diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2024-07-23 08:50:27 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-07-23 08:50:27 +0200 |
| commit | 85501c9aaabf207b04e3fe961825385f9519f633 (patch) | |
| tree | 9aa1bc85e61707ac7ed17570c076f341bcb89e1b /tests/cfgs/default/result/no_sni.pcap.out | |
| parent | b15337a32bcff7a0b0734cb60c6984229f07a7e5 (diff) | |
FPC: add DPI information (#2514)
If the flow is classified (via DPI) after the first packet, we should
use this information as FPC
Diffstat (limited to 'tests/cfgs/default/result/no_sni.pcap.out')
| -rw-r--r-- | tests/cfgs/default/result/no_sni.pcap.out | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/tests/cfgs/default/result/no_sni.pcap.out b/tests/cfgs/default/result/no_sni.pcap.out index d51fe7e1a..5ecd56967 100644 --- a/tests/cfgs/default/result/no_sni.pcap.out +++ b/tests/cfgs/default/result/no_sni.pcap.out @@ -7,7 +7,7 @@ LRU cache stun: 0/0/0 (insert/search/found) LRU cache tls_cert: 0/12/0 (insert/search/found) LRU cache mining: 0/0/0 (insert/search/found) LRU cache msteams: 0/0/0 (insert/search/found) -LRU cache fpc_dns: 0/8/0 (insert/search/found) +LRU cache fpc_dns: 0/7/0 (insert/search/found) Automa host: 3/1 (search/found) Automa domain: 3/0 (search/found) Automa tls cert: 0/0 (search/found) @@ -38,4 +38,4 @@ JA3 Host Stats: 5 TCP 192.168.1.119:51636 <-> 104.17.198.37:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 6][cat: Web/5][12 pkts/1786 bytes <-> 11 pkts/4212 bytes][Goodput ratio: 62/85][0.56 sec][Hostname/SNI: 951c558a-5e07-47ca-a0c0-225da1b33163.is-doh.help.every1dns.net][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2][bytes ratio: -0.404 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 38/44 117/211 47/72][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 149/383 571/1514 159/503][TLSv1.3][JA3C: aa7744226c695c0b2e440419848cf700][JA4: t13d1814h2_e8a523a41297_d267a5f792d4][JA3S: eb1d94daa7e0344597e756a1fb6e7054][Firefox][Cipher: TLS_AES_128_GCM_SHA256][Plen Bins: 27,0,9,0,0,9,0,0,0,0,18,0,0,0,0,0,18,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0,0,0,0,0,9,0,0] 6 TCP 192.168.1.119:51638 <-> 104.22.72.170:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 6][cat: Web/5][12 pkts/1659 bytes <-> 10 pkts/3915 bytes][Goodput ratio: 59/85][0.56 sec][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2][bytes ratio: -0.405 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 43/30 129/142 42/52][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 138/392 766/1514 196/550][Risk: ** Probing attempt **][Risk Score: 50][Risk Info: TLS/QUIC Probing][TLSv1.3][JA3C: 62a4a00de930bd0a5bee0309cc8362ed][JA4: t13d1813h2_e8a523a41297_0d6ff543c596][JA3S: eb1d94daa7e0344597e756a1fb6e7054][ESNI: 4BC224582D83D9B999D5A6A5C8CA5F7044ECCCB75B644BE507AF762431A6292DA0EFBEED632A2BC868756FF720C5BD83C345E60B3529B7BF7DA4DB25E657E0B126FFCD62BB1544D84A8D81FF78CE3E14BB03DC429F25D34982D42B00F7DCFCD6C0A6D91EAFA2B6A3338187DEB367AA29ED731C52FD0561923C1FF20AE22DA56551A91FEF05347C46D01C51DEEFD63A35801F1D9A11BB271EB163912E7E3C65E877D9637FA0ECBF83787F8D2AF237AAA43E3BC82BD98140C9A227A7EE1D8EB5DB3EC55D9C635A8A525D8ADC7E7C2261A235120A5BB10EC883C9D1956D1C4CB7D3B22B606E085082EE035C09B154074E031EA961651127B1E4F41A36851D026A40C6CDD36712E84A3AACDEDC40319883A9C1C13870A8CC10E79E6A84352D0681134CC97941][ESNI Cipher: TLS_AES_128_GCM_SHA256][Firefox][Cipher: TLS_AES_128_GCM_SHA256][Plen Bins: 25,0,12,0,0,12,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,12,0,0] 7 TCP 192.168.1.119:51639 <-> 104.22.72.170:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 6][cat: Web/5][12 pkts/1659 bytes <-> 10 pkts/3915 bytes][Goodput ratio: 59/85][0.55 sec][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2][bytes ratio: -0.405 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 44/27 126/129 43/47][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 138/392 766/1514 196/550][Risk: ** Probing attempt **][Risk Score: 50][Risk Info: TLS/QUIC Probing][TLSv1.3][JA3C: 62a4a00de930bd0a5bee0309cc8362ed][JA4: t13d1813h2_e8a523a41297_0d6ff543c596][JA3S: eb1d94daa7e0344597e756a1fb6e7054][ESNI: 1A5D1DCC8C47DD46E21570FFB62F999CD85F69983DF08FC0E944E15E9520556C5462F5110EE1FC34F93862ADD6B2DE6FD479263028F82157273B3A728443CE0A259E50F657019E02DD9BB408C7297C541B756A55769B88C04FBF268F677EEBC074CEB1D905770D67E6663B392CF09E80086661BD59F640035FEF65DEF6B93654AD359D9514C4236BBF9F565D299224475DEA5D1813F7AF1CF9A4402AB0ADB1DD2D3075ECE78A216DE6E88A82E89F72BDB3EC3B26604D6433FF5EF71C15FC7E3E624ECC15C1644AC4CF839119636965184DAF8FC115C6C09260306FCE2024D360636EFB39AACB9DCE54226E847B6356F1A2FCA88222266CC21D575EFFBF9FE0F553D99B1AE564AA7A001DA3C775FFE19DCFF96A1814AAF8554B871926B6582467FDA05224][ESNI Cipher: TLS_AES_128_GCM_SHA256][Firefox][Cipher: TLS_AES_128_GCM_SHA256][Plen Bins: 25,0,12,0,0,12,0,0,0,0,0,0,0,0,0,0,12,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,12,0,0,0,12,0,0] - 8 TCP 192.168.1.119:51331 <-> 104.16.249.249:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 220/Cloudflare, Confidence: IP address][DPI packets: 7][cat: Web/5][4 pkts/279 bytes <-> 3 pkts/180 bytes][Goodput ratio: 22/0][0.12 sec][bytes ratio: 0.216 (Upload)][IAT c2s/s2c min/avg/max/stddev: 119/0 40/0 119/0 56/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 70/60 93/60 17/0][Risk: ** Probing attempt **][Risk Score: 50][Risk Info: TCP connection with unidirectional traffic][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 8 TCP 192.168.1.119:51331 <-> 104.16.249.249:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 7][cat: Web/5][4 pkts/279 bytes <-> 3 pkts/180 bytes][Goodput ratio: 22/0][0.12 sec][bytes ratio: 0.216 (Upload)][IAT c2s/s2c min/avg/max/stddev: 119/0 40/0 119/0 56/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 70/60 93/60 17/0][Risk: ** Probing attempt **][Risk Score: 50][Risk Info: TCP connection with unidirectional traffic][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |