk: ** IDN Domain Name **** Error Code **][Risk Score: 20][Risk Info: HTTP Error Code 403 / www.love.xn--55qx5d][TCP Fingerprint: 2_64_65535_d29295416479/macOS][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.140:45520 <-> 192.168.2.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/69 bytes <-> 1 pkts/128 bytes][Goodput ratio: 39/67][0.02 sec][Hostname/SNI: i.scdn.co][146.75.62.248][DNS Id: 0xa57b][PLAIN TEXT (scdnco)][Plen Bins: 50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.140:60156 <-> 192.168.2.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/81 bytes <-> 1 pkts/81 bytes][Goodput ratio: 48/48][0.00 sec][Hostname/SNI: www.xn--mnich-kva.com][0.0.0.0][DNS Id: 0xfb05][Risk: ** IDN Domain Name **** Error Code **][Risk Score: 20][Risk Info: DNS Error Code NXDOMAIN / www.xn--mnich-kva.com][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic-23.pcap.out b/tests/cfgs/default/result/quic-23.pcap.out index 48601e19a..8644defcb 100644 --- a/tests/cfgs/default/result/quic-23.pcap.out +++ b/tests/cfgs/default/result/quic-23.pcap.out @@ -24,6 +24,8 @@ QUIC 20 7191 1 Acceptable 20 7191 1 +Web 20 7191 1 + JA Host Stats: IP Address # JA4C 1 2e4a:774d:26fd:7f9b:785b:2d1b:4f8a:63c7 1 diff --git a/tests/cfgs/default/result/quic-24.pcap.out b/tests/cfgs/default/result/quic-24.pcap.out index ecee99cfe..2862e83ef 100644 --- a/tests/cfgs/default/result/quic-24.pcap.out +++ b/tests/cfgs/default/result/quic-24.pcap.out @@ -24,6 +24,8 @@ QUIC 15 8000 1 Acceptable 15 8000 1 +Web 15 8000 1 + JA Host Stats: IP Address # JA4C 1 10.9.0.1 1 diff --git a/tests/cfgs/default/result/quic-27.pcap.out b/tests/cfgs/default/result/quic-27.pcap.out index b3a62afad..254936bab 100644 --- a/tests/cfgs/default/result/quic-27.pcap.out +++ b/tests/cfgs/default/result/quic-27.pcap.out @@ -24,6 +24,8 @@ PlayStore 20 12887 1 Safe 20 12887 1 +SoftwareUpdate 20 12887 1 + JA Host Stats: IP Address # JA4C 1 3ef4:2194:f4a6:3503:40cd:714:57:c4e4 1 diff --git a/tests/cfgs/default/result/quic-28.pcap.out b/tests/cfgs/default/result/quic-28.pcap.out index 474863fd3..1eaa67c07 100644 --- a/tests/cfgs/default/result/quic-28.pcap.out +++ b/tests/cfgs/default/result/quic-28.pcap.out @@ -24,6 +24,8 @@ QUIC 253 246793 1 Acceptable 253 246793 1 +Web 253 246793 1 + JA Host Stats: IP Address # JA4C 1 10.9.0.2 1 diff --git a/tests/cfgs/default/result/quic-29.pcap.out b/tests/cfgs/default/result/quic-29.pcap.out index 918043429..b85e7ee68 100644 --- a/tests/cfgs/default/result/quic-29.pcap.out +++ b/tests/cfgs/default/result/quic-29.pcap.out @@ -24,6 +24,8 @@ QUIC 15 9386 1 Acceptable 15 9386 1 +Web 15 9386 1 + JA Host Stats: IP Address # JA4C 1 10.9.0.1 1 diff --git a/tests/cfgs/default/result/quic-33.pcapng.out b/tests/cfgs/default/result/quic-33.pcapng.out index 65aaf2764..7cd97aea2 100644 --- a/tests/cfgs/default/result/quic-33.pcapng.out +++ b/tests/cfgs/default/result/quic-33.pcapng.out @@ -24,6 +24,8 @@ QUIC 7 5336 1 Acceptable 7 5336 1 +Web 7 5336 1 + JA Host Stats: IP Address # JA4C 1 ::1 1 diff --git a/tests/cfgs/default/result/quic-34.pcap.out b/tests/cfgs/default/result/quic-34.pcap.out index 5ae621b6b..230a002b5 100644 --- a/tests/cfgs/default/result/quic-34.pcap.out +++ b/tests/cfgs/default/result/quic-34.pcap.out @@ -24,6 +24,8 @@ QUIC 4 4836 1 Acceptable 4 4836 1 +Web 4 4836 1 + JA Host Stats: IP Address # JA4C 1 192.168.56.1 1 diff --git a/tests/cfgs/default/result/quic-forcing-vn-with-data.pcapng.out b/tests/cfgs/default/result/quic-forcing-vn-with-data.pcapng.out index d78b2d890..20faac26f 100644 --- a/tests/cfgs/default/result/quic-forcing-vn-with-data.pcapng.out +++ b/tests/cfgs/default/result/quic-forcing-vn-with-data.pcapng.out @@ -24,6 +24,8 @@ QUIC 21 9039 1 Acceptable 21 9039 1 +Web 21 9039 1 + JA Host Stats: IP Address # JA4C 1 192.168.56.103 1 diff --git a/tests/cfgs/default/result/quic-fuzz-overflow.pcapng.out b/tests/cfgs/default/result/quic-fuzz-overflow.pcapng.out index 1e7b245dd..e52907493 100644 --- a/tests/cfgs/default/result/quic-fuzz-overflow.pcapng.out +++ b/tests/cfgs/default/result/quic-fuzz-overflow.pcapng.out @@ -24,4 +24,6 @@ QUIC 1 1280 1 Acceptable 1 1280 1 +Web 1 1280 1 + 1 UDP 255.255.255.255:8224 -> 255.255.255.32:8224 [proto: 188/QUIC][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/1280 bytes -> 0 pkts/0 bytes][Goodput ratio: 98/0][< 1 sec][Risk: ** Known Proto on Non Std Port **** Missing SNI TLS Extn **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No server to client traffic / SNI should be present all time: attack ? / Expected on port 443][QUIC ver: Q024][PLAIN TEXT ( )][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic-mvfst-22.pcap.out b/tests/cfgs/default/result/quic-mvfst-22.pcap.out index a413fe49e..d3e0d3a04 100644 --- a/tests/cfgs/default/result/quic-mvfst-22.pcap.out +++ b/tests/cfgs/default/result/quic-mvfst-22.pcap.out @@ -24,6 +24,8 @@ Facebook 490 288303 1 Fun 490 288303 1 +SocialNetwork 490 288303 1 + JA Host Stats: IP Address # JA4C 1 10.0.2.15 1 diff --git a/tests/cfgs/default/result/quic-mvfst-22_decryption_error.pcap.out b/tests/cfgs/default/result/quic-mvfst-22_decryption_error.pcap.out index ddd9d989f..3d0395bda 100644 --- a/tests/cfgs/default/result/quic-mvfst-22_decryption_error.pcap.out +++ b/tests/cfgs/default/result/quic-mvfst-22_decryption_error.pcap.out @@ -24,4 +24,6 @@ QUIC 11 3918 1 Acceptable 11 3918 1 +Web 11 3918 1 + 1 UDP 10.230.40.168:62196 <-> 94.97.225.146:443 [proto: 188/QUIC][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 1][cat: Web/5][10 pkts/3852 bytes <-> 1 pkts/66 bytes][Goodput ratio: 93/57][0.00 sec][bytes ratio: 0.966 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 1/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/66 385/66 1260/66 401/0][QUIC ver: MVFST-22][Plen Bins: 0,36,27,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,27,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic-mvfst-27.pcapng.out b/tests/cfgs/default/result/quic-mvfst-27.pcapng.out index 32f48b9fa..38244fb5b 100644 --- a/tests/cfgs/default/result/quic-mvfst-27.pcapng.out +++ b/tests/cfgs/default/result/quic-mvfst-27.pcapng.out @@ -24,6 +24,8 @@ Facebook 20 11399 1 Fun 20 11399 1 +SocialNetwork 20 11399 1 + JA Host Stats: IP Address # JA4C 1 10.0.2.15 1 diff --git a/tests/cfgs/default/result/quic-mvfst-exp.pcap.out b/tests/cfgs/default/result/quic-mvfst-exp.pcap.out index ff817ddbd..6a6b73b7e 100644 --- a/tests/cfgs/default/result/quic-mvfst-exp.pcap.out +++ b/tests/cfgs/default/result/quic-mvfst-exp.pcap.out @@ -24,6 +24,8 @@ FbookReelStory 30 26309 1 Fun 30 26309 1 +SocialNetwork 30 26309 1 + JA Host Stats: IP Address # JA4C 1 2aac:cdf7:d506:7807:9092:75f:a963:f4ab 1 diff --git a/tests/cfgs/default/result/quic-v2.pcapng.out b/tests/cfgs/default/result/quic-v2.pcapng.out index 234a3faaa..531d17ab7 100644 --- a/tests/cfgs/default/result/quic-v2.pcapng.out +++ b/tests/cfgs/default/result/quic-v2.pcapng.out @@ -24,6 +24,8 @@ QUIC 19 12970 1 Acceptable 19 12970 1 +Web 19 12970 1 + JA Host Stats: IP Address # JA4C 1 ::1 1 diff --git a/tests/cfgs/default/result/quic.pcap.out b/tests/cfgs/default/result/quic.pcap.out index 27d103907..1a2b1398a 100644 --- a/tests/cfgs/default/result/quic.pcap.out +++ b/tests/cfgs/default/result/quic.pcap.out @@ -31,6 +31,10 @@ QUIC 9 7436 2 Acceptable 433 272373 5 Fun 85 76193 5 +Media 85 76193 5 +Email 413 254874 1 +Web 20 17499 4 + 1 UDP 192.168.1.109:57833 <-> 216.58.212.101:443 [proto: 188.122/QUIC.GMail][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 188.122/QUIC.GMail, Confidence: DPI][DPI packets: 1][cat: Email/3][161 pkts/23930 bytes <-> 252 pkts/230944 bytes][Goodput ratio: 72/95][37.93 sec][Hostname/SNI: mail.google.com][bytes ratio: -0.812 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 303/161 21144/21225 1960/1485][Pkt Len c2s/s2c min/avg/max/stddev: 67/61 149/916 1392/1392 207/581][QUIC ver: Q024][Idle Timeout: 30][PLAIN TEXT (mail.google.com)][Plen Bins: 4,37,1,5,3,0,3,0,0,0,0,1,0,0,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,40,0,0,0,0,0] 2 UDP 192.168.1.109:35236 <-> 216.58.210.206:443 [proto: 188.124/QUIC.YouTube][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 188.124/QUIC.YouTube, Confidence: DPI][DPI packets: 1][cat: Media/1][25 pkts/5276 bytes <-> 44 pkts/53157 bytes][Goodput ratio: 80/97][1.00 sec][Hostname/SNI: www.youtube.com][bytes ratio: -0.819 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 52/26 803/828 183/134][Pkt Len c2s/s2c min/avg/max/stddev: 79/61 211/1208 1392/1392 358/430][QUIC ver: Q030][Idle Timeout: 30][PLAIN TEXT (www.youtube.com)][Plen Bins: 1,35,1,0,0,0,0,0,0,0,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,57,0,0,0,0,0] 3 UDP 10.0.0.4:40134 -> 10.0.0.3:6121 [proto: 188/QUIC][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 1][cat: Web/5][6 pkts/7072 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][4.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 150/0 800/0 1749/0 595/0][Pkt Len c2s/s2c min/avg/max/stddev: 112/0 1179/0 1392/0 477/0][Risk: ** Known Proto on Non Std Port **** Missing SNI TLS Extn **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No server to client traffic / SNI should be present all time: attack ? / Expected on port 443][QUIC ver: Q033][Idle Timeout: 600][Plen Bins: 0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,83,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic046.pcap.out b/tests/cfgs/default/result/quic046.pcap.out index 7e8c781fa..43a19aff1 100644 --- a/tests/cfgs/default/result/quic046.pcap.out +++ b/tests/cfgs/default/result/quic046.pcap.out @@ -24,4 +24,6 @@ YouTube 100 91297 1 Fun 100 91297 1 +Media 100 91297 1 + 1 UDP 192.168.1.236:50587 <-> 216.58.206.86:443 [proto: 188.124/QUIC.YouTube][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 188.124/QUIC.YouTube, Confidence: DPI][DPI packets: 1][cat: Media/1][37 pkts/6724 bytes <-> 63 pkts/84573 bytes][Goodput ratio: 77/97][0.05 sec][Hostname/SNI: i.ytimg.com][bytes ratio: -0.853 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 1/5 0/1][Pkt Len c2s/s2c min/avg/max/stddev: 70/62 182/1342 1392/1392 304/222][QUIC ver: Q046][Idle Timeout: 30][PLAIN TEXT (i.ytimg.com)][Plen Bins: 26,1,1,0,5,2,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,61,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_0RTT.pcap.out b/tests/cfgs/default/result/quic_0RTT.pcap.out index 78a97a6a3..395d1360d 100644 --- a/tests/cfgs/default/result/quic_0RTT.pcap.out +++ b/tests/cfgs/default/result/quic_0RTT.pcap.out @@ -25,6 +25,8 @@ QUIC 2 2588 1 Acceptable 17 7766 2 +Web 17 7766 2 + JA Host Stats: IP Address # JA4C 1 192.168.2.100 1 diff --git a/tests/cfgs/default/result/quic_cc_ack.pcapng.out b/tests/cfgs/default/result/quic_cc_ack.pcapng.out index 125fa9227..3aa42da4f 100644 --- a/tests/cfgs/default/result/quic_cc_ack.pcapng.out +++ b/tests/cfgs/default/result/quic_cc_ack.pcapng.out @@ -24,5 +24,7 @@ QUIC 2 2784 2 Acceptable 2 2784 2 +Web 2 2784 2 + 1 UDP 152.14.223.145:57113 -> 71.98.228.93:443 [proto: 188/QUIC][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/1392 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][QUIC ver: Draft-29][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0] 2 UDP 183.23.159.144:37787 -> 108.140.147.22:443 [proto: 188/QUIC][IP: 276/Azure][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/1392 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][QUIC ver: Draft-29][PLAIN TEXT (IhUo.7y)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_crypto_aes_auth_size.pcap.out b/tests/cfgs/default/result/quic_crypto_aes_auth_size.pcap.out index 8d7cf7e60..a7ac5f0c6 100644 --- a/tests/cfgs/default/result/quic_crypto_aes_auth_size.pcap.out +++ b/tests/cfgs/default/result/quic_crypto_aes_auth_size.pcap.out @@ -24,6 +24,8 @@ Snapchat 2 2784 2 Fun 2 2784 2 +SocialNetwork 2 2784 2 + JA Host Stats: IP Address # JA4C 1 134.53.36.43 1 diff --git a/tests/cfgs/default/result/quic_frags_ch_in_multiple_packets.pcapng.out b/tests/cfgs/default/result/quic_frags_ch_in_multiple_packets.pcapng.out index 6fdc7ab47..6429bcdd1 100644 --- a/tests/cfgs/default/result/quic_frags_ch_in_multiple_packets.pcapng.out +++ b/tests/cfgs/default/result/quic_frags_ch_in_multiple_packets.pcapng.out @@ -24,6 +24,8 @@ QUIC 4 3998 1 Acceptable 4 3998 1 +Web 4 3998 1 + JA Host Stats: IP Address # JA4C 1 ::1 1 diff --git a/tests/cfgs/default/result/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out b/tests/cfgs/default/result/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out index fe16aaec2..810d5d17a 100644 --- a/tests/cfgs/default/result/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out +++ b/tests/cfgs/default/result/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out @@ -35,6 +35,14 @@ Safe 3 4176 3 Acceptable 154 214368 88 Fun 22 30624 22 +Media 21 29232 21 +Web 124 172608 59 +Download 1 1392 1 +Cloud 5 6960 5 +Network 7 9744 7 +SoftwareUpdate 3 4176 3 +Advertisement 18 25056 17 + JA Host Stats: IP Address # JA4C 1 168.144.64.5 2 diff --git a/tests/cfgs/default/result/quic_frags_different_dcid.pcapng.out b/tests/cfgs/default/result/quic_frags_different_dcid.pcapng.out index 0653f986b..30148de41 100644 --- a/tests/cfgs/default/result/quic_frags_different_dcid.pcapng.out +++ b/tests/cfgs/default/result/quic_frags_different_dcid.pcapng.out @@ -24,6 +24,8 @@ Cloudflare 3 3826 1 Acceptable 3 3826 1 +Media 3 3826 1 + JA Host Stats: IP Address # JA4C 1 129.21.84.33 1 diff --git a/tests/cfgs/default/result/quic_interop_V.pcapng.out b/tests/cfgs/default/result/quic_interop_V.pcapng.out index 5d895a2cf..e7354c31c 100644 --- a/tests/cfgs/default/result/quic_interop_V.pcapng.out +++ b/tests/cfgs/default/result/quic_interop_V.pcapng.out @@ -27,6 +27,9 @@ QUIC 215 224846 63 Acceptable 246 242924 77 +Web 215 224846 63 +Network 31 18078 14 + 1 UDP 192.168.1.128:34511 -> 131.159.24.198:443 [proto: 188/QUIC][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 2][cat: Web/5][8 pkts/10352 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][9.94 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 150/0 1419/0 4800/0 1551/0][Pkt Len c2s/s2c min/avg/max/stddev: 1294/0 1294/0 1294/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][QUIC ver: Ver-Negotiation][PLAIN TEXT (SezYZO)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.128:37643 -> 71.202.41.169:443 [proto: 188/QUIC][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 2][cat: Web/5][8 pkts/10352 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][9.98 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 243/0 1426/0 4801/0 1546/0][Pkt Len c2s/s2c min/avg/max/stddev: 1294/0 1294/0 1294/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][QUIC ver: Ver-Negotiation][PLAIN TEXT (tIABbj)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.128:42468 -> 138.91.188.147:4433 [proto: 188/QUIC][IP: 276/Azure][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 2][cat: Web/5][8 pkts/10352 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][9.98 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 150/0 1425/0 4800/0 1548/0][Pkt Len c2s/s2c min/avg/max/stddev: 1294/0 1294/0 1294/0 0/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 443][QUIC ver: Ver-Negotiation][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_q39.pcap.out b/tests/cfgs/default/result/quic_q39.pcap.out index acce278b0..967e9964d 100644 --- a/tests/cfgs/default/result/quic_q39.pcap.out +++ b/tests/cfgs/default/result/quic_q39.pcap.out @@ -24,4 +24,6 @@ YouTube 60 24185 1 Fun 60 24185 1 +Media 60 24185 1 + 1 UDP 170.216.16.209:38620 <-> 21.157.183.227:443 [proto: 188.124/QUIC.YouTube][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188.124/QUIC.YouTube, Confidence: DPI][DPI packets: 1][cat: Media/1][27 pkts/20099 bytes <-> 33 pkts/4086 bytes][Goodput ratio: 94/66][48.95 sec][Hostname/SNI: s.youtube.com][bytes ratio: 0.662 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 2239/1370 14326/14805 3925/3576][Pkt Len c2s/s2c min/avg/max/stddev: 65/60 744/124 1392/1392 569/228][QUIC ver: Q039][Idle Timeout: 30][PLAIN TEXT (s.youtube.com)][Plen Bins: 24,47,0,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,1,5,0,0,0,0,0,1,0,0,1,0,0,0,0,0,0,16,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_q43.pcap.out b/tests/cfgs/default/result/quic_q43.pcap.out index d928caadb..c312ba613 100644 --- a/tests/cfgs/default/result/quic_q43.pcap.out +++ b/tests/cfgs/default/result/quic_q43.pcap.out @@ -24,4 +24,6 @@ DoH_DoT 2 1464 1 Acceptable 2 1464 1 +Network 2 1464 1 + 1 UDP 51.120.20.202:49241 <-> 72.119.217.29:443 [proto: 188.196/QUIC.DoH_DoT][IP: 276/Azure][Encrypted][Confidence: DPI][FPC: 188.196/QUIC.DoH_DoT, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/1392 bytes <-> 1 pkts/72 bytes][Goodput ratio: 97/41][0.05 sec][Hostname/SNI: dns.google.com][QUIC ver: Q043][Idle Timeout: 30][PLAIN TEXT (dns.google.com)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_q46.pcap.out b/tests/cfgs/default/result/quic_q46.pcap.out index f5c477377..0628a49b4 100644 --- a/tests/cfgs/default/result/quic_q46.pcap.out +++ b/tests/cfgs/default/result/quic_q46.pcap.out @@ -24,4 +24,6 @@ PlayStore 20 21241 1 Safe 20 21241 1 +SoftwareUpdate 20 21241 1 + 1 UDP 172.29.42.236:38292 <-> 153.20.183.203:443 [proto: 188.228/QUIC.PlayStore][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188.228/QUIC.PlayStore, Confidence: DPI][DPI packets: 1][cat: SoftwareUpdate/19][5 pkts/1675 bytes <-> 15 pkts/19566 bytes][Goodput ratio: 87/97][0.31 sec][Hostname/SNI: play.google.com][bytes ratio: -0.842 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/20 17/224 8/59][Pkt Len c2s/s2c min/avg/max/stddev: 70/78 335/1304 1392/1392 529/328][QUIC ver: Q046][Idle Timeout: 30][PLAIN TEXT (play.google.comL)][Plen Bins: 20,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,75,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_q46_b.pcap.out b/tests/cfgs/default/result/quic_q46_b.pcap.out index 1546b72ae..7831009a7 100644 --- a/tests/cfgs/default/result/quic_q46_b.pcap.out +++ b/tests/cfgs/default/result/quic_q46_b.pcap.out @@ -24,4 +24,6 @@ YouTubeUpload 20 7020 1 Fun 20 7020 1 +Media 20 7020 1 + 1 UDP 172.27.69.216:45530 <-> 110.231.134.35:443 [proto: 188.136/QUIC.YouTubeUpload][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188.136/QUIC.YouTubeUpload, Confidence: DPI][DPI packets: 1][cat: Media/1][6 pkts/2916 bytes <-> 14 pkts/4104 bytes][Goodput ratio: 81/69][3.09 sec][Hostname/SNI: upload.youtube.com][bytes ratio: -0.169 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 24/0 200/218 384/1017 128/277][Pkt Len c2s/s2c min/avg/max/stddev: 118/106 486/293 1440/1440 466/345][QUIC ver: Q046][Idle Timeout: 30][PLAIN TEXT (upload.youtube.comx)][Plen Bins: 45,15,0,0,0,0,0,0,0,0,20,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_q50.pcap.out b/tests/cfgs/default/result/quic_q50.pcap.out index 187c325b8..692909cf7 100644 --- a/tests/cfgs/default/result/quic_q50.pcap.out +++ b/tests/cfgs/default/result/quic_q50.pcap.out @@ -24,4 +24,6 @@ GoogleServices 20 20434 1 Acceptable 20 20434 1 +Web 20 20434 1 + 1 UDP 248.144.129.147:39203 <-> 184.151.193.237:443 [proto: 188.239/QUIC.GoogleServices][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188.239/QUIC.GoogleServices, Confidence: DPI][DPI packets: 1][cat: Web/5][6 pkts/3579 bytes <-> 14 pkts/16855 bytes][Goodput ratio: 93/97][0.47 sec][Hostname/SNI: www.googletagmanager.com][bytes ratio: -0.650 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 85/27 210/221 80/63][Pkt Len c2s/s2c min/avg/max/stddev: 75/67 596/1204 1392/1392 588/461][QUIC ver: Q050][Idle Timeout: 30][PLAIN TEXT (x.GdrZY)][Plen Bins: 5,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,70,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_sh.pcap.out b/tests/cfgs/default/result/quic_sh.pcap.out index fe63384e7..4b0025012 100644 --- a/tests/cfgs/default/result/quic_sh.pcap.out +++ b/tests/cfgs/default/result/quic_sh.pcap.out @@ -24,6 +24,8 @@ QUIC 38 23111 3 Acceptable 38 23111 3 +Web 38 23111 3 + 1 UDP [2001:b07:a3d:c112:91b7:b97e:6e2:fad8]:37542 <-> [2606:4700:7::a29f:9804]:443 [proto: 188/QUIC][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 5][cat: Web/5][6 pkts/634 bytes <-> 15 pkts/13073 bytes][Goodput ratio: 41/93][0.11 sec][bytes ratio: -0.907 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/7 20/86 9/23][Pkt Len c2s/s2c min/avg/max/stddev: 105/90 106/872 109/1262 1/472][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 6.456 (Executable?)][PLAIN TEXT (vS17md)][Plen Bins: 4,34,0,4,0,0,0,0,0,4,0,4,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,4,0,0,0,0,0,0,0,0,0,40,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.245:40408 <-> 13.226.175.53:443 [proto: 188/QUIC][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 3][cat: Web/5][4 pkts/340 bytes <-> 3 pkts/4482 bytes][Goodput ratio: 50/97][0.00 sec][bytes ratio: -0.859 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 85/1494 85/1494 85/1494 0/0][Plen Bins: 0,57,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,42,0,0] 3 UDP [2a00:1450:4002:411::200e]:443 <-> [2001:b07:a3d:c112:91b7:b97e:6e2:fad8]:33144 [proto: 188/QUIC][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 6][cat: Web/5][3 pkts/3876 bytes <-> 7 pkts/706 bytes][Goodput ratio: 95/38][0.03 sec][bytes ratio: 0.692 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 1/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 1292/99 1292/101 1292/104 0/2][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.836 (Encrypted or Random?)][Plen Bins: 0,70,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,30,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/quic_t50.pcap.out b/tests/cfgs/default/result/quic_t50.pcap.out index 648defa7f..0cbf32c5d 100644 --- a/tests/cfgs/default/result/quic_t50.pcap.out +++ b/tests/cfgs/default/result/quic_t50.pcap.out @@ -24,6 +24,8 @@ GoogleServices 12 8420 1 Acceptable 12 8420 1 +Web 12 8420 1 + JA Host Stats: IP Address # JA4C 1 40.154.127.200 1 diff --git a/tests/cfgs/default/result/quic_t51.pcap.out b/tests/cfgs/default/result/quic_t51.pcap.out index 0198683af..f79f50368 100644 --- a/tests/cfgs/default/result/quic_t51.pcap.out +++ b/tests/cfgs/default/result/quic_t51.pcap.out @@ -24,6 +24,8 @@ Google 12 9296 1 Acceptable 12 9296 1 +Web 12 9296 1 + JA Host Stats: IP Address # JA4C 1 187.227.136.152 1 diff --git a/tests/cfgs/default/result/quickplay.pcap.out b/tests/cfgs/default/result/quickplay.pcap.out index cc02a9caa..8ca970433 100644 --- a/tests/cfgs/default/result/quickplay.pcap.out +++ b/tests/cfgs/default/result/quickplay.pcap.out @@ -29,6 +29,13 @@ Xiaomi 2 1469 1 Acceptable 137 98026 13 Fun 18 6521 8 +Web 2 1469 1 +SocialNetwork 6 1740 3 +Download 9 3444 4 +Chat 3 1337 1 +Streaming 133 96179 11 +ConnCheck 2 378 1 + 1 TCP 10.54.169.250:52009 <-> 120.28.35.40:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7/HTTP, Confidence: DPI][DPI packets: 9][cat: Streaming/17][35 pkts/17902 bytes <-> 30 pkts/28000 bytes][Goodput ratio: 89/94][101.50 sec][Hostname/SNI: vod-singtelhawk.quickplay.com][bytes ratio: -0.220 (Download)][IAT c2s/s2c min/avg/max/stddev: 182/2021 3144/2862 23289/5776 4036/929][Pkt Len c2s/s2c min/avg/max/stddev: 500/76 511/933 587/1456 27/494][URL: vod-singtelhawk.quickplay.com/seg/vol1/s/Warner/qpmezzhawkdigitalcontagion2054033featureenglish20ltrt23976fps7834192/2015-02-02/STV250R240/qpmezz-Hawk_Digital_CONTAGION_2054033_FEATURE_ENGLISH_2_0_LTRT_23976fps_7834192.m2t_STV250R240-0023.ts][User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; MI 3W Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36][PLAIN TEXT (GET /seg/vol1/s/Warner/qpmezz)][Plen Bins: 3,0,0,3,1,1,0,0,0,1,0,0,0,49,1,1,7,0,1,0,0,0,0,0,3,0,0,0,3,1,0,0,0,1,1,0,3,3,0,0,0,0,0,13,0,0,0,0] 2 TCP 10.54.169.250:52019 <-> 120.28.35.40:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7/HTTP, Confidence: DPI][DPI packets: 9][cat: Streaming/17][14 pkts/7028 bytes <-> 11 pkts/12578 bytes][Goodput ratio: 89/95][109.64 sec][Hostname/SNI: vod-singtelhawk.quickplay.com][bytes ratio: -0.283 (Download)][IAT c2s/s2c min/avg/max/stddev: 1066/2163 7709/7600 23311/23043 9303/8905][Pkt Len c2s/s2c min/avg/max/stddev: 502/652 502/1143 502/1456 0/288][URL: vod-singtelhawk.quickplay.com/seg/vol1/s/Warner/qpmezzhawkdigitalcontagion2054033featureenglish20ltrt23976fps7834192/2015-02-02/STV510R360/qpmezz-Hawk_Digital_CONTAGION_2054033_FEATURE_ENGLISH_2_0_LTRT_23976fps_7834192.m2t_STV510R360-0058.ts][User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; MI 3W Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36][PLAIN TEXT (GET /seg/vol1/s/Warner/qpmezz)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,56,0,0,0,0,4,0,0,0,0,8,0,0,4,0,0,0,0,0,0,0,4,4,0,0,0,4,0,4,0,12,0,0,0,0] 3 TCP 10.54.169.250:52017 <-> 120.28.35.40:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7/HTTP, Confidence: DPI][DPI packets: 8][cat: Streaming/17][5 pkts/2510 bytes <-> 3 pkts/3522 bytes][Goodput ratio: 89/95][53.74 sec][Hostname/SNI: vod-singtelhawk.quickplay.com][bytes ratio: -0.168 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2521/3055 13434/13894 23447/24732 10022/10838][Pkt Len c2s/s2c min/avg/max/stddev: 502/822 502/1174 502/1456 0/264][URL: vod-singtelhawk.quickplay.com/seg/vol1/s/Warner/qpmezzhawkdigitalcontagion2054033featureenglish20ltrt23976fps7834192/2015-02-02/STV510R360/qpmezz-Hawk_Digital_CONTAGION_2054033_FEATURE_ENGLISH_2_0_LTRT_23976fps_7834192.m2t_STV510R360-0052.ts][User-Agent: Mozilla/5.0 (Linux; Android 4.4.4; MI 3W Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/33.0.0.0 Mobile Safari/537.36][PLAIN TEXT (GET /seg/vol1/s/Warner/qpmezz)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,63,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,12,0,0,0,0] diff --git a/tests/cfgs/default/result/radius_false_positive.pcapng.out b/tests/cfgs/default/result/radius_false_positive.pcapng.out index 5d9c86706..14a1b0d99 100644 --- a/tests/cfgs/default/result/radius_false_positive.pcapng.out +++ b/tests/cfgs/default/result/radius_false_positive.pcapng.out @@ -24,4 +24,6 @@ QUIC 10 7479 1 Acceptable 10 7479 1 +Web 10 7479 1 + 1 UDP [2bc6:b5ac:cb3b:676b::18]:443 -> [3dba:3762:c186:e122:89b0:5170:a86c:ecff]:53129 [proto: 188/QUIC][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 1][cat: Web/5][10 pkts/7479 bytes -> 0 pkts/0 bytes][Goodput ratio: 92/0][0.34 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 38/0 290/0 90/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 748/0 1292/0 549/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][PLAIN TEXT (AESGCC20at)][Plen Bins: 20,0,0,0,0,0,20,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/radmin3.pcapng.out b/tests/cfgs/default/result/radmin3.pcapng.out index ce97f52b3..22648d995 100644 --- a/tests/cfgs/default/result/radmin3.pcapng.out +++ b/tests/cfgs/default/result/radmin3.pcapng.out @@ -24,5 +24,7 @@ Radmin 17 1074 2 Acceptable 17 1074 2 +RemoteAccess 17 1074 2 + 1 TCP 192.168.88.208:49736 <-> 192.168.88.197:4899 [proto: 391/Radmin][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: RemoteAccess/12][6 pkts/346 bytes <-> 5 pkts/346 bytes][Goodput ratio: 3/13][0.77 sec][bytes ratio: 0.000 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/51 153/228 457/405 193/177][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 58/69 66/100 5/16][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found Radmin][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.88.208:49739 <-> 192.168.88.197:4899 [proto: 391/Radmin][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: RemoteAccess/12][3 pkts/188 bytes <-> 3 pkts/194 bytes][Goodput ratio: 7/7][0.40 sec][bytes ratio: -0.016 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/51 0/201 0/351 0/150][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 63/65 68/68 6/3][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found Radmin][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/raft.pcap.out b/tests/cfgs/default/result/raft.pcap.out index 0537b4382..c15fecf0f 100644 --- a/tests/cfgs/default/result/raft.pcap.out +++ b/tests/cfgs/default/result/raft.pcap.out @@ -24,5 +24,7 @@ Raft 64 5504 2 Acceptable 64 5504 2 +Network 64 5504 2 + 1 TCP 127.0.0.1:46286 <-> 127.0.0.1:9002 [proto: 392/Raft][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][17 pkts/2234 bytes <-> 15 pkts/822 bytes][Goodput ratio: 58/0][1.13 sec][bytes ratio: 0.462 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/4 74/81 125/125 58/57][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 131/55 214/66 38/3][TCP Fingerprint: 2_128_65495_c65f0625e065/Unknown][PLAIN TEXT (127.0.0.1)][Plen Bins: 0,20,61,6,6,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:38488 <-> 127.0.0.1:9001 [proto: 392/Raft][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][17 pkts/1626 bytes <-> 15 pkts/822 bytes][Goodput ratio: 43/0][1.13 sec][bytes ratio: 0.328 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/6 74/82 137/137 58/57][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 96/55 102/66 14/3][TCP Fingerprint: 2_128_65495_c65f0625e065/Unknown][PLAIN TEXT (127.0.0.1)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/raknet.pcap.out b/tests/cfgs/default/result/raknet.pcap.out index ca6856336..d35910ef0 100644 --- a/tests/cfgs/default/result/raknet.pcap.out +++ b/tests/cfgs/default/result/raknet.pcap.out @@ -27,6 +27,9 @@ RakNet 64 9286 10 Fun 64 9286 10 Unrated 2 314 2 +Unspecified 2 314 2 +Game 64 9286 10 + 1 UDP 192.168.2.100:60689 <-> 148.153.35.205:60028 [proto: 286/RakNet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: Game/8][8 pkts/2036 bytes <-> 7 pkts/577 bytes][Goodput ratio: 83/44][0.13 sec][bytes ratio: 0.558 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/10 14/16 30/21 11/5][Pkt Len c2s/s2c min/avg/max/stddev: 49/60 254/82 1506/152 474/31][Plen Bins: 60,20,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0] 2 UDP 192.168.2.100:32951 <-> 148.153.35.205:60021 [proto: 286/RakNet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: Game/8][8 pkts/2039 bytes <-> 7 pkts/563 bytes][Goodput ratio: 83/44][0.11 sec][bytes ratio: 0.567 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 13/12 25/21 10/9][Pkt Len c2s/s2c min/avg/max/stddev: 49/60 255/80 1506/152 474/30][Plen Bins: 60,20,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0] 3 UDP 192.168.2.100:44501 <-> 148.153.35.205:60030 [proto: 286/RakNet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: Game/8][8 pkts/2039 bytes <-> 7 pkts/563 bytes][Goodput ratio: 83/44][0.14 sec][bytes ratio: 0.567 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 18/12 46/23 17/9][Pkt Len c2s/s2c min/avg/max/stddev: 49/60 255/80 1506/152 474/30][Plen Bins: 60,20,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0] diff --git a/tests/cfgs/default/result/rdp.pcap.out b/tests/cfgs/default/result/rdp.pcap.out index f0d38e31f..e09831d3a 100644 --- a/tests/cfgs/default/result/rdp.pcap.out +++ b/tests/cfgs/default/result/rdp.pcap.out @@ -24,4 +24,6 @@ RDP 20 3658 1 Acceptable 20 3658 1 +RemoteAccess 20 3658 1 + 1 TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RemoteAccess/12][13 pkts/1677 bytes <-> 7 pkts/1981 bytes][Goodput ratio: 64/84][0.37 sec][bytes ratio: -0.083 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/43 25/56 45/86 20/16][Pkt Len c2s/s2c min/avg/max/stddev: 44/56 129/283 616/1223 152/394][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][TCP Fingerprint: 194_64_65535_dd834c0209f5/Unknown][PLAIN TEXT (192.168.2.142)][Plen Bins: 16,16,16,16,0,8,0,0,0,8,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rdp2.pcap.out b/tests/cfgs/default/result/rdp2.pcap.out index 5de9241c0..21dcc498d 100644 --- a/tests/cfgs/default/result/rdp2.pcap.out +++ b/tests/cfgs/default/result/rdp2.pcap.out @@ -24,6 +24,8 @@ RDP 39 11371 3 Acceptable 39 11371 3 +RemoteAccess 39 11371 3 + 1 UDP 192.168.122.181:54759 <-> 192.168.122.2:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: RemoteAccess/12][4 pkts/2694 bytes <-> 2 pkts/2334 bytes][Goodput ratio: 94/96][1.76 sec][bytes ratio: 0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1649 550/1649 1011/1649 418/0][Pkt Len c2s/s2c min/avg/max/stddev: 184/1060 674/1167 1274/1274 494/107][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (OKBI.HARDENING.COM)][Plen Bins: 0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0] 2 UDP 10.50.181.210:60355 <-> 10.50.73.36:3389 [VLAN: 1108][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: RemoteAccess/12][4 pkts/1907 bytes <-> 3 pkts/1468 bytes][Goodput ratio: 90/90][0.13 sec][bytes ratio: 0.130 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/7 41/48 80/90 31/42][Pkt Len c2s/s2c min/avg/max/stddev: 199/64 477/489 1278/1278 463/558][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (drcsalgfc)][Plen Bins: 14,0,14,0,28,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,28,0,0,0,0,0,0,0,0,0] 3 UDP 10.8.37.100:51652 <-> 10.100.2.87:3389 [VLAN: 1308][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RemoteAccess/12][12 pkts/1418 bytes <-> 14 pkts/1550 bytes][Goodput ratio: 60/58][0.73 sec][bytes ratio: -0.044 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/65 428/261 140/94][Pkt Len c2s/s2c min/avg/max/stddev: 64/60 118/111 384/148 82/26][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][Plen Bins: 19,46,19,11,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rdp3.pcap.out b/tests/cfgs/default/result/rdp3.pcap.out index bcb8bee27..07db23709 100644 --- a/tests/cfgs/default/result/rdp3.pcap.out +++ b/tests/cfgs/default/result/rdp3.pcap.out @@ -24,4 +24,6 @@ RDP 30 4151 1 Acceptable 30 4151 1 +RemoteAccess 30 4151 1 + 1 TCP 10.150.9.21:1685 <-> 10.157.4.161:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RemoteAccess/12][17 pkts/2567 bytes <-> 13 pkts/1584 bytes][Goodput ratio: 63/54][0.67 sec][bytes ratio: 0.237 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 44/54 234/331 66/93][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 151/122 573/440 162/126][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][PLAIN TEXT (Cookie)][Plen Bins: 59,16,4,0,0,0,0,0,0,0,4,0,12,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rdp_over_tls.pcap.out b/tests/cfgs/default/result/rdp_over_tls.pcap.out index f4e979c29..dd79c2307 100644 --- a/tests/cfgs/default/result/rdp_over_tls.pcap.out +++ b/tests/cfgs/default/result/rdp_over_tls.pcap.out @@ -24,6 +24,8 @@ RDP 19 3868 1 Acceptable 19 3868 1 +RemoteAccess 19 3868 1 + JA Host Stats: IP Address # JA4C 1 91.238.181.21 1 diff --git a/tests/cfgs/default/result/reasm_crash_anon.pcapng.out b/tests/cfgs/default/result/reasm_crash_anon.pcapng.out index 70065a382..d0ce89395 100644 --- a/tests/cfgs/default/result/reasm_crash_anon.pcapng.out +++ b/tests/cfgs/default/result/reasm_crash_anon.pcapng.out @@ -24,6 +24,8 @@ Unknown 200 20067 1 Unrated 200 20067 1 +Unspecified 200 20067 1 + Undetected flows: diff --git a/tests/cfgs/default/result/reasm_segv_anon.pcapng.out b/tests/cfgs/default/result/reasm_segv_anon.pcapng.out index 2a1fc6ae1..650120c38 100644 --- a/tests/cfgs/default/result/reasm_segv_anon.pcapng.out +++ b/tests/cfgs/default/result/reasm_segv_anon.pcapng.out @@ -26,4 +26,6 @@ HTTP 82 77940 1 Acceptable 82 77940 1 +Web 82 77940 1 + 1 TCP 172.17.36.21:57619 <-> 63.190.145.43:80 [proto: GTP:7/HTTP][IP: 265/AmazonAWS][ClearText][Confidence: Match by port][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 15][cat: Web/5][28 pkts/3184 bytes <-> 54 pkts/74756 bytes][Goodput ratio: 0/93][15.67 sec][bytes ratio: -0.918 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 448/205 1615/2133 476/518][Pkt Len c2s/s2c min/avg/max/stddev: 94/90 114/1384 130/1490 9/330][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.880 (Encrypted or Random?)][PLAIN TEXT (.iJoJJ)][Plen Bins: 0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,1,0,0,92,0,0,0,0] diff --git a/tests/cfgs/default/result/reddit.pcap.out b/tests/cfgs/default/result/reddit.pcap.out index 96f72bd6f..e2b2d2d12 100644 --- a/tests/cfgs/default/result/reddit.pcap.out +++ b/tests/cfgs/default/result/reddit.pcap.out @@ -36,6 +36,11 @@ Acceptable 907 330940 24 Fun 733 252471 26 Tracker_Ads 127 68146 3 +Media 103 37264 3 +Web 758 282706 21 +SocialNetwork 630 215207 23 +Advertisement 451 178819 13 + JA Host Stats: IP Address # JA4C 1 2a01:cb01:2049:8b07:991d:ec85:28df:f629 1 diff --git a/tests/cfgs/default/result/resp.pcap.out b/tests/cfgs/default/result/resp.pcap.out index c069f6e79..a9ec38dbb 100644 --- a/tests/cfgs/default/result/resp.pcap.out +++ b/tests/cfgs/default/result/resp.pcap.out @@ -24,4 +24,6 @@ RESP 39 92898 1 Acceptable 39 92898 1 +Database 39 92898 1 + 1 TCP 192.168.88.221:51882 <-> 192.168.88.231:6379 [proto: 182/RESP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Database/11][22 pkts/1556 bytes <-> 17 pkts/91342 bytes][Goodput ratio: 6/99][28.51 sec][bytes ratio: -0.967 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1413/1863 15066/15069 3554/4207][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 71/5373 108/20338 10/5879][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (COMMAND)][Plen Bins: 35,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,59] diff --git a/tests/cfgs/default/result/riot.pcapng.out b/tests/cfgs/default/result/riot.pcapng.out