Added risks for checking

- invalid DNS traffic (probably carrying exfiltrated data)
- TLS traffic with no SNI extension

1 files changed, 6 insertions, 0 deletions

diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c
index 8360dd789..b96f52531 100644
--- a/src/lib/ndpi_utils.c
+++ b/src/lib/ndpi_utils.c
@@ -1708,6 +1708,12 @@ const char* ndpi_risk2str(ndpi_risk_enum risk) {
   case NDPI_UNSAFE_PROTOCOL:
     return("Unsafe Protocol");
 
+  case NDPI_DNS_SUSPICIOUS_TRAFFIC:
+    return("Suspicious DNS traffic"); /* Exfiltration ? */
+    
+  case NDPI_TLS_MISSING_SNI:
+    return("SNI TLS extension was missing");
+    
   default:
     snprintf(buf, sizeof(buf), "%d", (int)risk);
     return(buf);