diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2022-07-30 12:05:43 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-07-30 12:05:43 +0200 |
| commit | d54d5083b3682b4223e1b8fb0b033b5c293174d5 (patch) | |
| tree | e466950af5c26f625fc36956a860afaa24fdfb23 /tests/result/pops.pcapng.out | |
| parent | 8402bd68ad95f486f3dc12984cb39ffd8351ea1d (diff) | |
SMTPS, POPS, IMAPS: fix classification and extra dissection (#1685)
The big change in TLS code is to allow "master" protocols other than
TLS/DTLS, like SMTPS, POPS and IMAPS.
This change will allow, in a future, a proper and complete TLS dissection
for all these protocols with "STARTTLS"-like messages.
Diffstat (limited to 'tests/result/pops.pcapng.out')
| -rw-r--r-- | tests/result/pops.pcapng.out | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/tests/result/pops.pcapng.out b/tests/result/pops.pcapng.out index 862267786..0b1470474 100644 --- a/tests/result/pops.pcapng.out +++ b/tests/result/pops.pcapng.out @@ -1,6 +1,6 @@ -Guessed flow protos: 0 +Guessed flow protos: 1 -DPI Packets (TCP): 3 (3.00 pkts/flow) +DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) Num dissector calls: 3 (3.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) @@ -26,4 +26,4 @@ JA3 Host Stats: 1 192.168.0.1 1 - 1 TCP 192.168.0.1:55077 <-> 10.10.10.1:995 [proto: 23/POPS][Encrypted][Confidence: DPI][cat: Email/3][2 pkts/304 bytes <-> 3 pkts/2694 bytes][Goodput ratio: 60/94][0.55 sec][Hostname/SNI: pop.secureserver.net][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: 36f7277af969a6947a61ae0b815907a1][Firefox][PLAIN TEXT (pop.secureserver.net)][Plen Bins: 0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0,0,0,0,0] + 1 TCP 192.168.0.1:55077 <-> 10.10.10.1:995 [proto: 23/POPS][Encrypted][Confidence: DPI][cat: Email/3][2 pkts/304 bytes <-> 3 pkts/2694 bytes][Goodput ratio: 60/94][0.55 sec][Hostname/SNI: pop.secureserver.net][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: 36f7277af969a6947a61ae0b815907a1][JA3S: 245de059547a730e42852c315cdc5a02][Firefox][Cipher: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384][PLAIN TEXT (pop.secureserver.net)][Plen Bins: 0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0,0,0,0,0] |