index bc88bcc9d..d863b5195 100644 --- a/tests/cfgs/default/result/riot.pcapng.out +++ b/tests/cfgs/default/result/riot.pcapng.out @@ -29,6 +29,9 @@ RiotGames 4 4338 1 Safe 3 4242 1 Fun 4 4338 1 +Web 3 4242 1 +Game 4 4338 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/riotgames.pcap.out b/tests/cfgs/default/result/riotgames.pcap.out index 9f85c49f0..6c5640e9c 100644 --- a/tests/cfgs/default/result/riotgames.pcap.out +++ b/tests/cfgs/default/result/riotgames.pcap.out @@ -25,6 +25,9 @@ RiotGames 40 3733 7 Fun 44 3953 9 +Game 40 3733 7 +Collaborative 4 220 2 + 1 UDP 192.168.2.100:59956 <-> 162.249.72.1:7194 [proto: 302/RiotGames][IP: 302/RiotGames][ClearText][Confidence: DPI][FPC: 302/RiotGames, Confidence: DPI][DPI packets: 1][cat: Game/8][10 pkts/1106 bytes <-> 5 pkts/387 bytes][Goodput ratio: 62/46][5.50 sec][bytes ratio: 0.482 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/30 684/10 1033/30 438/14][Pkt Len c2s/s2c min/avg/max/stddev: 87/75 111/77 259/87 50/5][Plen Bins: 0,93,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:49298 <-> 162.249.72.1:7194 [proto: 302/RiotGames][IP: 302/RiotGames][ClearText][Confidence: DPI][FPC: 302/RiotGames, Confidence: DPI][DPI packets: 1][cat: Game/8][6 pkts/712 bytes <-> 9 pkts/748 bytes][Goodput ratio: 65/49][2.43 sec][bytes ratio: -0.025 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 28/31 283/132 994/203 372/82][Pkt Len c2s/s2c min/avg/max/stddev: 81/66 119/83 259/181 63/35][Plen Bins: 33,54,0,0,6,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:50004 <-> 162.249.72.1:8181 [proto: 302/RiotGames][IP: 302/RiotGames][ClearText][Confidence: DPI][FPC: 302/RiotGames, Confidence: DPI][DPI packets: 1][cat: Game/8][1 pkts/78 bytes <-> 1 pkts/78 bytes][Goodput ratio: 46/46][0.04 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ripe_atlas.pcap.out b/tests/cfgs/default/result/ripe_atlas.pcap.out index 8d1005cb9..6a667c527 100644 --- a/tests/cfgs/default/result/ripe_atlas.pcap.out +++ b/tests/cfgs/default/result/ripe_atlas.pcap.out @@ -24,6 +24,8 @@ RipeAtlas 7 469 7 Acceptable 7 469 7 +Network 7 469 7 + 1 UDP 9.160.203.32:41059 -> 68.90.0.255:38409 [proto: 417/RipeAtlas][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 417/RipeAtlas, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/67 bytes -> 0 pkts/0 bytes][Goodput ratio: 37/0][< 1 sec][PLAIN TEXT (11.111.11.111)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 23.57.157.60:36137 -> 152.246.227.169:4712 [proto: 417/RipeAtlas][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 417/RipeAtlas, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/67 bytes -> 0 pkts/0 bytes][Goodput ratio: 37/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (11.111.11.111)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 147.63.105.185:48224 -> 128.53.92.31:2164 [proto: 417/RipeAtlas][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 417/RipeAtlas, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/67 bytes -> 0 pkts/0 bytes][Goodput ratio: 37/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (11.111.11.111)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rmcp.pcap.out b/tests/cfgs/default/result/rmcp.pcap.out index 600d6dc40..5b417cd75 100644 --- a/tests/cfgs/default/result/rmcp.pcap.out +++ b/tests/cfgs/default/result/rmcp.pcap.out @@ -24,6 +24,8 @@ RMCP 6 380 6 Safe 6 380 6 +System 6 380 6 + 1 UDP 64.240.55.240:57984 -> 30.144.16.67:623 [proto: 351/RMCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 351/RMCP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/65 bytes -> 0 pkts/0 bytes][Goodput ratio: 35/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 123.212.25.229:49531 -> 171.47.173.23:623 [proto: 351/RMCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 351/RMCP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/65 bytes -> 0 pkts/0 bytes][Goodput ratio: 35/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 127.36.88.103:34698 -> 164.114.97.252:623 [proto: 351/RMCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 351/RMCP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/65 bytes -> 0 pkts/0 bytes][Goodput ratio: 35/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/roblox.pcapng.out b/tests/cfgs/default/result/roblox.pcapng.out index aa017cbb2..3d5aa1c9d 100644 --- a/tests/cfgs/default/result/roblox.pcapng.out +++ b/tests/cfgs/default/result/roblox.pcapng.out @@ -26,6 +26,8 @@ Roblox 34 12002 1 Fun 78 33909 4 +Game 78 33909 4 + JA Host Stats: IP Address # JA4C 1 192.168.12.156 1 diff --git a/tests/cfgs/default/result/rockstar_games.pcapng.out b/tests/cfgs/default/result/rockstar_games.pcapng.out index 245438e51..35296d226 100644 --- a/tests/cfgs/default/result/rockstar_games.pcapng.out +++ b/tests/cfgs/default/result/rockstar_games.pcapng.out @@ -25,6 +25,8 @@ RockstarGames 25 8964 4 Fun 25 8964 4 +Game 25 8964 4 + JA Host Stats: IP Address # JA4C 1 192.168.1.27 1 diff --git a/tests/cfgs/default/result/roughtime.pcap.out b/tests/cfgs/default/result/roughtime.pcap.out index fd92dae03..1a9746f5a 100644 --- a/tests/cfgs/default/result/roughtime.pcap.out +++ b/tests/cfgs/default/result/roughtime.pcap.out @@ -24,6 +24,8 @@ Roughtime 4 2936 4 Acceptable 4 2936 4 +System 4 2936 4 + 1 UDP 192.168.2.100:36225 -> 64.233.164.158:2002 [proto: 383/Roughtime][IP: 126/Google][ClearText][Confidence: DPI][FPC: 383/Roughtime, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/1066 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (NONCPAD)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:39393 -> 35.192.98.51:2002 [proto: 383/Roughtime][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 383/Roughtime, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/1066 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (NONCPAD)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 35.192.98.51:2002 -> 192.168.2.100:57626 [proto: 383/Roughtime][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 383/Roughtime, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/402 bytes -> 0 pkts/0 bytes][Goodput ratio: 89/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (PATHSREPCERTIND)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rsh-syslog-false-positive.pcap.out b/tests/cfgs/default/result/rsh-syslog-false-positive.pcap.out index b6cede513..dfda6528b 100644 --- a/tests/cfgs/default/result/rsh-syslog-false-positive.pcap.out +++ b/tests/cfgs/default/result/rsh-syslog-false-positive.pcap.out @@ -24,4 +24,6 @@ Syslog 6 3335 1 Acceptable 6 3335 1 +System 6 3335 1 + 1 TCP 172.31.78.129:9039 -> 172.29.43.201:514 [proto: 17/Syslog][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 17/Syslog, Confidence: DPI][DPI packets: 1][cat: System/18][6 pkts/3335 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][0.08 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 11/0 16/0 26/0 6/0][Pkt Len c2s/s2c min/avg/max/stddev: 292/0 556/0 844/0 212/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (52.926451)][Plen Bins: 0,0,0,0,0,0,0,34,0,0,0,0,0,16,0,0,0,0,16,0,0,16,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rsh.pcap.out b/tests/cfgs/default/result/rsh.pcap.out index b1a87a76e..946f8ac82 100644 --- a/tests/cfgs/default/result/rsh.pcap.out +++ b/tests/cfgs/default/result/rsh.pcap.out @@ -24,5 +24,7 @@ RSH 24 1721 2 Unsafe 24 1721 2 +RemoteAccess 24 1721 2 + 1 TCP 127.0.0.1:1021 <-> 127.0.0.1:514 [proto: 294/RSH][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: RemoteAccess/12][7 pkts/508 bytes <-> 5 pkts/356 bytes][Goodput ratio: 7/5][1.43 sec][bytes ratio: 0.176 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/16 286/477 1414/1414 564/663][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 73/71 99/84 11/7][Risk: ** Unsafe Protocol **** Clear-Text Credentials **][Risk Score: 110][Risk Info: User 'someuser' executing 'some random command'][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][PLAIN TEXT (someuser)][Plen Bins: 66,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:1023 <-> 127.0.0.1:514 [proto: 294/RSH][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: RemoteAccess/12][7 pkts/498 bytes <-> 5 pkts/359 bytes][Goodput ratio: 6/6][1.31 sec][bytes ratio: 0.162 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/15 262/437 1295/1295 517/607][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 71/72 89/87 8/8][Risk: ** Unsafe Protocol **** Clear-Text Credentials **][Risk Score: 110][Risk Info: User 'root' executing 'mkdir testdir'][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rsync.pcap.out b/tests/cfgs/default/result/rsync.pcap.out index cff10d0e7..f0d288752 100644 --- a/tests/cfgs/default/result/rsync.pcap.out +++ b/tests/cfgs/default/result/rsync.pcap.out @@ -24,4 +24,6 @@ RSYNC 30 2493 1 Acceptable 30 2493 1 +DataTransfer 30 2493 1 + 1 TCP 127.0.0.1:54489 <-> 127.0.0.1:873 [proto: 166/RSYNC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: DataTransfer/4][16 pkts/1150 bytes <-> 14 pkts/1343 bytes][Goodput ratio: 7/31][0.14 sec][bytes ratio: -0.077 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 8/10 39/39 14/16][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 72/96 101/412 9/88][TCP Fingerprint: 2_64_43690_4282f7101799/Unknown][PLAIN TEXT (@RSYNCD)][Plen Bins: 87,6,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rtcp_multiple_pkts_in_the_same_datagram.pcap.out b/tests/cfgs/default/result/rtcp_multiple_pkts_in_the_same_datagram.pcap.out index 9cc50deb7..f5d4a6a98 100644 --- a/tests/cfgs/default/result/rtcp_multiple_pkts_in_the_same_datagram.pcap.out +++ b/tests/cfgs/default/result/rtcp_multiple_pkts_in_the_same_datagram.pcap.out @@ -24,4 +24,6 @@ RTCP 5 740 1 Acceptable 5 740 1 +VoIP 5 740 1 + 1 UDP 217.12.244.34:25963 <-> 217.12.247.98:31601 [proto: 165/RTCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VoIP/10][3 pkts/468 bytes <-> 2 pkts/272 bytes][Goodput ratio: 72/67][8.04 sec][PLAIN TEXT (931534)][Plen Bins: 0,0,40,60,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rtmp.pcap.out b/tests/cfgs/default/result/rtmp.pcap.out index 5bf91e9ac..d29a283fc 100644 --- a/tests/cfgs/default/result/rtmp.pcap.out +++ b/tests/cfgs/default/result/rtmp.pcap.out @@ -24,6 +24,8 @@ RTMP 60 25463 3 Acceptable 60 25463 3 +Media 60 25463 3 + 1 TCP 10.140.74.206:59509 <-> 193.118.47.46:6002 [VLAN: 113][proto: GTP:174/RTMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Media/1][8 pkts/4268 bytes <-> 9 pkts/4410 bytes][Goodput ratio: 79/77][2.62 sec][bytes ratio: -0.016 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 331/225 819/1319 326/455][Pkt Len c2s/s2c min/avg/max/stddev: 122/118 534/490 1458/1458 539/530][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 1935][TCP Fingerprint: 2_64_65535_d29295416479/macOS][PLAIN TEXT (StreamMedia)][Plen Bins: 13,20,6,0,0,13,6,6,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,27,0,0,0,0,0] 2 TCP 10.140.80.204:49757 <-> 203.205.224.48:1935 [VLAN: 113][proto: GTP:174/RTMP][IP: 285/Tencent][ClearText][Confidence: DPI][FPC: 285/Tencent, Confidence: IP address][DPI packets: 5][cat: Media/1][8 pkts/4155 bytes <-> 9 pkts/4262 bytes][Goodput ratio: 81/79][0.83 sec][bytes ratio: -0.013 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 98/72 177/168 76/54][Pkt Len c2s/s2c min/avg/max/stddev: 110/99 519/474 1458/1458 547/539][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][PLAIN TEXT (connect)][Plen Bins: 26,13,0,0,0,13,0,13,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,26,0,0,0,0,0] 3 TCP 192.168.43.1:1177 <-> 192.168.43.128:1935 [proto: 174/RTMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: Media/1][12 pkts/4108 bytes <-> 14 pkts/4260 bytes][Goodput ratio: 84/82][1.04 sec][bytes ratio: -0.018 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 83/75 334/230 119/85][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 342/304 1514/1514 531/465][TCP Fingerprint: 2_128_65535_44bd01ba086e/Unknown][PLAIN TEXT (ace@nAt)][Plen Bins: 7,21,14,0,7,7,0,0,0,7,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,7,0,0,0,0,0,21,0,0] diff --git a/tests/cfgs/default/result/rtp.pcapng.out b/tests/cfgs/default/result/rtp.pcapng.out index 8bad7183f..dd7855d2d 100644 --- a/tests/cfgs/default/result/rtp.pcapng.out +++ b/tests/cfgs/default/result/rtp.pcapng.out @@ -27,6 +27,9 @@ RTP 82 43715 3 Acceptable 82 43715 3 Fun 30 16092 1 +Media 82 43715 3 +Collaborative 30 16092 1 + 1 TCP 172.16.168.24:40252 <-> 172.16.168.64:5000 [proto: 87/RTP][IP: 0/Unknown][Stream Content: Audio][Payload Type: ITU-T G.711 PCMA (8.0)][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 32][cat: Media/1][19 pkts/21900 bytes <-> 18 pkts/1196 bytes][Goodput ratio: 94/0][85.30 sec][bytes ratio: 0.896 (Upload)][IAT c2s/s2c min/avg/max/stddev: 93/93 5654/6060 82923/82923 20651/21318][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1153/66 1280/74 371/2][TCP Fingerprint: 2_64_5840_1596d0698b3d/Unknown][PLAIN TEXT (QQSPSSV)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.204.220.71:6000 -> 10.204.220.171:6000 [proto: 87/RTP][IP: 0/Unknown][Stream Content: Audio][Payload Type: ITU-T H.263 (34.0)][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 15][cat: Media/1][15 pkts/18438 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][0.34 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 25/0 77/0 31/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 1229/0 1486/0 467/0][Plen Bins: 6,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,6,0,0,0,0,0,0,0,0,0,6,0,0,0,68,0,0] 3 UDP 150.219.118.19:54234 <-> 192.113.193.227:50003 [proto: 58/Discord][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: Collaborative/15][11 pkts/1455 bytes <-> 19 pkts/14637 bytes][Goodput ratio: 68/95][0.14 sec][Client IP: 85.154.2.145][bytes ratio: -0.819 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 13/6 36/29 11/11][Pkt Len c2s/s2c min/avg/max/stddev: 85/116 132/770 207/1146 54/475][PLAIN TEXT (85.154.2.145)][Plen Bins: 0,20,6,20,3,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,26,13,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rtps.pcap.out b/tests/cfgs/default/result/rtps.pcap.out index 51aea28ea..8cfa1cb8a 100644 --- a/tests/cfgs/default/result/rtps.pcap.out +++ b/tests/cfgs/default/result/rtps.pcap.out @@ -24,4 +24,6 @@ RTPS 29 22382 1 Acceptable 29 22382 1 +RPC 29 22382 1 + 1 UDP 127.0.0.1:28108 -> 127.0.0.1:7410 [proto: 359/RTPS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 359/RTPS, Confidence: DPI][DPI packets: 1][cat: RPC/16][29 pkts/22382 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][490.03 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1000/0 17655/0 30000/0 13497/0][Pkt Len c2s/s2c min/avg/max/stddev: 58/0 772/0 822/0 185/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 7401][PLAIN TEXT (dds.sys)][Plen Bins: 3,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,93,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rtsp.pcap.out b/tests/cfgs/default/result/rtsp.pcap.out index 0f41732e9..06b8509f2 100644 --- a/tests/cfgs/default/result/rtsp.pcap.out +++ b/tests/cfgs/default/result/rtsp.pcap.out @@ -24,6 +24,8 @@ RTSP 568 100872 7 Fun 568 100872 7 +Media 568 100872 7 + 1 TCP 10.1.1.10:52478 <-> 10.2.2.2:8554 [proto: 50/RTSP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 21][cat: Media/1][44 pkts/6374 bytes <-> 60 pkts/11092 bytes][Goodput ratio: 59/68][59.02 sec][bytes ratio: -0.270 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1730/3 58323/42 9852/8][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 145/185 257/751 77/190][User-Agent: LibVLC/3.0.16 (LIVE555 Streaming Media v2016.11.28)][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 554][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (OPTIONS rtsp)][Plen Bins: 0,0,0,16,25,8,16,0,16,0,8,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.1.1.10:52472 <-> 10.2.2.2:8554 [proto: 50/RTSP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 13][cat: Media/1][40 pkts/6114 bytes <-> 56 pkts/10878 bytes][Goodput ratio: 62/70][58.23 sec][bytes ratio: -0.280 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1872/2 58022/20 10252/6][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 153/194 258/751 77/194][User-Agent: LibVLC/3.0.16 (LIVE555 Streaming Media v2016.11.28)][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 554][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (OPTIONS rtsp)][Plen Bins: 0,0,0,16,25,8,16,0,16,0,8,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.1.1.10:52480 <-> 10.2.2.2:8554 [proto: 50/RTSP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 13][cat: Media/1][40 pkts/6114 bytes <-> 52 pkts/10628 bytes][Goodput ratio: 62/71][59.74 sec][bytes ratio: -0.270 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1921/2 59529/21 10518/6][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 153/204 258/751 77/198][User-Agent: LibVLC/3.0.16 (LIVE555 Streaming Media v2016.11.28)][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 554][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (OPTIONS rtsp)][Plen Bins: 0,0,0,16,25,8,16,0,16,0,8,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rtsp_setup_http.pcapng.out b/tests/cfgs/default/result/rtsp_setup_http.pcapng.out index be3b85647..9be552b9d 100644 --- a/tests/cfgs/default/result/rtsp_setup_http.pcapng.out +++ b/tests/cfgs/default/result/rtsp_setup_http.pcapng.out @@ -24,4 +24,6 @@ RTSP 1 233 1 Fun 1 233 1 +Media 1 233 1 + 1 TCP 172.28.5.170:63840 -> 172.28.4.26:8554 [proto: 50/RTSP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 50/RTSP, Confidence: DPI][DPI packets: 1][cat: Media/1][1 pkts/233 bytes -> 0 pkts/0 bytes][Goodput ratio: 76/0][< 1 sec][User-Agent: LibVLC/3.0.16 (LIVE555 Streaming Media v2016.11.28)][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 554][PLAIN TEXT (SETUP rtsp)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/rx.pcap.out b/tests/cfgs/default/result/rx.pcap.out index 74faf6b8a..deea0bc0d 100644 --- a/tests/cfgs/default/result/rx.pcap.out +++ b/tests/cfgs/default/result/rx.pcap.out @@ -24,6 +24,8 @@ RX 132 26475 5 Acceptable 132 26475 5 +RPC 132 26475 5 + 1 UDP 131.114.219.168:7001 <-> 192.167.206.241:7000 [proto: 223/RX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: RPC/16][48 pkts/6808 bytes <-> 31 pkts/5568 bytes][Goodput ratio: 70/77][20.45 sec][bytes ratio: 0.100 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 509/13 19828/65 3094/18][Pkt Len c2s/s2c min/avg/max/stddev: 70/74 142/180 510/782 117/123][PLAIN TEXT (UZ.SNS.IT)][Plen Bins: 2,26,41,0,17,6,0,0,0,0,0,0,2,0,3,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 131.114.219.168:7001 <-> 192.167.206.124:7003 [proto: 223/RX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: RPC/16][18 pkts/1833 bytes <-> 9 pkts/8086 bytes][Goodput ratio: 59/95][0.72 sec][bytes ratio: -0.630 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/20 47/76 240/282 63/93][Pkt Len c2s/s2c min/avg/max/stddev: 82/130 102/898 134/1118 15/411][PLAIN TEXT (root.cell)][Plen Bins: 0,25,48,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 131.114.219.168:7001 <-> 192.167.206.124:7000 [proto: 223/RX][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: RPC/16][10 pkts/2085 bytes <-> 10 pkts/1057 bytes][Goodput ratio: 80/60][20.17 sec][bytes ratio: 0.327 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 2520/4 19845/17 6549/5][Pkt Len c2s/s2c min/avg/max/stddev: 70/74 208/106 510/198 183/34][PLAIN TEXT (UZ.SNS.IT)][Plen Bins: 10,30,40,0,5,0,0,0,0,0,0,0,5,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/s7comm-plus.pcap.out b/tests/cfgs/default/result/s7comm-plus.pcap.out index 85c71e3f2..f8d7bd4f5 100644 --- a/tests/cfgs/default/result/s7comm-plus.pcap.out +++ b/tests/cfgs/default/result/s7comm-plus.pcap.out @@ -24,4 +24,6 @@ S7CommPlus 79 10271 1 Acceptable 79 10271 1 +IoT-Scada 79 10271 1 + 1 TCP 192.168.25.177:53162 <-> 192.168.25.131:102 [proto: 361/S7CommPlus][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 9][cat: IoT-Scada/31][54 pkts/6194 bytes <-> 25 pkts/4077 bytes][Goodput ratio: 53/65][7.11 sec][bytes ratio: 0.206 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 122/276 995/964 315/396][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 115/163 395/351 76/132][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (SIMATIC)][Plen Bins: 42,6,28,3,1,0,3,0,0,12,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/s7comm.pcap.out b/tests/cfgs/default/result/s7comm.pcap.out index fa4147c83..978b1f015 100644 --- a/tests/cfgs/default/result/s7comm.pcap.out +++ b/tests/cfgs/default/result/s7comm.pcap.out @@ -24,4 +24,6 @@ S7Comm 55 5260 1 Acceptable 55 5260 1 +IoT-Scada 55 5260 1 + 1 TCP 192.168.1.10:4185 <-> 192.168.1.40:102 [proto: 249/S7Comm][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: IoT-Scada/31][36 pkts/3146 bytes <-> 19 pkts/2114 bytes][Goodput ratio: 38/51][0.14 sec][bytes ratio: 0.196 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/3 3/6 8/12 3/3][Pkt Len c2s/s2c min/avg/max/stddev: 61/74 87/111 301/275 54/44][PLAIN TEXT (TestHMI00040)][Plen Bins: 53,32,9,0,0,0,1,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/safari.pcap.out b/tests/cfgs/default/result/safari.pcap.out index f279f5f9c..e786b94a9 100644 --- a/tests/cfgs/default/result/safari.pcap.out +++ b/tests/cfgs/default/result/safari.pcap.out @@ -24,6 +24,8 @@ TLS 168 83390 7 Safe 168 83390 7 +Web 168 83390 7 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 2 diff --git a/tests/cfgs/default/result/salesforce.pcap.out b/tests/cfgs/default/result/salesforce.pcap.out index bbae8c4ba..bb76c6671 100644 --- a/tests/cfgs/default/result/salesforce.pcap.out +++ b/tests/cfgs/default/result/salesforce.pcap.out @@ -24,6 +24,8 @@ Salesforce 15 5205 1 Safe 15 5205 1 +Cloud 15 5205 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 1 diff --git a/tests/cfgs/default/result/scanner.pcap.out b/tests/cfgs/default/result/scanner.pcap.out index 6512b8843..dc9fb87c2 100644 --- a/tests/cfgs/default/result/scanner.pcap.out +++ b/tests/cfgs/default/result/scanner.pcap.out @@ -24,6 +24,8 @@ Unknown 1 64 1 Unrated 1 64 1 +Unspecified 1 64 1 + Undetected flows: diff --git a/tests/cfgs/default/result/sccp_hw_conf_register.pcapng.out b/tests/cfgs/default/result/sccp_hw_conf_register.pcapng.out index 01c695032..a858ef280 100644 --- a/tests/cfgs/default/result/sccp_hw_conf_register.pcapng.out +++ b/tests/cfgs/default/result/sccp_hw_conf_register.pcapng.out @@ -24,4 +24,6 @@ CiscoSkinny 17 1522 1 Acceptable 17 1522 1 +VoIP 17 1522 1 + 1 TCP 10.180.110.58:46461 <-> 10.180.110.48:2000 [proto: 164/CiscoSkinny][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VoIP/10][8 pkts/932 bytes <-> 9 pkts/590 bytes][Goodput ratio: 53/17][0.24 sec][bytes ratio: 0.225 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/1 40/29 202/199 74/70][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 116/66 370/86 105/13][TCP Fingerprint: 2_255_4128_6bbe28597824/Unknown][PLAIN TEXT (NONSECURE)][Plen Bins: 63,12,0,0,12,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/sctp.cap.out b/tests/cfgs/default/result/sctp.cap.out index 0d0afdf83..64554ae81 100644 --- a/tests/cfgs/default/result/sctp.cap.out +++ b/tests/cfgs/default/result/sctp.cap.out @@ -24,5 +24,7 @@ SCTP 4 340 2 Acceptable 4 340 2 +Network 4 340 2 + 1 SCTP 10.28.6.43:0 <-> 10.28.6.44:0 [proto: 84/SCTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 84/SCTP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/138 bytes <-> 1 pkts/62 bytes][Goodput ratio: 0/0][< 1 sec][PLAIN TEXT (MEGACO/2 )][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 SCTP 10.28.6.42:0 <-> 10.28.6.44:0 [proto: 84/SCTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 84/SCTP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/70 bytes <-> 1 pkts/70 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/selfsigned.pcap.out b/tests/cfgs/default/result/selfsigned.pcap.out index 738f86d40..512f037fd 100644 --- a/tests/cfgs/default/result/selfsigned.pcap.out +++ b/tests/cfgs/default/result/selfsigned.pcap.out @@ -24,6 +24,8 @@ ntop 20 3766 1 Safe 20 3766 1 +Network 20 3766 1 + JA Host Stats: IP Address # JA4C 1 127.0.0.1 1 diff --git a/tests/cfgs/default/result/sflow.pcap.out b/tests/cfgs/default/result/sflow.pcap.out index 18e8c14de..3a918cdc5 100644 --- a/tests/cfgs/default/result/sflow.pcap.out +++ b/tests/cfgs/default/result/sflow.pcap.out @@ -24,4 +24,6 @@ sFlow 9 1702 1 Acceptable 9 1702 1 +Network 9 1702 1 + 1 UDP 172.21.35.17:1027 -> 172.21.35.199:6343 [proto: 129/sFlow][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: Network/14][9 pkts/1702 bytes -> 0 pkts/0 bytes][Goodput ratio: 78/0][109.01 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 6002/0 13626/0 19002/0 4554/0][Pkt Len c2s/s2c min/avg/max/stddev: 186/0 189/0 214/0 9/0][PLAIN TEXT (abcdefghijklmnopq)][Plen Bins: 0,0,0,0,88,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/shadowsocks.pcap.out b/tests/cfgs/default/result/shadowsocks.pcap.out index 02612e26a..3f492dd47 100644 --- a/tests/cfgs/default/result/shadowsocks.pcap.out +++ b/tests/cfgs/default/result/shadowsocks.pcap.out @@ -27,6 +27,9 @@ SOCKS 29 69355 1 Acceptable 29 69355 1 Unrated 15 68444 1 +Unspecified 15 68444 1 +Web 29 69355 1 + 1 TCP 127.0.0.1:37904 <-> 127.0.0.1:1080 [proto: 172/SOCKS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][16 pkts/1160 bytes <-> 13 pkts/68195 bytes][Goodput ratio: 8/99][1.49 sec][bytes ratio: -0.967 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 114/160 659/660 191/203][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 72/5246 148/16450 20/7185][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 33,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,41] diff --git a/tests/cfgs/default/result/shell.pcap.out b/tests/cfgs/default/result/shell.pcap.out index 9b0d7d0f0..66a6ef9a1 100644 --- a/tests/cfgs/default/result/shell.pcap.out +++ b/tests/cfgs/default/result/shell.pcap.out @@ -25,6 +25,8 @@ Unknown 18 13422 4 Unrated 18 13422 4 +Unspecified 18 13422 4 + Undetected flows: diff --git a/tests/cfgs/default/result/signal.pcap.out b/tests/cfgs/default/result/signal.pcap.out index da98cae43..2cb214ffa 100644 --- a/tests/cfgs/default/result/signal.pcap.out +++ b/tests/cfgs/default/result/signal.pcap.out @@ -33,6 +33,11 @@ Safe 28 2022 3 Acceptable 9 1914 4 Fun 600 311832 12 +Web 28 2022 3 +Chat 510 282037 10 +Network 9 1914 4 +Streaming 90 29795 2 + JA Host Stats: IP Address # JA4C 1 192.168.2.17 3 diff --git a/tests/cfgs/default/result/signal_audiocall.pcapng.out b/tests/cfgs/default/result/signal_audiocall.pcapng.out index 4c055bb99..72567dc33 100644 --- a/tests/cfgs/default/result/signal_audiocall.pcapng.out +++ b/tests/cfgs/default/result/signal_audiocall.pcapng.out @@ -25,6 +25,8 @@ SignalVoip 268 50558 4 Acceptable 268 50558 4 +VoIP 268 50558 4 + 1 UDP 192.168.12.67:45419 <-> 35.219.226.11:54116 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 7][cat: VoIP/10][91 pkts/20258 bytes <-> 87 pkts/18776 bytes][Goodput ratio: 81/81][16.10 sec][bytes ratio: 0.038 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 185/163 2145/2221 406/335][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 223/216 337/337 105/106][Mapped IP/Port: 93.35.168.30:45251][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (zaziGwgI)][Plen Bins: 6,15,11,11,0,0,0,0,46,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:45419 <-> 35.219.252.146:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][29 pkts/3570 bytes <-> 29 pkts/4210 bytes][Goodput ratio: 66/71][19.07 sec][Hostname/SNI: signal.org][bytes ratio: -0.082 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 594/604 2518/2516 688/680][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 123/145 182/182 41/34][Mapped IP/Port: 93.35.168.30:45250][Relayed IP/Port: 35.219.252.146:22269][PLAIN TEXT (BDIbPI2)][Plen Bins: 17,8,15,32,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:45419 <-> 35.219.226.11:12261 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 7][cat: VoIP/10][11 pkts/1238 bytes <-> 11 pkts/1454 bytes][Goodput ratio: 63/68][14.81 sec][bytes ratio: -0.080 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 97/26 1215/1207 2521/2521 1083/1093][Pkt Len c2s/s2c min/avg/max/stddev: 106/106 113/132 146/138 14/12][Mapped IP/Port: 93.35.168.30:45251][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BV39hIkc1)][Plen Bins: 0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/signal_audiocall_2.pcapng.out b/tests/cfgs/default/result/signal_audiocall_2.pcapng.out index c8577c968..e373f01e1 100644 --- a/tests/cfgs/default/result/signal_audiocall_2.pcapng.out +++ b/tests/cfgs/default/result/signal_audiocall_2.pcapng.out @@ -28,6 +28,9 @@ SignalVoip 167 33543 3 Acceptable 167 33543 3 Fun 91 23664 2 +Chat 91 23664 2 +VoIP 167 33543 3 + JA Host Stats: IP Address # JA4C 1 192.168.12.67 1 diff --git a/tests/cfgs/default/result/signal_multiparty.pcapng.out b/tests/cfgs/default/result/signal_multiparty.pcapng.out index fbbfa87c9..77b1a6780 100644 --- a/tests/cfgs/default/result/signal_multiparty.pcapng.out +++ b/tests/cfgs/default/result/signal_multiparty.pcapng.out @@ -24,4 +24,6 @@ SignalVoip 30 9753 1 Acceptable 30 9753 1 +VoIP 30 9753 1 + 1 UDP 192.168.12.67:38303 <-> 35.207.138.135:10000 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Encrypted][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][24 pkts/9059 bytes <-> 6 pkts/694 bytes][Goodput ratio: 89/64][0.46 sec][bytes ratio: 0.858 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 21/23 213/46 46/22][Pkt Len c2s/s2c min/avg/max/stddev: 87/81 377/116 1036/142 286/27][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BCipr/LEZ)][Plen Bins: 0,23,10,20,0,0,3,3,0,3,0,0,0,0,26,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/signal_videocall.pcapng.out b/tests/cfgs/default/result/signal_videocall.pcapng.out index 566efc4c6..747a23172 100644 --- a/tests/cfgs/default/result/signal_videocall.pcapng.out +++ b/tests/cfgs/default/result/signal_videocall.pcapng.out @@ -25,6 +25,8 @@ SignalVoip 334 123259 3 Acceptable 334 123259 3 +VoIP 334 123259 3 + 1 UDP 192.168.12.67:47926 <-> 35.219.252.146:56377 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 7][cat: VoIP/10][167 pkts/87565 bytes <-> 131 pkts/31930 bytes][Goodput ratio: 92/83][10.75 sec][bytes ratio: 0.466 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 64/82 2304/2449 291/279][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 524/244 1223/900 385/198][Mapped IP/Port: 93.35.168.30:45266][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (17uAgN)][Plen Bins: 3,28,9,7,0,0,0,0,16,8,1,0,0,1,1,0,1,1,0,1,0,0,0,0,7,3,0,1,0,0,1,1,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:47926 <-> 35.219.252.146:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][13 pkts/1258 bytes <-> 13 pkts/1454 bytes][Goodput ratio: 57/62][10.01 sec][Hostname/SNI: signal.org][bytes ratio: -0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 6/6 804/804 4015/4015 1248/1248][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 97/112 162/126 43/14][Mapped IP/Port: 93.35.168.30:45265][Relayed IP/Port: 35.219.252.146:40378][PLAIN TEXT (BFODsIPgWuCIX)][Plen Bins: 34,19,30,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:47926 <-> 35.216.234.234:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][5 pkts/510 bytes <-> 5 pkts/542 bytes][Goodput ratio: 59/61][10.02 sec][Hostname/SNI: signal.org][bytes ratio: -0.030 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5/4 2503/2503 9988/9988 4321/4321][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 102/108 158/126 46/15][Mapped IP/Port: 93.35.168.30:45265][Relayed IP/Port: 35.216.234.234:29688][PLAIN TEXT (42oPBlgi)][Plen Bins: 30,30,20,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/signal_videocall_multiparty.pcapng.out b/tests/cfgs/default/result/signal_videocall_multiparty.pcapng.out index c127fa720..786f16928 100644 --- a/tests/cfgs/default/result/signal_videocall_multiparty.pcapng.out +++ b/tests/cfgs/default/result/signal_videocall_multiparty.pcapng.out @@ -24,4 +24,6 @@ SignalVoip 260 96919 1 Acceptable 260 96919 1 +VoIP 260 96919 1 + 1 UDP 192.168.1.117:59446 <-> 35.207.67.68:10000 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][192 pkts/75765 bytes <-> 68 pkts/21154 bytes][Goodput ratio: 89/86][17.98 sec][bytes ratio: 0.563 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 94/273 1011/1358 238/433][Pkt Len c2s/s2c min/avg/max/stddev: 70/74 395/311 1253/1226 355/365][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BvkPzIMF7)][Plen Bins: 1,40,2,9,0,1,0,2,1,15,1,0,5,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0,0,1,0,0,0,0,3,0,2,2,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/simple-dnscrypt.pcap.out b/tests/cfgs/default/result/simple-dnscrypt.pcap.out index 958284bd3..2661aa218 100644 --- a/tests/cfgs/default/result/simple-dnscrypt.pcap.out +++ b/tests/cfgs/default/result/simple-dnscrypt.pcap.out @@ -25,6 +25,8 @@ DNScrypt 111 44676 4 Acceptable 111 44676 4 +Network 111 44676 4 + JA Host Stats: IP Address # JA4C 1 192.168.43.167 2 diff --git a/tests/cfgs/default/result/sip.pcap.out b/tests/cfgs/default/result/sip.pcap.out index efbc81a15..d1a968f5d 100644 --- a/tests/cfgs/default/result/sip.pcap.out +++ b/tests/cfgs/default/result/sip.pcap.out @@ -28,6 +28,10 @@ SIP 102 47087 2 Acceptable 111 49013 3 Unrated 1 146 1 +Unspecified 1 146 1 +Media 9 1926 1 +VoIP 102 47087 2 + 1 UDP 192.168.1.2:5060 <-> 212.242.33.35:5060 [proto: 100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 100/SIP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][53 pkts/21940 bytes <-> 31 pkts/15635 bytes][Goodput ratio: 90/92][1521.57 sec][SIP From: <sip:voi18063@sip.cybercity.dk>;tag=903df0a][SIP To: <sip:voi18063@sip.cybercity.dk>][bytes ratio: 0.168 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 158/13 25541/22026 150200/89874 25265/23489][Pkt Len c2s/s2c min/avg/max/stddev: 47/342 414/504 1118/711 343/85][PLAIN TEXT (REGISTER sip)][Plen Bins: 26,0,0,0,0,0,0,0,0,4,8,0,2,4,13,17,0,0,3,0,1,10,0,0,0,5,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.2:5060 <-> 200.68.120.81:5060 [proto: 100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 100/SIP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][15 pkts/7568 bytes <-> 3 pkts/1944 bytes][Goodput ratio: 92/93][67.09 sec][SIP From: "arik" <sip:816666@voip.brurjula.net>;tag=6433ef9][SIP To: <sip:97239287044@voip.brujula.net>][bytes ratio: 0.591 (Upload)][IAT c2s/s2c min/avg/max/stddev: 507/34556 4746/34556 32608/34556 8188/0][Pkt Len c2s/s2c min/avg/max/stddev: 389/637 505/648 864/656 180/8][PLAIN TEXT (INVITE sip)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,5,62,0,0,0,0,0,0,5,11,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.2:30000 -> 212.242.33.36:40392 [proto: 87/RTP][IP: 0/Unknown][Stream Content: Audio][Payload Type: ITU-T G.711 PCMA (8.0)][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 9][cat: Media/1][9 pkts/1926 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][0.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 20/0 69/0 23/0][Pkt Len c2s/s2c min/avg/max/stddev: 214/0 214/0 214/0 0/0][PLAIN TEXT (VRUDKBuYs)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/sip_hello.pcapng.out b/tests/cfgs/default/result/sip_hello.pcapng.out index 58bbb0558..f92a0665b 100644 --- a/tests/cfgs/default/result/sip_hello.pcapng.out +++ b/tests/cfgs/default/result/sip_hello.pcapng.out @@ -24,4 +24,6 @@ SIP 30 5592 1 Acceptable 30 5592 1 +VoIP 30 5592 1 + 1 UDP 10.239.156.235:5060 <-> 172.29.38.91:5060 [proto: 100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 100/SIP, Confidence: DPI][DPI packets: 1][cat: VoIP/10][15 pkts/2691 bytes <-> 15 pkts/2901 bytes][Goodput ratio: 73/75][491.56 sec][bytes ratio: -0.038 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 67/59 36861/36861 49155/49155 16718/16727][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 179/193 555/661 205/233][PLAIN TEXT (oREGISTER sip)][Plen Bins: 74,0,0,0,0,0,0,0,0,0,0,0,0,13,0,0,6,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/sites.pcapng.out b/tests/cfgs/default/result/sites.pcapng.out index cf2a667d8..a0b462c02 100644 --- a/tests/cfgs/default/result/sites.pcapng.out +++ b/tests/cfgs/default/result/sites.pcapng.out @@ -81,6 +81,24 @@ Acceptable 247 137549 29 Fun 482 310458 34 Potentially_Dangerous 4 2225 1 +Media 99 104198 1 +VPN 43 23426 2 +Email 9 5954 1 +Web 132 48664 12 +SocialNetwork 187 120668 10 +Download 4 2225 1 +Game 41 22792 6 +Chat 26 16492 4 +VoIP 31 10555 1 +Cloud 102 64539 12 +Network 18 8375 1 +Collaborative 13 8908 3 +Streaming 85 31043 7 +Music 12 6665 3 +Video 30 16616 6 +Shopping 4 2245 1 +VirtAssistant 4 2245 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 5 diff --git a/tests/cfgs/default/result/sites2.pcapng.out b/tests/cfgs/default/result/sites2.pcapng.out index 6cc6c016c..d0a22bd5b 100644 --- a/tests/cfgs/default/result/sites2.pcapng.out +++ b/tests/cfgs/default/result/sites2.pcapng.out @@ -29,6 +29,10 @@ YandexAlice 10 882 1 Acceptable 58 20370 4 Fun 4 797 1 +Streaming 4 797 1 +Shopping 48 19488 3 +ConnCheck 10 882 1 + JA Host Stats: IP Address # JA4C 1 192.168.12.67 4 diff --git a/tests/cfgs/default/result/skinny.pcap.out b/tests/cfgs/default/result/skinny.pcap.out index f87b39764..f3e2414fd 100644 --- a/tests/cfgs/default/result/skinny.pcap.out +++ b/tests/cfgs/default/result/skinny.pcap.out @@ -26,6 +26,9 @@ CiscoSkinny 61 6964 2 Acceptable 196 35854 7 +Media 135 28890 5 +VoIP 61 6964 2 + 1 UDP 192.168.195.58:32144 <-> 192.168.195.50:17718 [proto: 87/RTP][IP: 0/Unknown][Stream Content: Audio][Payload Type: ITU-T G.711 PCMU (0.0) / ITU-T G.711 PCMU (0.0)][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Media/1][36 pkts/7704 bytes <-> 33 pkts/7062 bytes][Goodput ratio: 80/80][0.35 sec][bytes ratio: 0.043 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/7 20/20 9/9][Pkt Len c2s/s2c min/avg/max/stddev: 214/214 214/214 214/214 0/0][PLAIN TEXT (zwwtvutz)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.195.58:32150 -> 192.168.193.24:9395 [proto: 87/RTP][IP: 0/Unknown][Stream Content: Audio][Payload Type: ITU-T G.711 PCMU (0.0)][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 18][cat: Media/1][18 pkts/3852 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][0.34 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 19/0 20/0 20/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 214/0 214/0 214/0 0/0][PLAIN TEXT (zwwtvutz)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.195.58:49399 <-> 192.168.193.12:2000 [proto: 164/CiscoSkinny][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 164/CiscoSkinny, Confidence: DPI][DPI packets: 1][cat: VoIP/10][13 pkts/992 bytes <-> 20 pkts/2724 bytes][Goodput ratio: 25/59][3.85 sec][bytes ratio: -0.466 (Download)][IAT c2s/s2c min/avg/max/stddev: 5/0 416/234 3609/3559 1129/859][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 76/136 106/378 20/85][PLAIN TEXT (RIX Meeting Room)][Plen Bins: 37,27,0,0,22,4,4,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/skype-conference-call.pcap.out b/tests/cfgs/default/result/skype-conference-call.pcap.out index ef47d1dd2..98f9cae92 100644 --- a/tests/cfgs/default/result/skype-conference-call.pcap.out +++ b/tests/cfgs/default/result/skype-conference-call.pcap.out @@ -24,4 +24,6 @@ TeamsCall 200 39687 1 Acceptable 200 39687 1 +VoIP 200 39687 1 + 1 UDP 192.168.2.20:49282 <-> 104.46.40.49:60642 [proto: 78.38/STUN.TeamsCall][IP: 276/Azure][ClearText][Confidence: DPI][FPC: 78.38/STUN.TeamsCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][133 pkts/24845 bytes <-> 67 pkts/14842 bytes][Goodput ratio: 78/81][1.50 sec][bytes ratio: 0.252 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 10/8 147/120 22/27][Pkt Len c2s/s2c min/avg/max/stddev: 74/77 187/222 957/957 244/233][Mapped IP/Port: 104.46.40.49:60642][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][Plen Bins: 0,41,17,28,1,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/smb_deletefile.pcap.out b/tests/cfgs/default/result/smb_deletefile.pcap.out index f1e12a192..4432b9706 100644 --- a/tests/cfgs/default/result/smb_deletefile.pcap.out +++ b/tests/cfgs/default/result/smb_deletefile.pcap.out @@ -24,4 +24,6 @@ SMBv23 101 30748 1 Acceptable 101 30748 1 +System 101 30748 1 + 1 TCP 192.168.1.118:56848 <-> 192.168.1.187:445 [proto: 10.41/NetBIOS.SMBv23][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 10.41/NetBIOS.SMBv23, Confidence: DPI][DPI packets: 1][cat: System/18][62 pkts/14382 bytes <-> 39 pkts/16366 bytes][Goodput ratio: 77/87][2.38 sec][bytes ratio: -0.065 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 46/80 2157/2158 299/394][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 232/420 530/1514 194/299][Plen Bins: 0,0,4,7,1,0,1,1,0,1,7,9,20,21,6,13,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,1,0,0] diff --git a/tests/cfgs/default/result/smb_frags.pcap.out b/tests/cfgs/default/result/smb_frags.pcap.out index dd7bd3564..7c9fe9597 100644 --- a/tests/cfgs/default/result/smb_frags.pcap.out +++ b/tests/cfgs/default/result/smb_frags.pcap.out @@ -24,4 +24,6 @@ SMBv1 8 2763 1 Dangerous 8 2763 1 +System 8 2763 1 + 1 TCP 10.202.211.125:54120 <-> 10.202.7.8:445 [VLAN: 1608][proto: 10.16/NetBIOS.SMBv1][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: System/18][5 pkts/2009 bytes <-> 3 pkts/754 bytes][Goodput ratio: 82/71][0.58 sec][bytes ratio: 0.454 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/94 144/238 387/383 145/144][Pkt Len c2s/s2c min/avg/max/stddev: 70/78 402/251 1438/397 525/132][Risk: ** Known Proto on Non Std Port **** SMB Insecure Vers **** Unsafe Protocol **][Risk Score: 160][Risk Info: Found SMBv1 / Expected on port 139][TCP Fingerprint: 2_64_65535_b104837f66f5/Unknown][PLAIN TEXT (defined.12)][Plen Bins: 0,20,0,0,0,0,20,20,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0,0,0,0] diff --git a/tests/cfgs/default/result/smbv1.pcap.out b/tests/cfgs/default/result/smbv1.pcap.out index 01f51d39b..5c710cd27 100644 --- a/tests/cfgs/default/result/smbv1.pcap.out +++ b/tests/cfgs/default/result/smbv1.pcap.out @@ -24,4 +24,6 @@ SMBv1 7 1197 1 Dangerous 7 1197 1 +System 7 1197 1 + 1 TCP 172.16.156.130:50927 <-> 10.128.0.243:445 [proto: 10.16/NetBIOS.SMBv1][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: System/18][4 pkts/669 bytes <-> 3 pkts/528 bytes][Goodput ratio: 68/69][0.10 sec][bytes ratio: 0.118 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 27/34 32/35 37/36 4/1][Pkt Len c2s/s2c min/avg/max/stddev: 136/114 167/176 194/243 26/53][Risk: ** Known Proto on Non Std Port **** SMB Insecure Vers **** Unsafe Protocol **][Risk Score: 160][Risk Info: Found SMBv1 / Expected on port 139][PLAIN TEXT (PC NETWORK PROGRAM 1.0)][Plen Bins: 0,14,28,14,28,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/smpp_in_general.pcap.out b/tests/cfgs/default/result/smpp_in_general.pcap.out index 7536adb1c..9c52785e8 100644 --- a/tests/cfgs/default/result/smpp_in_general.pcap.out +++ b/tests/cfgs/default/result/smpp_in_general.pcap.out @@ -24,4 +24,6 @@ SMPP 17 1144 1 Acceptable 17 1144 1 +Download 17 1144 1 + 1 TCP 10.226.202.118:1770 <-> 10.226.202.53:9000 [proto: 207/SMPP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Download/7][10 pkts/670 bytes <-> 7 pkts/474 bytes][Goodput ratio: 18/16][30.95 sec][bytes ratio: 0.171 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 3848/7230 28802/28906 9451/12515][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 67/68 104/79 17/7][TCP Fingerprint: 2_128_32767_82992e3bddf8/Unknown][PLAIN TEXT (password)][Plen Bins: 75,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/smtp-starttls.pcap.out b/tests/cfgs/default/result/smtp-starttls.pcap.out index 37ae31eca..43f61ba01 100644 --- a/tests/cfgs/default/result/smtp-starttls.pcap.out +++ b/tests/cfgs/default/result/smtp-starttls.pcap.out @@ -26,6 +26,8 @@ Google 36 8403 1 Safe 33 6429 1 Acceptable 36 8403 1 +Email 69 14832 2 + JA Host Stats: IP Address # JA4C 1 10.0.0.1 1 diff --git a/tests/cfgs/default/result/smtp.pcap.out b/tests/cfgs/default/result/smtp.pcap.out index d080b2708..3be9868b8 100644 --- a/tests/cfgs/default/result/smtp.pcap.out +++ b/tests/cfgs/default/result/smtp.pcap.out @@ -24,4 +24,6 @@ SMTP 95 23157 1 Acceptable 95 23157 1 +Email 95 23157 1 + 1 TCP 194.7.248.153:2127 <-> 172.16.114.207:25 [proto: 3/SMTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 11][cat: Email/3][51 pkts/19311 bytes <-> 44 pkts/3846 bytes][Goodput ratio: 86/37][0.23 sec][Hostname/SNI: pigeon.eyrie.af.mil][bytes ratio: 0.668 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/1 5/6 67/68 12/15][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 379/87 1514/138 562/15][Risk: ** Malicious Fingerpint **][Risk Score: 100][Risk Info: Unusual TCP fingerprint (scanner detected?)][TCP Fingerprint: 2_64_512_6bbe28597824/Unknown][PLAIN TEXT (220 pigeon.eyrie.af.mil ESMTP S)][Plen Bins: 8,78,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,10,0,0] diff --git a/tests/cfgs/default/result/smtps.pcapng.out b/tests/cfgs/default/result/smtps.pcapng.out index bf7dcdfd1..7285c0240 100644 --- a/tests/cfgs/default/result/smtps.pcapng.out +++ b/tests/cfgs/default/result/smtps.pcapng.out @@ -24,6 +24,8 @@ SMTPS 4 936 1 Safe 4 936 1 +Email 4 936 1 + JA Host Stats: IP Address # JA4C 1 62.43.36.99 1 diff --git a/tests/cfgs/default/result/snapchat.pcap.out b/tests/cfgs/default/result/snapchat.pcap.out index c5b777a83..ba6d9b6a9 100644 --- a/tests/cfgs/default/result/snapchat.pcap.out +++ b/tests/cfgs/default/result/snapchat.pcap.out @@ -26,6 +26,9 @@ Snapchat 34 7320 2 Safe 22 2879 1 Fun 34 7320 2 +Web 22 2879 1 +SocialNetwork 34 7320 2 + JA Host Stats: IP Address # JA4C 1 10.8.0.1 2 diff --git a/tests/cfgs/default/result/snapchat_call.pcapng.out b/tests/cfgs/default/result/snapchat_call.pcapng.out index 9e53ef28f..e9a2df9bf 100644 --- a/tests/cfgs/default/result/snapchat_call.pcapng.out +++ b/tests/cfgs/default/result/snapchat_call.pcapng.out @@ -24,4 +24,6 @@ SnapchatCall 50 12772 1 Acceptable 50 12772 1 +VoIP 50 12772 1 + 1 UDP 192.168.12.169:42083 <-> 18.184.138.142:443 [proto: 188.255/QUIC.SnapchatCall][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 188/QUIC, Confidence: DPI][DPI packets: 20][cat: VoIP/10][25 pkts/5295 bytes <-> 25 pkts/7477 bytes][Goodput ratio: 80/86][8.29 sec][bytes ratio: -0.171 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 288/246 1313/1315 376/342][Pkt Len c2s/s2c min/avg/max/stddev: 65/62 212/299 1392/1392 365/419][Risk: ** Missing SNI TLS Extn **][Risk Score: 50][Risk Info: SNI should be present all time: attack ?][QUIC ver: Q046][Idle Timeout: 40][PLAIN TEXT (AESGCC20)][Plen Bins: 28,44,0,2,2,0,0,2,4,4,0,0,2,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0,0,0,0] diff --git a/tests/cfgs/default/result/snapchat_call_v1.pcapng.out b/tests/cfgs/default/result/snapchat_call_v1.pcapng.out index 19d0707b0..89597bbc8 100644 --- a/tests/cfgs/default/result/snapchat_call_v1.pcapng.out +++ b/tests/cfgs/default/result/snapchat_call_v1.pcapng.out @@ -24,6 +24,8 @@ SnapchatCall 477 365314 1 Acceptable 477 365314 1 +VoIP 477 365314 1 + JA Host Stats: IP Address # JA4C 1 192.168.12.169 1 diff --git a/tests/cfgs/default/result/snmp.pcap.out b/tests/cfgs/default/result/snmp.pcap.out index 469cca07a..b140968a6 100644 --- a/tests/cfgs/default/result/snmp.pcap.out +++ b/tests/cfgs/default/result/snmp.pcap.out @@ -24,6 +24,8 @@ SNMP 72 14435 17 Acceptable 72 14435 17 +Network 72 14435 17 + 1 UDP 10.99.8.88:43242 <-> 10.100.253.146:161 [VLAN: 1308][proto: 14/SNMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 14/SNMP, Confidence: DPI][DPI packets: 2][cat: Network/14][3 pkts/2367 bytes <-> 3 pkts/1502 bytes][Goodput ratio: 94/91][0.11 sec][bytes ratio: 0.224 (Upload)][IAT c2s/s2c min/avg/max/stddev: 21/18 44/20 67/21 23/2][Pkt Len c2s/s2c min/avg/max/stddev: 611/75 789/501 1143/717 250/301][Risk: ** Error Code **][Risk Score: 10][Risk Info: SNMP Error 1][PLAIN TEXT (public)][Plen Bins: 16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 131.179.49.165:35970 <-> 254.158.1.169:161 [proto: 14/SNMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 14/SNMP, Confidence: DPI][DPI packets: 1][cat: Network/14][3 pkts/462 bytes <-> 3 pkts/534 bytes][Goodput ratio: 73/76][0.43 sec][bytes ratio: -0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 143/142 144/144 145/146 1/2][Pkt Len c2s/s2c min/avg/max/stddev: 106/147 154/178 178/198 34/22][Plen Bins: 0,0,16,16,67,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 131.179.49.165:60694 <-> 254.158.1.169:161 [proto: 14/SNMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 14/SNMP, Confidence: DPI][DPI packets: 1][cat: Network/14][3 pkts/462 bytes <-> 3 pkts/527 bytes][Goodput ratio: 73/76][0.43 sec][bytes ratio: -0.066 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 117/150 134/154 150/158 16/4][Pkt Len c2s/s2c min/avg/max/stddev: 106/147 154/176 178/191 34/20][Plen Bins: 0,0,16,16,67,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/soap.pcap.out b/tests/cfgs/default/result/soap.pcap.out index 90ed9361b..29736f6ac 100644 --- a/tests/cfgs/default/result/soap.pcap.out +++ b/tests/cfgs/default/result/soap.pcap.out @@ -24,6 +24,9 @@ SOAP 20 10948 3 Acceptable 20 10948 3 +Collaborative 1 1506 1 +RPC 19 9442 2 + 1 TCP 192.168.2.100:50100 <-> 23.2.213.165:80 [proto: 253/SOAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: RPC/16][7 pkts/4746 bytes <-> 7 pkts/752 bytes][Goodput ratio: 92/39][5.01 sec][bytes ratio: 0.726 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 989/1236 2486/2486 1098/1096][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 678/107 1506/362 717/104][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (POST /fwlink/)][Plen Bins: 0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,75,0,0] 2 TCP 185.32.192.30:80 <-> 85.154.114.113:56028 [VLAN: 808][proto: 253/SOAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: RPC/16][3 pkts/2487 bytes <-> 2 pkts/1457 bytes][Goodput ratio: 92/92][0.34 sec][PLAIN TEXT (xml version)][Plen Bins: 0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,50,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.100:50100 -> 23.2.213.165:4176 [proto: 7.253/HTTP.SOAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7.253/HTTP.SOAP, Confidence: DPI][DPI packets: 1][cat: Collaborative/15][1 pkts/1506 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Hostname/SNI: go.microsoft.com][URL: go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409][Req Content-Type: text/xml][User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 80][PLAIN TEXT (POST /fwlink/)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0] diff --git a/tests/cfgs/default/result/socks.pcap.out b/tests/cfgs/default/result/socks.pcap.out index b650e567a..c5016b414 100644 --- a/tests/cfgs/default/result/socks.pcap.out +++ b/tests/cfgs/default/result/socks.pcap.out @@ -24,6 +24,8 @@ SOCKS 60 10559 4 Acceptable 60 10559 4 +Web 60 10559 4 + 1 TCP 10.180.156.185:53535 <-> 10.180.156.249:1080 [proto: 172/SOCKS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][10 pkts/832 bytes <-> 7 pkts/2073 bytes][Goodput ratio: 19/77][0.01 sec][bytes ratio: -0.427 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1/1 4/3 2/1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 83/296 212/1514 43/500][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (uGET / HTTP/1.1)][Plen Bins: 57,0,0,0,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0] 2 TCP 10.180.156.185:53534 <-> 10.180.156.249:1080 [proto: 172/SOCKS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][8 pkts/711 bytes <-> 7 pkts/2069 bytes][Goodput ratio: 24/77][0.05 sec][bytes ratio: -0.488 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 8/12 47/46 18/20][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 89/296 212/1514 47/500][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 40,0,0,0,40,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0] 3 TCP 10.180.156.185:53533 <-> 10.180.156.249:1080 [proto: 172/SOCKS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][8 pkts/695 bytes <-> 6 pkts/2003 bytes][Goodput ratio: 22/80][0.01 sec][bytes ratio: -0.485 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/2 3/4 1/2][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 87/334 212/1514 48/530][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 40,0,0,0,40,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0] diff --git a/tests/cfgs/default/result/softether.pcap.out b/tests/cfgs/default/result/softether.pcap.out index 728d8e0ef..b3ba4101c 100644 --- a/tests/cfgs/default/result/softether.pcap.out +++ b/tests/cfgs/default/result/softether.pcap.out @@ -25,6 +25,8 @@ Softether 177 21287 4 Acceptable 177 21287 4 +VPN 177 21287 4 + 1 UDP 192.168.2.100:51381 <-> 130.158.6.113:5004 [proto: 290/Softether][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: VPN/2][60 pkts/6549 bytes <-> 53 pkts/6612 bytes][Goodput ratio: 62/66][15284492.00 sec][Client IP: 90.186.132.133][Client Port: 51381][Hostname: vpn][FQDN: moishele.softether.net][bytes ratio: -0.005 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 96258056/107928440 3621430369/3621456266 526500672/568478016][Pkt Len c2s/s2c min/avg/max/stddev: 43/69 109/125 522/370 160/114][PLAIN TEXT (90.186.132.133)][Plen Bins: 84,0,0,1,0,0,0,0,1,0,7,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:51381 <-> 130.158.6.105:5004 [proto: 290/Softether][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 290/Softether, Confidence: DPI][DPI packets: 7][cat: VPN/2][16 pkts/2201 bytes <-> 14 pkts/2116 bytes][Goodput ratio: 69/72][238448.62 sec][Client IP: 84.59.132.100][Client Port: 51381][Hostname: vpn][FQDN: moishele.softether.net][bytes ratio: 0.020 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 18338798/21672040 238159482/238187129 63456764/68468080][Pkt Len c2s/s2c min/avg/max/stddev: 43/69 138/151 522/368 183/130][PLAIN TEXT (opcode)][Plen Bins: 74,0,0,3,0,0,0,0,3,0,10,0,0,0,3,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:51381 <-> 130.158.6.112:5004 [proto: 290/Softether][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 17][cat: VPN/2][16 pkts/1167 bytes <-> 14 pkts/1250 bytes][Goodput ratio: 42/53][117087.70 sec][Client IP: 2.207.60.163][Client Port: 51381][bytes ratio: -0.034 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5948/21107 9003169/10639145 116754845/116778948 31105232/33564352][Pkt Len c2s/s2c min/avg/max/stddev: 43/68 73/89 522/366 116/77][PLAIN TEXT (2.207.60.163)][Plen Bins: 93,0,0,0,0,0,0,0,0,0,3,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/someip-tp.pcap.out b/tests/cfgs/default/result/someip-tp.pcap.out index 856c6597a..115f524d4 100644 --- a/tests/cfgs/default/result/someip-tp.pcap.out +++ b/tests/cfgs/default/result/someip-tp.pcap.out @@ -24,4 +24,6 @@ SOMEIP 9 12850 1 Acceptable 9 12850 1 +RPC 9 12850 1 + 1 UDP 10.0.1.207:56772 -> 10.0.1.1:18193 [proto: 229/SOMEIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 229/SOMEIP, Confidence: DPI][DPI packets: 1][cat: RPC/16][9 pkts/12850 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][0.10 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/0 12/0 20/0 5/0][Pkt Len c2s/s2c min/avg/max/stddev: 1218/0 1428/0 1454/0 74/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 30491,30501,30490][PLAIN TEXT (./0123456789)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,11,0,0,0,0,0,0,0,88,0,0,0] diff --git a/tests/cfgs/default/result/someip-udp-method-call.pcapng.out b/tests/cfgs/default/result/someip-udp-method-call.pcapng.out index e4edefd68..ba06e55e4 100644 --- a/tests/cfgs/default/result/someip-udp-method-call.pcapng.out +++ b/tests/cfgs/default/result/someip-udp-method-call.pcapng.out @@ -24,5 +24,7 @@ SOMEIP 3 504 2 Acceptable 3 504 2 +RPC 3 504 2 + 1 UDP 192.168.0.1:49190 -> 224.0.0.1:49190 [proto: 229/SOMEIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 229/SOMEIP, Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/370 bytes -> 0 pkts/0 bytes][Goodput ratio: 88/0][< 1 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 30491,30501,30490][Plen Bins: 0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.0.125:49191 <-> 192.168.0.1:49201 [proto: 229/SOMEIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 229/SOMEIP, Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/67 bytes <-> 1 pkts/67 bytes][Goodput ratio: 37/37][0.00 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 30491,30501,30490][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/someip_sd_sample.pcap.out b/tests/cfgs/default/result/someip_sd_sample.pcap.out index 8d8a6787f..c0574d04d 100644 --- a/tests/cfgs/default/result/someip_sd_sample.pcap.out +++ b/tests/cfgs/default/result/someip_sd_sample.pcap.out @@ -24,5 +24,7 @@ SOMEIP 6 660 2 Acceptable 6 660 2 +RPC 6 660 2 + 1 UDP 192.168.88.77:30490 <-> 192.168.88.73:30490 [proto: 229/SOMEIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 229/SOMEIP, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/228 bytes <-> 2 pkts/204 bytes][Goodput ratio: 49/43][0.80 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.88.73:30490 -> 235.2.3.5:30490 [proto: 229/SOMEIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 229/SOMEIP, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/228 bytes -> 0 pkts/0 bytes][Goodput ratio: 49/0][0.80 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/sonos.pcapng.out b/tests/cfgs/default/result/sonos.pcapng.out index e74439daa..20f05f139 100644 --- a/tests/cfgs/default/result/sonos.pcapng.out +++ b/tests/cfgs/default/result/sonos.pcapng.out @@ -25,6 +25,8 @@ Sonos 61 29332 2 Fun 61 29332 2 +Music 61 29332 2 + JA Host Stats: IP Address # JA4C 1 192.168.1.29 1 diff --git a/tests/cfgs/default/result/source_engine.pcap.out b/tests/cfgs/default/result/source_engine.pcap.out index 704833396..e9134b4cf 100644 --- a/tests/cfgs/default/result/source_engine.pcap.out +++ b/tests/cfgs/default/result/source_engine.pcap.out @@ -24,6 +24,8 @@ Source_Engine 17 1139 17 Fun 17 1139 17 +Game 17 1139 17 + 1 UDP 118.149.186.147:21285 -> 206.125.246.214:27015 [proto: 333/Source_Engine][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 333/Source_Engine, Confidence: DPI][DPI packets: 1][cat: Game/8][1 pkts/67 bytes -> 0 pkts/0 bytes][Goodput ratio: 37/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 140.151.209.84:8335 -> 206.125.246.214:27015 [proto: 333/Source_Engine][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 333/Source_Engine, Confidence: DPI][DPI packets: 1][cat: Game/8][1 pkts/67 bytes -> 0 pkts/0 bytes][Goodput ratio: 37/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 151.182.246.17:17890 -> 206.125.246.221:27015 [proto: 333/Source_Engine][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 333/Source_Engine, Confidence: DPI][DPI packets: 1][cat: Game/8][1 pkts/67 bytes -> 0 pkts/0 bytes][Goodput ratio: 37/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/spotify_tcp.pcap.out b/tests/cfgs/default/result/spotify_tcp.pcap.out index 104219ae0..de171bd37 100644 --- a/tests/cfgs/default/result/spotify_tcp.pcap.out +++ b/tests/cfgs/default/result/spotify_tcp.pcap.out @@ -24,4 +24,6 @@ Spotify 10 3370 1 Fun 10 3370 1 +Music 10 3370 1 + 1 TCP 10.0.2.15:48628 <-> 35.190.243.72:4070 [proto: 156/Spotify][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 4][cat: Music/25][5 pkts/1094 bytes <-> 5 pkts/2276 bytes][Goodput ratio: 72/88][0.19 sec][bytes ratio: -0.351 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/33 30/42 63/71 23/28][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 219/455 517/1514 194/569][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,0,0,0,0,0,0,0,0,25,0,0,0,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0] diff --git a/tests/cfgs/default/result/sql_injection.pcap.out b/tests/cfgs/default/result/sql_injection.pcap.out index 36c0409bd..601c270b0 100644 --- a/tests/cfgs/default/result/sql_injection.pcap.out +++ b/tests/cfgs/default/result/sql_injection.pcap.out @@ -24,4 +24,6 @@ HTTP 5 2748 1 Acceptable 5 2748 1 +Web 5 2748 1 + 1 TCP 192.168.3.109:53528 <-> 192.168.3.107:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7/HTTP, Confidence: DPI][DPI packets: 3][cat: Web/5][2 pkts/823 bytes <-> 3 pkts/1925 bytes][Goodput ratio: 84/90][0.00 sec][Hostname/SNI: 192.168.3.107][URL: 192.168.3.107/DVWA-master/vulnerabilities/sqli/?id=%3Fid%3Da%27+UNION+SELECT+%22text1%22%2C%22text2%22%3B--+-%26Submit%3DSubmit&Submit=Submit][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.41 (Ubuntu)][User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36][Risk: ** SQL Injection **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 160][Risk Info: Found host 192.168.3.107 / Suspicious URL [/DVWA-master/vulnerabilities/sqli/?id=%3Fid%3Da%27+UNION+SELECT+%22text1%22%2C%22te][PLAIN TEXT (GET /DV)][Plen Bins: 0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0] diff --git a/tests/cfgs/default/result/srvloc-v1.pcapng.out b/tests/cfgs/default/result/srvloc-v1.pcapng.out index 959b29a0e..be3c53bc7 100644 --- a/tests/cfgs/default/result/srvloc-v1.pcapng.out +++ b/tests/cfgs/default/result/srvloc-v1.pcapng.out @@ -24,5 +24,7 @@ Service_Location_Protocol 2 490 2 Acceptable 2 490 2 +RPC 2 490 2 + 1 UDP 23.220.116.175:427 -> 192.168.199.71:57782 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 347/Service_Location_Protocol, Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/404 bytes -> 0 pkts/0 bytes][Goodput ratio: 89/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][PLAIN TEXT (Stella4)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 250.83.105.78:51708 -> 172.30.246.115:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 347/Service_Location_Protocol, Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (service)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/srvloc.pcap.out b/tests/cfgs/default/result/srvloc.pcap.out index 2e2a5d577..f4db3684e 100644 --- a/tests/cfgs/default/result/srvloc.pcap.out +++ b/tests/cfgs/default/result/srvloc.pcap.out @@ -24,6 +24,8 @@ Service_Location_Protocol 629 57125 620 Acceptable 629 57125 620 +RPC 629 57125 620 + 1 UDP 45.124.147.156:50663 -> 165.114.202.61:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 347/Service_Location_Protocol, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/280 bytes -> 0 pkts/0 bytes][Goodput ratio: 70/0][< 1 sec][URL(s): slpTest://test:31337/][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (slpTest)][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 20.133.112.32:11510 -> 165.114.202.61:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 347/Service_Location_Protocol, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/192 bytes -> 0 pkts/0 bytes][Goodput ratio: 56/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (service)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 42.224.153.12:15346 -> 90.147.171.51:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 347/Service_Location_Protocol, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/192 bytes -> 0 pkts/0 bytes][Goodput ratio: 56/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (service)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ssdp-m-search-ua.pcap.out b/tests/cfgs/default/result/ssdp-m-search-ua.pcap.out index fd119d556..82b2b7733 100644 --- a/tests/cfgs/default/result/ssdp-m-search-ua.pcap.out +++ b/tests/cfgs/default/result/ssdp-m-search-ua.pcap.out @@ -24,4 +24,6 @@ SSDP 4 864 1 Acceptable 4 864 1 +System 4 864 1 + 1 UDP 192.168.242.50:56446 -> 239.255.255.250:1900 [proto: 12/SSDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 12/SSDP, Confidence: DPI][DPI packets: 1][cat: System/18][4 pkts/864 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][3.00 sec][Hostname/SNI: 239.255.255.250][User-Agent: Google Chrome/99.0.4844.74 Mac OS X][PLAIN TEXT (SEARCH )][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ssdp-m-search.pcap.out b/tests/cfgs/default/result/ssdp-m-search.pcap.out index 2fae52dce..10131843b 100644 --- a/tests/cfgs/default/result/ssdp-m-search.pcap.out +++ b/tests/cfgs/default/result/ssdp-m-search.pcap.out @@ -24,4 +24,6 @@ SSDP 19 1197 1 Acceptable 19 1197 1 +System 19 1197 1 + 1 UDP 192.168.242.8:42253 -> 192.168.242.255:32412 [proto: 12/SSDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 12/SSDP, Confidence: DPI][DPI packets: 1][cat: System/18][19 pkts/1197 bytes -> 0 pkts/0 bytes][Goodput ratio: 33/0][90.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4999/0 4999/0 5000/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 63/0 63/0 63/0 0/0][PLAIN TEXT (SEARCH )][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ssdp.pcapng.out b/tests/cfgs/default/result/ssdp.pcapng.out index e033889e6..0ac376280 100644 --- a/tests/cfgs/default/result/ssdp.pcapng.out +++ b/tests/cfgs/default/result/ssdp.pcapng.out @@ -24,4 +24,6 @@ SSDP 1 848 1 Acceptable 1 848 1 +System 1 848 1 + 1 UDP 192.168.1.173:58006 -> 239.255.255.250:1900 [proto: 12/SSDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 12/SSDP, Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/848 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Hostname/SNI: 239.255.255.250][PLAIN TEXT (ENOTIFY )][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ssh.pcap.out b/tests/cfgs/default/result/ssh.pcap.out index 92148973a..402251c6e 100644 --- a/tests/cfgs/default/result/ssh.pcap.out +++ b/tests/cfgs/default/result/ssh.pcap.out @@ -24,5 +24,7 @@ SSH 295 44977 2 Acceptable 295 44977 2 +RemoteAccess 295 44977 2 + 1 TCP 172.16.238.1:58395 <-> 172.16.238.168:22 [proto: 92/SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: RemoteAccess/12][159 pkts/15615 bytes <-> 99 pkts/19931 bytes][Goodput ratio: 33/67][248.48 sec][Hostname/SNI: SSH-2.0-OpenSSH_5.6][bytes ratio: -0.121 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1846/2934 166223/166224 14794/19692][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 98/201 970/1346 83/283][Risk: ** SSH Obsolete Cli Vers/Cipher **** SSH Obsolete Ser Vers/Cipher **][Risk Score: 150][Risk Info: Found cipher arcfour128 / Found cipher arcfour128][TCP Fingerprint: 2_64_65535_b6a8548bc8e8/Unknown][HASSH-C: 21B457A327CE7A2D4FCE5EF2C42400BD][Server: SSH-2.0-OpenSSH_5.3][HASSH-S: B1C6C0D56317555B85C7005A3DE29325][Plen Bins: 2,76,12,2,3,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0] 2 TCP 127.0.0.1:58496 <-> 127.0.0.1:8000 [proto: 92/SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 9][cat: RemoteAccess/12][20 pkts/5598 bytes <-> 17 pkts/3833 bytes][Goodput ratio: 76/71][2.18 sec][Hostname/SNI: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.11][bytes ratio: 0.187 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1 119/162 1760/1760 424/463][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 280/225 1602/1098 437/270][Risk: ** Known Proto on Non Std Port **** SSH Obsolete Ser Vers/Cipher **][Risk Score: 100][Risk Info: Found cipher arcfour128 / Expected on port 22][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][HASSH-C: C11B200866CF918393E62EA25D851D90][Server: SSH-2.0-APACHE-SSHD-2.5.0][HASSH-S: CA6DD86B2D9A44E4A3F1A55C53E6B0FA][Plen Bins: 13,4,42,4,4,0,0,0,0,0,0,4,4,0,0,0,0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,4,0,0,0,0,0,4] diff --git a/tests/cfgs/default/result/ssh_unidirectional.pcap.out b/tests/cfgs/default/result/ssh_unidirectional.pcap.out index 164b0866e..cc19a0bda 100644 --- a/tests/cfgs/default/result/ssh_unidirectional.pcap.out +++ b/tests/cfgs/default/result/ssh_unidirectional.pcap.out @@ -26,4 +26,6 @@ SSH 13 938 1 Acceptable 13 938 1 +RemoteAccess 13 938 1 + 1 TCP 192.168.2.198:50306 <-> 192.168.2.1:22 [proto: 92/SSH][IP: 0/Unknown][Encrypted][Confidence: DPI (partial)][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 13][cat: RemoteAccess/12][7 pkts/476 bytes <-> 6 pkts/462 bytes][Goodput ratio: 0/13][0.55 sec][bytes ratio: 0.015 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 109/182 321/324 136/135][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/77 78/105 4/14][TCP Fingerprint: 2_64_65535_d29295416479/macOS][Server: SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u7][PLAIN TEXT (OpenSSH)][Plen Bins: 66,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ssl-cert-name-mismatch.pcap.out b/tests/cfgs/default/result/ssl-cert-name-mismatch.pcap.out index 09183f50a..63af542bb 100644 --- a/tests/cfgs/default/result/ssl-cert-name-mismatch.pcap.out +++ b/tests/cfgs/default/result/ssl-cert-name-mismatch.pcap.out @@ -24,6 +24,8 @@ TLS 21 5412 1 Safe 21 5412 1 +Web 21 5412 1 + JA Host Stats: IP Address # JA4C 1 192.168.2.222 1 diff --git a/tests/cfgs/default/result/starcraft_battle.pcap.out b/tests/cfgs/default/result/starcraft_battle.pcap.out index 94e8a4f28..e87797f61 100644 --- a/tests/cfgs/default/result/starcraft_battle.pcap.out +++ b/tests/cfgs/default/result/starcraft_battle.pcap.out @@ -40,6 +40,13 @@ Safe 46 3071 14 Acceptable 57 9913 13 Fun 694 347188 25 +Web 55 3733 17 +Download 179 134204 1 +Game 515 212984 24 +Network 28 2968 8 +System 11 4984 1 +Advertisement 9 1299 1 + 1 TCP 192.168.1.100:3508 <-> 87.248.221.254:80 [proto: 7.213/HTTP.Blizzard][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 213/Blizzard, Confidence: DNS][DPI packets: 6][cat: Download/7][90 pkts/5059 bytes <-> 89 pkts/129145 bytes][Goodput ratio: 4/96][3.22 sec][Hostname/SNI: llnw.blizzard.com][bytes ratio: -0.925 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 45/3 2914/58 341/11][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 56/1451 241/1514 20/291][URL: llnw.blizzard.com/sc2-pod-retail/AF11CD00/EU/24621.direct/s2-36281-BA356DD57557728843CAF63A12C79AA3.mfil][StatusCode: 200][Content-Type: application/octet-stream][Server: Apache][User-Agent: Blizzard Web Client][Risk: ** Binary File/Data Transfer (Attempt) **][Risk Score: 50][Risk Info: Found binary mime octet-stream][TCP Fingerprint: 2_128_65535_6bb88f5575fd/Windows][PLAIN TEXT (GET /sc)][Plen Bins: 0,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,97,0,0] 2 TCP 192.168.1.100:3517 <-> 213.248.127.130:1119 [proto: 213/Blizzard][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 18][cat: Game/8][126 pkts/9157 bytes <-> 89 pkts/41021 bytes][Goodput ratio: 26/88][3.83 sec][bytes ratio: -0.635 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 30/37 1016/1086 104/133][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 73/461 249/1514 28/593][TCP Fingerprint: 2_128_32768_5a9ef1c58d0b/Windows][PLAIN TEXT (matteobracci1@gmail.com)][Plen Bins: 76,2,2,2,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,13,0,0] 3 TCP 192.168.1.100:3527 <-> 2.228.46.112:80 [proto: 7.213/HTTP.Blizzard][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 213/Blizzard, Confidence: DNS][DPI packets: 6][cat: Game/8][15 pkts/971 bytes <-> 26 pkts/36462 bytes][Goodput ratio: 15/96][0.10 sec][Hostname/SNI: bnetcmsus-a.akamaihd.net][bytes ratio: -0.948 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/3 33/34 13/9][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 65/1402 203/1514 37/387][URL: bnetcmsus-a.akamaihd.net/cms/bnet_thumbnail/gc/GCF1DHMH8FDY1434670037434.jpg][StatusCode: 200][Content-Type: image/jpeg][Server: Apache][User-Agent: Battle.net Web Client][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (GET /cms/bnet)][Plen Bins: 0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,96,0,0] diff --git a/tests/cfgs/default/result/steam.pcapng.out b/tests/cfgs/default/result/steam.pcapng.out index f721799bf..ba33c4624 100644 --- a/tests/cfgs/default/result/steam.pcapng.out +++ b/tests/cfgs/default/result/steam.pcapng.out @@ -27,6 +27,8 @@ Dota2 10 2545 1 Fun 48 12726 7 +Game 48 12726 7 + JA Host Stats: IP Address # JA4C 1 192.168.88.231 3 diff --git a/tests/cfgs/default/result/stomp.pcapng.out b/tests/cfgs/default/result/stomp.pcapng.out index f7bb603fa..fc8b65f95 100644 --- a/tests/cfgs/default/result/stomp.pcapng.out +++ b/tests/cfgs/default/result/stomp.pcapng.out @@ -24,4 +24,6 @@ STOMP 19 1756 1 Acceptable 19 1756 1 +RPC 19 1756 1 + 1 TCP 192.168.88.231:34732 <-> 192.168.88.198:61613 [proto: 390/STOMP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][10 pkts/863 bytes <-> 9 pkts/893 bytes][Goodput ratio: 23/33][19.02 sec][bytes ratio: -0.017 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 2377/1549 9791/7564 3705/2763][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 86/99 126/177 25/46][TCP Fingerprint: 2_64_32120_2e3cee914fc1/Linux][PLAIN TEXT (accept)][Plen Bins: 14,42,14,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun.pcap.out b/tests/cfgs/default/result/stun.pcap.out index d08807ac7..5b76ca3db 100644 --- a/tests/cfgs/default/result/stun.pcap.out +++ b/tests/cfgs/default/result/stun.pcap.out @@ -32,6 +32,9 @@ GoogleCall 41 7228 2 Safe 4 766 1 Acceptable 197 28062 8 +VoIP 131 19906 4 +Network 70 8922 5 + JA Host Stats: IP Address # JA4C 1 192.168.12.169 1 diff --git a/tests/cfgs/default/result/stun_classic.pcap.out b/tests/cfgs/default/result/stun_classic.pcap.out index aa0f4b56e..2eb1500cd 100644 --- a/tests/cfgs/default/result/stun_classic.pcap.out +++ b/tests/cfgs/default/result/stun_classic.pcap.out @@ -24,4 +24,6 @@ RTP 22 1624 1 Acceptable 22 1624 1 +Media 22 1624 1 + 1 UDP 172.16.63.224:55050 <-> 172.16.63.21:13958 [proto: 78.87/STUN.RTP][IP: 0/Unknown][Stream Content: Audio][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: Media/1][9 pkts/662 bytes <-> 13 pkts/962 bytes][Goodput ratio: 43/43][0.23 sec][bytes ratio: -0.185 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/0 32/17 101/42 32/11][Pkt Len c2s/s2c min/avg/max/stddev: 70/74 74/74 74/74 1/0][Mapped IP/Port: 172.16.63.224:55050][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][Plen Bins: 4,95,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_dtls_rtp.pcapng.out b/tests/cfgs/default/result/stun_dtls_rtp.pcapng.out index b5b206f47..650981fa8 100644 --- a/tests/cfgs/default/result/stun_dtls_rtp.pcapng.out +++ b/tests/cfgs/default/result/stun_dtls_rtp.pcapng.out @@ -25,6 +25,8 @@ GoogleCall 102 26347 2 Acceptable 102 26347 2 +VoIP 102 26347 2 + JA Host Stats: IP Address # JA4C 1 192.168.12.156 1 diff --git a/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out b/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out index f8b68fa0a..f0f9c1e6e 100644 --- a/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out +++ b/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out @@ -24,5 +24,7 @@ STUN 43 10358 2 Acceptable 43 10358 2 +Network 43 10358 2 + 1 UDP 10.1.0.3:5853 -> 10.10.0.1:2808 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: Network/14][18 pkts/5384 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][7.17 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 386/0 4001/0 979/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/0 299/0 750/0 221/0][Mapped IP/Port: 10.10.0.1:26378][Peer IP/Port: 10.0.0.147:60770][Relayed IP/Port: 10.1.0.3:60815][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 3478][PLAIN TEXT (Coturn)][Plen Bins: 0,5,5,5,34,22,0,0,0,5,0,0,0,0,0,5,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.10.0.1:65226 -> 10.1.0.3:57730 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: Network/14][25 pkts/4974 bytes -> 0 pkts/0 bytes][Goodput ratio: 79/0][7.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 324/0 4001/0 904/0][Pkt Len c2s/s2c min/avg/max/stddev: 78/0 199/0 478/0 92/0][Peer IP/Port: 192.168.2.105:60770][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 3478][PLAIN TEXT (username1)][Plen Bins: 0,8,16,16,32,0,4,8,0,12,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_dtls_unidirectional_client.pcap.out b/tests/cfgs/default/result/stun_dtls_unidirectional_client.pcap.out index 0fd38d343..f8b5599f4 100644 --- a/tests/cfgs/default/result/stun_dtls_unidirectional_client.pcap.out +++ b/tests/cfgs/default/result/stun_dtls_unidirectional_client.pcap.out @@ -24,6 +24,8 @@ DTLS 6 1708 1 Safe 6 1708 1 +Network 6 1708 1 + JA Host Stats: IP Address # JA4C 1 26.83.9.81 1 diff --git a/tests/cfgs/default/result/stun_dtls_unidirectional_server.pcap.out b/tests/cfgs/default/result/stun_dtls_unidirectional_server.pcap.out index 703840fda..841dd1952 100644 --- a/tests/cfgs/default/result/stun_dtls_unidirectional_server.pcap.out +++ b/tests/cfgs/default/result/stun_dtls_unidirectional_server.pcap.out @@ -24,6 +24,8 @@ DTLS 6 1563 1 Safe 6 1563 1 +Network 6 1563 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/stun_google_meet.pcapng.out b/tests/cfgs/default/result/stun_google_meet.pcapng.out index 08d533b49..95199fbe2 100644 --- a/tests/cfgs/default/result/stun_google_meet.pcapng.out +++ b/tests/cfgs/default/result/stun_google_meet.pcapng.out @@ -25,6 +25,8 @@ GoogleCall 362 74597 7 Acceptable 362 74597 7 +VoIP 362 74597 7 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:48a1:1094:1227:281e 1 diff --git a/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out b/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out index 28a045c8d..1ca371baf 100644 --- a/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out +++ b/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out @@ -24,4 +24,6 @@ TeamsCall 12 5944 1 Acceptable 12 5944 1 +VoIP 12 5944 1 + 1 UDP 52.115.136.55:3479 -> 10.0.0.1:50006 [proto: 78.38/STUN.TeamsCall][IP: 276/Azure][Stream Content: Audio][ClearText][Confidence: DPI][FPC: 78.38/STUN.TeamsCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][12 pkts/5944 bytes -> 0 pkts/0 bytes][Goodput ratio: 92/0][4.53 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 453/0 1210/0 379/0][Pkt Len c2s/s2c min/avg/max/stddev: 81/0 495/0 1257/0 539/0][Mapped IP/Port: 82.178.63.123:50006][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 3478][Plen Bins: 0,16,33,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_signal.pcapng.out b/tests/cfgs/default/result/stun_signal.pcapng.out index b38bec1ed..782fb3c99 100644 --- a/tests/cfgs/default/result/stun_signal.pcapng.out +++ b/tests/cfgs/default/result/stun_signal.pcapng.out @@ -27,6 +27,9 @@ SignalVoip 407 43310 21 Acceptable 460 48496 23 +VoIP 407 43310 21 +Network 53 5186 2 + 1 UDP 192.168.12.169:43068 <-> 18.195.131.143:61156 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 7][cat: VoIP/10][48 pkts/4692 bytes <-> 58 pkts/7630 bytes][Goodput ratio: 57/68][12.11 sec][bytes ratio: -0.238 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 224/234 1055/1059 250/294][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 98/132 146/306 23/72][Mapped IP/Port: 93.47.225.19:11914][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BrDwrhkDr//9e)][Plen Bins: 26,31,15,15,5,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.169:47767 <-> 18.195.131.143:61498 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 7][cat: VoIP/10][18 pkts/1900 bytes <-> 35 pkts/6496 bytes][Goodput ratio: 60/77][2.67 sec][bytes ratio: -0.547 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 173/74 665/630 186/150][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 106/186 146/306 26/92][Mapped IP/Port: 93.47.225.19:11932][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (80JiLM)][Plen Bins: 13,16,18,18,9,0,0,0,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 ICMP 35.158.183.167:0 <-> 192.168.12.169:0 [proto: 81/ICMP][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 81/ICMP, Confidence: DPI][DPI packets: 1][cat: Network/14][30 pkts/2780 bytes <-> 4 pkts/552 bytes][Goodput ratio: 55/69][51.83 sec][bytes ratio: 0.669 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 906/1 7931/1 2120/0][Pkt Len c2s/s2c min/avg/max/stddev: 90/138 93/138 98/138 4/0][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: No server to client traffic / Entropy: 5.051 (Executable?)][PLAIN TEXT (BJKHNYBG4)][Plen Bins: 0,88,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_signal_tcp.pcapng.out b/tests/cfgs/default/result/stun_signal_tcp.pcapng.out index bf5f07c84..2e0057d51 100644 --- a/tests/cfgs/default/result/stun_signal_tcp.pcapng.out +++ b/tests/cfgs/default/result/stun_signal_tcp.pcapng.out @@ -24,4 +24,6 @@ SignalVoip 500 114216 1 Acceptable 500 114216 1 +VoIP 500 114216 1 + 1 TCP 192.168.1.117:51296 <-> 35.219.252.146:80 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 284/GoogleCloud, Confidence: IP address][DPI packets: 10][cat: VoIP/10][226 pkts/71104 bytes <-> 274 pkts/43112 bytes][Goodput ratio: 82/64][17.42 sec][Hostname/SNI: signal.org][bytes ratio: 0.245 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/68 2434/2433 281/278][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 315/157 1242/1474 338/185][Mapped IP/Port: 93.35.171.86:51262][Peer IP/Port: 93.33.26.150:37920][Relayed IP/Port: 35.219.252.146:13140][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (LODkFIIf)][Plen Bins: 0,21,18,20,5,0,0,0,21,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_tcp_multiple_msgs_same_pkt.pcap.out b/tests/cfgs/default/result/stun_tcp_multiple_msgs_same_pkt.pcap.out index 13598b0d2..c6b8367a4 100644 --- a/tests/cfgs/default/result/stun_tcp_multiple_msgs_same_pkt.pcap.out +++ b/tests/cfgs/default/result/stun_tcp_multiple_msgs_same_pkt.pcap.out @@ -24,4 +24,6 @@ STUN 5 506 1 Acceptable 5 506 1 +Network 5 506 1 + 1 TCP 166.172.142.131:3479 <-> 23.183.197.71:42849 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Network/14][1 pkts/74 bytes <-> 4 pkts/432 bytes][Goodput ratio: 0/39][10.93 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (RXgFYlY)][Plen Bins: 75,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_wa_call.pcapng.out b/tests/cfgs/default/result/stun_wa_call.pcapng.out index 1e1494826..dd85d955b 100644 --- a/tests/cfgs/default/result/stun_wa_call.pcapng.out +++ b/tests/cfgs/default/result/stun_wa_call.pcapng.out @@ -27,6 +27,9 @@ ICMP 1 110 1 Acceptable 591 133689 13 +VoIP 590 133579 12 +Network 1 110 1 + 1 UDP 192.168.12.156:46652 <-> 93.57.123.227:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][171 pkts/28371 bytes <-> 206 pkts/29803 bytes][Goodput ratio: 75/71][31.78 sec][bytes ratio: -0.025 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 178/151 2505/2463 255/222][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 166/145 434/446 100/85][Mapped IP/Port: 93.35.171.3:61494][Relayed IP/Port: 93.57.123.227:3478][Plen Bins: 14,41,11,8,2,2,3,2,5,4,1,1,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.156:49526 <-> 157.240.203.62:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 119/Facebook][ClearText][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][48 pkts/12953 bytes <-> 73 pkts/40083 bytes][Goodput ratio: 84/92][14.68 sec][bytes ratio: -0.512 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 191/164 3009/3009 684/623][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 270/549 542/1155 203/421][Mapped IP/Port: 93.35.171.3:61517][Relayed IP/Port: 157.240.203.62:3478][PLAIN TEXT (dsUmpy)][Plen Bins: 8,18,19,1,0,0,0,0,3,0,0,0,0,0,0,14,14,0,0,0,0,0,0,0,0,0,0,0,2,4,2,1,2,3,4,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.156:49526 <-> 93.33.118.87:41107 [proto: 338.45/SRTP.WhatsAppCall][IP: 0/Unknown][Stream Content: Audio, Video][Encrypted][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][8 pkts/3465 bytes <-> 8 pkts/5392 bytes][Goodput ratio: 90/94][0.38 sec][bytes ratio: -0.218 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 53/35 124/160 55/59][Pkt Len c2s/s2c min/avg/max/stddev: 75/86 433/674 997/876 437/340][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][Plen Bins: 0,38,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,18,18,0,0,18,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_zoom.pcapng.out b/tests/cfgs/default/result/stun_zoom.pcapng.out index d169423d0..bae48172b 100644 --- a/tests/cfgs/default/result/stun_zoom.pcapng.out +++ b/tests/cfgs/default/result/stun_zoom.pcapng.out @@ -26,6 +26,9 @@ Zoom 30 8381 1 Safe 40 9877 1 Acceptable 30 8381 1 +Network 40 9877 1 +Video 30 8381 1 + JA Host Stats: IP Address # JA4C 1 192.168.43.169 1 diff --git a/tests/cfgs/default/result/syncthing.pcap.out b/tests/cfgs/default/result/syncthing.pcap.out index 02b5a8a80..11627fee3 100644 --- a/tests/cfgs/default/result/syncthing.pcap.out +++ b/tests/cfgs/default/result/syncthing.pcap.out @@ -24,6 +24,8 @@ Syncthing 34 15680 4 Fun 34 15680 4 +Download 34 15680 4 + 1 UDP [fe80::6238:e0ff:fec5:35a0]:47077 -> [ff12::8384]:21027 [proto: 313/Syncthing][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 313/Syncthing, Confidence: DPI][DPI packets: 1][cat: Download/7][15 pkts/7450 bytes -> 0 pkts/0 bytes][Goodput ratio: 88/0][419.99 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 29994/0 30000/0 30004/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 267/0 497/0 530/0 85/0][PLAIN TEXT (//192.168.2.100)][Plen Bins: 0,0,0,0,0,0,6,6,0,0,0,0,0,0,87,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:54977 -> 192.168.2.255:21027 [proto: 313/Syncthing][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 313/Syncthing, Confidence: DPI][DPI packets: 1][cat: Download/7][15 pkts/7150 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][0.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 29994/0 30000/0 30005/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 247/0 477/0 510/0 85/0][PLAIN TEXT (//192.168.2.100)][Plen Bins: 0,0,0,0,0,0,6,6,0,0,0,0,0,0,87,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP [fe80::6238:e0ff:fec5:35a0]:42370 -> [ff12::8384]:21027 [proto: 313/Syncthing][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 313/Syncthing, Confidence: DPI][DPI packets: 1][cat: Download/7][2 pkts/560 bytes -> 0 pkts/0 bytes][Goodput ratio: 78/0][29.99 sec][PLAIN TEXT (//192.168.2.100)][Plen Bins: 0,0,0,0,0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/synscan.pcap.out b/tests/cfgs/default/result/synscan.pcap.out index 1a3361cfe..5d1345393 100644 --- a/tests/cfgs/default/result/synscan.pcap.out +++ b/tests/cfgs/default/result/synscan.pcap.out @@ -95,6 +95,24 @@ Fun 8 464 8 Unsafe 8 464 8 Unrated 1848 107192 1844 +Unspecified 1850 107308 1846 +Media 4 232 4 +VPN 6 348 6 +Email 14 814 13 +DataTransfer 10 580 10 +Web 21 1226 17 +Download 4 232 4 +Game 4 232 4 +VoIP 10 580 10 +Database 12 696 12 +RemoteAccess 21 1226 17 +Network 27 1574 23 +Collaborative 4 232 4 +RPC 6 348 6 +System 12 696 12 +IoT-Scada 4 232 4 +Crypto_Currency 2 116 2 + 1 TCP 172.16.0.8:36050 <-> 64.13.134.52:22 [proto: 92/SSH][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: RemoteAccess/12][1 pkts/58 bytes <-> 4 pkts/240 bytes][Goodput ratio: 0/0][21.68 sec][TCP Fingerprint: 2_64_1024_6bbe28597824/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.16.0.8:36050 <-> 64.13.134.52:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Network/14][1 pkts/58 bytes <-> 4 pkts/240 bytes][Goodput ratio: 0/0][21.09 sec][0.0.0.0][TCP Fingerprint: 2_64_3072_6bbe28597824/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 172.16.0.8:36050 <-> 64.13.134.52:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Web/5][1 pkts/58 bytes <-> 4 pkts/240 bytes][Goodput ratio: 0/0][21.27 sec][TCP Fingerprint: 2_64_3072_6bbe28597824/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/syslog.pcap.out b/tests/cfgs/default/result/syslog.pcap.out index 88b578427..9d15abcaf 100644 --- a/tests/cfgs/default/result/syslog.pcap.out +++ b/tests/cfgs/default/result/syslog.pcap.out @@ -28,6 +28,9 @@ Syslog 93 20321 21 Acceptable 93 20321 21 Unrated 1 78 1 +Unspecified 1 78 1 +System 93 20321 21 + 1 UDP [2001:470:6c:a1::2]:38159 -> [2001:470:765b::b15:22]:514 [proto: 17/Syslog][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 17/Syslog, Confidence: DPI][DPI packets: 1][cat: System/18][6 pkts/2994 bytes -> 0 pkts/0 bytes][Goodput ratio: 84/0][12.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 15/0 2400/0 7985/0 3185/0][Pkt Len c2s/s2c min/avg/max/stddev: 480/0 499/0 537/0 27/0][PLAIN TEXT ( NetScreen device)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,66,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 172.20.51.54:514 -> 172.31.110.40:514 [proto: 17/Syslog][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 17/Syslog, Confidence: DPI][DPI packets: 1][cat: System/18][15 pkts/2925 bytes -> 0 pkts/0 bytes][Goodput ratio: 78/0][22.45 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 8/0 1495/0 5398/0 2274/0][Pkt Len c2s/s2c min/avg/max/stddev: 150/0 195/0 234/0 34/0][PLAIN TEXT (854 08/20/2013)][Plen Bins: 0,0,0,20,40,0,40,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 172.26.229.190:514 -> 172.23.80.196:514 [proto: 17/Syslog][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 17/Syslog, Confidence: DPI][DPI packets: 1][cat: System/18][20 pkts/2084 bytes -> 0 pkts/0 bytes][Goodput ratio: 60/0][31.18 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 14/0 1731/0 15022/0 4686/0][Pkt Len c2s/s2c min/avg/max/stddev: 99/0 104/0 112/0 6/0][PLAIN TEXT ( Connection from UDP)][Plen Bins: 0,60,40,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tailscale.pcap.out b/tests/cfgs/default/result/tailscale.pcap.out index f419810f8..f63fc9f3b 100644 --- a/tests/cfgs/default/result/tailscale.pcap.out +++ b/tests/cfgs/default/result/tailscale.pcap.out @@ -24,4 +24,6 @@ Tailscale 107 16516 1 Acceptable 107 16516 1 +VPN 107 16516 1 + 1 UDP 192.168.88.3:41641 <-> 18.196.71.179:41641 [proto: 24/Tailscale][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 24/Tailscale, Confidence: DPI][DPI packets: 1][cat: VPN/2][51 pkts/7842 bytes <-> 56 pkts/8674 bytes][Goodput ratio: 73/73][31.88 sec][bytes ratio: -0.050 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 28/0 586/517 2000/1880 588/502][Pkt Len c2s/s2c min/avg/max/stddev: 134/134 154/155 170/170 15/16][Plen Bins: 0,0,29,27,42,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/targusdataspeed_false_positives.pcap.out b/tests/cfgs/default/result/targusdataspeed_false_positives.pcap.out index 410caba40..801a24876 100644 --- a/tests/cfgs/default/result/targusdataspeed_false_positives.pcap.out +++ b/tests/cfgs/default/result/targusdataspeed_false_positives.pcap.out @@ -24,5 +24,7 @@ BitTorrent 4 939 2 Acceptable 4 939 2 +Download 4 939 2 + 1 UDP 10.0.2.15:23994 <-> 89.64.45.227:5201 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 2][cat: Download/7][1 pkts/140 bytes <-> 1 pkts/345 bytes][Goodput ratio: 70/88][0.72 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 6771,51413][PLAIN TEXT (target20)][Plen Bins: 0,0,0,50,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.0.2.15:23994 <-> 79.164.55.123:5001 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 37/BitTorrent, Confidence: DPI][DPI packets: 2][cat: Download/7][1 pkts/140 bytes <-> 1 pkts/314 bytes][Goodput ratio: 70/86][0.07 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 6771,51413][PLAIN TEXT (target20)][Plen Bins: 0,0,0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tcp_scan.pcapng.out b/tests/cfgs/default/result/tcp_scan.pcapng.out index c889ee1e7..cc6103ec3 100644 --- a/tests/cfgs/default/result/tcp_scan.pcapng.out +++ b/tests/cfgs/default/result/tcp_scan.pcapng.out @@ -33,6 +33,11 @@ Safe 4 272 1 Acceptable 8 528 3 Unrated 6 342 3 +Unspecified 6 342 3 +Web 8 544 2 +RemoteAccess 2 118 1 +System 2 138 1 + 1 TCP 192.168.1.178:56272 <-> 192.168.1.2:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][3 pkts/198 bytes <-> 1 pkts/74 bytes][Goodput ratio: 0/0][0.00 sec][Risk: ** TCP Connection Issues **** Probing Attempt **][Risk Score: 100][Risk Info: TCP probing attempt / Connection refused (client)][TCP Fingerprint: 2_255_65535_15db81ff8b0d/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.178:56273 <-> 192.168.1.2:443 [proto: 91/TLS][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][3 pkts/198 bytes <-> 1 pkts/74 bytes][Goodput ratio: 0/0][0.00 sec][Risk: ** TCP Connection Issues **** Probing Attempt **][Risk Score: 100][Risk Info: TCP probing attempt / Connection refused (client)][TCP Fingerprint: 2_255_65535_15db81ff8b0d/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.1.178:56274 <-> 192.168.1.2:445 [proto: 41/SMBv23][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: System/18][1 pkts/78 bytes <-> 1 pkts/60 bytes][Goodput ratio: 0/0][0.00 sec][Risk: ** TCP Connection Issues **** Probing Attempt **][Risk Score: 100][Risk Info: TCP probing attempt / Connection refused (server)][TCP Fingerprint: 2_255_65535_15db81ff8b0d/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/teams.pcap.out b/tests/cfgs/default/result/teams.pcap.out index 4a7a695b7..c4ea3b205 100644 --- a/tests/cfgs/default/result/teams.pcap.out +++ b/tests/cfgs/default/result/teams.pcap.out @@ -45,6 +45,15 @@ Acceptable 714 378066 54 Fun 1 82 1 Unrated 4 456 1 +Unspecified 4 456 1 +Web 20 11474 2 +Chat 3 186 1 +VoIP 124 33394 13 +Cloud 2 1054 2 +Network 91 18328 27 +Collaborative 1253 612021 36 +Music 1 82 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.6 7 diff --git a/tests/cfgs/default/result/teamspeak3.pcap.out b/tests/cfgs/default/result/teamspeak3.pcap.out index 1b502fa60..f13ddc181 100644 --- a/tests/cfgs/default/result/teamspeak3.pcap.out +++ b/tests/cfgs/default/result/teamspeak3.pcap.out @@ -24,5 +24,7 @@ TeamSpeak 589 33015 2 Fun 589 33015 2 +VoIP 589 33015 2 + 1 UDP 193.31.25.70:2011 <-> 51.68.181.92:2010 [proto: 162/TeamSpeak][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: VoIP/10][288 pkts/14976 bytes <-> 288 pkts/16128 bytes][Goodput ratio: 19/12][85808.12 sec][bytes ratio: -0.037 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/4 300028/300028 600231/600231 300023/300023][Pkt Len c2s/s2c min/avg/max/stddev: 46/56 52/56 58/56 6/0][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.0.0.1:53187 -> 10.0.0.2:9987 [proto: 162/TeamSpeak][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 162/TeamSpeak, Confidence: DPI][DPI packets: 1][cat: VoIP/10][13 pkts/1911 bytes -> 0 pkts/0 bytes][Goodput ratio: 71/0][37.01 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 387/0 1301/0 449/0][Pkt Len c2s/s2c min/avg/max/stddev: 76/0 147/0 230/0 77/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (DDDDDDffffff)][Plen Bins: 0,53,0,0,0,46,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/teamviewer.pcap.out b/tests/cfgs/default/result/teamviewer.pcap.out index 91f5d4b5e..8ba3b9414 100644 --- a/tests/cfgs/default/result/teamviewer.pcap.out +++ b/tests/cfgs/default/result/teamviewer.pcap.out @@ -25,5 +25,7 @@ TeamViewer 352 172990 2 Acceptable 352 172990 2 +RemoteAccess 352 172990 2 + 1 TCP 10.0.2.15:35732 <-> 162.250.2.170:5938 [proto: 148/TeamViewer][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RemoteAccess/12][129 pkts/67997 bytes <-> 160 pkts/73349 bytes][Goodput ratio: 89/88][399.56 sec][bytes ratio: -0.038 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 3451/2522 50678/50677 9036/8571][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 527/458 1514/1514 537/563][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (XDsiBZ)][Plen Bins: 9,4,0,2,0,2,8,0,2,0,0,1,0,1,2,0,0,2,2,0,0,0,2,1,0,0,1,0,0,0,0,0,0,23,1,0,0,2,1,1,1,1,0,0,1,23,0,0] 2 UDP 10.0.2.15:34417 <-> 93.47.224.241:36037 [proto: 148/TeamViewer][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RemoteAccess/12][1 pkts/138 bytes <-> 62 pkts/31506 bytes][Goodput ratio: 69/92][1.32 sec][bytes ratio: -0.991 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/23 0/442 0/75][Pkt Len c2s/s2c min/avg/max/stddev: 138/58 138/508 138/1066 0/452][Risk: ** Known Proto on Non Std Port **** Desktop/File Sharing **][Risk Score: 60][Risk Info: Found TeamViewer / Expected on port 5938][PLAIN TEXT (93.47.224.241)][Plen Bins: 11,17,14,3,3,1,3,1,0,0,0,1,0,0,3,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,37,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/telegram.pcap.out b/tests/cfgs/default/result/telegram.pcap.out index a004dbd51..7f0e7f9fd 100644 --- a/tests/cfgs/default/result/telegram.pcap.out +++ b/tests/cfgs/default/result/telegram.pcap.out @@ -38,6 +38,14 @@ Fun 9 742 2 Dangerous 1 243 1 Unrated 306 72708 3 +Unspecified 306 72708 3 +Web 6 5708 2 +Chat 908 185304 12 +Cloud 4 2024 2 +Network 314 67111 20 +System 19 3228 7 +Music 9 742 2 + 1 UDP 192.168.1.77:28150 <-> 91.108.8.1:533 [proto: 185/Telegram][IP: 185/Telegram][Encrypted][Confidence: DPI][FPC: 185/Telegram, Confidence: DPI][DPI packets: 7][cat: Chat/9][12 pkts/1272 bytes <-> 276 pkts/68136 bytes][Goodput ratio: 60/83][16.92 sec][bytes ratio: -0.963 (Download)][IAT c2s/s2c min/avg/max/stddev: 48/0 290/61 504/476 186/43][Pkt Len c2s/s2c min/avg/max/stddev: 74/90 106/247 138/330 24/41][Plen Bins: 0,2,4,3,0,19,37,21,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.77:28150 <-> 91.108.8.8:529 [proto: 185/Telegram][IP: 185/Telegram][Encrypted][Confidence: DPI][FPC: 185/Telegram, Confidence: DPI][DPI packets: 7][cat: Chat/9][285 pkts/65890 bytes <-> 13 pkts/1522 bytes][Goodput ratio: 82/64][16.92 sec][bytes ratio: 0.955 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/27 59/210 504/472 30/201][Pkt Len c2s/s2c min/avg/max/stddev: 74/90 231/117 314/138 44/16][Plen Bins: 0,2,4,3,8,28,14,37,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP [fe80::4ba:91a:7817:e318]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 8/MDNS, Confidence: DPI][DPI packets: 1][cat: Network/14][120 pkts/27243 bytes -> 0 pkts/0 bytes][Goodput ratio: 73/0][58.59 sec][Hostname/SNI: _dacp._tcp.local][_dacp._tcp.local][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 504/0 17386/0 1760/0][Pkt Len c2s/s2c min/avg/max/stddev: 162/0 227/0 489/0 65/0][PLAIN TEXT (iTunes)][Plen Bins: 0,0,0,50,8,20,0,5,15,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/telegram_videocall.pcapng.out b/tests/cfgs/default/result/telegram_videocall.pcapng.out index 4b4b97f1e..9c524dc77 100644 --- a/tests/cfgs/default/result/telegram_videocall.pcapng.out +++ b/tests/cfgs/default/result/telegram_videocall.pcapng.out @@ -39,6 +39,12 @@ TelegramVoip 228 41561 16 Safe 4 295 1 Acceptable 883 382822 33 +Web 4 295 1 +Chat 636 339253 8 +VoIP 228 41561 16 +Cloud 6 636 2 +Network 13 1372 7 + 1 TCP 192.168.12.169:37950 <-> 149.154.167.91:443 [proto: 185/Telegram][IP: 185/Telegram][Encrypted][Confidence: Match by IP][FPC: 185/Telegram, Confidence: IP address][DPI packets: 4][cat: Chat/9][156 pkts/40749 bytes <-> 214 pkts/142865 bytes][Goodput ratio: 75/90][41.14 sec][bytes ratio: -0.556 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 246/152 12847/5983 1291/707][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 261/668 1090/1294 224/564][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.257 (Encrypted Executable?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (MMHu@J)][Plen Bins: 0,0,2,2,4,5,6,4,4,3,0,1,0,0,1,0,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,60,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.12.169:40830 <-> 149.154.167.222:443 [proto: 185/Telegram][IP: 185/Telegram][Encrypted][Confidence: Match by IP][FPC: 185/Telegram, Confidence: IP address][DPI packets: 4][cat: Chat/9][80 pkts/7287 bytes <-> 100 pkts/120708 bytes][Goodput ratio: 27/95][28.19 sec][bytes ratio: -0.886 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 437/1 25008/31 3114/5][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 91/1207 644/1294 95/289][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.638 (Encrypted or Random?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (elySaT)][Plen Bins: 0,0,0,0,0,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,94,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.169:42405 <-> 93.36.13.115:35393 [proto: 78.355/STUN.TelegramVoip][IP: 0/Unknown][ClearText][Confidence: DPI (cache)][FPC: 78.355/STUN.TelegramVoip, Confidence: DPI][DPI packets: 7][cat: VoIP/10][59 pkts/17987 bytes <-> 55 pkts/9102 bytes][Goodput ratio: 86/75][2.02 sec][bytes ratio: 0.328 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 32/28 306/117 48/28][Pkt Len c2s/s2c min/avg/max/stddev: 65/63 305/165 1154/435 330/102][Mapped IP/Port: 93.47.225.70:11624][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BPEmhF0)][Plen Bins: 8,28,25,7,0,0,0,15,0,1,1,0,2,1,0,1,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/telegram_videocall_2.pcapng.out b/tests/cfgs/default/result/telegram_videocall_2.pcapng.out index 780e4ce7b..8dc3b6de6 100644 --- a/tests/cfgs/default/result/telegram_videocall_2.pcapng.out +++ b/tests/cfgs/default/result/telegram_videocall_2.pcapng.out @@ -26,6 +26,9 @@ TelegramVoip 305 130511 4 Acceptable 315 131265 8 +VoIP 305 130511 4 +Network 10 754 4 + 1 UDP 192.168.12.67:39968 <-> 91.108.9.106:1400 [proto: 78.355/STUN.TelegramVoip][IP: 185/Telegram][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][124 pkts/50596 bytes <-> 120 pkts/70545 bytes][Goodput ratio: 90/93][2.48 sec][Hostname/SNI: telegram.org][bytes ratio: -0.165 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 19/20 633/629 67/66][Pkt Len c2s/s2c min/avg/max/stddev: 70/84 408/588 1253/1235 406/467][Mapped IP/Port: 93.35.170.144:39295][Peer IP/Port: 91.108.9.106:52874][Relayed IP/Port: 91.108.9.106:37674][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (1/talggGwr)][Plen Bins: 0,22,11,4,10,2,6,1,7,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,1,3,6,4,2,0,0,1,4,6,3,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:44275 <-> 91.108.9.10:597 [proto: 78.355/STUN.TelegramVoip][IP: 185/Telegram][ClearText][Confidence: DPI][FPC: 185/Telegram, Confidence: DPI][DPI packets: 7][cat: VoIP/10][17 pkts/2958 bytes <-> 16 pkts/2740 bytes][Goodput ratio: 76/75][2.07 sec][bytes ratio: 0.038 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 85/139 514/688 135/213][Pkt Len c2s/s2c min/avg/max/stddev: 82/106 174/171 638/614 119/118][Mapped IP/Port: 91.108.9.10:597][PLAIN TEXT (OUePGE4)][Plen Bins: 0,6,42,39,3,3,0,0,0,0,0,0,0,0,0,0,0,3,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:42417 <-> 91.108.13.26:598 [proto: 78.355/STUN.TelegramVoip][IP: 185/Telegram][ClearText][Confidence: DPI][FPC: 185/Telegram, Confidence: DPI][DPI packets: 7][cat: VoIP/10][9 pkts/1266 bytes <-> 9 pkts/1154 bytes][Goodput ratio: 70/67][1.72 sec][bytes ratio: 0.046 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 51/42 198/214 514/512 144/169][Pkt Len c2s/s2c min/avg/max/stddev: 82/106 141/128 162/162 33/15][Mapped IP/Port: 91.108.13.26:598][PLAIN TEXT (03U/SsH)][Plen Bins: 0,11,50,38,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/telegram_voice.pcapng.out b/tests/cfgs/default/result/telegram_voice.pcapng.out index 5f5142aa7..8cbee7490 100644 --- a/tests/cfgs/default/result/telegram_voice.pcapng.out +++ b/tests/cfgs/default/result/telegram_voice.pcapng.out @@ -29,6 +29,10 @@ TelegramVoip 853 161775 5 Acceptable 868 163553 10 +Chat 6 564 1 +VoIP 853 161775 5 +Network 9 1214 4 + 1 UDP 192.168.12.67:42567 <-> 91.108.9.34:1400 [proto: 78.355/STUN.TelegramVoip][IP: 185/Telegram][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][401 pkts/72973 bytes <-> 341 pkts/67660 bytes][Goodput ratio: 77/79][14.03 sec][Hostname/SNI: telegram.org][bytes ratio: 0.038 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 32/37 364/362 30/30][Pkt Len c2s/s2c min/avg/max/stddev: 70/84 182/198 329/330 82/86][Mapped IP/Port: 93.35.170.144:39263][Peer IP/Port: 91.108.9.34:47026][Relayed IP/Port: 91.108.9.34:51052][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (Unauthorized)][Plen Bins: 0,28,6,5,5,1,6,21,26,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:41011 <-> 91.108.9.68:596 [proto: 78.355/STUN.TelegramVoip][IP: 185/Telegram][ClearText][Confidence: DPI][FPC: 185/Telegram, Confidence: DPI][DPI packets: 7][cat: VoIP/10][12 pkts/2100 bytes <-> 60 pkts/14416 bytes][Goodput ratio: 76/83][10.53 sec][bytes ratio: -0.746 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 55/27 245/216 71/45][Pkt Len c2s/s2c min/avg/max/stddev: 82/106 175/240 614/682 138/121][Mapped IP/Port: 91.108.9.68:596][PLAIN TEXT (kWpcVUz)][Plen Bins: 0,4,28,20,2,1,1,2,35,2,0,0,0,0,0,0,0,1,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:46013 <-> 91.108.13.52:1400 [proto: 78.355/STUN.TelegramVoip][IP: 185/Telegram][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][10 pkts/1084 bytes <-> 6 pkts/804 bytes][Goodput ratio: 61/69][12.44 sec][Hostname/SNI: telegram.org][bytes ratio: 0.148 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 248/0 1188/0 4001/0 1191/0][Pkt Len c2s/s2c min/avg/max/stddev: 70/134 108/134 166/134 47/0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (v/cApISKdp)][Plen Bins: 37,0,37,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/telnet.pcap.out b/tests/cfgs/default/result/telnet.pcap.out index 6ae41ed1f..3e8b2a7c4 100644 --- a/tests/cfgs/default/result/telnet.pcap.out +++ b/tests/cfgs/default/result/telnet.pcap.out @@ -24,4 +24,6 @@ Telnet 87 7418 1 Unsafe 87 7418 1 +RemoteAccess 87 7418 1 + 1 TCP 192.168.0.2:1550 <-> 192.168.0.1:23 [proto: 77/Telnet][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 32][cat: RemoteAccess/12][43 pkts/3135 bytes <-> 44 pkts/4283 bytes][Goodput ratio: 9/32][39.57 sec][Username: fake][bytes ratio: -0.155 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1130/544 14699/8799 2838/1502][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 73/97 151/554 17/76][Risk: ** Unsafe Protocol **][Risk Score: 10][TCP Fingerprint: 2_64_32120_615eac77f548/Unknown][PLAIN TEXT (bam.zing.org)][Plen Bins: 70,6,19,0,2,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tencent_games.pcap.out b/tests/cfgs/default/result/tencent_games.pcap.out index 8cbee5c1f..8370d7800 100644 --- a/tests/cfgs/default/result/tencent_games.pcap.out +++ b/tests/cfgs/default/result/tencent_games.pcap.out @@ -24,6 +24,8 @@ TencentGames 32 5618 4 Fun 32 5618 4 +Game 32 5618 4 + 1 TCP 10.215.173.1:47046 <-> 129.226.103.74:31003 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][FPC: 285/Tencent, Confidence: IP address][DPI packets: 4][cat: Game/8][5 pkts/678 bytes <-> 5 pkts/2540 bytes][Goodput ratio: 67/92][1.09 sec][bytes ratio: -0.579 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 181/121 362/362 181/170][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 136/508 498/2372 181/932][TCP Fingerprint: 2_64_65535_b8d6cf600040/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50] 2 TCP 10.215.173.1:42864 <-> 162.62.116.201:20731 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][FPC: 285/Tencent, Confidence: IP address][DPI packets: 4][cat: Game/8][4 pkts/951 bytes <-> 2 pkts/88 bytes][Goodput ratio: 81/0][0.23 sec][bytes ratio: 0.831 (Upload)][IAT c2s/s2c min/avg/max/stddev: 32/124 75/124 124/124 38/0][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 238/44 473/48 191/4][TCP Fingerprint: 2_64_65535_b8d6cf600040/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.215.173.1:43300 <-> 43.130.19.227:65010 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][FPC: 285/Tencent, Confidence: IP address][DPI packets: 4][cat: Game/8][5 pkts/413 bytes <-> 5 pkts/405 bytes][Goodput ratio: 47/49][0.61 sec][bytes ratio: 0.010 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/4 103/104 200/200 95/96][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 83/81 157/173 46/52][TCP Fingerprint: 2_64_65535_b8d6cf600040/Unknown][PLAIN TEXT (9089499565149320430)][Plen Bins: 0,0,50,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/teredo.pcap.out b/tests/cfgs/default/result/teredo.pcap.out index cf852949f..dd2147843 100644 --- a/tests/cfgs/default/result/teredo.pcap.out +++ b/tests/cfgs/default/result/teredo.pcap.out @@ -24,6 +24,8 @@ Teredo 24 2574 5 Acceptable 24 2574 5 +Network 24 2574 5 + 1 UDP 10.112.16.67:51812 <-> 194.136.28.76:3544 [proto: 214/Teredo][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 214/Teredo, Confidence: DPI][DPI packets: 1][cat: Network/14][10 pkts/930 bytes <-> 4 pkts/374 bytes][Goodput ratio: 55/55][17.48 sec][bytes ratio: 0.426 (Upload)][IAT c2s/s2c min/avg/max/stddev: 42/10 2184/2486 8524/4963 2528/2476][Pkt Len c2s/s2c min/avg/max/stddev: 82/90 93/94 95/95 4/2][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.112.16.106:52513 <-> 194.136.28.76:3544 [proto: 214/Teredo][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 214/Teredo, Confidence: DPI][DPI packets: 1][cat: Network/14][2 pkts/206 bytes <-> 2 pkts/302 bytes][Goodput ratio: 59/72][38.10 sec][Plen Bins: 0,50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 10.112.16.64:56154 <-> 194.136.28.76:3544 [proto: 214/Teredo][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 214/Teredo, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/103 bytes <-> 1 pkts/151 bytes][Goodput ratio: 59/72][0.05 sec][Plen Bins: 0,50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/teso.pcapng.out b/tests/cfgs/default/result/teso.pcapng.out index f7c123261..db29eadb8 100644 --- a/tests/cfgs/default/result/teso.pcapng.out +++ b/tests/cfgs/default/result/teso.pcapng.out @@ -24,5 +24,7 @@ TES_Online 8 2253 2 Fun 8 2253 2 +Game 8 2253 2 + 1 TCP 192.168.88.231:56158 <-> 159.100.232.124:24120 [proto: 408/TES_Online][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Game/8][3 pkts/1064 bytes <-> 1 pkts/74 bytes][Goodput ratio: 81/0][0.05 sec][TCP Fingerprint: 2_64_32120_2e3cee914fc1/Linux][PLAIN TEXT (gachimuchileatherman)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.88.231:47860 <-> 159.100.232.114:24504 [proto: 408/TES_Online][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Game/8][3 pkts/1041 bytes <-> 1 pkts/74 bytes][Goodput ratio: 80/0][0.04 sec][TCP Fingerprint: 2_64_32120_2e3cee914fc1/Linux][PLAIN TEXT (eso.live.9.3.6.2849903)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tftp.pcap.out b/tests/cfgs/default/result/tftp.pcap.out index 97babf8e1..b5bd5fad0 100644 --- a/tests/cfgs/default/result/tftp.pcap.out +++ b/tests/cfgs/default/result/tftp.pcap.out @@ -27,6 +27,8 @@ TFTP 109 31453 9 Acceptable 109 31453 9 +DataTransfer 109 31453 9 + 1 UDP 192.168.0.10:3445 <-> 192.168.0.253:50618 [proto: 96/TFTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: DataTransfer/4][49 pkts/26853 bytes <-> 49 pkts/2940 bytes][Goodput ratio: 92/7][< 1 sec][bytes ratio: 0.803 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/2 3/3 9/7 2/2][Pkt Len c2s/s2c min/avg/max/stddev: 69/60 548/60 558/60 69/0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 69][PLAIN TEXT (Network Working Group )][Plen Bins: 51,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 172.28.5.170:62058 <-> 172.28.5.91:44618 [proto: 96/TFTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: DataTransfer/4][2 pkts/92 bytes <-> 2 pkts/1116 bytes][Goodput ratio: 9/92][0.00 sec][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 69][PLAIN TEXT (BCCCCCC)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.45:35840 -> 192.168.2.200:69 [proto: 96/TFTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 96/TFTP, Confidence: DPI][DPI packets: 1][cat: DataTransfer/4][1 pkts/87 bytes -> 0 pkts/0 bytes][Goodput ratio: 51/0][< 1 sec][Filename: empty100KB][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (blksize)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/threema.pcap.out b/tests/cfgs/default/result/threema.pcap.out index c41737f86..96645b531 100644 --- a/tests/cfgs/default/result/threema.pcap.out +++ b/tests/cfgs/default/result/threema.pcap.out @@ -27,6 +27,8 @@ Threema 83 11578 6 Fun 83 11578 6 +Chat 83 11578 6 + 1 TCP 192.168.2.100:50484 <-> 185.88.236.110:5222 [proto: 305/Threema][IP: 305/Threema][Encrypted][Confidence: DPI][FPC: 305/Threema, Confidence: IP address][DPI packets: 10][cat: Chat/9][9 pkts/1998 bytes <-> 6 pkts/1066 bytes][Goodput ratio: 70/62][30.23 sec][bytes ratio: 0.304 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/28 347/6958 2277/27743 788/12000][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 222/178 801/534 238/162][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 0,33,22,0,0,11,0,0,0,0,0,0,11,0,11,0,0,0,0,0,0,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.2.100:50298 <-> 185.88.236.110:5222 [proto: 305/Threema][IP: 305/Threema][Encrypted][Confidence: DPI][FPC: 305/Threema, Confidence: IP address][DPI packets: 10][cat: Chat/9][10 pkts/2025 bytes <-> 5 pkts/548 bytes][Goodput ratio: 67/38][46.73 sec][bytes ratio: 0.574 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/31 5838/33 46525/38 15378/3][Pkt Len c2s/s2c min/avg/max/stddev: 66/74 202/110 510/146 167/24][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 0,44,11,0,0,11,0,0,0,11,0,11,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.100:50618 <-> 185.88.236.110:5222 [proto: 305/Threema][IP: 305/Threema][Encrypted][Confidence: DPI][FPC: 305/Threema, Confidence: IP address][DPI packets: 10][cat: Chat/9][9 pkts/879 bytes <-> 6 pkts/1079 bytes][Goodput ratio: 31/62][5.39 sec][bytes ratio: -0.102 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/28 52/1686 209/4996 67/2340][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 98/180 257/661 59/217][TCP Fingerprint: 2_64_65535_41a9d5af7dd3/Android][Plen Bins: 0,40,20,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/thrift.pcap.out b/tests/cfgs/default/result/thrift.pcap.out index 496c7db47..bfa7bd47a 100644 --- a/tests/cfgs/default/result/thrift.pcap.out +++ b/tests/cfgs/default/result/thrift.pcap.out @@ -25,5 +25,7 @@ Thrift 172 104345 2 Acceptable 172 104345 2 +RPC 172 104345 2 + 1 TCP 169.254.59.247:53387 <-> 169.254.46.4:11010 [proto: 345/Thrift][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][66 pkts/18026 bytes <-> 104 pkts/77061 bytes][Goodput ratio: 80/93][0.01 sec][bytes ratio: -0.621 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 273/741 6929/1514 1017/585][TCP Fingerprint: 2_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (devicedriver)][Plen Bins: 0,18,3,2,0,0,1,0,1,0,0,0,0,0,0,0,0,2,31,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,34,0,3] 2 UDP 127.0.0.1:49164 -> 127.0.0.1:6831 [proto: 345/Thrift][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 345/Thrift, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/9258 bytes -> 0 pkts/0 bytes][Goodput ratio: 99/0][11.73 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (emitBatch)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100] diff --git a/tests/cfgs/default/result/tinc.pcap.out b/tests/cfgs/default/result/tinc.pcap.out index ef716cd3b..ad5a7fe3b 100644 --- a/tests/cfgs/default/result/tinc.pcap.out +++ b/tests/cfgs/default/result/tinc.pcap.out @@ -26,6 +26,8 @@ TINC 317 352291 4 Acceptable 317 352291 4 +VPN 317 352291 4 + 1 UDP 185.83.218.112:55656 <-> 131.114.168.27:55656 [proto: 209/TINC][IP: 0/Unknown][ClearText][Confidence: DPI (cache)][FPC: 209/TINC, Confidence: DPI][DPI packets: 1][cat: VPN/2][29 pkts/30038 bytes <-> 105 pkts/139726 bytes][Goodput ratio: 96/97][35.82 sec][bytes ratio: -0.646 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 244/335 1049/2670 434/517][Pkt Len c2s/s2c min/avg/max/stddev: 158/118 1036/1331 1502/1510 544/412][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 655][PLAIN TEXT (E@zUIs1)][Plen Bins: 0,0,2,7,1,0,0,0,0,1,0,0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,2,2,3,1,0,2,73,0,0] 2 UDP 131.114.168.27:55655 <-> 185.83.218.112:55655 [proto: 209/TINC][IP: 0/Unknown][ClearText][Confidence: DPI (cache)][FPC: 209/TINC, Confidence: DPI][DPI packets: 1][cat: VPN/2][101 pkts/136966 bytes <-> 29 pkts/32550 bytes][Goodput ratio: 97/96][42.97 sec][bytes ratio: 0.616 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 442/280 10377/1045 1172/448][Pkt Len c2s/s2c min/avg/max/stddev: 118/158 1356/1122 1510/1502 400/534][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic / Expected on port 655][PLAIN TEXT (Cr64lS)][Plen Bins: 0,0,2,6,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,0,3,0,0,1,81,0,0] 3 TCP 131.114.168.27:49290 <-> 185.83.218.112:55656 [proto: 209/TINC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: VPN/2][14 pkts/3812 bytes <-> 13 pkts/3098 bytes][Goodput ratio: 80/76][47.37 sec][bytes ratio: 0.103 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 4297/19 46927/55 13481/24][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 272/238 1093/1091 380/363][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 655][TCP Fingerprint: 2_64_29200_2e3cee914fc1/Linux][PLAIN TEXT (1 94 64 0 0 5861ABF)][Plen Bins: 21,7,28,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tk.pcap.out b/tests/cfgs/default/result/tk.pcap.out index cd3b4f714..3eb26ebe4 100644 --- a/tests/cfgs/default/result/tk.pcap.out +++ b/tests/cfgs/default/result/tk.pcap.out @@ -24,6 +24,8 @@ DNS 6 566 3 Acceptable 6 566 3 +Network 6 566 3 + 1 UDP 192.168.1.178:53820 <-> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/72 bytes <-> 1 pkts/131 bytes][Goodput ratio: 41/67][0.05 sec][Hostname/SNI: whois.dot.tk][0.0.0.0][DNS Id: 0x9886][Risk: ** Risky Domain Name **][Risk Score: 50][Risk Info: whois.dot.tk][PLAIN TEXT (freenom)][Plen Bins: 50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.178:55591 <-> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/72 bytes <-> 1 pkts/131 bytes][Goodput ratio: 41/67][0.06 sec][Hostname/SNI: whois.dot.tk][0.0.0.0][DNS Id: 0x3969][Risk: ** Risky Domain Name **][Risk Score: 50][Risk Info: whois.dot.tk][PLAIN TEXT (freenom)][Plen Bins: 50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.178:51954 <-> 192.168.1.1:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/72 bytes <-> 1 pkts/88 bytes][Goodput ratio: 41/52][0.10 sec][Hostname/SNI: whois.dot.tk][104.155.55.158][DNS Id: 0x0886][Risk: ** Risky Domain Name **][Risk Score: 50][Risk Info: whois.dot.tk][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tls-appdata.pcap.out b/tests/cfgs/default/result/tls-appdata.pcap.out index 63e55b610..44eb47c5a 100644 --- a/tests/cfgs/default/result/tls-appdata.pcap.out +++ b/tests/cfgs/default/result/tls-appdata.pcap.out @@ -24,5 +24,7 @@ TLS 120 119945 2 Safe 120 119945 2 +Web 120 119945 2 + 1 TCP 192.168.2.100:58976 <-> 52.223.198.7:443 [proto: 91/TLS][IP: 195/Twitch][Encrypted][Confidence: DPI][FPC: 195/Twitch, Confidence: IP address][DPI packets: 11][cat: Web/5][65 pkts/15286 bytes <-> 49 pkts/103870 bytes][Goodput ratio: 77/97][4470.16 sec][bytes ratio: -0.743 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 86847/10887 1637911/18446744073709505728 325792/64809][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 235/2120 1506/2958 476/1092][Plen Bins: 14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,33,0,51] 2 TCP 179.60.195.173:443 <-> 192.168.2.100:60636 [proto: 91/TLS][IP: 119/Facebook][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 6][cat: Web/5][3 pkts/627 bytes <-> 3 pkts/162 bytes][Goodput ratio: 68/0][0.22 sec][bytes ratio: 0.589 (Upload)][IAT c2s/s2c min/avg/max/stddev: 11/0 56/0 101/0 45/0][Pkt Len c2s/s2c min/avg/max/stddev: 201/54 209/54 225/54 11/0][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tls-esni-fuzzed.pcap.out b/tests/cfgs/default/result/tls-esni-fuzzed.pcap.out index b22350607..b6388b49e 100644 --- a/tests/cfgs/default/result/tls-esni-fuzzed.pcap.out +++ b/tests/cfgs/default/result/tls-esni-fuzzed.pcap.out @@ -24,6 +24,8 @@ TLS 3 2310 3 Safe 3 2310 3 +Web 3 2310 3 + JA Host Stats: IP Address # JA4C 1 192.168.1.12 1 diff --git a/tests/cfgs/default/result/tls-rdn-extract.pcap.out b/tests/cfgs/default/result/tls-rdn-extract.pcap.out index fad03b0fa..bb80d6e72 100644 --- a/tests/cfgs/default/result/tls-rdn-extract.pcap.out +++ b/tests/cfgs/default/result/tls-rdn-extract.pcap.out @@ -24,6 +24,8 @@ Azure 6 7205 1 Acceptable 6 7205 1 +Cloud 6 7205 1 + JA Host Stats: IP Address # JA4C 1 10.0.0.1 1 diff --git a/tests/cfgs/default/result/tls_1.2_unidirectional_client.pcapng.out b/tests/cfgs/default/result/tls_1.2_unidirectional_client.pcapng.out index 0c1cd0f6c..d9c4a65f2 100644 --- a/tests/cfgs/default/result/tls_1.2_unidirectional_client.pcapng.out +++ b/tests/cfgs/default/result/tls_1.2_unidirectional_client.pcapng.out @@ -24,6 +24,8 @@ GoogleServices 17 3004 1 Acceptable 17 3004 1 +Web 17 3004 1 + JA Host Stats: IP Address # JA4C 1 192.168.12.156 1 diff --git a/tests/cfgs/default/result/tls_1.2_unidirectional_client_no_cert.pcapng.out b/tests/cfgs/default/result/tls_1.2_unidirectional_client_no_cert.pcapng.out index a09bcb882..b26a6ebc3 100644 --- a/tests/cfgs/default/result/tls_1.2_unidirectional_client_no_cert.pcapng.out +++ b/tests/cfgs/default/result/tls_1.2_unidirectional_client_no_cert.pcapng.out @@ -24,6 +24,8 @@ TLS 10 1549 1 Safe 10 1549 1 +Web 10 1549 1 + JA Host Stats: IP Address # JA4C 1 192.168.12.156 1 diff --git a/tests/cfgs/default/result/tls_1.2_unidirectional_server.pcapng.out b/tests/cfgs/default/result/tls_1.2_unidirectional_server.pcapng.out index 6b5d63f69..d6b8be1ce 100644 --- a/tests/cfgs/default/result/tls_1.2_unidirectional_server.pcapng.out +++ b/tests/cfgs/default/result/tls_1.2_unidirectional_server.pcapng.out @@ -24,6 +24,8 @@ YouTubeUpload 18 7218 1 Fun 18 7218 1 +Media 18 7218 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/tls_1.2_unidirectional_server_no_cert.pcapng.out b/tests/cfgs/default/result/tls_1.2_unidirectional_server_no_cert.pcapng.out index bbfd91280..6e9e1982d 100644 --- a/tests/cfgs/default/result/tls_1.2_unidirectional_server_no_cert.pcapng.out +++ b/tests/cfgs/default/result/tls_1.2_unidirectional_server_no_cert.pcapng.out @@ -24,6 +24,8 @@ TLS 10 1978 1 Safe 10 1978 1 +Web 10 1978 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/tls_1.3_unidirectional_client.pcapng.out b/tests/cfgs/default/result/tls_1.3_unidirectional_client.pcapng.out index 4dedf9695..5672c9b8b 100644 --- a/tests/cfgs/default/result/tls_1.3_unidirectional_client.pcapng.out +++ b/tests/cfgs/default/result/tls_1.3_unidirectional_client.pcapng.out @@ -24,6 +24,8 @@ Google 9 1488 1 Acceptable 9 1488 1 +Web 9 1488 1 + JA Host Stats: IP Address # JA4C 1 192.168.12.156 1 diff --git a/tests/cfgs/default/result/tls_1.3_unidirectional_server.pcapng.out b/tests/cfgs/default/result/tls_1.3_unidirectional_server.pcapng.out index 5b3f5f7dd..5c8f4a6f8 100644 --- a/tests/cfgs/default/result/tls_1.3_unidirectional_server.pcapng.out +++ b/tests/cfgs/default/result/tls_1.3_unidirectional_server.pcapng.out @@ -24,6 +24,8 @@ TLS 9 1651 1 Safe 9 1651 1 +Web 9 1651 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/tls_2_reasms.pcapng.out b/tests/cfgs/default/result/tls_2_reasms.pcapng.out index 3d67fb2d8..68191158b 100644 --- a/tests/cfgs/default/result/tls_2_reasms.pcapng.out +++ b/tests/cfgs/default/result/tls_2_reasms.pcapng.out @@ -24,6 +24,8 @@ Instagram 14 6907 1 Fun 14 6907 1 +SocialNetwork 14 6907 1 + JA Host Stats: IP Address # JA4C 1 192.91.186.174 1 diff --git a/tests/cfgs/default/result/tls_2_reasms_b.pcapng.out b/tests/cfgs/default/result/tls_2_reasms_b.pcapng.out index d77212be0..b65b65f92 100644 --- a/tests/cfgs/default/result/tls_2_reasms_b.pcapng.out +++ b/tests/cfgs/default/result/tls_2_reasms_b.pcapng.out @@ -24,6 +24,8 @@ FbookReelStory 15 13455 1 Fun 15 13455 1 +SocialNetwork 15 13455 1 + JA Host Stats: IP Address # JA4C 1 88.14.137.195 1 diff --git a/tests/cfgs/default/result/tls_alert.pcap.out b/tests/cfgs/default/result/tls_alert.pcap.out index 7e14da0d6..c693e8109 100644 --- a/tests/cfgs/default/result/tls_alert.pcap.out +++ b/tests/cfgs/default/result/tls_alert.pcap.out @@ -26,6 +26,9 @@ Google 11 952 1 Safe 7 533 1 Acceptable 11 952 1 +Web 7 533 1 +Advertisement 11 952 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.192 1 diff --git a/tests/cfgs/default/result/tls_certificate_too_long.pcap.out b/tests/cfgs/default/result/tls_certificate_too_long.pcap.out index 60a9ed195..9ec548f37 100644 --- a/tests/cfgs/default/result/tls_certificate_too_long.pcap.out +++ b/tests/cfgs/default/result/tls_certificate_too_long.pcap.out @@ -38,6 +38,12 @@ Safe 249 100762 15 Acceptable 53 6650 19 Unrated 13 5582 1 +Unspecified 13 5582 1 +Web 227 94723 13 +Download 22 6039 2 +Network 45 5930 15 +System 8 720 4 + JA Host Stats: IP Address # JA4C 1 192.168.1.121 1 diff --git a/tests/cfgs/default/result/tls_change_cipher.pcap.out b/tests/cfgs/default/result/tls_change_cipher.pcap.out index e6dac3166..bee31be6a 100644 --- a/tests/cfgs/default/result/tls_change_cipher.pcap.out +++ b/tests/cfgs/default/result/tls_change_cipher.pcap.out @@ -24,4 +24,6 @@ TLS 14 13753 1 Safe 14 13753 1 +Web 14 13753 1 + 1 TCP 18.139.7.8:443 <-> 172.29.190.157:62797 [VLAN: 113][proto: GTP:91/TLS][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 14][cat: Web/5][1 pkts/134 bytes <-> 13 pkts/13619 bytes][Goodput ratio: 0/88][4.99 sec][bytes ratio: -0.981 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/438 0/4677 0/1341][Pkt Len c2s/s2c min/avg/max/stddev: 134/194 134/1048 134/1458 0/494][PLAIN TEXT (oCpI.P7)][Plen Bins: 0,0,7,0,7,0,0,0,7,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,7,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,55,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tls_cipher_lens.pcap.out b/tests/cfgs/default/result/tls_cipher_lens.pcap.out index 8179c5de3..255e1b804 100644 --- a/tests/cfgs/default/result/tls_cipher_lens.pcap.out +++ b/tests/cfgs/default/result/tls_cipher_lens.pcap.out @@ -26,6 +26,8 @@ Google 1 233 1 Safe 4 932 4 Acceptable 1 233 1 +Web 5 1165 5 + JA Host Stats: IP Address # JA4C 1 192.168.11.11 2 diff --git a/tests/cfgs/default/result/tls_client_certificate_with_missing_server_one.pcapng.out b/tests/cfgs/default/result/tls_client_certificate_with_missing_server_one.pcapng.out index be393f0a5..6268a0e59 100644 --- a/tests/cfgs/default/result/tls_client_certificate_with_missing_server_one.pcapng.out +++ b/tests/cfgs/default/result/tls_client_certificate_with_missing_server_one.pcapng.out @@ -26,6 +26,9 @@ AnyDesk 9 3433 1 Safe 8 2093 1 Acceptable 9 3433 1 +Web 8 2093 1 +RemoteAccess 9 3433 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 1 diff --git a/tests/cfgs/default/result/tls_ech.pcapng.out b/tests/cfgs/default/result/tls_ech.pcapng.out index ce59cf55d..bf2111cf8 100644 --- a/tests/cfgs/default/result/tls_ech.pcapng.out +++ b/tests/cfgs/default/result/tls_ech.pcapng.out @@ -24,6 +24,8 @@ Cloudflare 10 4226 1 Acceptable 10 4226 1 +Web 10 4226 1 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:ce16:b409:3d0a:9177 1 diff --git a/tests/cfgs/default/result/tls_esni_sni_both.pcap.out b/tests/cfgs/default/result/tls_esni_sni_both.pcap.out index 00a34df1b..646d481a1 100644 --- a/tests/cfgs/default/result/tls_esni_sni_both.pcap.out +++ b/tests/cfgs/default/result/tls_esni_sni_both.pcap.out @@ -24,6 +24,8 @@ TLS 38 15899 2 Safe 38 15899 2 +Web 38 15899 2 + JA Host Stats: IP Address # JA4C 1 192.168.1.21 1 diff --git a/tests/cfgs/default/result/tls_false_positives.pcapng.out b/tests/cfgs/default/result/tls_false_positives.pcapng.out index d468b9a0a..e88f22d33 100644 --- a/tests/cfgs/default/result/tls_false_positives.pcapng.out +++ b/tests/cfgs/default/result/tls_false_positives.pcapng.out @@ -24,6 +24,8 @@ Unknown 30 37313 1 Unrated 30 37313 1 +Unspecified 30 37313 1 + Undetected flows: diff --git a/tests/cfgs/default/result/tls_heur__shadowsocks-tcp.pcapng.out b/tests/cfgs/default/result/tls_heur__shadowsocks-tcp.pcapng.out index 737c2fe67..dddcbe218 100644 --- a/tests/cfgs/default/result/tls_heur__shadowsocks-tcp.pcapng.out +++ b/tests/cfgs/default/result/tls_heur__shadowsocks-tcp.pcapng.out @@ -31,6 +31,11 @@ Acceptable 34 22102 2 Fun 41 36148 1 Unrated 25 22923 1 +Unspecified 25 22923 1 +Media 41 36148 1 +Web 30 21330 1 +Network 4 772 1 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:8628:88aa:8b00:913c 1 diff --git a/tests/cfgs/default/result/tls_heur__trojan-tcp-tls.pcapng.out b/tests/cfgs/default/result/tls_heur__trojan-tcp-tls.pcapng.out index c1e3ec3fd..938a62778 100644 --- a/tests/cfgs/default/result/tls_heur__trojan-tcp-tls.pcapng.out +++ b/tests/cfgs/default/result/tls_heur__trojan-tcp-tls.pcapng.out @@ -30,6 +30,10 @@ Safe 25 11617 1 Acceptable 43 12236 8 Fun 32 15921 1 +Media 32 15921 1 +Web 52 21596 2 +Network 16 2257 7 + JA Host Stats: IP Address # JA4C 1 127.0.0.1 1 diff --git a/tests/cfgs/default/result/tls_heur__vmess-tcp-tls.pcapng.out b/tests/cfgs/default/result/tls_heur__vmess-tcp-tls.pcapng.out index 82882bf32..5860152c2 100644 --- a/tests/cfgs/default/result/tls_heur__vmess-tcp-tls.pcapng.out +++ b/tests/cfgs/default/result/tls_heur__vmess-tcp-tls.pcapng.out @@ -30,6 +30,10 @@ Safe 30 14152 1 Acceptable 44 12052 8 Fun 26 20991 1 +Media 26 20991 1 +Web 58 24198 2 +Network 16 2006 7 + JA Host Stats: IP Address # JA4C 1 127.0.0.1 1 diff --git a/tests/cfgs/default/result/tls_heur__vmess-tcp.pcapng.out b/tests/cfgs/default/result/tls_heur__vmess-tcp.pcapng.out index 03f0ecc8b..58db4d2ae 100644 --- a/tests/cfgs/default/result/tls_heur__vmess-tcp.pcapng.out +++ b/tests/cfgs/default/result/tls_heur__vmess-tcp.pcapng.out @@ -31,6 +31,11 @@ Acceptable 34 22245 2 Fun 37 24955 1 Unrated 29 22543 1 +Unspecified 29 22543 1 +Media 37 24955 1 +Web 30 21345 1 +Network 4 900 1 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:8628:88aa:8b00:913c 1 diff --git a/tests/cfgs/default/result/tls_heur__vmess-websocket.pcapng.out b/tests/cfgs/default/result/tls_heur__vmess-websocket.pcapng.out index 1cac4792d..f33f8b045 100644 --- a/tests/cfgs/default/result/tls_heur__vmess-websocket.pcapng.out +++ b/tests/cfgs/default/result/tls_heur__vmess-websocket.pcapng.out @@ -29,6 +29,10 @@ WebSocket 35 22912 1 Acceptable 72 45159 3 Fun 28 23909 1 +Media 28 23909 1 +Web 68 44387 2 +Network 4 772 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.183 1 diff --git a/tests/cfgs/default/result/tls_invalid_reads.pcap.out b/tests/cfgs/default/result/tls_invalid_reads.pcap.out index efd6077a7..b69fe9193 100644 --- a/tests/cfgs/default/result/tls_invalid_reads.pcap.out +++ b/tests/cfgs/default/result/tls_invalid_reads.pcap.out @@ -29,6 +29,9 @@ Crashlytics 3 560 1 Safe 8 1891 2 Acceptable 3 560 1 +DataTransfer 3 560 1 +Web 8 1891 2 + JA Host Stats: IP Address # JA4C 1 10.191.139.17 1 diff --git a/tests/cfgs/default/result/tls_long_cert.pcap.out b/tests/cfgs/default/result/tls_long_cert.pcap.out index df485a0eb..b25895242 100644 --- a/tests/cfgs/default/result/tls_long_cert.pcap.out +++ b/tests/cfgs/default/result/tls_long_cert.pcap.out @@ -24,6 +24,8 @@ TLS 182 117601 1 Safe 182 117601 1 +Web 182 117601 1 + JA Host Stats: IP Address # JA4C 1 192.168.2.126 1 diff --git a/tests/cfgs/default/result/tls_malicious_sha1.pcapng.out b/tests/cfgs/default/result/tls_malicious_sha1.pcapng.out index 550d5e7e5..18f928cb6 100644 --- a/tests/cfgs/default/result/tls_malicious_sha1.pcapng.out +++ b/tests/cfgs/default/result/tls_malicious_sha1.pcapng.out @@ -24,6 +24,8 @@ TLS 22 7204 1 Safe 22 7204 1 +Web 22 7204 1 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:9726:f643:a838:b0c4 1 diff --git a/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out b/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out index cc8914220..1e7e77f97 100644 --- a/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out +++ b/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out @@ -24,6 +24,8 @@ TLS 14 10082 1 Safe 14 10082 1 +Web 14 10082 1 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/default/result/tls_multiple_synack_different_seq.pcapng.out b/tests/cfgs/default/result/tls_multiple_synack_different_seq.pcapng.out index b8f0e5e50..32ad717ad 100644 --- a/tests/cfgs/default/result/tls_multiple_synack_different_seq.pcapng.out +++ b/tests/cfgs/default/result/tls_multiple_synack_different_seq.pcapng.out @@ -24,6 +24,8 @@ AmazonAWS 10 6532 1 Acceptable 10 6532 1 +Cloud 10 6532 1 + JA Host Stats: IP Address # JA4C 1 10.10.10.1 1 diff --git a/tests/cfgs/default/result/tls_port_80.pcapng.out b/tests/cfgs/default/result/tls_port_80.pcapng.out index 58975f092..6e5e4ae77 100644 --- a/tests/cfgs/default/result/tls_port_80.pcapng.out +++ b/tests/cfgs/default/result/tls_port_80.pcapng.out @@ -24,6 +24,8 @@ TLS 13 2439 1 Safe 13 2439 1 +Web 13 2439 1 + JA Host Stats: IP Address # JA4C 1 57.91.202.194 1 diff --git a/tests/cfgs/default/result/tls_torrent.pcapng.out b/tests/cfgs/default/result/tls_torrent.pcapng.out index 6ef873633..177e35bc4 100644 --- a/tests/cfgs/default/result/tls_torrent.pcapng.out +++ b/tests/cfgs/default/result/tls_torrent.pcapng.out @@ -24,6 +24,8 @@ BitTorrent 7 6308 1 Acceptable 7 6308 1 +Download 7 6308 1 + JA Host Stats: IP Address # JA4C 1 10.10.10.1 1 diff --git a/tests/cfgs/default/result/tls_unidirectional.pcap.out b/tests/cfgs/default/result/tls_unidirectional.pcap.out index b12facde9..7c6756373 100644 --- a/tests/cfgs/default/result/tls_unidirectional.pcap.out +++ b/tests/cfgs/default/result/tls_unidirectional.pcap.out @@ -26,4 +26,6 @@ TLS 8 550 1 Safe 8 550 1 +Web 8 550 1 + 1 TCP 192.168.2.198:50548 <-> 192.168.2.1:443 [proto: 91/TLS][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: Web/5][5 pkts/344 bytes <-> 3 pkts/206 bytes][Goodput ratio: 1/0][4.68 sec][bytes ratio: 0.251 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/3291 1171/3291 3288/3291 1347/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 69/69 78/74 5/4][TCP Fingerprint: 2_64_65535_d29295416479/macOS][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tls_verylong_certificate.pcap.out b/tests/cfgs/default/result/tls_verylong_certificate.pcap.out index eb58330e5..f7da7d0f0 100644 --- a/tests/cfgs/default/result/tls_verylong_certificate.pcap.out +++ b/tests/cfgs/default/result/tls_verylong_certificate.pcap.out @@ -24,6 +24,8 @@ Cybersec 48 22229 1 Safe 48 22229 1 +Cybersecurity 48 22229 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.160 1 diff --git a/tests/cfgs/default/result/tls_with_huge_ch.pcapng.out b/tests/cfgs/default/result/tls_with_huge_ch.pcapng.out index 31e95de36..6f7a260a0 100644 --- a/tests/cfgs/default/result/tls_with_huge_ch.pcapng.out +++ b/tests/cfgs/default/result/tls_with_huge_ch.pcapng.out @@ -24,6 +24,8 @@ TLS 428 119100 1 Safe 428 119100 1 +Web 428 119100 1 + JA Host Stats: IP Address # JA4C 1 172.30.84.193 1 diff --git a/tests/cfgs/default/result/toca-boca.pcap.out b/tests/cfgs/default/result/toca-boca.pcap.out index 6dfd0d88b..5ba1c298c 100644 --- a/tests/cfgs/default/result/toca-boca.pcap.out +++ b/tests/cfgs/default/result/toca-boca.pcap.out @@ -27,6 +27,8 @@ TocaBoca 77 15576 21 Fun 77 15576 21 +Game 77 15576 21 + 1 UDP 192.168.2.100:55544 <-> 92.38.154.49:5055 [proto: 155/TocaBoca][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 155/TocaBoca, Confidence: DPI][DPI packets: 1][cat: Game/8][8 pkts/1266 bytes <-> 7 pkts/1556 bytes][Goodput ratio: 73/81][1.22 sec][bytes ratio: -0.103 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5/11 35/31 48/47 14/15][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 158/222 458/522 120/185][PLAIN TEXT (HlvlwYJ)][Plen Bins: 13,27,27,0,13,0,0,0,0,0,0,0,0,6,6,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.100:50173 <-> 91.199.81.225:5055 [proto: 155/TocaBoca][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 155/TocaBoca, Confidence: DPI][DPI packets: 1][cat: Game/8][7 pkts/1134 bytes <-> 8 pkts/1327 bytes][Goodput ratio: 74/75][2.41 sec][bytes ratio: -0.078 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 46/31 256/383 982/1078 363/465][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 162/166 458/428 127/122][PLAIN TEXT (AstGDGW)][Plen Bins: 13,41,13,0,13,0,0,6,0,0,0,0,6,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.100:44818 <-> 91.199.81.123:5055 [proto: 155/TocaBoca][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 155/TocaBoca, Confidence: DPI][DPI packets: 1][cat: Game/8][8 pkts/1177 bytes <-> 7 pkts/1167 bytes][Goodput ratio: 71/75][2.29 sec][bytes ratio: 0.004 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 51/15 360/435 985/1007 340/380][Pkt Len c2s/s2c min/avg/max/stddev: 74/74 147/167 478/515 129/147][PLAIN TEXT (82620531)][Plen Bins: 0,61,13,0,13,0,0,0,0,0,0,0,0,6,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tor-browser.pcap.out b/tests/cfgs/default/result/tor-browser.pcap.out index 78c1acd86..0cd977590 100644 --- a/tests/cfgs/default/result/tor-browser.pcap.out +++ b/tests/cfgs/default/result/tor-browser.pcap.out @@ -32,6 +32,10 @@ Safe 31 10988 2 Acceptable 21 10489 2 Potentially_Dangerous 113 57510 5 +VPN 113 57510 5 +Web 31 10988 2 +Network 21 10489 2 + JA Host Stats: IP Address # JA4C 1 192.168.0.123 2 diff --git a/tests/cfgs/default/result/tor.pcap.out b/tests/cfgs/default/result/tor.pcap.out index b7264b284..1f366ff0e 100644 --- a/tests/cfgs/default/result/tor.pcap.out +++ b/tests/cfgs/default/result/tor.pcap.out @@ -35,6 +35,12 @@ Acceptable 16 2766 2 Potentially_Dangerous 112 39736 3 Dangerous 1 252 1 +VPN 112 39736 3 +Web 220 93832 5 +Cloud 10 1860 1 +Network 6 906 1 +System 1 252 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.252 1 diff --git a/tests/cfgs/default/result/tplink_shp.pcap.out b/tests/cfgs/default/result/tplink_shp.pcap.out index fa4a1f272..50b0640af 100644 --- a/tests/cfgs/default/result/tplink_shp.pcap.out +++ b/tests/cfgs/default/result/tplink_shp.pcap.out @@ -24,6 +24,8 @@ TPLINK_SHP 251 17821 8 Acceptable 251 17821 8 +IoT-Scada 251 17821 8 + 1 UDP 192.168.242.40:9999 -> 255.255.255.255:9999 [proto: 332/TPLINK_SHP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 332/TPLINK_SHP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][32 pkts/2272 bytes -> 0 pkts/0 bytes][Goodput ratio: 41/0][1860.44 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 58157/0 60014/0 62682/0 801/0][Pkt Len c2s/s2c min/avg/max/stddev: 71/0 71/0 71/0 0/0][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.242.41:9999 -> 255.255.255.255:9999 [proto: 332/TPLINK_SHP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 332/TPLINK_SHP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][32 pkts/2272 bytes -> 0 pkts/0 bytes][Goodput ratio: 41/0][1860.44 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 59941/0 60012/0 60058/0 30/0][Pkt Len c2s/s2c min/avg/max/stddev: 71/0 71/0 71/0 0/0][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.242.99:9999 -> 255.255.255.255:9999 [proto: 332/TPLINK_SHP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 332/TPLINK_SHP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][32 pkts/2272 bytes -> 0 pkts/0 bytes][Goodput ratio: 41/0][1860.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 59882/0 59999/0 60106/0 30/0][Pkt Len c2s/s2c min/avg/max/stddev: 71/0 71/0 71/0 0/0][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/trdp.pcapng.out b/tests/cfgs/default/result/trdp.pcapng.out index 7900e7982..a484041c0 100644 --- a/tests/cfgs/default/result/trdp.pcapng.out +++ b/tests/cfgs/default/result/trdp.pcapng.out @@ -25,6 +25,8 @@ TRDP 14 1508 3 Acceptable 14 1508 3 +IoT-Scada 14 1508 3 + 1 TCP 192.168.88.231:45482 <-> 192.168.88.138:17225 [proto: 424/TRDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][6 pkts/536 bytes <-> 4 pkts/408 bytes][Goodput ratio: 25/33][0.01 sec][bytes ratio: 0.136 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5 2/6 6/6 3/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 89/102 198/202 49/58][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (How are you)][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.88.231:45318 <-> 192.168.88.138:17225 [proto: 424/TRDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 424/TRDP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][1 pkts/174 bytes <-> 1 pkts/178 bytes][Goodput ratio: 75/76][< 1 sec][PLAIN TEXT (fHow are you)][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.88.231:47228 -> 192.168.88.138:17224 [proto: 424/TRDP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 424/TRDP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][2 pkts/212 bytes -> 0 pkts/0 bytes][Goodput ratio: 60/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (Hello World)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/trickbot.pcap.out b/tests/cfgs/default/result/trickbot.pcap.out index 717c09e4a..0db5e6c4a 100644 --- a/tests/cfgs/default/result/trickbot.pcap.out +++ b/tests/cfgs/default/result/trickbot.pcap.out @@ -24,4 +24,6 @@ HTTP 74 62002 1 Acceptable 74 62002 1 +Web 74 62002 1 + 1 TCP 10.12.29.101:61318 <-> 82.118.225.196:7080 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: Web/5][28 pkts/2801 bytes <-> 46 pkts/59201 bytes][Goodput ratio: 46/96][8.40 sec][Hostname/SNI: 82.118.225.196][bytes ratio: -0.910 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 327/167 1000/1000 339/292][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 100/1287 982/1514 182/426][URL: 82.118.225.196:7080/OK21pqJAtyyGBEo00sk][StatusCode: 200][Req Content-Type: application/x-www-form-urlencoded][Content-Type: text/html][Server: nginx][User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **** HTTP Susp Content **][Risk Score: 160][Risk Info: Susp content DF6A56F8 / Found host 82.118.225.196 / Expected on port 80][TCP Fingerprint: 2_128_65535_6bb88f5575fd/Windows][PLAIN TEXT (POST /OK21p)][Plen Bins: 0,0,0,0,0,0,0,2,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,2,0,0,0,0,4,0,0,6,2,0,35,0,0,44,0,0] diff --git a/tests/cfgs/default/result/tumblr.pcap.out b/tests/cfgs/default/result/tumblr.pcap.out index 3ab2468ac..60f749392 100644 --- a/tests/cfgs/default/result/tumblr.pcap.out +++ b/tests/cfgs/default/result/tumblr.pcap.out @@ -35,6 +35,10 @@ Acceptable 170 130417 2 Fun 84 38260 2 Tracker_Ads 54 17122 2 +Web 617 304290 43 +SocialNetwork 84 38260 2 +Advertisement 54 17122 2 + JA Host Stats: IP Address # JA4C 1 2a01:cb01:2049:8b07:991d:ec85:28df:f629 2 diff --git a/tests/cfgs/default/result/tunnelbear.pcap.out b/tests/cfgs/default/result/tunnelbear.pcap.out index 675d61cd0..34863db7e 100644 --- a/tests/cfgs/default/result/tunnelbear.pcap.out +++ b/tests/cfgs/default/result/tunnelbear.pcap.out @@ -35,6 +35,12 @@ Safe 24 9110 1 Acceptable 375 94996 19 Tracker_Ads 34 13737 2 +VPN 337 86766 16 +Web 39 11771 2 +Chat 18 5263 1 +Network 5 306 1 +Advertisement 34 13737 2 + JA Host Stats: IP Address # JA4C 1 10.8.0.1 5 diff --git a/tests/cfgs/default/result/tuya_lp.pcap.out b/tests/cfgs/default/result/tuya_lp.pcap.out index cb16f043b..eb64195ff 100644 --- a/tests/cfgs/default/result/tuya_lp.pcap.out +++ b/tests/cfgs/default/result/tuya_lp.pcap.out @@ -24,6 +24,8 @@ TuyaLP 98 21948 13 Acceptable 98 21948 13 +IoT-Scada 98 21948 13 + 1 UDP 192.168.242.170:49154 -> 255.255.255.255:6667 [proto: 331/TuyaLP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 331/TuyaLP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][8 pkts/1840 bytes -> 0 pkts/0 bytes][Goodput ratio: 82/0][35.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4999/0 5000/0 5001/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 230/0 230/0 230/0 0/0][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.242.172:49154 -> 255.255.255.255:6667 [proto: 331/TuyaLP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 331/TuyaLP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][8 pkts/1840 bytes -> 0 pkts/0 bytes][Goodput ratio: 82/0][35.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4997/0 5000/0 5001/0 2/0][Pkt Len c2s/s2c min/avg/max/stddev: 230/0 230/0 230/0 0/0][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.242.174:49154 -> 255.255.255.255:6667 [proto: 331/TuyaLP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 331/TuyaLP, Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][8 pkts/1840 bytes -> 0 pkts/0 bytes][Goodput ratio: 82/0][35.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4998/0 5000/0 5003/0 2/0][Pkt Len c2s/s2c min/avg/max/stddev: 230/0 230/0 230/0 0/0][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ubntac2.pcap.out b/tests/cfgs/default/result/ubntac2.pcap.out index 032e8dbf1..b478b4eb6 100644 --- a/tests/cfgs/default/result/ubntac2.pcap.out +++ b/tests/cfgs/default/result/ubntac2.pcap.out @@ -25,6 +25,8 @@ UBNTAC2 22 4514 13 Safe 22 4514 13 +Network 22 4514 13 + 1 TCP 192.168.1.138:35726 <-> 192.168.1.204:8080 [proto: 7.31/HTTP.UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Network/14][6 pkts/1559 bytes <-> 4 pkts/448 bytes][Goodput ratio: 78/49][0.02 sec][Hostname/SNI: 192.168.1.204][bytes ratio: 0.554 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/2 3/8 13/13 5/6][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 260/112 1277/274 455/94][URL: 192.168.1.204:8080/inform][StatusCode: 200][Req Content-Type: application/x-binary][Content-Type: application/x-binary][User-Agent: AirControl Agent v1.0][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 60][Risk Info: Found host 192.168.1.204 / Expected on port 80][TCP Fingerprint: 2_64_29200_80d34a615d0a/Unknown][PLAIN TEXT (POST /inform HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.1.138:60790 -> 255.255.255.255:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/296 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][< 1 sec][BZ.qca956x_6.6.77+15402.240813.0934][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.1:34085 -> 255.255.255.255:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/217 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][UniFiSecurityGateway.ER-e120.v4.3.33.4936086.161203.2031][PLAIN TEXT (UniFiSecurityGateway.ER)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/uftp_v4_v5.pcap.out b/tests/cfgs/default/result/uftp_v4_v5.pcap.out index e7ce8ba87..0a521f618 100644 --- a/tests/cfgs/default/result/uftp_v4_v5.pcap.out +++ b/tests/cfgs/default/result/uftp_v4_v5.pcap.out @@ -24,6 +24,8 @@ UFTP 260 296340 3 Acceptable 260 296340 3 +Download 260 296340 3 + 1 UDP 10.0.0.1:37173 -> 230.5.5.56:1044 [proto: 373/UFTP][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 373/UFTP, Confidence: DPI][DPI packets: 1][cat: Download/7][220 pkts/293060 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][2.35 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 12/0 391/0 27/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 1332/0 1366/0 203/0][Plen Bins: 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,98,0,0,0,0,0,0] 2 UDP 10.0.0.1:37173 -> 230.4.4.1:1044 [proto: 373/UFTP][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 373/UFTP, Confidence: DPI][DPI packets: 1][cat: Download/7][20 pkts/1640 bytes -> 0 pkts/0 bytes][Goodput ratio: 49/0][10.87 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 18/0 602/0 1511/0 718/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 82/0 82/0 0/0][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.1.186:37457 -> 230.4.4.1:1044 [proto: 373/UFTP][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 373/UFTP, Confidence: DPI][DPI packets: 1][cat: Download/7][20 pkts/1640 bytes -> 0 pkts/0 bytes][Goodput ratio: 49/0][2.07 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 19/0 113/0 1513/0 340/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 82/0 82/0 0/0][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ultrasurf.pcap.out b/tests/cfgs/default/result/ultrasurf.pcap.out index 22295b257..93e0295e4 100644 --- a/tests/cfgs/default/result/ultrasurf.pcap.out +++ b/tests/cfgs/default/result/ultrasurf.pcap.out @@ -26,6 +26,9 @@ UltraSurf 100 120543 1 Safe 233 106228 2 Acceptable 100 120543 1 +VPN 100 120543 1 +Web 233 106228 2 + JA Host Stats: IP Address # JA4C 1 10.132.0.23 1 diff --git a/tests/cfgs/default/result/umas.pcap.out b/tests/cfgs/default/result/umas.pcap.out index 27269a89e..6dc94310d 100644 --- a/tests/cfgs/default/result/umas.pcap.out +++ b/tests/cfgs/default/result/umas.pcap.out @@ -24,4 +24,6 @@ UMAS 191 29046 1 Acceptable 191 29046 1 +IoT-Scada 191 29046 1 + 1 TCP 192.168.63.100:7718 <-> 192.168.63.253:502 [proto: 44.364/Modbus.UMAS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][94 pkts/6876 bytes <-> 97 pkts/22170 bytes][Goodput ratio: 26/76][0.77 sec][bytes ratio: -0.527 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/1 8/8 183/183 21/20][Pkt Len c2s/s2c min/avg/max/stddev: 54/64 73/229 315/315 36/105][TCP Fingerprint: 2_128_64240_5a9ef1c58d0b/Unknown][PLAIN TEXT (PU 311 10)][Plen Bins: 57,1,5,2,0,1,0,4,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/upnp.pcap.out b/tests/cfgs/default/result/upnp.pcap.out index 04702a430..c6469991c 100644 --- a/tests/cfgs/default/result/upnp.pcap.out +++ b/tests/cfgs/default/result/upnp.pcap.out @@ -24,5 +24,7 @@ WSD 14 9912 2 Acceptable 14 9912 2 +Network 14 9912 2 + 1 UDP [fe80::3441:3d24:6d30:a807]:58932 -> [ff02::c]:3702 [proto: 153/WSD][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 153/WSD, Confidence: DPI][DPI packets: 1][cat: Network/14][7 pkts/5026 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][5.63 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 118/0 938/0 2000/0 752/0][Pkt Len c2s/s2c min/avg/max/stddev: 718/0 718/0 718/0 0/0][PLAIN TEXT (xml version)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.61.66:58931 -> 239.255.255.250:3702 [proto: 153/WSD][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 153/WSD, Confidence: DPI][DPI packets: 1][cat: Network/14][7 pkts/4886 bytes -> 0 pkts/0 bytes][Goodput ratio: 94/0][6.64 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 179/0 1107/0 2004/0 740/0][Pkt Len c2s/s2c min/avg/max/stddev: 698/0 698/0 698/0 0/0][PLAIN TEXT (xml version)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/viber.pcap.out b/tests/cfgs/default/result/viber.pcap.out index 6bc5e1410..86c0a1673 100644 --- a/tests/cfgs/default/result/viber.pcap.out +++ b/tests/cfgs/default/result/viber.pcap.out @@ -39,6 +39,11 @@ Safe 102 33446 6 Acceptable 69 16870 14 Fun 291 104977 10 +Web 132 42415 8 +Chat 113 75823 2 +VoIP 193 31236 9 +Network 24 5819 11 + JA Host Stats: IP Address # JA4C 1 192.168.0.17 3 diff --git a/tests/cfgs/default/result/vivox.pcapng.out b/tests/cfgs/default/result/vivox.pcapng.out index e29773467..93773382a 100644 --- a/tests/cfgs/default/result/vivox.pcapng.out +++ b/tests/cfgs/default/result/vivox.pcapng.out @@ -27,6 +27,9 @@ Vivox 4 509 1 Acceptable 3 361 1 Fun 4 509 1 +Media 3 361 1 +Game 4 509 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.13 1 diff --git a/tests/cfgs/default/result/vk.pcapng.out b/tests/cfgs/default/result/vk.pcapng.out index 08c222dc9..155c66d45 100644 --- a/tests/cfgs/default/result/vk.pcapng.out +++ b/tests/cfgs/default/result/vk.pcapng.out @@ -26,6 +26,9 @@ TLS 827 116853 6 Safe 827 116853 6 Fun 82 10228 4 +Web 827 116853 6 +SocialNetwork 82 10228 4 + JA Host Stats: IP Address # JA4C 1 192.168.1.249 1 diff --git a/tests/cfgs/default/result/vnc.pcap.out b/tests/cfgs/default/result/vnc.pcap.out index 80e9f1dae..b970f9b28 100644 --- a/tests/cfgs/default/result/vnc.pcap.out +++ b/tests/cfgs/default/result/vnc.pcap.out @@ -24,5 +24,7 @@ VNC 4551 329158 2 Acceptable 4551 329158 2 +RemoteAccess 4551 329158 2 + 1 TCP 95.237.48.208:59791 <-> 192.168.2.110:6900 [proto: 89/VNC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: RemoteAccess/12][2485 pkts/199101 bytes <-> 1058 pkts/57444 bytes][Goodput ratio: 32/1][16.52 sec][bytes ratio: 0.552 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/10 841/845 31/42][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 80/54 89/88 5/3][Risk: ** Known Proto on Non Std Port **** Desktop/File Sharing **][Risk Score: 60][Risk Info: Found VNC / Expected on port 5900,5901,5800][TCP Fingerprint: 2_128_8192_8df5eacf1616/Unknown][Plen Bins: 88,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 95.237.48.208:51559 <-> 192.168.2.110:6900 [proto: 89/VNC][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: RemoteAccess/12][684 pkts/54893 bytes <-> 324 pkts/17720 bytes][Goodput ratio: 32/1][4.15 sec][bytes ratio: 0.512 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/12 538/501 32/43][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 80/55 89/88 5/4][Risk: ** Known Proto on Non Std Port **** Desktop/File Sharing **][Risk Score: 60][Risk Info: Found VNC / Expected on port 5900,5901,5800][TCP Fingerprint: 2_128_8192_8df5eacf1616/Unknown][Plen Bins: 90,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/vrrp3.pcapng.out b/tests/cfgs/default/result/vrrp3.pcapng.out index 894cea594..e97b466fa 100644 --- a/tests/cfgs/default/result/vrrp3.pcapng.out +++ b/tests/cfgs/default/result/vrrp3.pcapng.out @@ -24,5 +24,7 @@ VRRP 10 820 2 Acceptable 10 820 2 +Network 10 820 2 + 1 VRRP [fe80::1]:0 -> [ff02::12]:0 [VLAN: 36][proto: 73/VRRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 73/VRRP, Confidence: DPI][DPI packets: 1][cat: Network/14][9 pkts/738 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][73.79 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 8603/0 9223/0 10004/0 503/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 82/0 82/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 VRRP [fe80::2]:0 -> [ff02::12]:0 [VLAN: 36][proto: 73/VRRP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 73/VRRP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/82 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/vxlan.pcap.out b/tests/cfgs/default/result/vxlan.pcap.out index f3e44f8a5..8f7f189f7 100644 --- a/tests/cfgs/default/result/vxlan.pcap.out +++ b/tests/cfgs/default/result/vxlan.pcap.out @@ -27,6 +27,9 @@ Facebook 119 84152 2 Acceptable 8 1170 2 Fun 119 84152 2 +SocialNetwork 119 84152 2 +Network 8 1170 2 + JA Host Stats: IP Address # JA4C 1 10.10.20.4 1 diff --git a/tests/cfgs/default/result/wa_video.pcap.out b/tests/cfgs/default/result/wa_video.pcap.out index 67121515a..e321b0ceb 100644 --- a/tests/cfgs/default/result/wa_video.pcap.out +++ b/tests/cfgs/default/result/wa_video.pcap.out @@ -35,6 +35,13 @@ Spotify 1 86 1 Acceptable 780 347731 13 Fun 1 86 1 +Chat 133 20568 1 +VoIP 635 324338 7 +Cloud 2 764 1 +Network 2 684 1 +System 8 1377 3 +Music 1 86 1 + 1 UDP 192.168.2.12:53688 <-> 31.13.86.48:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 119/Facebook][ClearText][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][347 pkts/223797 bytes <-> 146 pkts/24878 bytes][Goodput ratio: 93/75][22.48 sec][bytes ratio: 0.800 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 44/77 2891/3013 278/400][Pkt Len c2s/s2c min/avg/max/stddev: 48/44 645/170 1181/1095 402/174][Mapped IP/Port: 80.180.162.48:53046][PLAIN TEXT (hw3@PydH)][Plen Bins: 11,29,10,5,5,0,0,0,0,0,0,0,0,0,14,0,3,0,0,0,0,0,0,0,0,1,1,0,1,3,2,0,2,4,2,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.12:53688 <-> 91.252.56.51:32641 [proto: 78.45/STUN.WhatsAppCall][IP: 0/Unknown][ClearText][Confidence: DPI (cache)][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][72 pkts/48848 bytes <-> 35 pkts/22821 bytes][Goodput ratio: 94/94][3.05 sec][bytes ratio: 0.363 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 47/19 707/132 139/32][Pkt Len c2s/s2c min/avg/max/stddev: 68/68 678/652 1160/1140 376/376][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (dBXAnF)][Plen Bins: 1,8,0,8,2,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,8,1,5,5,14,2,5,1,8,4,3,1,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.12:49355 <-> 157.240.20.53:5222 [proto: 142/WhatsApp][IP: 142/WhatsApp][Encrypted][Confidence: Match by IP][FPC: 142/WhatsApp, Confidence: IP address][DPI packets: 19][cat: Chat/9][66 pkts/8810 bytes <-> 67 pkts/11758 bytes][Goodput ratio: 50/62][27.94 sec][bytes ratio: -0.143 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 365/429 6456/7033 1181/1216][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 133/175 1454/1454 183/248][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.866 (Encrypted or Random?)][PLAIN TEXT (AaPKuGR)][Plen Bins: 2,50,0,5,13,17,0,0,2,0,0,1,0,0,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0] diff --git a/tests/cfgs/default/result/wa_voice.pcap.out b/tests/cfgs/default/result/wa_voice.pcap.out index 5c6343c89..6b94c0e0e 100644 --- a/tests/cfgs/default/result/wa_voice.pcap.out +++ b/tests/cfgs/default/result/wa_voice.pcap.out @@ -43,6 +43,16 @@ Acceptable 722 169382 25 Fun 2 172 1 Unrated 2 120 1 +Unspecified 2 120 1 +Web 8 542 1 +Download 50 24752 1 +Chat 348 86095 2 +VoIP 261 43719 7 +Cloud 28 9535 2 +Network 27 3916 8 +System 8 1365 5 +Music 2 172 1 + JA Host Stats: IP Address # JA4C 1 192.168.2.12 2 diff --git a/tests/cfgs/default/result/waze.pcap.out b/tests/cfgs/default/result/waze.pcap.out index 8a087b40a..e0ad853cb 100644 --- a/tests/cfgs/default/result/waze.pcap.out +++ b/tests/cfgs/default/result/waze.pcap.out @@ -36,6 +36,12 @@ Safe 21 2574 3 Acceptable 566 355633 29 Unrated 10 786 1 +Unspecified 10 786 1 +Web 533 293481 29 +Download 37 63205 1 +Chat 15 1341 1 +System 2 180 1 + JA Host Stats: IP Address # JA4C 1 10.8.0.1 2 diff --git a/tests/cfgs/default/result/webdav.pcap.out b/tests/cfgs/default/result/webdav.pcap.out index dd779127d..b75d19947 100644 --- a/tests/cfgs/default/result/webdav.pcap.out +++ b/tests/cfgs/default/result/webdav.pcap.out @@ -24,6 +24,8 @@ WebDAV 92 22025 8 Acceptable 92 22025 8 +Collaborative 92 22025 8 + 1 TCP 192.168.16.173:35612 <-> 198.244.151.63:80 [proto: 7.376/HTTP.WebDAV][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Collaborative/15][8 pkts/1196 bytes <-> 4 pkts/2599 bytes][Goodput ratio: 55/89][0.11 sec][Hostname/SNI: www.dlp-test.com][bytes ratio: -0.370 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/26 13/27 28/28 13/1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 150/650 572/1614 167/640][URL: www.dlp-test.com/webdav][StatusCode: 401][Content-Type: text/html][Server: Microsoft-HTTPAPI/2.0][User-Agent: curl/7.68.0][Risk: ** Error Code **][Risk Score: 10][Risk Info: HTTP Error Code 401][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (MKCOL /webdav HTTP/1.1)][Plen Bins: 0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25] 2 TCP 192.168.16.173:47726 <-> 198.244.151.63:80 [proto: 7.376/HTTP.WebDAV][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Collaborative/15][7 pkts/1136 bytes <-> 4 pkts/2468 bytes][Goodput ratio: 59/89][0.11 sec][Hostname/SNI: www.dlp-test.com][bytes ratio: -0.370 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/26 16/26 28/27 13/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 162/617 575/1483 177/592][URL: www.dlp-test.com/webdav][StatusCode: 401][Content-Type: text/html][Server: Microsoft-HTTPAPI/2.0][User-Agent: curl/7.68.0][Risk: ** Error Code **][Risk Score: 10][Risk Info: HTTP Error Code 401][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (PROPFIND /webdav HTTP/1.1)][Plen Bins: 0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0] 3 TCP 10.24.8.189:50652 <-> 104.156.149.6:80 [proto: 7.376/HTTP.WebDAV][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Collaborative/15][7 pkts/727 bytes <-> 7 pkts/2015 bytes][Goodput ratio: 46/81][5.07 sec][Hostname/SNI: 104.156.149.6][bytes ratio: -0.470 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 22/8 67/20 24/9][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 104/288 223/1107 75/390][URL: 104.156.149.6/webdav][StatusCode: 301][Content-Type: text/html][Server: Apache/2.4.52 (Ubuntu)][User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045][Risk: ** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 10][Risk Info: Found host 104.156.149.6][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (PROPFIND /webdav HTTP/1.1)][Plen Bins: 0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/webex.pcap.out b/tests/cfgs/default/result/webex.pcap.out index b48dbc967..017f337a4 100644 --- a/tests/cfgs/default/result/webex.pcap.out +++ b/tests/cfgs/default/result/webex.pcap.out @@ -34,6 +34,10 @@ Webex 790 500686 30 Safe 259 29507 23 Acceptable 851 525599 34 +Web 281 32689 25 +VoIP 812 516042 31 +Advertisement 17 6375 1 + JA Host Stats: IP Address # JA4C 1 10.8.0.1 6 diff --git a/tests/cfgs/default/result/websocket-chisel-ssh.pcap.out b/tests/cfgs/default/result/websocket-chisel-ssh.pcap.out index 87e1fd3ae..5062422e8 100644 --- a/tests/cfgs/default/result/websocket-chisel-ssh.pcap.out +++ b/tests/cfgs/default/result/websocket-chisel-ssh.pcap.out @@ -24,5 +24,7 @@ WebSocket 9 1243 2 Acceptable 9 1243 2 +Web 9 1243 2 + 1 TCP 172.18.82.242:41986 <-> 172.18.82.243:80 [proto: 7.251/HTTP.WebSocket][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][3 pkts/429 bytes <-> 4 pkts/477 bytes][Goodput ratio: 52/43][0.52 sec][Hostname/SNI: something1.tld][bytes ratio: -0.053 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 106/102 213/307 106/145][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 143/119 289/247 103/74][StatusCode: 101][Server: nginx][User-Agent: Go-http-client/1.1][Risk: ** Obfuscated Traffic **][Risk Score: 100][Risk Info: Obfuscated SSH-in-HTTP-WebSocket traffic][TCP Fingerprint: 2_64_65500_c9121a61c67d/Unknown][PLAIN TEXT (GET / H)][Plen Bins: 33,0,0,0,0,33,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.18.82.243:80 -> 172.18.82.242:51634 [proto: 7.251/HTTP.WebSocket][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7.251/HTTP.WebSocket, Confidence: DPI][DPI packets: 2][cat: Web/5][2 pkts/337 bytes -> 0 pkts/0 bytes][Goodput ratio: 61/0][< 1 sec][StatusCode: 101][Server: nginx][Risk: ** HTTP Susp User-Agent **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No client to server traffic / Empty or missing User-Agent][PLAIN TEXT (HTTP/1.1 101 Switching Protocol)][Plen Bins: 50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/websocket.pcap.out b/tests/cfgs/default/result/websocket.pcap.out index 1c4321511..6f81295fb 100644 --- a/tests/cfgs/default/result/websocket.pcap.out +++ b/tests/cfgs/default/result/websocket.pcap.out @@ -24,4 +24,6 @@ WebSocket 5 441 1 Acceptable 5 441 1 +Web 5 441 1 + 1 TCP 192.168.43.135:12345 <-> 192.168.43.1:50999 [proto: 251/WebSocket][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 251/WebSocket, Confidence: DPI][DPI packets: 1][cat: Web/5][3 pkts/294 bytes <-> 2 pkts/147 bytes][Goodput ratio: 45/26][77.63 sec][PLAIN TEXT (Welcome)][Plen Bins: 60,40,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/wechat.pcap.out b/tests/cfgs/default/result/wechat.pcap.out index c7658153c..ac2edf9ab 100644 --- a/tests/cfgs/default/result/wechat.pcap.out +++ b/tests/cfgs/default/result/wechat.pcap.out @@ -47,6 +47,12 @@ Acceptable 360 48810 53 Fun 1004 528540 27 Dangerous 3 751 1 +Web 452 114638 34 +Chat 1004 528540 27 +Network 190 17651 38 +Collaborative 13 4812 1 +System 13 1669 3 + JA Host Stats: IP Address # JA4C 1 192.168.1.103 3 diff --git a/tests/cfgs/default/result/weibo.pcap.out b/tests/cfgs/default/result/weibo.pcap.out index 9f8469019..6be8d7d5e 100644 --- a/tests/cfgs/default/result/weibo.pcap.out +++ b/tests/cfgs/default/result/weibo.pcap.out @@ -36,6 +36,10 @@ Safe 23 1578 15 Acceptable 58 7507 19 Fun 417 258470 10 +Web 60 6820 22 +SocialNetwork 417 258470 10 +Network 21 2265 12 + JA Host Stats: IP Address # JA4C 1 192.168.1.105 1 diff --git a/tests/cfgs/default/result/whatsapp.pcap.out b/tests/cfgs/default/result/whatsapp.pcap.out index 6372db203..c31b4377d 100644 --- a/tests/cfgs/default/result/whatsapp.pcap.out +++ b/tests/cfgs/default/result/whatsapp.pcap.out @@ -24,6 +24,8 @@ WhatsApp 679 96293 86 Acceptable 679 96293 86 +Chat 679 96293 86 + 1 TCP 192.168.2.100:49026 -> 179.60.195.33:5222 [proto: 142/WhatsApp][IP: 119/Facebook][Encrypted][Confidence: DPI][FPC: 119/Facebook, Confidence: IP address][DPI packets: 4][cat: Chat/9][8 pkts/3049 bytes -> 0 pkts/0 bytes][Goodput ratio: 82/0][0.19 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 28/0 125/0 41/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 381/0 1315/0 539/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_65535_685ad951a756/Android][Plen Bins: 60,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,40,0,0,0,0,0,0,0,0] 2 TCP 192.168.2.100:44804 -> 179.60.195.49:5222 [proto: 142/WhatsApp][IP: 142/WhatsApp][Encrypted][Confidence: DPI][FPC: 142/WhatsApp, Confidence: IP address][DPI packets: 4][cat: Chat/9][9 pkts/2139 bytes -> 0 pkts/0 bytes][Goodput ratio: 72/0][0.33 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 42/0 131/0 41/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 238/0 1090/0 319/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_65535_685ad951a756/Android][Plen Bins: 40,0,0,0,0,0,20,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.100:40108 -> 179.60.195.33:5222 [proto: 142/WhatsApp][IP: 119/Facebook][Encrypted][Confidence: DPI][FPC: 119/Facebook, Confidence: IP address][DPI packets: 4][cat: Chat/9][9 pkts/1919 bytes -> 0 pkts/0 bytes][Goodput ratio: 69/0][0.28 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 35/0 224/0 72/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 213/0 1324/0 393/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_65535_685ad951a756/Android][Plen Bins: 60,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/whatsapp_login_call.pcap.out b/tests/cfgs/default/result/whatsapp_login_call.pcap.out index dd667c203..afa9a21e0 100644 --- a/tests/cfgs/default/result/whatsapp_login_call.pcap.out +++ b/tests/cfgs/default/result/whatsapp_login_call.pcap.out @@ -45,6 +45,15 @@ Safe 196 50522 22 Acceptable 1052 142326 34 Fun 3 258 1 +Email 17 1998 1 +Web 105 21163 22 +Chat 180 24874 1 +VoIP 803 102942 20 +Cloud 26 8102 2 +Network 32 5682 8 +SoftwareUpdate 85 28087 2 +Music 3 258 1 + JA Host Stats: IP Address # JA4C 1 192.168.2.4 1 diff --git a/tests/cfgs/default/result/whatsapp_login_chat.pcap.out b/tests/cfgs/default/result/whatsapp_login_chat.pcap.out index bebe34efd..343fe1fc5 100644 --- a/tests/cfgs/default/result/whatsapp_login_chat.pcap.out +++ b/tests/cfgs/default/result/whatsapp_login_chat.pcap.out @@ -33,6 +33,12 @@ Safe 50 23466 2 Acceptable 42 6585 6 Fun 1 86 1 +Web 50 23466 2 +Chat 30 2963 1 +Cloud 2 1088 1 +Network 10 2534 4 +Music 1 86 1 + 1 TCP 192.168.2.4:49205 <-> 17.173.66.102:443 [proto: 91/TLS][IP: 140/Apple][Encrypted][Confidence: DPI][FPC: 140/Apple, Confidence: IP address][DPI packets: 6][cat: Web/5][24 pkts/15117 bytes <-> 20 pkts/6254 bytes][Goodput ratio: 91/83][3.89 sec][bytes ratio: 0.415 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 180/27 2803/212 622/57][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 630/313 1494/1002 544/370][Plen Bins: 0,0,4,0,0,0,0,0,0,0,16,0,0,0,8,4,0,16,0,0,0,0,4,0,0,0,0,0,0,16,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,16,0,0] 2 TCP 192.168.2.4:49206 <-> 158.85.58.15:5222 [proto: 142/WhatsApp][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Chat/9][17 pkts/1794 bytes <-> 13 pkts/1169 bytes][Goodput ratio: 37/26][19.72 sec][bytes ratio: 0.211 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/10 1371/2066 10513/10479 2988/3556][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 106/90 267/144 68/22][TCP Fingerprint: 2_64_65535_09b18f059744/macOS][PLAIN TEXT (iPhone)][Plen Bins: 21,50,7,0,0,14,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 17.110.229.14:5223 -> 192.168.2.4:49193 [proto: 91/TLS][IP: 140/Apple][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 6][cat: Web/5][6 pkts/2095 bytes -> 0 pkts/0 bytes][Goodput ratio: 81/0][20.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 659/0 4000/0 10199/0 3476/0][Pkt Len c2s/s2c min/avg/max/stddev: 220/0 349/0 375/0 58/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 443][Plen Bins: 0,0,0,0,16,0,0,0,0,83,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/whatsapp_voice_and_message.pcap.out b/tests/cfgs/default/result/whatsapp_voice_and_message.pcap.out index dc3df2b5b..ebb0ad2bd 100644 --- a/tests/cfgs/default/result/whatsapp_voice_and_message.pcap.out +++ b/tests/cfgs/default/result/whatsapp_voice_and_message.pcap.out @@ -26,6 +26,9 @@ WhatsApp 217 22139 5 Acceptable 261 28055 13 +Chat 217 22139 5 +VoIP 44 5916 8 + 1 TCP 10.8.0.1:42241 <-> 173.192.222.189:5222 [proto: 142/WhatsApp][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Chat/9][30 pkts/2539 bytes <-> 32 pkts/3070 bytes][Goodput ratio: 35/44][47.83 sec][bytes ratio: -0.095 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1858/1709 28667/28718 5783/5581][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 85/96 299/559 55/94][TCP Fingerprint: 2_64_14600_38c452335ffe/Unknown][PLAIN TEXT (Android)][Plen Bins: 47,21,7,3,7,7,0,3,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.8.0.1:35480 <-> 184.173.179.46:443 [proto: 142/WhatsApp][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Chat/9][24 pkts/3029 bytes <-> 22 pkts/1961 bytes][Goodput ratio: 57/39][13.49 sec][bytes ratio: 0.214 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 681/812 10696/10748 2366/2570][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 126/89 590/469 124/92][TCP Fingerprint: 2_64_14600_38c452335ffe/Unknown][PLAIN TEXT (Android)][Plen Bins: 21,10,37,5,0,10,0,0,0,0,0,5,5,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 10.8.0.1:44819 <-> 158.85.58.42:5222 [proto: 142/WhatsApp][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Chat/9][15 pkts/2690 bytes <-> 15 pkts/2019 bytes][Goodput ratio: 69/60][8.61 sec][bytes ratio: 0.142 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 717/767 8044/4043 2210/1535][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 179/135 590/1022 203/241][TCP Fingerprint: 2_64_14600_38c452335ffe/Unknown][PLAIN TEXT (Android)][Plen Bins: 36,0,0,9,9,9,0,0,0,0,0,0,0,0,0,0,27,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/whatsappfiles.pcap.out b/tests/cfgs/default/result/whatsappfiles.pcap.out index f584bf06a..7b69b1a35 100644 --- a/tests/cfgs/default/result/whatsappfiles.pcap.out +++ b/tests/cfgs/default/result/whatsappfiles.pcap.out @@ -24,6 +24,8 @@ WhatsAppFiles 620 452233 2 Acceptable 620 452233 2 +Download 620 452233 2 + JA Host Stats: IP Address # JA4C 1 192.168.2.29 2 diff --git a/tests/cfgs/default/result/whois.pcapng.out b/tests/cfgs/default/result/whois.pcapng.out index fe64f845e..ec4fe3cf1 100644 --- a/tests/cfgs/default/result/whois.pcapng.out +++ b/tests/cfgs/default/result/whois.pcapng.out @@ -29,6 +29,9 @@ Whois-DAS 16 4294 2 Safe 7 2046 1 Acceptable 16 4294 2 +Web 7 2046 1 +Network 16 4294 2 + JA Host Stats: IP Address # JA4C 1 10.17.34.139 1 diff --git a/tests/cfgs/default/result/windowsupdate_over_http.pcap.out b/tests/cfgs/default/result/windowsupdate_over_http.pcap.out index 5c743d069..3480fbe49 100644 --- a/tests/cfgs/default/result/windowsupdate_over_http.pcap.out +++ b/tests/cfgs/default/result/windowsupdate_over_http.pcap.out @@ -24,4 +24,6 @@ WindowsUpdate 20 15975 1 Safe 20 15975 1 +Download 20 15975 1 + 1 TCP 10.0.2.15:49815 <-> 151.99.72.125:80 [proto: 7.147/HTTP.WindowsUpdate][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Download/7][8 pkts/923 bytes <-> 12 pkts/15052 bytes][Goodput ratio: 52/96][0.02 sec][Hostname/SNI: 151.99.72.125][bytes ratio: -0.884 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2/1 9/8 4/2][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 115/1254 533/1514 158/536][URL: 151.99.72.125/data/0783dedfb62fa709/msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d1d060c0-7ece-4b96-9558-4bd0f2326040?P1=1652084683&P2=404&P3=2&P4=GtXnDMvssaTVZE%2bliGRNZPdTCGZcdK3lsfQhBycGI5on2dyQK7mRzg%2fAP%2fOuVTebtfWU%2bfL%2bVp][StatusCode: 206][Content-Type: application/octet-stream][Server: nginx][User-Agent: Microsoft-Delivery-Optimization/10.0][Risk: ** HTTP/TLS/QUIC Numeric Hostname/SNI **** Binary File/Data Transfer (Attempt) **][Risk Score: 60][Risk Info: Found binary mime octet-stream / Found host 151.99.72.125][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (GET /data/0783dedfb)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,18,72,0,0] diff --git a/tests/cfgs/default/result/windscribe.pcapng.out b/tests/cfgs/default/result/windscribe.pcapng.out index b73c31326..2284846a9 100644 --- a/tests/cfgs/default/result/windscribe.pcapng.out +++ b/tests/cfgs/default/result/windscribe.pcapng.out @@ -24,6 +24,8 @@ Windscribe 24 9582 1 Acceptable 24 9582 1 +VPN 24 9582 1 + JA Host Stats: IP Address # JA4C 1 192.168.12.156 1 diff --git a/tests/cfgs/default/result/wireguard.pcap.out b/tests/cfgs/default/result/wireguard.pcap.out index 4eb2a78b0..fcc8770d5 100644 --- a/tests/cfgs/default/result/wireguard.pcap.out +++ b/tests/cfgs/default/result/wireguard.pcap.out @@ -24,5 +24,7 @@ WireGuard 52 12740 2 Acceptable 52 12740 2 +VPN 52 12740 2 + 1 UDP 139.162.192.157:51820 <-> 192.168.0.14:36116 [proto: 206/WireGuard][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: VPN/2][18 pkts/5428 bytes <-> 12 pkts/2568 bytes][Goodput ratio: 86/80][9.40 sec][bytes ratio: 0.358 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 414/661 5525/5525 1367/1721][Pkt Len c2s/s2c min/avg/max/stddev: 138/138 302/214 842/314 223/80][Plen Bins: 0,0,0,41,23,0,0,0,16,3,3,0,0,0,0,0,3,0,0,3,3,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 10.9.0.1:43462 <-> 10.9.0.2:51820 [proto: 206/WireGuard][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: VPN/2][12 pkts/3100 bytes <-> 10 pkts/1644 bytes][Goodput ratio: 84/74][140.28 sec][bytes ratio: 0.307 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1369/17528 10176/138081 3139/45567][Pkt Len c2s/s2c min/avg/max/stddev: 74/122 258/164 1494/330 375/58][Plen Bins: 0,9,22,18,41,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0] diff --git a/tests/cfgs/default/result/xdmcp.pcap.out b/tests/cfgs/default/result/xdmcp.pcap.out index 72c8506a1..4fa666281 100644 --- a/tests/cfgs/default/result/xdmcp.pcap.out +++ b/tests/cfgs/default/result/xdmcp.pcap.out @@ -24,4 +24,6 @@ XDMCP 6 598 1 Acceptable 6 598 1 +RemoteAccess 6 598 1 + 1 UDP 10.1.2.2:61426 <-> 10.1.2.4:177 [proto: 15/XDMCP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 15/XDMCP, Confidence: DPI][DPI packets: 1][cat: RemoteAccess/12][4 pkts/433 bytes <-> 2 pkts/165 bytes][Goodput ratio: 59/49][3.02 sec][bytes ratio: 0.448 (Upload)][IAT c2s/s2c min/avg/max/stddev: 5/144 1006/144 1992/144 811/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/71 108/82 231/94 71/12][PLAIN TEXT (COOKIEg to manag)][Plen Bins: 67,16,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/xiaomi.pcap.out b/tests/cfgs/default/result/xiaomi.pcap.out index 9818ff6f2..4aab9c1db 100644 --- a/tests/cfgs/default/result/xiaomi.pcap.out +++ b/tests/cfgs/default/result/xiaomi.pcap.out @@ -24,6 +24,8 @@ Xiaomi 52 11467 7 Acceptable 52 11467 7 +Web 52 11467 7 + 1 TCP 192.168.2.100:45106 <-> 18.193.233.122:5222 [proto: 287/Xiaomi][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Web/5][8 pkts/2061 bytes <-> 7 pkts/1063 bytes][Goodput ratio: 74/56][359.14 sec][Hostname/SNI: fr-app-chat-global-xiaomi-net2-2117517874.eu-central-1.elb.amazonaws.com][bytes ratio: 0.319 (Upload)][IAT c2s/s2c min/avg/max/stddev: 7/1 59816/100 358553/211 133599/79][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 258/152 1014/488 311/142][User-Agent: Redmi Note 8T][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 5.758 (Executable?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (xiaomi.com)][Plen Bins: 14,0,14,14,0,0,14,0,0,0,14,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.2.100:37708 <-> 3.127.176.74:5222 [proto: 287/Xiaomi][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Web/5][8 pkts/1983 bytes <-> 7 pkts/641 bytes][Goodput ratio: 73/27][455.15 sec][Hostname/SNI: fr-app-chat-global-xiaomi-net1-1667981913.eu-central-1.elb.amazonaws.com][bytes ratio: 0.511 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 75808/90740 453408/453409 168869/181335][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 248/92 999/171 303/39][User-Agent: Redmi Note 9 Pro][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 5.872 (Executable?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (xiaomi.com)][Plen Bins: 16,0,16,16,0,0,0,16,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 115.164.74.232:5222 <-> 192.168.247.13:38018 [proto: 287/Xiaomi][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: Web/5][4 pkts/456 bytes <-> 3 pkts/1283 bytes][Goodput ratio: 40/85][149.32 sec][Hostname/SNI: 47.241.35.73][bytes ratio: -0.476 (Download)][IAT c2s/s2c min/avg/max/stddev: 143/153 49772/74586 149015/149020 70175/74434][Pkt Len c2s/s2c min/avg/max/stddev: 74/78 114/428 172/980 41/395][User-Agent: M2010J19SG][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 5.561 (Executable?)][PLAIN TEXT (xiaomi.com)][Plen Bins: 34,0,16,16,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/xss.pcap.out b/tests/cfgs/default/result/xss.pcap.out index e188e1516..d9e9aa66a 100644 --- a/tests/cfgs/default/result/xss.pcap.out +++ b/tests/cfgs/default/result/xss.pcap.out @@ -27,5 +27,7 @@ HTTP 11 3209 2 Acceptable 11 3209 2 +Web 11 3209 2 + 1 TCP 192.168.3.109:53514 <-> 192.168.3.107:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][4 pkts/880 bytes <-> 4 pkts/2115 bytes][Goodput ratio: 69/87][0.01 sec][Hostname/SNI: 192.168.3.107][bytes ratio: -0.412 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 3/2 5/4 2/2][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 220/529 674/1514 262/591][URL: 192.168.3.107/DVWA-master/vulnerabilities/xss_d/?default=English%3Cscript%3Ealert(1)%3C/script%3E][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.41 (Ubuntu)][User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36][Risk: ** XSS Attack **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 160][Risk Info: Found host 192.168.3.107 / Suspicious URL [/DVWA-master/vulnerabilities/xss_d/?default=English%3Cscript%3Ealert(1)%3C/script%3][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (FGET /DVWA)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0] 2 TCP 192.168.3.109:53516 <-> 192.168.3.107:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: Web/5][2 pkts/140 bytes <-> 1 pkts/74 bytes][Goodput ratio: 0/0][0.00 sec][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/yandex.pcapng.out b/tests/cfgs/default/result/yandex.pcapng.out index f2ae78078..e7671c58e 100644 --- a/tests/cfgs/default/result/yandex.pcapng.out +++ b/tests/cfgs/default/result/yandex.pcapng.out @@ -33,6 +33,13 @@ Safe 94 40622 7 Fun 18 8243 1 Tracker_Ads 18 8718 1 +Email 11 3137 1 +Web 36 12950 3 +Cloud 36 20647 2 +Music 18 8243 1 +Shopping 11 3888 1 +Advertisement 18 8718 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.249 1 diff --git a/tests/cfgs/default/result/yojimbo.pcap.out b/tests/cfgs/default/result/yojimbo.pcap.out index 64116365a..6756cd47a 100644 --- a/tests/cfgs/default/result/yojimbo.pcap.out +++ b/tests/cfgs/default/result/yojimbo.pcap.out @@ -24,4 +24,6 @@ Yojimbo 1 1120 1 Fun 1 1120 1 +Game 1 1120 1 + 1 UDP 127.0.0.1:34638 -> 127.0.0.1:40000 [proto: 388/Yojimbo][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 388/Yojimbo, Confidence: DPI][DPI packets: 1][cat: Game/8][1 pkts/1120 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (NETCODE 1.02)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/youtube_quic.pcap.out b/tests/cfgs/default/result/youtube_quic.pcap.out index 87eb13a61..7af2856a0 100644 --- a/tests/cfgs/default/result/youtube_quic.pcap.out +++ b/tests/cfgs/default/result/youtube_quic.pcap.out @@ -26,6 +26,9 @@ Google 31 13144 2 Acceptable 31 13144 2 Fun 258 178495 1 +Media 258 178495 1 +Advertisement 31 13144 2 + 1 UDP 192.168.1.7:56074 <-> 216.58.198.33:443 [proto: 188.124/QUIC.YouTube][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 188.124/QUIC.YouTube, Confidence: DPI][DPI packets: 1][cat: Media/1][113 pkts/16111 bytes <-> 145 pkts/162384 bytes][Goodput ratio: 71/96][3.12 sec][Hostname/SNI: yt3.ggpht.com][bytes ratio: -0.819 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/5 70/69 15/12][Pkt Len c2s/s2c min/avg/max/stddev: 77/73 143/1120 1392/1392 176/437][QUIC ver: Q035][Idle Timeout: 30][PLAIN TEXT (yt3.ggpht.com)][Plen Bins: 0,31,1,12,8,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,1,1,0,0,41,0,0,0,0,0] 2 UDP 192.168.1.7:53859 <-> 216.58.205.66:443 [proto: 188.126/QUIC.Google][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 188.126/QUIC.Google, Confidence: DPI][DPI packets: 1][cat: Advertisement/101][9 pkts/3929 bytes <-> 9 pkts/4736 bytes][Goodput ratio: 90/92][0.44 sec][Hostname/SNI: googleads.g.doubleclick.net][bytes ratio: -0.093 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5 36/37 114/158 48/52][Pkt Len c2s/s2c min/avg/max/stddev: 80/69 437/526 1392/1392 524/546][QUIC ver: Q035][Idle Timeout: 30][PLAIN TEXT (googleads.g.doubleclick.net)][Plen Bins: 16,39,0,0,0,0,0,0,0,5,5,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,22,0,0,0,0,0] 3 UDP 192.168.1.7:54997 <-> 216.58.205.66:443 [proto: 188.126/QUIC.Google][IP: 126/Google][Encrypted][Confidence: DPI][FPC: 188.126/QUIC.Google, Confidence: DPI][DPI packets: 1][cat: Advertisement/101][7 pkts/2312 bytes <-> 6 pkts/2167 bytes][Goodput ratio: 87/88][0.56 sec][Hostname/SNI: pagead2.googlesyndication.com][bytes ratio: 0.032 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/8 40/17 89/44 35/17][Pkt Len c2s/s2c min/avg/max/stddev: 80/72 330/361 1392/1392 449/479][QUIC ver: Q035][Idle Timeout: 30][PLAIN TEXT (pagead2.googlesyndication.com)][Plen Bins: 23,30,7,0,7,0,0,0,0,0,0,0,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,15,0,0,0,0,0] diff --git a/tests/cfgs/default/result/youtubeupload.pcap.out b/tests/cfgs/default/result/youtubeupload.pcap.out index c3728f4f3..cde3c6b32 100644 --- a/tests/cfgs/default/result/youtubeupload.pcap.out +++ b/tests/cfgs/default/result/youtubeupload.pcap.out @@ -25,6 +25,8 @@ YouTubeUpload 137 127038 3 Fun 137 127038 3 +Media 137 127038 3 + JA Host Stats: IP Address # JA4C 1 192.168.2.27 1 diff --git a/tests/cfgs/default/result/z3950.pcapng.out b/tests/cfgs/default/result/z3950.pcapng.out index 8bc01cbe2..24ab25a18 100644 --- a/tests/cfgs/default/result/z3950.pcapng.out +++ b/tests/cfgs/default/result/z3950.pcapng.out @@ -27,5 +27,7 @@ Z3950 31 6308 2 Acceptable 31 6308 2 +Network 31 6308 2 + 1 TCP 192.168.2.100:58921 <-> 193.174.240.93:210 [proto: 260/Z3950][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 15][cat: Network/14][7 pkts/623 bytes <-> 8 pkts/4374 bytes][Goodput ratio: 37/90][1.55 sec][bytes ratio: -0.751 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 293/29 1341/73 524/28][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 89/547 170/1506 44/623][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (p.5.4.1 12b)][Plen Bins: 25,0,25,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0] 2 TCP 192.168.0.20:46524 <-> 129.187.139.43:9991 [proto: 260/Z3950][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 11][cat: Network/14][10 pkts/764 bytes <-> 6 pkts/547 bytes][Goodput ratio: 28/36][76.54 sec][bytes ratio: 0.166 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/2 1539/3022 9007/9037 3003/4253][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 76/91 138/167 32/37][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 210][TCP Fingerprint: 2_192_64240_565ad129ac37/Unknown][PLAIN TEXT (p/5.27.1 872b)][Plen Bins: 0,50,33,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/zabbix.pcap.out b/tests/cfgs/default/result/zabbix.pcap.out index ced49f6e3..091149371 100644 --- a/tests/cfgs/default/result/zabbix.pcap.out +++ b/tests/cfgs/default/result/zabbix.pcap.out @@ -24,6 +24,8 @@ Zabbix 236 24571 24 Acceptable 236 24571 24 +Network 236 24571 24 + 1 TCP 192.168.7.16:36699 <-> 192.168.7.17:10051 [proto: 248/Zabbix][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][5 pkts/429 bytes <-> 5 pkts/1083 bytes][Goodput ratio: 21/69][0.00 sec][bytes ratio: -0.433 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/1 2/2 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 86/217 157/811 36/297][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.7.16:60217 <-> 192.168.7.17:10051 [proto: 248/Zabbix][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][5 pkts/429 bytes <-> 5 pkts/1083 bytes][Goodput ratio: 21/69][0.00 sec][bytes ratio: -0.433 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/1 2/2 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 86/217 157/811 36/297][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.7.16:50639 <-> 192.168.7.17:10051 [proto: 248/Zabbix][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][5 pkts/669 bytes <-> 5 pkts/436 bytes][Goodput ratio: 49/22][0.00 sec][bytes ratio: 0.211 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 134/87 397/164 132/39][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,0,50,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/zattoo.pcap.out b/tests/cfgs/default/result/zattoo.pcap.out index e6aaef1df..ea29cbafa 100644 --- a/tests/cfgs/default/result/zattoo.pcap.out +++ b/tests/cfgs/default/result/zattoo.pcap.out @@ -24,6 +24,8 @@ Zattoo 32 13467 2 Fun 32 13467 2 +Video 32 13467 2 + JA Host Stats: IP Address # JA4C 1 10.101.0.2 1 diff --git a/tests/cfgs/default/result/zeromq.pcapng.out b/tests/cfgs/default/result/zeromq.pcapng.out index 2f364993f..f0d078071 100644 --- a/tests/cfgs/default/result/zeromq.pcapng.out +++ b/tests/cfgs/default/result/zeromq.pcapng.out @@ -24,4 +24,6 @@ ZeroMQ 44 3295 1 Acceptable 44 3295 1 +RPC 44 3295 1 + 1 TCP 127.0.0.1:47638 <-> 127.0.0.1:5555 [proto: 177/ZeroMQ][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][18 pkts/1390 bytes <-> 26 pkts/1905 bytes][Goodput ratio: 14/9][10.00 sec][bytes ratio: -0.156 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 538/448 1000/1000 499/495][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 77/73 120/119 15/11][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][PLAIN TEXT (Socket)][Plen Bins: 88,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/zmap.pcap.out b/tests/cfgs/default/result/zmap.pcap.out index 91b654aab..138235273 100644 --- a/tests/cfgs/default/result/zmap.pcap.out +++ b/tests/cfgs/default/result/zmap.pcap.out @@ -26,6 +26,8 @@ HTTP 10 540 10 Acceptable 10 540 10 +Web 10 540 10 + 1 TCP 192.168.2.61:36368 -> 192.168.2.237:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/54 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Malicious Fingerpint **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No server to client traffic / Massive scanner detected (probably zmap)][TCP Fingerprint: 2_255_65535_e3b0c44298fc/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.2.61:38482 -> 192.168.2.4:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/54 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Malicious Fingerpint **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No server to client traffic / Massive scanner detected (probably zmap)][TCP Fingerprint: 2_255_65535_e3b0c44298fc/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.61:40049 -> 192.168.2.41:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/54 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Malicious Fingerpint **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No server to client traffic / Massive scanner detected (probably zmap)][TCP Fingerprint: 2_255_65535_e3b0c44298fc/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/zoom.pcap.out b/tests/cfgs/default/result/zoom.pcap.out index 648ae6df0..7a8833af2 100644 --- a/tests/cfgs/default/result/zoom.pcap.out +++ b/tests/cfgs/default/result/zoom.pcap.out @@ -43,6 +43,13 @@ Safe 40 11444 4 Acceptable 737 370956 29 Fun 1 86 1 +Email 2 226 1 +Web 28 8965 4 +Network 37 5926 11 +System 4 498 2 +Music 1 86 1 +Video 706 366785 15 + JA Host Stats: IP Address # JA4C 1 192.168.1.117 4 diff --git a/tests/cfgs/default/result/zoom2.pcap.out b/tests/cfgs/default/result/zoom2.pcap.out index 96bdd386a..1900d5892 100644 --- a/tests/cfgs/default/result/zoom2.pcap.out +++ b/tests/cfgs/default/result/zoom2.pcap.out @@ -25,6 +25,8 @@ Zoom 342 112658 4 Acceptable 342 112658 4 +Video 342 112658 4 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 1 diff --git a/tests/cfgs/default/result/zoom_p2p.pcapng.out b/tests/cfgs/default/result/zoom_p2p.pcapng.out index a7af88a91..2b5be45fd 100644 --- a/tests/cfgs/default/result/zoom_p2p.pcapng.out +++ b/tests/cfgs/default/result/zoom_p2p.pcapng.out @@ -28,6 +28,10 @@ Zoom 691 262429 8 Acceptable 763 271804 12 +Cloud 16 2784 1 +Network 56 6591 3 +Video 691 262429 8 + 1 UDP 192.168.12.156:39065 <-> 192.168.1.226:46757 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 5][cat: Video/26][148 pkts/108673 bytes <-> 174 pkts/110457 bytes][Goodput ratio: 94/93][1.67 sec][bytes ratio: -0.008 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/8 88/71 15/12][Pkt Len c2s/s2c min/avg/max/stddev: 127/98 734/635 1269/1302 277/371][PLAIN TEXT (192.168.1.226)][Plen Bins: 0,0,9,1,0,0,0,6,1,0,0,0,0,2,5,11,10,5,4,4,2,0,0,1,2,2,0,0,0,0,0,1,16,0,0,0,3,1,5,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.156:49579 -> 10.78.14.178:49586 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 5][cat: Video/26][154 pkts/19404 bytes -> 0 pkts/0 bytes][Goodput ratio: 67/0][4.51 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 28/0 82/0 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 126/0 126/0 126/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (10.78.14.178)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.156:42208 -> 10.78.14.178:47312 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 5][cat: Video/26][130 pkts/16380 bytes -> 0 pkts/0 bytes][Goodput ratio: 67/0][2.24 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 18/0 82/0 18/0][Pkt Len c2s/s2c min/avg/max/stddev: 126/0 126/0 126/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (10.78.14.178)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/zug.pcap.out b/tests/cfgs/default/result/zug.pcap.out index 6f3ae607c..384a15667 100644 --- a/tests/cfgs/default/result/zug.pcap.out +++ b/tests/cfgs/default/result/zug.pcap.out @@ -27,6 +27,9 @@ ZUG 6 984 6 Acceptable 6 984 6 Unrated 1 452 1 +Unspecified 1 452 1 +Crypto_Currency 6 984 6 + 1 UDP 52.104.45.69:44174 -> 53.52.158.15:19000 [proto: 415/ZUG][IP: 221/MS_OneDrive][Encrypted][Confidence: DPI][FPC: 415/ZUG, Confidence: DPI][DPI packets: 1][cat: Crypto_Currency/106][1 pkts/164 bytes -> 0 pkts/0 bytes][Goodput ratio: 74/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 74.90.102.55:44370 -> 17.218.251.92:19000 [proto: 415/ZUG][IP: 140/Apple][Encrypted][Confidence: DPI][FPC: 415/ZUG, Confidence: DPI][DPI packets: 1][cat: Crypto_Currency/106][1 pkts/164 bytes -> 0 pkts/0 bytes][Goodput ratio: 74/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 117.220.197.41:37556 -> 44.22.132.225:19000 [proto: 415/ZUG][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 415/ZUG, Confidence: DPI][DPI packets: 1][cat: Crypto_Currency/106][1 pkts/164 bytes -> 0 pkts/0 bytes][Goodput ratio: 74/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out b/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out index 1d2546dc0..9a122bbd0 100644 --- a/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out +++ b/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out @@ -28,6 +28,9 @@ Ookla 84 15245 5 Safe 113 38411 6 +Web 29 23166 1 +Network 84 15245 5 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 2 diff --git a/tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out b/tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out index 4ec73a287..ca31d733a 100644 --- a/tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out +++ b/tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out @@ -26,4 +26,6 @@ Google 2 262 1 Acceptable 2 262 1 +Web 2 262 1 + 1 UDP 192.168.1.168:65311 <-> 8.8.8.8:53 [proto: 126/Google][IP: 126/Google][Encrypted][Confidence: Match by IP][FPC: 126/Google, Confidence: IP address][DPI packets: 2][cat: Web/5][1 pkts/103 bytes <-> 1 pkts/159 bytes][Goodput ratio: 59/73][0.02 sec][PLAIN TEXT (fhkfhsdkfhsk)][Plen Bins: 0,50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/disable_protocols/result/esp.pcapng.out b/tests/cfgs/disable_protocols/result/esp.pcapng.out index 2c0fbca97..7c284145d 100644 --- a/tests/cfgs/disable_protocols/result/esp.pcapng.out +++ b/tests/cfgs/disable_protocols/result/esp.pcapng.out @@ -28,6 +28,9 @@ ESP 2 332 1 Safe 2 332 1 Unrated 4 1524 1 +Unspecified 4 1524 1 +VPN 2 332 1 + 1 ESP 10.2.3.2:0 <-> 10.3.4.4:0 [proto: 117/ESP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 117/ESP, Confidence: DPI][DPI packets: 1][cat: VPN/2][1 pkts/166 bytes <-> 1 pkts/166 bytes][Goodput ratio: 0/0][0.00 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/disable_protocols/result/ospfv2_add_new_prefix.pcap.out b/tests/cfgs/disable_protocols/result/ospfv2_add_new_prefix.pcap.out index c918a9274..1e41c0c94 100644 --- a/tests/cfgs/disable_protocols/result/ospfv2_add_new_prefix.pcap.out +++ b/tests/cfgs/disable_protocols/result/ospfv2_add_new_prefix.pcap.out @@ -24,6 +24,8 @@ Unknown 2 200 1 Unrated 2 200 1 +Unspecified 2 200 1 + Undetected flows: diff --git a/tests/cfgs/disable_protocols/result/pluralsight.pcap.out b/tests/cfgs/disable_protocols/result/pluralsight.pcap.out index 1cb235fe1..164961e95 100644 --- a/tests/cfgs/disable_protocols/result/pluralsight.pcap.out +++ b/tests/cfgs/disable_protocols/result/pluralsight.pcap.out @@ -24,6 +24,8 @@ TLS 44 29652 6 Safe 44 29652 6 +Web 44 29652 6 + JA Host Stats: IP Address # JA4C 1 192.168.1.128 1 diff --git a/tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out b/tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out index 5c2c9da2b..9a42b860f 100644 --- a/tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out +++ b/tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out @@ -26,4 +26,6 @@ Facebook 20 11399 1 Fun 20 11399 1 +SocialNetwork 20 11399 1 + 1 UDP 10.0.2.15:35957 <-> 69.171.250.15:443 [proto: 119/Facebook][IP: 119/Facebook][Encrypted][Confidence: Match by IP][FPC: 119/Facebook, Confidence: IP address][DPI packets: 7][cat: SocialNetwork/6][7 pkts/3196 bytes <-> 13 pkts/8203 bytes][Goodput ratio: 79/85][8.96 sec][bytes ratio: -0.439 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1782/811 8808/8827 3513/2535][Pkt Len c2s/s2c min/avg/max/stddev: 128/115 457/631 1326/1346 492/540][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.857 (Encrypted or Random?)][PLAIN TEXT (Xic gcl)][Plen Bins: 20,25,10,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,5,0,0,0,0,5,0,0,0,0,0,5,20,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/disable_protocols/result/sctp.cap.out b/tests/cfgs/disable_protocols/result/sctp.cap.out index 0d0afdf83..64554ae81 100644 --- a/tests/cfgs/disable_protocols/result/sctp.cap.out +++ b/tests/cfgs/disable_protocols/result/sctp.cap.out @@ -24,5 +24,7 @@ SCTP 4 340 2 Acceptable 4 340 2 +Network 4 340 2 + 1 SCTP 10.28.6.43:0 <-> 10.28.6.44:0 [proto: 84/SCTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 84/SCTP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/138 bytes <-> 1 pkts/62 bytes][Goodput ratio: 0/0][< 1 sec][PLAIN TEXT (MEGACO/2 )][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 SCTP 10.28.6.42:0 <-> 10.28.6.44:0 [proto: 84/SCTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 84/SCTP, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/70 bytes <-> 1 pkts/70 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/disable_protocols/result/soap.pcap.out b/tests/cfgs/disable_protocols/result/soap.pcap.out index 3a7893597..813e7d784 100644 --- a/tests/cfgs/disable_protocols/result/soap.pcap.out +++ b/tests/cfgs/disable_protocols/result/soap.pcap.out @@ -28,6 +28,9 @@ Microsoft365 1 1506 1 Acceptable 20 10948 3 +Web 19 9442 2 +Collaborative 1 1506 1 + 1 TCP 192.168.2.100:50100 <-> 23.2.213.165:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 14][cat: Web/5][7 pkts/4746 bytes <-> 7 pkts/752 bytes][Goodput ratio: 92/39][5.01 sec][bytes ratio: 0.726 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 989/1236 2486/2486 1098/1096][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 678/107 1506/362 717/104][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (POST /fwlink/)][Plen Bins: 0,0,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,75,0,0] 2 TCP 185.32.192.30:80 <-> 85.154.114.113:56028 [VLAN: 808][proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Web/5][3 pkts/2487 bytes <-> 2 pkts/1457 bytes][Goodput ratio: 92/92][0.34 sec][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 6.075 (Executable?)][PLAIN TEXT (xml version)][Plen Bins: 0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,0,50,0,0,0,0,0,0,0,0,0] 3 TCP 192.168.2.100:50100 -> 23.2.213.165:4176 [proto: 7.219/HTTP.Microsoft365][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 7.219/HTTP.Microsoft365, Confidence: DPI][DPI packets: 1][cat: Collaborative/15][1 pkts/1506 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Hostname/SNI: go.microsoft.com][URL: go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409][Req Content-Type: text/xml][User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 80][PLAIN TEXT (POST /fwlink/)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0] diff --git a/tests/cfgs/disable_use_client_ip/result/bot.pcap.out b/tests/cfgs/disable_use_client_ip/result/bot.pcap.out index 5fd76695c..f90c45eb0 100644 --- a/tests/cfgs/disable_use_client_ip/result/bot.pcap.out +++ b/tests/cfgs/disable_use_client_ip/result/bot.pcap.out @@ -24,4 +24,6 @@ HTTP 402 431124 1 Acceptable 402 431124 1 +Bots 402 431124 1 + 1 TCP 40.77.167.36:64768 <-> 89.31.72.220:80 [VLAN: 77][proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Bots/124][115 pkts/7672 bytes <-> 287 pkts/423452 bytes][Goodput ratio: 4/96][5.66 sec][Hostname/SNI: atlanteditorino.it][bytes ratio: -0.964 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 58/3 4532/106 489/16][Pkt Len c2s/s2c min/avg/max/stddev: 64/64 67/1475 374/1498 29/171][URL: atlanteditorino.it/quartieri/img/S.Donato_M.Vittoria1930_B.jpg][StatusCode: 200][Content-Type: image/jpeg][Server: Apache][User-Agent: Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)][Risk: ** Crawler/Bot **][Risk Score: 10][Risk Info: UA Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/b][TCP Fingerprint: 194_128_64240_f65176b9e3ec/Unknown][PLAIN TEXT (GET /quartieri/im)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0] diff --git a/tests/cfgs/disable_use_client_port/result/iphone.pcap.out b/tests/cfgs/disable_use_client_port/result/iphone.pcap.out index e7bb753dd..dc3270666 100644 --- a/tests/cfgs/disable_use_client_port/result/iphone.pcap.out +++ b/tests/cfgs/disable_use_client_port/result/iphone.pcap.out @@ -42,6 +42,15 @@ Acceptable 288 144245 39 Fun 64 23471 3 Unrated 2 120 1 +Unspecified 2 120 1 +Web 332 178040 12 +Cloud 2 1104 1 +Network 75 16440 31 +Streaming 62 23299 2 +System 2 336 2 +Music 2 172 1 +ConnCheck 9 1441 1 + JA Host Stats: IP Address # JA4C 1 192.168.2.17 3 diff --git a/tests/cfgs/dns_sub_enable/result/dns.pcap.out b/tests/cfgs/dns_sub_enable/result/dns.pcap.out index 9db182dfa..4d982b46c 100644 --- a/tests/cfgs/dns_sub_enable/result/dns.pcap.out +++ b/tests/cfgs/dns_sub_enable/result/dns.pcap.out @@ -28,6 +28,8 @@ WhatsApp 2 310 1 Acceptable 17 3553 4 +Network 17 3553 4 + 1 TCP [2001:b07:a3d:c112:b831:a73f:7974:e604]:49774 <-> [2001:b07:a3d:c112::1]:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][6 pkts/490 bytes <-> 5 pkts/2156 bytes][Goodput ratio: 7/82][0.01 sec][Hostname/SNI: opentracker.io][45.9.60.30][DNS Id: 0x3d73][bytes ratio: -0.630 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2/2 6/5 3/2][Pkt Len c2s/s2c min/avg/max/stddev: 74/74 82/431 108/1294 13/481][TCP Fingerprint: 2_64_65535_108f896b6121/Unknown][PLAIN TEXT (opentracker)][Plen Bins: 0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0] 2 UDP [fe80::a00:27ff:feb3:e62e]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 8/MDNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/371 bytes -> 0 pkts/0 bytes][Goodput ratio: 83/0][< 1 sec][Hostname/SNI: e.2.6.e.3.b.e.f.f.f.7.2.0.0.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa][e.2.6.e.3.b.e.f.f.f.7.2.0.0.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa][PLAIN TEXT (Android)][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 82.178.113.245:47255 <-> 82.178.158.181:53 [VLAN: 785][proto: 5.142/DNS.WhatsApp][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5.142/DNS.WhatsApp, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/91 bytes <-> 1 pkts/219 bytes][Goodput ratio: 36/73][0.00 sec][Hostname/SNI: e7.whatsapp.net][169.45.219.235][DNS Id: 0x7843][PLAIN TEXT (whatsapp)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/dns_sub_enable/result/dns2.pcap.out b/tests/cfgs/dns_sub_enable/result/dns2.pcap.out index 3ef38e2da..8e10b93f5 100644 --- a/tests/cfgs/dns_sub_enable/result/dns2.pcap.out +++ b/tests/cfgs/dns_sub_enable/result/dns2.pcap.out @@ -24,4 +24,6 @@ Github 4 405 1 Acceptable 4 405 1 +Network 4 405 1 + 1 UDP 192.168.255.251:56550 <-> 8.8.8.8:53 [proto: 5.203/DNS.Github][IP: 126/Google][ClearText][Confidence: DPI][FPC: 5.203/DNS.Github, Confidence: DPI][DPI packets: 3][cat: Network/14][2 pkts/148 bytes <-> 2 pkts/257 bytes][Goodput ratio: 43/67][0.03 sec][Hostname/SNI: www.github.com][0.0.0.0][DNS Id: 0xeaef][PLAIN TEXT (github)][Plen Bins: 0,75,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/dns_sub_enable/result/dns_multiple_transactions_same_flow.pcap.out b/tests/cfgs/dns_sub_enable/result/dns_multiple_transactions_same_flow.pcap.out index 812febcfe..8c47e2dc3 100644 --- a/tests/cfgs/dns_sub_enable/result/dns_multiple_transactions_same_flow.pcap.out +++ b/tests/cfgs/dns_sub_enable/result/dns_multiple_transactions_same_flow.pcap.out @@ -24,4 +24,6 @@ Google 80 10969 1 Acceptable 80 10969 1 +Network 80 10969 1 + 1 UDP 192.168.1.204:50234 <-> 192.168.1.253:53 [proto: 5.126/DNS.Google][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5.126/DNS.Google, Confidence: DPI][DPI packets: 2][cat: Network/14][40 pkts/3152 bytes <-> 40 pkts/7817 bytes][Goodput ratio: 47/78][403.67 sec][Hostname/SNI: www.google.com][142.251.209.36][DNS Id: 0x1655][bytes ratio: -0.425 (Download)][IAT c2s/s2c min/avg/max/stddev: 23/9 11635/11637 110617/110608 23370/23370][Pkt Len c2s/s2c min/avg/max/stddev: 68/68 79/195 94/356 9/104][PLAIN TEXT (google)][Plen Bins: 27,36,6,8,0,1,5,2,6,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/dns_sub_enable/result/dns_retransmissions.pcap.out b/tests/cfgs/dns_sub_enable/result/dns_retransmissions.pcap.out index 6aa76a12c..dfa0d9572 100644 --- a/tests/cfgs/dns_sub_enable/result/dns_retransmissions.pcap.out +++ b/tests/cfgs/dns_sub_enable/result/dns_retransmissions.pcap.out @@ -24,4 +24,6 @@ Microsoft 4 450 1 Safe 4 450 1 +Network 4 450 1 + 1 UDP 37.41.101.140:11892 <-> 208.67.222.222:53 [VLAN: 103][proto: 5.212/DNS.Microsoft][IP: 225/OpenDNS][ClearText][Confidence: DPI][FPC: 5.212/DNS.Microsoft, Confidence: DPI][DPI packets: 3][cat: Network/14][2 pkts/150 bytes <-> 2 pkts/300 bytes][Goodput ratio: 38/69][0.20 sec][Hostname/SNI: api.msn.com][204.79.197.203][DNS Id: 0xb8e2][PLAIN TEXT (msedge)][Plen Bins: 50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/dns_subclassification_and_process_response_disable/result/dns.pcap.out b/tests/cfgs/dns_subclassification_and_process_response_disable/result/dns.pcap.out index 868f4d8dd..7ffdb5ca3 100644 --- a/tests/cfgs/dns_subclassification_and_process_response_disable/result/dns.pcap.out +++ b/tests/cfgs/dns_subclassification_and_process_response_disable/result/dns.pcap.out @@ -26,6 +26,8 @@ MDNS 1 371 1 Acceptable 17 3553 4 +Network 17 3553 4 + 1 TCP [2001:b07:a3d:c112:b831:a73f:7974:e604]:49774 <-> [2001:b07:a3d:c112::1]:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Network/14][6 pkts/490 bytes <-> 5 pkts/2156 bytes][Goodput ratio: 7/82][0.01 sec][Hostname/SNI: opentracker.io][0.0.0.0][DNS Id: 0x3d73][bytes ratio: -0.630 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2/2 6/5 3/2][Pkt Len c2s/s2c min/avg/max/stddev: 74/74 82/431 108/1294 13/481][TCP Fingerprint: 2_64_65535_108f896b6121/Unknown][PLAIN TEXT (opentracker)][Plen Bins: 0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0] 2 UDP [fe80::a00:27ff:feb3:e62e]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 8/MDNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/371 bytes -> 0 pkts/0 bytes][Goodput ratio: 83/0][< 1 sec][Hostname/SNI: e.2.6.e.3.b.e.f.f.f.7.2.0.0.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa][e.2.6.e.3.b.e.f.f.f.7.2.0.0.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa][PLAIN TEXT (Android)][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 82.178.113.245:47255 <-> 82.178.158.181:53 [VLAN: 785][proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/91 bytes <-> 1 pkts/219 bytes][Goodput ratio: 36/73][0.00 sec][Hostname/SNI: e7.whatsapp.net][0.0.0.0][DNS Id: 0x7843][PLAIN TEXT (whatsapp)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/enable_doh_heuristic/result/doh.pcapng.out b/tests/cfgs/enable_doh_heuristic/result/doh.pcapng.out index 1c68f59c9..de6c76a39 100644 --- a/tests/cfgs/enable_doh_heuristic/result/doh.pcapng.out +++ b/tests/cfgs/enable_doh_heuristic/result/doh.pcapng.out @@ -24,6 +24,8 @@ TLS 120 14592 1 Safe 120 14592 1 +Web 120 14592 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.253 1 diff --git a/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out b/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out index a0c65a324..134ea60f7 100644 --- a/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out +++ b/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out @@ -52,6 +52,17 @@ Fun 933 1975152 48 Dangerous 5 1197 2 Unrated 19 5564 9 +Unspecified 19 5564 9 +Media 13 4318 2 +Web 380 410792 43 +Download 2 553 1 +Chat 58 25273 5 +Network 148 18784 68 +Streaming 902 1969950 44 +System 175 40630 22 +SoftwareUpdate 2 1359 1 +Advertisement 24 50551 2 + Payload Analysis [....] [2E 2E 2E 2E] [len: 4][num_occurrencies: 437][flowId: 0 7 9 10 12 13 3 15 17 18 19 23 25 32 33 38 42 46 47 48 51 52 54 61 62 63 66 67 68 71 72 75 77 79 80 81 84 89 90 91 94 95 96 97 98 99 100 101 102 103 107 110 111 113 114 117 119 120 121 122 123 124 125 126 127 128 146 159][packetIds: 1 2 11 14 15 17 18 19 20 21 29 30 32 35 36 39 40 41 42 43 44 48 49 52 53 54 55 56 59 69 70 71 84 85 198 199 387 388 472 473 474 507 539 547 554 555 563 564 583 589 591 592 594 595 597 598 602 642 643 645 646 648 651 654 657 658 662 665 666 667 669 670 671 672 673 682 684 686 687 688 690 691 696 703 706 730 731 733 734 738 740 743 755 756 761 773 774 775 777 778 780 781 787 788 798 799 800 801 803 814 820 822 827 828 829 830 831 835 836 858 859 901 902 903 904 930 931 932 941 985 986 991 994 995 996 1008 1009 1011 1012 1015 1016 1017 1018 1021 1023 1024 1025 1026 1304 1383] diff --git a/tests/cfgs/flow_risk_infos_disabled/result/http_invalid_server.pcap.out b/tests/cfgs/flow_risk_infos_disabled/result/http_invalid_server.pcap.out index 8f186ff20..c57f39eff 100644 --- a/tests/cfgs/flow_risk_infos_disabled/result/http_invalid_server.pcap.out +++ b/tests/cfgs/flow_risk_infos_disabled/result/http_invalid_server.pcap.out @@ -24,4 +24,6 @@ OCSP 12 1301 1 Safe 12 1301 1 +Network 12 1301 1 + 1 TCP 192.168.1.29:51536 <-> 143.204.14.183:80 [proto: 7.63/HTTP.OCSP][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 6][cat: Network/14][7 pkts/556 bytes <-> 5 pkts/745 bytes][Goodput ratio: 15/55][0.04 sec][Hostname/SNI: ocsp.rootg2.amazontrust.com][bytes ratio: -0.145 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/4 12/12 6/6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 79/149 148/468 28/160][URL: ocsp.rootg2.amazontrust.com/][StatusCode: 200][Content-Type: application/ocsp-response][Server: ¯\_(ツ)_/¯][User-Agent: **][Risk: ** HTTP Susp User-Agent **** HTTP Susp Header **][Risk Score: 200][TCP Fingerprint: 2_64_65535_d29295416479/macOS][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 33,0,33,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/flow_risk_infos_disabled/result/tls_malicious_sha1.pcapng.out b/tests/cfgs/flow_risk_infos_disabled/result/tls_malicious_sha1.pcapng.out index 6eca74293..23a1d5b67 100644 --- a/tests/cfgs/flow_risk_infos_disabled/result/tls_malicious_sha1.pcapng.out +++ b/tests/cfgs/flow_risk_infos_disabled/result/tls_malicious_sha1.pcapng.out @@ -24,6 +24,8 @@ TLS 22 7204 1 Safe 22 7204 1 +Web 22 7204 1 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:9726:f643:a838:b0c4 1 diff --git a/tests/cfgs/flow_risk_list_disable/result/flow_risk_lists.pcapng.out b/tests/cfgs/flow_risk_list_disable/result/flow_risk_lists.pcapng.out index 4da069c31..50dc6e86c 100644 --- a/tests/cfgs/flow_risk_list_disable/result/flow_risk_lists.pcapng.out +++ b/tests/cfgs/flow_risk_list_disable/result/flow_risk_lists.pcapng.out @@ -28,5 +28,7 @@ TLS 1 94 1 Safe 1 94 1 Acceptable 1 74 1 +Web 2 168 2 + 1 TCP [2a02:26f7:d198:400::1]:44878 -> [2001:db8:200::1]:443 [proto: 91/TLS][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/94 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_65320_5c453b01be6e/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 23.98.142.176:53684 -> 8.8.8.8:80 [proto: 7/HTTP][IP: 126/Google][ClearText][Confidence: Match by port][FPC: 126/Google, Confidence: IP address][DPI packets: 1][cat: Web/5][1 pkts/74 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/fpc/result/1kxun.pcap.out b/tests/cfgs/fpc/result/1kxun.pcap.out index abe1b1f7a..61ac16f66 100644 --- a/tests/cfgs/fpc/result/1kxun.pcap.out +++ b/tests/cfgs/fpc/result/1kxun.pcap.out @@ -57,6 +57,17 @@ Fun 933 1975152 48 Dangerous 5 1197 2 Unrated 19 5564 9 +Unspecified 19 5564 9 +Media 13 4318 2 +Web 380 410792 43 +Download 2 553 1 +Chat 58 25273 5 +Network 148 18784 68 +Streaming 902 1969950 44 +System 175 40630 22 +SoftwareUpdate 2 1359 1 +Advertisement 24 50551 2 + JA Host Stats: IP Address # JA4C 1 192.168.5.16 2 diff --git a/tests/cfgs/fpc/result/signal_videocall.pcapng.out b/tests/cfgs/fpc/result/signal_videocall.pcapng.out index 462839d05..dd919d228 100644 --- a/tests/cfgs/fpc/result/signal_videocall.pcapng.out +++ b/tests/cfgs/fpc/result/signal_videocall.pcapng.out @@ -27,6 +27,8 @@ SignalVoip 334 123259 3 298 119495 1 (*) Acceptable 334 123259 3 +VoIP 334 123259 3 + 1 UDP 192.168.12.67:47926 <-> 35.219.252.146:56377 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 7][cat: VoIP/10][167 pkts/87565 bytes <-> 131 pkts/31930 bytes][Goodput ratio: 92/83][10.75 sec][bytes ratio: 0.466 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 64/82 2304/2449 291/279][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 524/244 1223/900 385/198][Mapped IP/Port: 93.35.168.30:45266][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (17uAgN)][Plen Bins: 3,28,9,7,0,0,0,0,16,8,1,0,0,1,1,0,1,1,0,1,0,0,0,0,7,3,0,1,0,0,1,1,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:47926 <-> 35.219.252.146:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][13 pkts/1258 bytes <-> 13 pkts/1454 bytes][Goodput ratio: 57/62][10.01 sec][Hostname/SNI: signal.org][bytes ratio: -0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 6/6 804/804 4015/4015 1248/1248][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 97/112 162/126 43/14][Mapped IP/Port: 93.35.168.30:45265][Relayed IP/Port: 35.219.252.146:40378][PLAIN TEXT (BFODsIPgWuCIX)][Plen Bins: 34,19,30,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:47926 <-> 35.216.234.234:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][5 pkts/510 bytes <-> 5 pkts/542 bytes][Goodput ratio: 59/61][10.02 sec][Hostname/SNI: signal.org][bytes ratio: -0.030 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5/4 2503/2503 9988/9988 4321/4321][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 102/108 158/126 46/15][Mapped IP/Port: 93.35.168.30:45265][Relayed IP/Port: 35.216.234.234:29688][PLAIN TEXT (42oPBlgi)][Plen Bins: 30,30,20,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/fpc_disabled/result/teams.pcap.out b/tests/cfgs/fpc_disabled/result/teams.pcap.out index 041ae29f7..faa6eddea 100644 --- a/tests/cfgs/fpc_disabled/result/teams.pcap.out +++ b/tests/cfgs/fpc_disabled/result/teams.pcap.out @@ -45,6 +45,15 @@ Acceptable 714 378066 54 Fun 1 82 1 Unrated 4 456 1 +Unspecified 4 456 1 +Web 20 11474 2 +Chat 3 186 1 +VoIP 124 33394 13 +Cloud 2 1054 2 +Network 91 18328 27 +Collaborative 1253 612021 36 +Music 1 82 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.6 7 diff --git a/tests/cfgs/guess_ip_before_port_enabled/result/1kxun.pcap.out b/tests/cfgs/guess_ip_before_port_enabled/result/1kxun.pcap.out index fdfc26162..fbcd94b98 100644 --- a/tests/cfgs/guess_ip_before_port_enabled/result/1kxun.pcap.out +++ b/tests/cfgs/guess_ip_before_port_enabled/result/1kxun.pcap.out @@ -53,6 +53,17 @@ Fun 933 1975152 48 Dangerous 5 1197 2 Unrated 19 5564 9 +Unspecified 19 5564 9 +Media 13 4318 2 +Web 357 403358 42 +Download 2 553 1 +Chat 81 32707 6 +Network 148 18784 68 +Streaming 902 1969950 44 +System 175 40630 22 +SoftwareUpdate 2 1359 1 +Advertisement 24 50551 2 + JA Host Stats: IP Address # JA4C 1 192.168.5.16 2 diff --git a/tests/cfgs/guessing_disable/result/webex.pcap.out b/tests/cfgs/guessing_disable/result/webex.pcap.out index 7492d3280..3842648a0 100644 --- a/tests/cfgs/guessing_disable/result/webex.pcap.out +++ b/tests/cfgs/guessing_disable/result/webex.pcap.out @@ -33,6 +33,11 @@ Safe 250 28977 20 Acceptable 835 524428 33 Unrated 25 1701 4 +Unspecified 25 1701 4 +Web 272 32159 22 +VoIP 796 514871 30 +Advertisement 17 6375 1 + JA Host Stats: IP Address # JA4C 1 10.8.0.1 6 diff --git a/tests/cfgs/http_process_response_disable/result/http.pcapng.out b/tests/cfgs/http_process_response_disable/result/http.pcapng.out index 466a0e4d6..e40a8f9ec 100644 --- a/tests/cfgs/http_process_response_disable/result/http.pcapng.out +++ b/tests/cfgs/http_process_response_disable/result/http.pcapng.out @@ -24,4 +24,6 @@ Google 10 1278 1 Acceptable 10 1278 1 +Web 10 1278 1 + 1 TCP 192.168.1.128:42170 <-> 216.58.208.142:80 [proto: 7.126/HTTP.Google][IP: 126/Google][ClearText][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 4][cat: Web/5][6 pkts/478 bytes <-> 4 pkts/800 bytes][Goodput ratio: 15/66][0.04 sec][Hostname/SNI: google.com][bytes ratio: -0.252 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/7 8/14 28/20 10/6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 80/200 140/594 27/227][URL: google.com/][User-Agent: curl/7.68.0][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/http_process_response_disable/result/http_asymmetric.pcapng.out b/tests/cfgs/http_process_response_disable/result/http_asymmetric.pcapng.out index ff3e86cee..876043525 100644 --- a/tests/cfgs/http_process_response_disable/result/http_asymmetric.pcapng.out +++ b/tests/cfgs/http_process_response_disable/result/http_asymmetric.pcapng.out @@ -24,5 +24,7 @@ HTTP 23 9961 2 Acceptable 23 9961 2 +Web 23 9961 2 + 1 TCP 192.168.1.146:80 -> 192.168.1.103:1044 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: Web/5][13 pkts/8357 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][5.11 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 464/0 5000/0 1435/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/0 643/0 1514/0 626/0][StatusCode: 200][Content-Type: text/html][Server: Apache/2.4.41 (Ubuntu)][Risk: ** HTTP Susp User-Agent **** Susp Entropy **** Unidirectional Traffic **][Risk Score: 120][Risk Info: No client to server traffic / Entropy: 7.815 (Encrypted or Random?) / Empty or missing User-Agent][PLAIN TEXT (HTTP/1.1 200 OK)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,14,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,57,0,0] 2 TCP 192.168.0.1:1044 -> 10.10.10.1:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: Web/5][10 pkts/1604 bytes -> 0 pkts/0 bytes][Goodput ratio: 66/0][5.11 sec][Hostname/SNI: proxy.wiresharkfest.acropolis.local][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 567/0 4951/0 1550/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 160/0 418/0 160/0][URL: proxy.wiresharkfest.acropolis.local/][User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,66,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/huge_number_of_custom_protocols/result/synscan.pcap.out b/tests/cfgs/huge_number_of_custom_protocols/result/synscan.pcap.out index 5e88facca..f3de57379 100644 --- a/tests/cfgs/huge_number_of_custom_protocols/result/synscan.pcap.out +++ b/tests/cfgs/huge_number_of_custom_protocols/result/synscan.pcap.out @@ -251,6 +251,24 @@ Unsafe 14 812 14 Potentially_Dangerous 2 116 2 Unrated 1528 88626 1527 +Unspecified 1883 109230 1875 +Media 6 348 6 +VPN 4 232 4 +Email 8 466 7 +DataTransfer 10 580 10 +Web 13 762 9 +Download 10 580 10 +Game 4 232 4 +Chat 2 116 2 +VoIP 6 348 6 +Database 10 580 10 +RemoteAccess 15 878 11 +Network 22 1276 22 +Collaborative 2 116 2 +System 10 580 10 +IoT-Scada 4 232 4 +Crypto_Currency 2 116 2 + 1 TCP 172.16.0.8:36050 <-> 64.13.134.52:22 [proto: 92/SSH][IP: 0/Unknown][Encrypted][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: RemoteAccess/12][1 pkts/58 bytes <-> 4 pkts/240 bytes][Goodput ratio: 0/0][21.68 sec][TCP Fingerprint: 2_64_1024_6bbe28597824/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 172.16.0.8:36050 <-> 64.13.134.52:53 [proto: 606/domain][IP: 0/Unknown][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/58 bytes <-> 4 pkts/240 bytes][Goodput ratio: 0/0][21.09 sec][TCP Fingerprint: 2_64_3072_6bbe28597824/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 TCP 172.16.0.8:36050 <-> 64.13.134.52:80 [proto: 7/HTTP][IP: 0/Unknown][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][1 pkts/58 bytes <-> 4 pkts/240 bytes][Goodput ratio: 0/0][21.27 sec][TCP Fingerprint: 2_64_3072_6bbe28597824/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/ip_lists_disable/result/1kxun.pcap.out b/tests/cfgs/ip_lists_disable/result/1kxun.pcap.out index 540fcf835..5727c0f27 100644 --- a/tests/cfgs/ip_lists_disable/result/1kxun.pcap.out +++ b/tests/cfgs/ip_lists_disable/result/1kxun.pcap.out @@ -52,6 +52,17 @@ Fun 933 1975152 48 Dangerous 5 1197 2 Unrated 19 5564 9 +Unspecified 19 5564 9 +Media 13 4318 2 +Web 380 410792 43 +Download 2 553 1 +Chat 58 25273 5 +Network 148 18784 68 +Streaming 902 1969950 44 +System 175 40630 22 +SoftwareUpdate 2 1359 1 +Advertisement 24 50551 2 + JA Host Stats: IP Address # JA4C 1 192.168.5.16 2 diff --git a/tests/cfgs/monitoring/result/signal_audiocall.pcapng.out b/tests/cfgs/monitoring/result/signal_audiocall.pcapng.out index a2c0a66ba..8255c5380 100644 --- a/tests/cfgs/monitoring/result/signal_audiocall.pcapng.out +++ b/tests/cfgs/monitoring/result/signal_audiocall.pcapng.out @@ -25,6 +25,8 @@ SignalVoip 268 50558 4 Acceptable 268 50558 4 +VoIP 268 50558 4 + 1 UDP 192.168.12.67:45419 <-> 35.219.226.11:54116 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][Stream Content: Audio][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 178][DPI packets before monitoring: 33][cat: VoIP/10][91 pkts/20258 bytes <-> 87 pkts/18776 bytes][Goodput ratio: 81/81][16.10 sec][bytes ratio: 0.038 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 185/163 2145/2221 406/335][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 223/216 337/337 105/106][Mapped IP/Port: 93.35.168.30:45251, 35.219.226.11:54116][RTP packets: 56/58][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (zaziGwgI)][Plen Bins: 6,15,11,11,0,0,0,0,46,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:45419 <-> 35.219.252.146:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 58][DPI packets before monitoring: 33][cat: VoIP/10][29 pkts/3570 bytes <-> 29 pkts/4210 bytes][Goodput ratio: 66/71][19.07 sec][Hostname/SNI: signal.org][bytes ratio: -0.082 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 594/604 2518/2516 688/680][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 123/145 182/182 41/34][Mapped IP/Port: 93.35.168.30:45250, 35.219.226.11:54116, 35.219.252.146:22269, 35.219.226.11:12261][Peer IP/Port: 35.219.226.11:12261, 35.219.226.11:54116, 35.219.226.11:10127][Relayed IP/Port: 35.219.252.146:22269][RTP packets: 0/0][PLAIN TEXT (BDIbPI2)][Plen Bins: 17,8,15,32,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:45419 <-> 35.219.226.11:12261 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 22][cat: VoIP/10][11 pkts/1238 bytes <-> 11 pkts/1454 bytes][Goodput ratio: 63/68][14.81 sec][bytes ratio: -0.080 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 97/26 1215/1207 2521/2521 1083/1093][Pkt Len c2s/s2c min/avg/max/stddev: 106/106 113/132 146/138 14/12][Mapped IP/Port: 93.35.168.30:45251, 35.219.226.11:12261][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BV39hIkc1)][Plen Bins: 0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/monitoring/result/signal_videocall.pcapng.out b/tests/cfgs/monitoring/result/signal_videocall.pcapng.out index 4d3a12716..b0eefa845 100644 --- a/tests/cfgs/monitoring/result/signal_videocall.pcapng.out +++ b/tests/cfgs/monitoring/result/signal_videocall.pcapng.out @@ -25,6 +25,8 @@ SignalVoip 334 123259 3 Acceptable 334 123259 3 +VoIP 334 123259 3 + 1 UDP 192.168.12.67:47926 <-> 35.219.252.146:56377 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][Stream Content: Audio, Video][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 298][DPI packets before monitoring: 33][cat: VoIP/10][167 pkts/87565 bytes <-> 131 pkts/31930 bytes][Goodput ratio: 92/83][10.75 sec][bytes ratio: 0.466 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 64/82 2304/2449 291/279][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 524/244 1223/900 385/198][Mapped IP/Port: 93.35.168.30:45266, 35.219.252.146:56377][RTP packets: 68/124][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (17uAgN)][Plen Bins: 3,28,9,7,0,0,0,0,16,8,1,0,0,1,1,0,1,1,0,1,0,0,0,0,7,3,0,1,0,0,1,1,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:47926 <-> 35.219.252.146:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 26][cat: VoIP/10][13 pkts/1258 bytes <-> 13 pkts/1454 bytes][Goodput ratio: 57/62][10.01 sec][Hostname/SNI: signal.org][bytes ratio: -0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 6/6 804/804 4015/4015 1248/1248][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 97/112 162/126 43/14][Mapped IP/Port: 93.35.168.30:45265][Peer IP/Port: 35.219.252.146:56377, 35.219.252.146:34099, 35.219.252.146:37175][Relayed IP/Port: 35.219.252.146:40378][PLAIN TEXT (BFODsIPgWuCIX)][Plen Bins: 34,19,30,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:47926 <-> 35.216.234.234:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78/STUN, Confidence: DPI][DPI packets: 10][cat: VoIP/10][5 pkts/510 bytes <-> 5 pkts/542 bytes][Goodput ratio: 59/61][10.02 sec][Hostname/SNI: signal.org][bytes ratio: -0.030 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5/4 2503/2503 9988/9988 4321/4321][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 102/108 158/126 46/15][Mapped IP/Port: 93.35.168.30:45265][Relayed IP/Port: 35.216.234.234:29688][PLAIN TEXT (42oPBlgi)][Plen Bins: 30,30,20,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/monitoring/result/signal_videocall_multiparty.pcapng.out b/tests/cfgs/monitoring/result/signal_videocall_multiparty.pcapng.out index a1a9748c3..09bc3a72f 100644 --- a/tests/cfgs/monitoring/result/signal_videocall_multiparty.pcapng.out +++ b/tests/cfgs/monitoring/result/signal_videocall_multiparty.pcapng.out @@ -24,4 +24,6 @@ SignalVoip 260 96919 1 Acceptable 260 96919 1 +VoIP 260 96919 1 + 1 UDP 192.168.1.117:59446 <-> 35.207.67.68:10000 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Stream Content: Audio, Video][Encrypted][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 260][DPI packets before monitoring: 33][cat: VoIP/10][192 pkts/75765 bytes <-> 68 pkts/21154 bytes][Goodput ratio: 89/86][17.98 sec][bytes ratio: 0.563 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 94/273 1011/1358 238/433][Pkt Len c2s/s2c min/avg/max/stddev: 70/74 395/311 1253/1226 355/365][RTP packets: 154/46][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BvkPzIMF7)][Plen Bins: 1,40,2,9,0,1,0,2,1,15,1,0,5,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0,0,1,0,0,0,0,3,0,2,2,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/monitoring/result/stun.pcap.out b/tests/cfgs/monitoring/result/stun.pcap.out index f08bba49b..3e0869fba 100644 --- a/tests/cfgs/monitoring/result/stun.pcap.out +++ b/tests/cfgs/monitoring/result/stun.pcap.out @@ -32,6 +32,9 @@ GoogleCall 41 7228 2 Safe 4 766 1 Acceptable 197 28062 8 +VoIP 131 19906 4 +Network 70 8922 5 + JA Host Stats: IP Address # JA4C 1 192.168.12.169 1 diff --git a/tests/cfgs/monitoring/result/stun_google_meet.pcapng.out b/tests/cfgs/monitoring/result/stun_google_meet.pcapng.out index 0b5c27e34..6b6442d72 100644 --- a/tests/cfgs/monitoring/result/stun_google_meet.pcapng.out +++ b/tests/cfgs/monitoring/result/stun_google_meet.pcapng.out @@ -25,6 +25,8 @@ GoogleCall 362 74597 7 Acceptable 362 74597 7 +VoIP 362 74597 7 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:48a1:1094:1227:281e 1 diff --git a/tests/cfgs/monitoring/result/stun_signal.pcapng.out b/tests/cfgs/monitoring/result/stun_signal.pcapng.out index 0d6d70cda..3d6527bea 100644 --- a/tests/cfgs/monitoring/result/stun_signal.pcapng.out +++ b/tests/cfgs/monitoring/result/stun_signal.pcapng.out @@ -27,6 +27,9 @@ SignalVoip 407 43310 21 Acceptable 460 48496 23 +VoIP 407 43310 21 +Network 53 5186 2 + 1 UDP 192.168.12.169:43068 <-> 18.195.131.143:61156 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][Stream Content: Audio][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 106][DPI packets before monitoring: 33][cat: VoIP/10][48 pkts/4692 bytes <-> 58 pkts/7630 bytes][Goodput ratio: 57/68][12.11 sec][bytes ratio: -0.238 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 224/234 1055/1059 250/294][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 98/132 146/306 23/72][Mapped IP/Port: 93.47.225.19:11914, 18.195.131.143:61156][RTP packets: 15/1][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BrDwrhkDr//9e)][Plen Bins: 26,31,15,15,5,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.169:47767 <-> 18.195.131.143:61498 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][Stream Content: Audio][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 53][DPI packets before monitoring: 33][cat: VoIP/10][18 pkts/1900 bytes <-> 35 pkts/6496 bytes][Goodput ratio: 60/77][2.67 sec][bytes ratio: -0.547 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 173/74 665/630 186/150][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 106/186 146/306 26/92][Mapped IP/Port: 93.47.225.19:11932, 18.195.131.143:61498][RTP packets: 19/1][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (80JiLM)][Plen Bins: 13,16,18,18,9,0,0,0,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 ICMP 35.158.183.167:0 <-> 192.168.12.169:0 [proto: 81/ICMP][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 81/ICMP, Confidence: DPI][DPI packets: 1][cat: Network/14][30 pkts/2780 bytes <-> 4 pkts/552 bytes][Goodput ratio: 55/69][51.83 sec][bytes ratio: 0.669 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 906/1 7931/1 2120/0][Pkt Len c2s/s2c min/avg/max/stddev: 90/138 93/138 98/138 4/0][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: No server to client traffic / Entropy: 5.051 (Executable?)][PLAIN TEXT (BJKHNYBG4)][Plen Bins: 0,88,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/monitoring/result/stun_wa_call.pcapng.out b/tests/cfgs/monitoring/result/stun_wa_call.pcapng.out index fe32b08fc..ff3f6c83c 100644 --- a/tests/cfgs/monitoring/result/stun_wa_call.pcapng.out +++ b/tests/cfgs/monitoring/result/stun_wa_call.pcapng.out @@ -27,6 +27,9 @@ ICMP 1 110 1 Acceptable 591 133689 13 +VoIP 590 133579 12 +Network 1 110 1 + 1 UDP 192.168.12.156:46652 <-> 93.57.123.227:3478 [proto: 338.45/SRTP.WhatsAppCall][IP: 0/Unknown][Stream Content: Audio][Encrypted][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 377][DPI packets before monitoring: 17][cat: VoIP/10][171 pkts/28371 bytes <-> 206 pkts/29803 bytes][Goodput ratio: 75/71][31.78 sec][bytes ratio: -0.025 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 178/151 2505/2463 255/222][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 166/145 434/446 100/85][Mapped IP/Port: 93.35.171.3:61494][Relayed IP/Port: 93.57.123.227:3478][RTP packets: 140/179][Plen Bins: 14,41,11,8,2,2,3,2,5,4,1,1,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.156:49526 <-> 157.240.203.62:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 119/Facebook][Stream Content: Audio, Video][ClearText][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 121][DPI packets before monitoring: 33][cat: VoIP/10][48 pkts/12953 bytes <-> 73 pkts/40083 bytes][Goodput ratio: 84/92][14.68 sec][bytes ratio: -0.512 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 191/164 3009/3009 684/623][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 270/549 542/1155 203/421][Mapped IP/Port: 93.35.171.3:61517][Relayed IP/Port: 157.240.203.62:3478][RTP packets: 4/30][PLAIN TEXT (dsUmpy)][Plen Bins: 8,18,19,1,0,0,0,0,3,0,0,0,0,0,0,14,14,0,0,0,0,0,0,0,0,0,0,0,2,4,2,1,2,3,4,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.156:49526 <-> 93.33.118.87:41107 [proto: 338.45/SRTP.WhatsAppCall][IP: 0/Unknown][Stream Content: Audio, Video][Encrypted][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 16][cat: VoIP/10][8 pkts/3465 bytes <-> 8 pkts/5392 bytes][Goodput ratio: 90/94][0.38 sec][bytes ratio: -0.218 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 53/35 124/160 55/59][Pkt Len c2s/s2c min/avg/max/stddev: 75/86 433/674 997/876 437/340][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][Plen Bins: 0,38,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,18,18,0,0,18,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/monitoring/result/stun_zoom.pcapng.out b/tests/cfgs/monitoring/result/stun_zoom.pcapng.out index a54a74965..317582e78 100644 --- a/tests/cfgs/monitoring/result/stun_zoom.pcapng.out +++ b/tests/cfgs/monitoring/result/stun_zoom.pcapng.out @@ -24,6 +24,8 @@ Zoom 70 18258 2 Acceptable 70 18258 2 +Video 70 18258 2 + JA Host Stats: IP Address # JA4C 1 192.168.43.169 1 diff --git a/tests/cfgs/monitoring/result/teams.pcap.out b/tests/cfgs/monitoring/result/teams.pcap.out index 31c5c0980..1f50ddfe4 100644 --- a/tests/cfgs/monitoring/result/teams.pcap.out +++ b/tests/cfgs/monitoring/result/teams.pcap.out @@ -45,6 +45,15 @@ Acceptable 714 378066 54 Fun 1 82 1 Unrated 4 456 1 +Unspecified 4 456 1 +Web 20 11474 2 +Chat 3 186 1 +VoIP 124 33394 13 +Cloud 2 1054 2 +Network 91 18328 27 +Collaborative 1253 612021 36 +Music 1 82 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.6 7 diff --git a/tests/cfgs/monitoring/result/telegram_videocall.pcapng.out b/tests/cfgs/monitoring/result/telegram_videocall.pcapng.out index 12cc2a177..cc1de4042 100644 --- a/tests/cfgs/monitoring/result/telegram_videocall.pcapng.out +++ b/tests/cfgs/monitoring/result/telegram_videocall.pcapng.out @@ -39,6 +39,12 @@ TelegramVoip 228 41561 16 Safe 4 295 1 Acceptable 883 382822 33 +Web 4 295 1 +Chat 636 339253 8 +VoIP 228 41561 16 +Cloud 6 636 2 +Network 13 1372 7 + 1 TCP 192.168.12.169:37950 <-> 149.154.167.91:443 [proto: 185/Telegram][IP: 185/Telegram][Encrypted][Confidence: Match by IP][FPC: 185/Telegram, Confidence: IP address][DPI packets: 4][cat: Chat/9][156 pkts/40749 bytes <-> 214 pkts/142865 bytes][Goodput ratio: 75/90][41.14 sec][bytes ratio: -0.556 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 246/152 12847/5983 1291/707][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 261/668 1090/1294 224/564][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.257 (Encrypted Executable?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (MMHu@J)][Plen Bins: 0,0,2,2,4,5,6,4,4,3,0,1,0,0,1,0,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,60,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.12.169:40830 <-> 149.154.167.222:443 [proto: 185/Telegram][IP: 185/Telegram][Encrypted][Confidence: Match by IP][FPC: 185/Telegram, Confidence: IP address][DPI packets: 4][cat: Chat/9][80 pkts/7287 bytes <-> 100 pkts/120708 bytes][Goodput ratio: 27/95][28.19 sec][bytes ratio: -0.886 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 437/1 25008/31 3114/5][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 91/1207 644/1294 95/289][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.638 (Encrypted or Random?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (elySaT)][Plen Bins: 0,0,0,0,0,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,94,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.169:42405 <-> 93.36.13.115:35393 [proto: 78.355/STUN.TelegramVoip][IP: 0/Unknown][Stream Content: Audio, Video][ClearText][Confidence: DPI (cache)][FPC: 78.355/STUN.TelegramVoip, Confidence: DPI][DPI packets: 114][DPI packets before monitoring: 33][cat: VoIP/10][59 pkts/17987 bytes <-> 55 pkts/9102 bytes][Goodput ratio: 86/75][2.02 sec][bytes ratio: 0.328 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 32/28 306/117 48/28][Pkt Len c2s/s2c min/avg/max/stddev: 65/63 305/165 1154/435 330/102][Mapped IP/Port: 93.47.225.70:11624, 93.36.13.115:35393][RTP packets: 2/7][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BPEmhF0)][Plen Bins: 8,28,25,7,0,0,0,15,0,1,1,0,2,1,0,1,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/monitoring/result/telegram_videocall_2.pcapng.out b/tests/cfgs/monitoring/result/telegram_videocall_2.pcapng.out index 9ea7535fa..486a6a711 100644 --- a/tests/cfgs/monitoring/result/telegram_videocall_2.pcapng.out +++ b/tests/cfgs/monitoring/result/telegram_videocall_2.pcapng.out @@ -26,6 +26,9 @@ TelegramVoip 305 130511 4 Acceptable 315 131265 8 +VoIP 305 130511 4 +Network 10 754 4 + JA Host Stats: IP Address # JA4C 1 192.168.12.67 1 diff --git a/tests/cfgs/monitoring/result/telegram_voice.pcapng.out b/tests/cfgs/monitoring/result/telegram_voice.pcapng.out index 930e9033f..62a6b3020 100644 --- a/tests/cfgs/monitoring/result/telegram_voice.pcapng.out +++ b/tests/cfgs/monitoring/result/telegram_voice.pcapng.out @@ -29,6 +29,10 @@ TelegramVoip 853 161775 5 Acceptable 868 163553 10 +Chat 6 564 1 +VoIP 853 161775 5 +Network 9 1214 4 + JA Host Stats: IP Address # JA4C 1 192.168.12.67 1 diff --git a/tests/cfgs/ndpireader_conf_file/result/openvpn_obfuscated.pcapng.out b/tests/cfgs/ndpireader_conf_file/result/openvpn_obfuscated.pcapng.out index e9cc19b80..b3b379f11 100644 --- a/tests/cfgs/ndpireader_conf_file/result/openvpn_obfuscated.pcapng.out +++ b/tests/cfgs/ndpireader_conf_file/result/openvpn_obfuscated.pcapng.out @@ -28,6 +28,9 @@ NordVPN 30 10598 1 Safe 60 17222 1 Acceptable 117 36067 2 +VPN 117 36067 2 +Web 60 17222 1 + 1 TCP 107.161.86.131:443 <-> 192.168.12.156:48072 [proto: 159/OpenVPN][IP: 0/Unknown][Encrypted][Confidence: DPI (aggressive)][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 40][cat: VPN/2][40 pkts/9272 bytes <-> 47 pkts/16197 bytes][Goodput ratio: 70/81][3.15 sec][bytes ratio: -0.272 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 57/52 212/303 66/79][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 232/345 1514/1090 370/406][Risk: ** Known Proto on Non Std Port **** Obfuscated Traffic **][Risk Score: 150][Risk Info: Obfuscated OpenVPN][PLAIN TEXT (MhLYoT)][Plen Bins: 35,3,3,15,1,1,0,0,1,3,5,1,0,1,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,18,0,0,0,0,0,0,0,0,0,1,0,0,3,0,0] 2 TCP 192.168.12.156:37976 <-> 185.128.25.99:465 [proto: 91/TLS][IP: 426/NordVPN][Encrypted][Confidence: DPI (aggressive)][FPC: 426/NordVPN, Confidence: IP address][DPI packets: 19][cat: Web/5][29 pkts/7410 bytes <-> 31 pkts/9812 bytes][Goodput ratio: 74/79][1.73 sec][bytes ratio: -0.139 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 66/26 1019/153 204/31][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 256/317 1090/1514 256/424][Risk: ** Known Proto on Non Std Port **** Obfuscated Traffic **][Risk Score: 150][Risk Info: Obfuscated TLS traffic][TCP Fingerprint: 2_64_65535_685ad951a756/Android][Plen Bins: 0,0,14,30,14,2,0,2,5,0,5,5,2,0,0,2,0,0,0,0,0,2,0,2,0,2,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,7,0,0] 3 UDP 192.168.12.156:47128 <-> 149.102.238.108:1214 [proto: 159.426/OpenVPN.NordVPN][IP: 426/NordVPN][Encrypted][Confidence: DPI (aggressive)][FPC: 426/NordVPN, Confidence: IP address][DPI packets: 10][cat: VPN/2][19 pkts/3629 bytes <-> 11 pkts/6969 bytes][Goodput ratio: 78/93][1.26 sec][bytes ratio: -0.315 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 78/132 1156/1023 278/337][Pkt Len c2s/s2c min/avg/max/stddev: 115/136 191/634 782/1158 153/438][Risk: ** Known Proto on Non Std Port **** Susp Entropy **** Obfuscated Traffic **][Risk Score: 160][Risk Info: Obfuscated OpenVPN][PLAIN TEXT (SFhAFI)][Plen Bins: 0,0,23,41,3,0,0,0,3,0,3,6,0,0,0,0,0,0,0,0,0,0,0,3,0,3,0,0,0,0,0,0,0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/ndpireader_conf_file/result/shadowsocks.pcap.out b/tests/cfgs/ndpireader_conf_file/result/shadowsocks.pcap.out index db6dc3847..bee328c88 100644 --- a/tests/cfgs/ndpireader_conf_file/result/shadowsocks.pcap.out +++ b/tests/cfgs/ndpireader_conf_file/result/shadowsocks.pcap.out @@ -27,6 +27,9 @@ SOCKS 29 69355 1 Acceptable 29 69355 1 Unrated 15 68444 1 +Unspecified 15 68444 1 +Web 29 69355 1 + 1 TCP 127.0.0.1:37904 <-> 127.0.0.1:1080 [proto: 172/SOCKS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Web/5][16 pkts/1160 bytes <-> 13 pkts/68195 bytes][Goodput ratio: 8/99][1.49 sec][bytes ratio: -0.967 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 114/160 659/660 191/203][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 72/5246 148/16450 20/7185][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 33,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,41] diff --git a/tests/cfgs/ndpireader_conf_file/result/signal_videocall.pcapng.out b/tests/cfgs/ndpireader_conf_file/result/signal_videocall.pcapng.out index 0ef342f82..fa93bd15f 100644 --- a/tests/cfgs/ndpireader_conf_file/result/signal_videocall.pcapng.out +++ b/tests/cfgs/ndpireader_conf_file/result/signal_videocall.pcapng.out @@ -25,6 +25,8 @@ SignalVoip 334 123259 3 Acceptable 334 123259 3 +VoIP 334 123259 3 + 1 UDP 192.168.12.67:47926 <-> 35.219.252.146:56377 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Stream Content: Audio, Video][Encrypted][Confidence: DPI][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 298][DPI packets before monitoring: 201][cat: VoIP/10][167 pkts/87565 bytes <-> 131 pkts/31930 bytes][Goodput ratio: 92/83][10.75 sec][bytes ratio: 0.466 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 64/82 2304/2449 291/279][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 524/244 1223/900 385/198][Mapped IP/Port: 93.35.168.30:45266, 35.219.252.146:56377][RTP packets: 68/124][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][PLAIN TEXT (17uAgN)][Plen Bins: 3,28,9,7,0,0,0,0,16,8,1,0,0,1,1,0,1,1,0,1,0,0,0,0,7,3,0,1,0,0,1,1,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:47926 <-> 35.219.252.146:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 26][cat: VoIP/10][13 pkts/1258 bytes <-> 13 pkts/1454 bytes][Goodput ratio: 57/62][10.01 sec][Hostname/SNI: signal.org][bytes ratio: -0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 6/6 804/804 4015/4015 1248/1248][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 97/112 162/126 43/14][Mapped IP/Port: 93.35.168.30:45265][Peer IP/Port: 35.219.252.146:56377, 35.219.252.146:34099, 35.219.252.146:37175][Relayed IP/Port: 35.219.252.146:40378][PLAIN TEXT (BFODsIPgWuCIX)][Plen Bins: 34,19,30,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:47926 <-> 35.216.234.234:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78/STUN, Confidence: DPI][DPI packets: 10][cat: VoIP/10][5 pkts/510 bytes <-> 5 pkts/542 bytes][Goodput ratio: 59/61][10.02 sec][Hostname/SNI: signal.org][bytes ratio: -0.030 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5/4 2503/2503 9988/9988 4321/4321][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 102/108 158/126 46/15][Mapped IP/Port: 93.35.168.30:45265][Relayed IP/Port: 35.216.234.234:29688][PLAIN TEXT (42oPBlgi)][Plen Bins: 30,30,20,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/ndpireader_conf_file/result/stun_signal_tcp.pcapng.out b/tests/cfgs/ndpireader_conf_file/result/stun_signal_tcp.pcapng.out index 3af738f30..9ed07d25c 100644 --- a/tests/cfgs/ndpireader_conf_file/result/stun_signal_tcp.pcapng.out +++ b/tests/cfgs/ndpireader_conf_file/result/stun_signal_tcp.pcapng.out @@ -24,4 +24,6 @@ SignalVoip 500 114216 1 Acceptable 500 114216 1 +VoIP 500 114216 1 + 1 TCP 192.168.1.117:51296 <-> 35.219.252.146:80 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Stream Content: Audio, Video][Encrypted][Confidence: DPI][FPC: 284/GoogleCloud, Confidence: IP address][DPI packets: 500][DPI packets before monitoring: 204][cat: VoIP/10][226 pkts/71104 bytes <-> 274 pkts/43112 bytes][Goodput ratio: 82/64][17.42 sec][Hostname/SNI: signal.org][bytes ratio: 0.245 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/68 2434/2433 281/278][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 315/157 1242/1474 338/185][Mapped IP/Port: 93.35.171.86:51262, 35.219.252.146:13140, 93.33.26.150:37920][Peer IP/Port: 93.33.26.150:37920, 35.219.252.146:17691, 35.219.252.146:38054, 35.219.252.146:18788][Relayed IP/Port: 35.219.252.146:13140][RTP packets: 106/62][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (LODkFIIf)][Plen Bins: 0,21,18,20,5,0,0,0,21,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/openvpn_heuristic_enabled/result/openvpn_obfuscated.pcapng.out b/tests/cfgs/openvpn_heuristic_enabled/result/openvpn_obfuscated.pcapng.out index 55689181c..918984a45 100644 --- a/tests/cfgs/openvpn_heuristic_enabled/result/openvpn_obfuscated.pcapng.out +++ b/tests/cfgs/openvpn_heuristic_enabled/result/openvpn_obfuscated.pcapng.out @@ -26,6 +26,8 @@ NordVPN 90 27820 2 Acceptable 177 53289 3 +VPN 177 53289 3 + 1 TCP 107.161.86.131:443 <-> 192.168.12.156:48072 [proto: 159/OpenVPN][IP: 0/Unknown][Encrypted][Confidence: DPI (aggressive)][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 40][cat: VPN/2][40 pkts/9272 bytes <-> 47 pkts/16197 bytes][Goodput ratio: 70/81][3.15 sec][bytes ratio: -0.272 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 57/52 212/303 66/79][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 232/345 1514/1090 370/406][Risk: ** Known Proto on Non Std Port **** Obfuscated Traffic **][Risk Score: 150][Risk Info: Obfuscated OpenVPN / Expected on port 1194][PLAIN TEXT (MhLYoT)][Plen Bins: 35,3,3,15,1,1,0,0,1,3,5,1,0,1,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,18,0,0,0,0,0,0,0,0,0,1,0,0,3,0,0] 2 TCP 192.168.12.156:37976 <-> 185.128.25.99:465 [proto: 159.426/OpenVPN.NordVPN][IP: 426/NordVPN][Encrypted][Confidence: DPI (aggressive)][FPC: 426/NordVPN, Confidence: IP address][DPI packets: 19][cat: VPN/2][29 pkts/7410 bytes <-> 31 pkts/9812 bytes][Goodput ratio: 74/79][1.73 sec][bytes ratio: -0.139 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 66/26 1019/153 204/31][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 256/317 1090/1514 256/424][Risk: ** Known Proto on Non Std Port **** Susp Entropy **** Obfuscated Traffic **][Risk Score: 160][Risk Info: Obfuscated OpenVPN / Entropy: 7.132 (Compressed Executable?) / Expected on port 1194][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (HrFTzP)][Plen Bins: 0,0,14,30,14,2,0,2,5,0,5,5,2,0,0,2,0,0,0,0,0,2,0,2,0,2,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,7,0,0] 3 UDP 192.168.12.156:47128 <-> 149.102.238.108:1214 [proto: 159.426/OpenVPN.NordVPN][IP: 426/NordVPN][Encrypted][Confidence: DPI (aggressive)][FPC: 426/NordVPN, Confidence: IP address][DPI packets: 10][cat: VPN/2][19 pkts/3629 bytes <-> 11 pkts/6969 bytes][Goodput ratio: 78/93][1.26 sec][bytes ratio: -0.315 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 78/132 1156/1023 278/337][Pkt Len c2s/s2c min/avg/max/stddev: 115/136 191/634 782/1158 153/438][Risk: ** Known Proto on Non Std Port **** Susp Entropy **** Obfuscated Traffic **][Risk Score: 160][Risk Info: Obfuscated OpenVPN / Entropy: 6.051 (Executable?) / Expected on port 1194][PLAIN TEXT (SFhAFI)][Plen Bins: 0,0,23,41,3,0,0,0,3,0,3,6,0,0,0,0,0,0,0,0,0,0,0,3,0,3,0,0,0,0,0,0,0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/packets_limit_per_flow/result/tls_verylong_certificate.pcap.out b/tests/cfgs/packets_limit_per_flow/result/tls_verylong_certificate.pcap.out index 234c188df..c8680c8bb 100644 --- a/tests/cfgs/packets_limit_per_flow/result/tls_verylong_certificate.pcap.out +++ b/tests/cfgs/packets_limit_per_flow/result/tls_verylong_certificate.pcap.out @@ -26,4 +26,6 @@ TLS 48 22229 1 Safe 48 22229 1 +Web 48 22229 1 + 1 TCP 192.168.1.160:54804 <-> 151.101.66.49:443 [proto: 91/TLS][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][24 pkts/2404 bytes <-> 24 pkts/19825 bytes][Goodput ratio: 35/92][0.09 sec][bytes ratio: -0.784 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/4 15/21 5/7][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 100/826 583/1434 109/662][TCP Fingerprint: 2_64_65535_15db81ff8b0d/Unknown][Plen Bins: 12,16,0,4,0,4,4,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,55,0,0,0,0,0] diff --git a/tests/cfgs/stun_extra_dissection/result/lru_ipv6_caches.pcapng.out b/tests/cfgs/stun_extra_dissection/result/lru_ipv6_caches.pcapng.out index 8e1aaad96..45cf940bb 100644 --- a/tests/cfgs/stun_extra_dissection/result/lru_ipv6_caches.pcapng.out +++ b/tests/cfgs/stun_extra_dissection/result/lru_ipv6_caches.pcapng.out @@ -29,6 +29,11 @@ Cloudflare 9 8862 3 Acceptable 88 20854 12 +Media 30 3450 1 +Web 9 8862 3 +Download 25 4546 5 +VoIP 24 3996 3 + JA Host Stats: IP Address # JA4C diff --git a/tests/cfgs/stun_extra_dissection/result/stun_dtls_rtp.pcapng.out b/tests/cfgs/stun_extra_dissection/result/stun_dtls_rtp.pcapng.out index 14d0305ab..12f92f656 100644 --- a/tests/cfgs/stun_extra_dissection/result/stun_dtls_rtp.pcapng.out +++ b/tests/cfgs/stun_extra_dissection/result/stun_dtls_rtp.pcapng.out @@ -25,6 +25,8 @@ GoogleCall 102 26347 2 Acceptable 102 26347 2 +VoIP 102 26347 2 + JA Host Stats: IP Address # JA4C 1 192.168.12.156 1 diff --git a/tests/cfgs/stun_extra_dissection/result/stun_dtls_rtp_unidir.pcapng.out b/tests/cfgs/stun_extra_dissection/result/stun_dtls_rtp_unidir.pcapng.out index e085b714b..cfbfe609c 100644 --- a/tests/cfgs/stun_extra_dissection/result/stun_dtls_rtp_unidir.pcapng.out +++ b/tests/cfgs/stun_extra_dissection/result/stun_dtls_rtp_unidir.pcapng.out @@ -24,6 +24,8 @@ SRTP 43 10358 2 Acceptable 43 10358 2 +Media 43 10358 2 + JA Host Stats: IP Address # JA4C 1 10.10.0.1 1 diff --git a/tests/cfgs/stun_extra_dissection/result/stun_zoom.pcapng.out b/tests/cfgs/stun_extra_dissection/result/stun_zoom.pcapng.out index 0d6eeb4e6..e87ec14e0 100644 --- a/tests/cfgs/stun_extra_dissection/result/stun_zoom.pcapng.out +++ b/tests/cfgs/stun_extra_dissection/result/stun_zoom.pcapng.out @@ -24,6 +24,8 @@ Zoom 70 18258 2 Acceptable 70 18258 2 +Video 70 18258 2 + JA Host Stats: IP Address # JA4C 1 192.168.43.169 1 diff --git a/tests/cfgs/stun_only_peer_address_enabled/result/stun_wa_call.pcapng.out b/tests/cfgs/stun_only_peer_address_enabled/result/stun_wa_call.pcapng.out index a838ea5c7..054fa9abb 100644 --- a/tests/cfgs/stun_only_peer_address_enabled/result/stun_wa_call.pcapng.out +++ b/tests/cfgs/stun_only_peer_address_enabled/result/stun_wa_call.pcapng.out @@ -27,6 +27,9 @@ ICMP 1 110 1 Acceptable 591 133689 13 +VoIP 590 133579 12 +Network 1 110 1 + 1 UDP 192.168.12.156:46652 <-> 93.57.123.227:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][171 pkts/28371 bytes <-> 206 pkts/29803 bytes][Goodput ratio: 75/71][31.78 sec][bytes ratio: -0.025 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 178/151 2505/2463 255/222][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 166/145 434/446 100/85][Plen Bins: 14,41,11,8,2,2,3,2,5,4,1,1,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.156:49526 <-> 157.240.203.62:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 119/Facebook][ClearText][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 7][cat: VoIP/10][48 pkts/12953 bytes <-> 73 pkts/40083 bytes][Goodput ratio: 84/92][14.68 sec][bytes ratio: -0.512 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 191/164 3009/3009 684/623][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 270/549 542/1155 203/421][PLAIN TEXT (dsUmpy)][Plen Bins: 8,18,19,1,0,0,0,0,3,0,0,0,0,0,0,14,14,0,0,0,0,0,0,0,0,0,0,0,2,4,2,1,2,3,4,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.156:49526 <-> 93.33.118.87:41107 [proto: 338.45/SRTP.WhatsAppCall][IP: 0/Unknown][Stream Content: Audio][Encrypted][Confidence: DPI][FPC: 78.45/STUN.WhatsAppCall, Confidence: DPI][DPI packets: 5][cat: VoIP/10][8 pkts/3465 bytes <-> 8 pkts/5392 bytes][Goodput ratio: 90/94][0.38 sec][bytes ratio: -0.218 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 53/35 124/160 55/59][Pkt Len c2s/s2c min/avg/max/stddev: 75/86 433/674 997/876 437/340][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][Plen Bins: 0,38,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,18,18,0,0,18,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/stun_only_peer_address_enabled/result/telegram_videocall.pcapng.out b/tests/cfgs/stun_only_peer_address_enabled/result/telegram_videocall.pcapng.out index b23f49157..1ce0d03b3 100644 --- a/tests/cfgs/stun_only_peer_address_enabled/result/telegram_videocall.pcapng.out +++ b/tests/cfgs/stun_only_peer_address_enabled/result/telegram_videocall.pcapng.out @@ -39,6 +39,12 @@ TelegramVoip 228 41561 16 Safe 4 295 1 Acceptable 883 382822 33 +Web 4 295 1 +Chat 636 339253 8 +VoIP 228 41561 16 +Cloud 6 636 2 +Network 13 1372 7 + 1 TCP 192.168.12.169:37950 <-> 149.154.167.91:443 [proto: 185/Telegram][IP: 185/Telegram][Encrypted][Confidence: Match by IP][FPC: 185/Telegram, Confidence: IP address][DPI packets: 4][cat: Chat/9][156 pkts/40749 bytes <-> 214 pkts/142865 bytes][Goodput ratio: 75/90][41.14 sec][bytes ratio: -0.556 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 246/152 12847/5983 1291/707][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 261/668 1090/1294 224/564][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.257 (Encrypted Executable?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (MMHu@J)][Plen Bins: 0,0,2,2,4,5,6,4,4,3,0,1,0,0,1,0,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,60,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.12.169:40830 <-> 149.154.167.222:443 [proto: 185/Telegram][IP: 185/Telegram][Encrypted][Confidence: Match by IP][FPC: 185/Telegram, Confidence: IP address][DPI packets: 4][cat: Chat/9][80 pkts/7287 bytes <-> 100 pkts/120708 bytes][Goodput ratio: 27/95][28.19 sec][bytes ratio: -0.886 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 437/1 25008/31 3114/5][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 91/1207 644/1294 95/289][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 7.638 (Encrypted or Random?)][TCP Fingerprint: 2_64_65535_685ad951a756/Android][PLAIN TEXT (elySaT)][Plen Bins: 0,0,0,0,0,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,94,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.169:42405 <-> 93.36.13.115:35393 [proto: 78.355/STUN.TelegramVoip][IP: 0/Unknown][ClearText][Confidence: DPI (cache)][FPC: 78.355/STUN.TelegramVoip, Confidence: DPI][DPI packets: 7][cat: VoIP/10][59 pkts/17987 bytes <-> 55 pkts/9102 bytes][Goodput ratio: 86/75][2.02 sec][bytes ratio: 0.328 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 32/28 306/117 48/28][Pkt Len c2s/s2c min/avg/max/stddev: 65/63 305/165 1154/435 330/102][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BPEmhF0)][Plen Bins: 8,28,25,7,0,0,0,15,0,1,1,0,2,1,0,1,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/subclassification_disable/result/anydesk.pcapng.out b/tests/cfgs/subclassification_disable/result/anydesk.pcapng.out index 3bdc79b62..7c92f3025 100644 --- a/tests/cfgs/subclassification_disable/result/anydesk.pcapng.out +++ b/tests/cfgs/subclassification_disable/result/anydesk.pcapng.out @@ -27,6 +27,9 @@ TLS 170 45725 5 Safe 170 45725 5 Acceptable 4 392 2 +Web 170 45725 5 +Network 4 392 2 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 1 diff --git a/tests/cfgs/subclassification_disable/result/dns.pcap.out b/tests/cfgs/subclassification_disable/result/dns.pcap.out index 897c122ac..35770a620 100644 --- a/tests/cfgs/subclassification_disable/result/dns.pcap.out +++ b/tests/cfgs/subclassification_disable/result/dns.pcap.out @@ -26,6 +26,8 @@ MDNS 1 371 1 Acceptable 17 3553 4 +Network 17 3553 4 + 1 TCP [2001:b07:a3d:c112:b831:a73f:7974:e604]:49774 <-> [2001:b07:a3d:c112::1]:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 6][cat: Network/14][6 pkts/490 bytes <-> 5 pkts/2156 bytes][Goodput ratio: 7/82][0.01 sec][Hostname/SNI: opentracker.io][45.9.60.30][DNS Id: 0x3d73][bytes ratio: -0.630 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2/2 6/5 3/2][Pkt Len c2s/s2c min/avg/max/stddev: 74/74 82/431 108/1294 13/481][TCP Fingerprint: 2_64_65535_108f896b6121/Unknown][PLAIN TEXT (opentracker)][Plen Bins: 0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0] 2 UDP [fe80::a00:27ff:feb3:e62e]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 8/MDNS, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/371 bytes -> 0 pkts/0 bytes][Goodput ratio: 83/0][< 1 sec][Hostname/SNI: e.2.6.e.3.b.e.f.f.f.7.2.0.0.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa][e.2.6.e.3.b.e.f.f.f.7.2.0.0.a.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa][PLAIN TEXT (Android)][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 82.178.113.245:47255 <-> 82.178.158.181:53 [VLAN: 785][proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 5/DNS, Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/91 bytes <-> 1 pkts/219 bytes][Goodput ratio: 36/73][0.00 sec][Hostname/SNI: e7.whatsapp.net][169.45.219.235][DNS Id: 0x7843][PLAIN TEXT (whatsapp)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/subclassification_disable/result/http.pcapng.out b/tests/cfgs/subclassification_disable/result/http.pcapng.out index 6e3fea81c..b490d6f6b 100644 --- a/tests/cfgs/subclassification_disable/result/http.pcapng.out +++ b/tests/cfgs/subclassification_disable/result/http.pcapng.out @@ -24,4 +24,6 @@ HTTP 10 1278 1 Acceptable 10 1278 1 +Web 10 1278 1 + 1 TCP 192.168.1.128:42170 <-> 216.58.208.142:80 [proto: 7/HTTP][IP: 126/Google][ClearText][Confidence: DPI][FPC: 126/Google, Confidence: IP address][DPI packets: 6][cat: Web/5][6 pkts/478 bytes <-> 4 pkts/800 bytes][Goodput ratio: 15/66][0.04 sec][Hostname/SNI: google.com][bytes ratio: -0.252 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/7 8/14 28/20 10/6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 80/200 140/594 27/227][URL: google.com/][StatusCode: 301][Content-Type: text/html][Server: gws][User-Agent: curl/7.68.0][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/subclassification_disable/result/quic-mvfst-27.pcapng.out b/tests/cfgs/subclassification_disable/result/quic-mvfst-27.pcapng.out index 6c035b8eb..4345577db 100644 --- a/tests/cfgs/subclassification_disable/result/quic-mvfst-27.pcapng.out +++ b/tests/cfgs/subclassification_disable/result/quic-mvfst-27.pcapng.out @@ -24,6 +24,8 @@ QUIC 20 11399 1 Acceptable 20 11399 1 +Web 20 11399 1 + JA Host Stats: IP Address # JA4C 1 10.0.2.15 1 diff --git a/tests/cfgs/subclassification_disable/result/tls_ech.pcapng.out b/tests/cfgs/subclassification_disable/result/tls_ech.pcapng.out index 5c416e21f..8a051725e 100644 --- a/tests/cfgs/subclassification_disable/result/tls_ech.pcapng.out +++ b/tests/cfgs/subclassification_disable/result/tls_ech.pcapng.out @@ -24,6 +24,8 @@ TLS 10 4226 1 Safe 10 4226 1 +Web 10 4226 1 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:ce16:b409:3d0a:9177 1 diff --git a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__shadowsocks-tcp.pcapng.out b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__shadowsocks-tcp.pcapng.out index c91526ca0..cf8e83ebf 100644 --- a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__shadowsocks-tcp.pcapng.out +++ b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__shadowsocks-tcp.pcapng.out @@ -31,6 +31,10 @@ Safe 25 22923 1 Acceptable 34 22102 2 Fun 41 36148 1 +Media 41 36148 1 +Web 55 44253 2 +Network 4 772 1 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:8628:88aa:8b00:913c 1 diff --git a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__trojan-tcp-tls.pcapng.out b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__trojan-tcp-tls.pcapng.out index b06708a52..867ffa494 100644 --- a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__trojan-tcp-tls.pcapng.out +++ b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__trojan-tcp-tls.pcapng.out @@ -31,6 +31,10 @@ Safe 25 11617 1 Acceptable 43 12236 8 Fun 32 15921 1 +Media 32 15921 1 +Web 52 21596 2 +Network 16 2257 7 + JA Host Stats: IP Address # JA4C 1 127.0.0.1 1 diff --git a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-tcp-tls.pcapng.out b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-tcp-tls.pcapng.out index d6833726e..235ec8bdf 100644 --- a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-tcp-tls.pcapng.out +++ b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-tcp-tls.pcapng.out @@ -31,6 +31,10 @@ Safe 30 14152 1 Acceptable 44 12052 8 Fun 26 20991 1 +Media 26 20991 1 +Web 58 24198 2 +Network 16 2006 7 + JA Host Stats: IP Address # JA4C 1 127.0.0.1 1 diff --git a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-tcp.pcapng.out b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-tcp.pcapng.out index 2f45e38c4..6b0e7896d 100644 --- a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-tcp.pcapng.out +++ b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-tcp.pcapng.out @@ -31,6 +31,10 @@ Safe 29 22543 1 Acceptable 34 22245 2 Fun 37 24955 1 +Media 37 24955 1 +Web 59 43888 2 +Network 4 900 1 + JA Host Stats: IP Address # JA4C 1 2001:b07:a3d:c112:8628:88aa:8b00:913c 1 diff --git a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-websocket.pcapng.out b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-websocket.pcapng.out index c563552f8..b75e7e277 100644 --- a/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-websocket.pcapng.out +++ b/tests/cfgs/tls_heuristics_enabled/result/tls_heur__vmess-websocket.pcapng.out @@ -30,6 +30,10 @@ WebSocket 35 22912 1 Acceptable 72 45159 3 Fun 28 23909 1 +Media 28 23909 1 +Web 68 44387 2 +Network 4 772 1 + JA Host Stats: IP Address # JA4C 1 192.168.1.183 1 diff --git a/tests/cfgs/zoom_extra_dissection/result/zoom.pcap.out b/tests/cfgs/zoom_extra_dissection/result/zoom.pcap.out index 76c02cc16..ff36f1cd0 100644 --- a/tests/cfgs/zoom_extra_dissection/result/zoom.pcap.out +++ b/tests/cfgs/zoom_extra_dissection/result/zoom.pcap.out @@ -43,6 +43,13 @@ Safe 40 11444 4 Acceptable 737 370956 29 Fun 1 86 1 +Email 2 226 1 +Web 28 8965 4 +Network 37 5926 11 +System 4 498 2 +Music 1 86 1 +Video 706 366785 15 + JA Host Stats: IP Address # JA4C 1 192.168.1.117 4 diff --git a/tests/cfgs/zoom_extra_dissection/result/zoom2.pcap.out b/tests/cfgs/zoom_extra_dissection/result/zoom2.pcap.out index d4dbe2354..e1dcec46f 100644 --- a/tests/cfgs/zoom_extra_dissection/result/zoom2.pcap.out +++ b/tests/cfgs/zoom_extra_dissection/result/zoom2.pcap.out @@ -25,6 +25,8 @@ Zoom 342 112658 4 Acceptable 342 112658 4 +Video 342 112658 4 + JA Host Stats: IP Address # JA4C 1 192.168.1.178 1 diff --git a/tests/cfgs/zoom_extra_dissection/result/zoom_p2p.pcapng.out b/tests/cfgs/zoom_extra_dissection/result/zoom_p2p.pcapng.out index 1e64e4ea9..3df8e8685 100644 --- a/tests/cfgs/zoom_extra_dissection/result/zoom_p2p.pcapng.out +++ b/tests/cfgs/zoom_extra_dissection/result/zoom_p2p.pcapng.out @@ -28,6 +28,10 @@ Zoom 691 262429 8 Acceptable 763 271804 12 +Cloud 16 2784 1 +Network 56 6591 3 +Video 691 262429 8 + 1 UDP 192.168.12.156:39065 <-> 192.168.1.226:46757 [proto: 338.189/SRTP.Zoom][IP: 0/Unknown][Stream Content: Video][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 12][cat: Video/26][148 pkts/108673 bytes <-> 174 pkts/110457 bytes][Goodput ratio: 94/93][1.67 sec][bytes ratio: -0.008 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/8 88/71 15/12][Pkt Len c2s/s2c min/avg/max/stddev: 127/98 734/635 1269/1302 277/371][PLAIN TEXT (192.168.1.226)][Plen Bins: 0,0,9,1,0,0,0,6,1,0,0,0,0,2,5,11,10,5,4,4,2,0,0,1,2,2,0,0,0,0,0,1,16,0,0,0,3,1,5,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.156:49579 -> 10.78.14.178:49586 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 154][cat: Video/26][154 pkts/19404 bytes -> 0 pkts/0 bytes][Goodput ratio: 67/0][4.51 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 28/0 82/0 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 126/0 126/0 126/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (10.78.14.178)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.156:42208 -> 10.78.14.178:47312 [proto: 189/Zoom][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 189/Zoom, Confidence: DPI][DPI packets: 130][cat: Video/26][130 pkts/16380 bytes -> 0 pkts/0 bytes][Goodput ratio: 67/0][2.24 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 18/0 82/0 18/0][Pkt Len c2s/s2c min/avg/max/stddev: 126/0 126/0 126/0 0/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (10.78.14.178)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |