diff options
| -rw-r--r-- | example/ndpiReader.c | 41 | ||||
| -rw-r--r-- | src/include/ndpi_api.h | 4 | ||||
| -rw-r--r-- | src/lib/ndpi_analyze.c | 4 | ||||
| -rw-r--r-- | tests/cfgs/default/result/collectd.pcap.out | 2 | ||||
| -rw-r--r-- | tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out | 14 | ||||
| -rw-r--r-- | tests/cfgs/default/result/tls-appdata.pcap.out | 2 |
6 files changed, 39 insertions, 28 deletions
diff --git a/example/ndpiReader.c b/example/ndpiReader.c index 27f300775..0b762e23c 100644 --- a/example/ndpiReader.c +++ b/example/ndpiReader.c @@ -1536,17 +1536,22 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa 100.0*((float)flow->dst2src_goodput_bytes / (float)(flow->dst2src_bytes+1))); /* IAT (Inter Arrival Time) */ - fprintf(csv_fp, "%u,%.1f,%u,%.1f,", - ndpi_data_min(flow->iat_flow), ndpi_data_average(flow->iat_flow), ndpi_data_max(flow->iat_flow), ndpi_data_stddev(flow->iat_flow)); + fprintf(csv_fp, "%llu,%.1f,%llu,%.1f,", + (unsigned long long int)ndpi_data_min(flow->iat_flow), ndpi_data_average(flow->iat_flow), + (unsigned long long int)ndpi_data_max(flow->iat_flow), ndpi_data_stddev(flow->iat_flow)); - fprintf(csv_fp, "%u,%.1f,%u,%.1f,%u,%.1f,%u,%.1f,", - ndpi_data_min(flow->iat_c_to_s), ndpi_data_average(flow->iat_c_to_s), ndpi_data_max(flow->iat_c_to_s), ndpi_data_stddev(flow->iat_c_to_s), - ndpi_data_min(flow->iat_s_to_c), ndpi_data_average(flow->iat_s_to_c), ndpi_data_max(flow->iat_s_to_c), ndpi_data_stddev(flow->iat_s_to_c)); + fprintf(csv_fp, "%llu,%.1f,%llu,%.1f,%llu,%.1f,%llu,%.1f,", + (unsigned long long int)ndpi_data_min(flow->iat_c_to_s), ndpi_data_average(flow->iat_c_to_s), + (unsigned long long int)ndpi_data_max(flow->iat_c_to_s), ndpi_data_stddev(flow->iat_c_to_s), + (unsigned long long int)ndpi_data_min(flow->iat_s_to_c), ndpi_data_average(flow->iat_s_to_c), + (unsigned long long int)ndpi_data_max(flow->iat_s_to_c), ndpi_data_stddev(flow->iat_s_to_c)); /* Packet Length */ - fprintf(csv_fp, "%u,%.1f,%u,%.1f,%u,%.1f,%u,%.1f,", - ndpi_data_min(flow->pktlen_c_to_s), ndpi_data_average(flow->pktlen_c_to_s), ndpi_data_max(flow->pktlen_c_to_s), ndpi_data_stddev(flow->pktlen_c_to_s), - ndpi_data_min(flow->pktlen_s_to_c), ndpi_data_average(flow->pktlen_s_to_c), ndpi_data_max(flow->pktlen_s_to_c), ndpi_data_stddev(flow->pktlen_s_to_c)); + fprintf(csv_fp, "%llu,%.1f,%llu,%.1f,%llu,%.1f,%llu,%.1f,", + (unsigned long long int)ndpi_data_min(flow->pktlen_c_to_s), ndpi_data_average(flow->pktlen_c_to_s), + (unsigned long long int)ndpi_data_max(flow->pktlen_c_to_s), ndpi_data_stddev(flow->pktlen_c_to_s), + (unsigned long long int)ndpi_data_min(flow->pktlen_s_to_c), ndpi_data_average(flow->pktlen_s_to_c), + (unsigned long long int)ndpi_data_max(flow->pktlen_s_to_c), ndpi_data_stddev(flow->pktlen_s_to_c)); /* TCP flags */ fprintf(csv_fp, "%d,%d,%d,%d,%d,%d,%d,%d,", flow->cwr_count, flow->ece_count, flow->urg_count, flow->ack_count, flow->psh_count, flow->rst_count, flow->syn_count, flow->fin_count); @@ -1819,17 +1824,21 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa fprintf(out, "[bytes ratio: %.3f (%s)]", data_ratio, ndpi_data_ratio2str(data_ratio)); /* IAT (Inter Arrival Time) */ - fprintf(out, "[IAT c2s/s2c min/avg/max/stddev: %u/%u %.0f/%.0f %u/%u %.0f/%.0f]", - ndpi_data_min(flow->iat_c_to_s), ndpi_data_min(flow->iat_s_to_c), + fprintf(out, "[IAT c2s/s2c min/avg/max/stddev: %llu/%llu %.0f/%.0f %llu/%llu %.0f/%.0f]", + (unsigned long long int)ndpi_data_min(flow->iat_c_to_s), + (unsigned long long int)ndpi_data_min(flow->iat_s_to_c), (float)ndpi_data_average(flow->iat_c_to_s), (float)ndpi_data_average(flow->iat_s_to_c), - ndpi_data_max(flow->iat_c_to_s), ndpi_data_max(flow->iat_s_to_c), + (unsigned long long int)ndpi_data_max(flow->iat_c_to_s), + (unsigned long long int)ndpi_data_max(flow->iat_s_to_c), (float)ndpi_data_stddev(flow->iat_c_to_s), (float)ndpi_data_stddev(flow->iat_s_to_c)); /* Packet Length */ - fprintf(out, "[Pkt Len c2s/s2c min/avg/max/stddev: %u/%u %.0f/%.0f %u/%u %.0f/%.0f]", - ndpi_data_min(flow->pktlen_c_to_s), ndpi_data_min(flow->pktlen_s_to_c), + fprintf(out, "[Pkt Len c2s/s2c min/avg/max/stddev: %llu/%llu %.0f/%.0f %llu/%llu %.0f/%.0f]", + (unsigned long long int)ndpi_data_min(flow->pktlen_c_to_s), + (unsigned long long int)ndpi_data_min(flow->pktlen_s_to_c), ndpi_data_average(flow->pktlen_c_to_s), ndpi_data_average(flow->pktlen_s_to_c), - ndpi_data_max(flow->pktlen_c_to_s), ndpi_data_max(flow->pktlen_s_to_c), + (unsigned long long int)ndpi_data_max(flow->pktlen_c_to_s), + (unsigned long long int)ndpi_data_max(flow->pktlen_s_to_c), ndpi_data_stddev(flow->pktlen_c_to_s), ndpi_data_stddev(flow->pktlen_s_to_c)); } } @@ -4910,7 +4919,9 @@ void analysisUnitTest() { printf("Average: [all: %f][window: %f]\n", ndpi_data_average(s), ndpi_data_window_average(s)); printf("Entropy: %f\n", ndpi_data_entropy(s)); printf("StdDev: %f\n", ndpi_data_stddev(s)); - printf("Min/Max: %u/%u\n", ndpi_data_min(s), ndpi_data_max(s)); + printf("Min/Max: %llu/%llu\n", + (unsigned long long int)ndpi_data_min(s), + (unsigned long long int)ndpi_data_max(s)); } ndpi_free_data_analysis(s, 1); diff --git a/src/include/ndpi_api.h b/src/include/ndpi_api.h index d7bb344ab..9621f8e37 100644 --- a/src/include/ndpi_api.h +++ b/src/include/ndpi_api.h @@ -1780,8 +1780,8 @@ extern "C" { float ndpi_data_stddev(struct ndpi_analyze_struct *s); float ndpi_data_mean(struct ndpi_analyze_struct *s); u_int64_t ndpi_data_last(struct ndpi_analyze_struct *s); - u_int32_t ndpi_data_min(struct ndpi_analyze_struct *s); - u_int32_t ndpi_data_max(struct ndpi_analyze_struct *s); + u_int64_t ndpi_data_min(struct ndpi_analyze_struct *s); + u_int64_t ndpi_data_max(struct ndpi_analyze_struct *s); float ndpi_data_ratio(u_int32_t sent, u_int32_t rcvd); /* ******************************* */ diff --git a/src/lib/ndpi_analyze.c b/src/lib/ndpi_analyze.c index f6d828107..c905139f8 100644 --- a/src/lib/ndpi_analyze.c +++ b/src/lib/ndpi_analyze.c @@ -150,8 +150,8 @@ u_int64_t ndpi_data_last(struct ndpi_analyze_struct *s) { } /* Return min/max on all values */ -u_int32_t ndpi_data_min(struct ndpi_analyze_struct *s) { return(s ? s->min_val : 0); } -u_int32_t ndpi_data_max(struct ndpi_analyze_struct *s) { return(s ? s->max_val : 0); } +u_int64_t ndpi_data_min(struct ndpi_analyze_struct *s) { return(s ? s->min_val : 0); } +u_int64_t ndpi_data_max(struct ndpi_analyze_struct *s) { return(s ? s->max_val : 0); } /* ********************************************************************************* */ diff --git a/tests/cfgs/default/result/collectd.pcap.out b/tests/cfgs/default/result/collectd.pcap.out index 941666027..e92c559dd 100644 --- a/tests/cfgs/default/result/collectd.pcap.out +++ b/tests/cfgs/default/result/collectd.pcap.out @@ -28,7 +28,7 @@ collectd 81 109386 8 1 UDP 127.0.0.1:35988 -> 127.0.0.1:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: System/18][49 pkts/66012 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][406.49 sec][Hostname/SNI: devlap.fritz.box][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8783/0 10000/0 3188/0][Pkt Len c2s/s2c min/avg/max/stddev: 193/0 1347/0 1388/0 167/0][PLAIN TEXT (devlap.fritz.box)][Plen Bins: 0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,83,10,0,0,0,0,0] 2 UDP 127.0.0.1:36832 -> 127.0.0.1:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: System/18][17 pkts/22755 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][134.67 sec][Hostname/SNI: devlap.fritz.box][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8311/0 10000/0 3518/0][Pkt Len c2s/s2c min/avg/max/stddev: 924/0 1339/0 1384/0 104/0][PLAIN TEXT (devlap.fritz.box)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,5,89,0,0,0,0,0,0] - 3 UDP 192.168.178.35:39576 -> 239.192.74.66:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 6][cat: System/18][6 pkts/8363 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][708570048.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 907/0 141714014208/0 4195363456/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 1274/0 1394/0 1434/0 54/0][PLAIN TEXT (RmBJSP)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,33,50,0,0,0,0] + 3 UDP 192.168.178.35:39576 -> 239.192.74.66:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 6][cat: System/18][6 pkts/8363 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][708570048.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 907/0 141714014208/0 708570000000/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 1274/0 1394/0 1434/0 54/0][PLAIN TEXT (RmBJSP)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,33,50,0,0,0,0] 4 UDP 127.0.0.1:54138 -> 127.0.0.1:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: System/18][5 pkts/6744 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][33.27 sec][Hostname/SNI: devlap.fritz.box][PLAIN TEXT (devlap.fritz.box)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,20,40,20,0,0,0,0,0] 5 UDP 192.168.178.35:39577 -> 239.192.74.66:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: System/18][1 pkts/1408 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0] 6 UDP 127.0.0.1:36064 -> 127.0.0.1:25826 [proto: 298/collectd][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/1368 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Hostname/SNI: devlap.fritz.box][PLAIN TEXT (devlap.fritz.box)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out b/tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out index 5856592bc..8eebf572e 100644 --- a/tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out +++ b/tests/cfgs/default/result/ipsec_isakmp_esp.pcap.out @@ -29,21 +29,21 @@ IPSec 1080 580682 24 2 UDP 192.168.2.100:14500 <-> 109.237.187.130:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][37 pkts/23230 bytes <-> 53 pkts/36862 bytes][Goodput ratio: 93/94][< 1 sec][bytes ratio: -0.227 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 51181/32575 761601/761794 163164/132507][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 628/696 1374/1374 489/539][PLAIN TEXT (H.P.RE)][Plen Bins: 0,0,6,13,20,0,6,0,0,0,0,0,0,6,0,0,0,0,1,0,0,0,0,0,0,6,0,0,0,0,0,0,12,0,0,0,0,0,0,0,6,20,0,0,0,0,0,0] 3 UDP 192.168.2.100:10500 <-> 109.237.187.227:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][54 pkts/44820 bytes <-> 53 pkts/11118 bytes][Goodput ratio: 95/80][< 1 sec][bytes ratio: 0.602 (Upload)][IAT c2s/s2c min/avg/max/stddev: 28/27 689892/698588 12245747/12245747 1998175/2019137][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/210 842/330 12/118][PLAIN TEXT (rMpKau6)][Plen Bins: 0,25,0,0,0,0,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 4 UDP 192.168.2.100:14500 <-> 109.237.187.195:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][42 pkts/30020 bytes <-> 48 pkts/21472 bytes][Goodput ratio: 94/91][15275.72 sec][bytes ratio: 0.166 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 85008/72283 1429414/1429546 288620/266457][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 715/447 1374/1374 518/432][PLAIN TEXT (@yIwAf)][Plen Bins: 0,0,8,13,26,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,4,2,0,0,0,6,0,0,0,0,0,0,0,0,19,0,0,0,0,0,0] - 5 UDP 192.168.2.100:14500 <-> 109.237.187.193:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][43 pkts/32226 bytes <-> 47 pkts/14246 bytes][Goodput ratio: 94/86][18892.62 sec][bytes ratio: 0.387 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 66479/485440637135486976 1521662/4249448008 281113/0][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 749/303 1374/1070 516/284][PLAIN TEXT (@7Ac9 )][Plen Bins: 0,0,12,13,27,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,0,7,0,0,0,5,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0] - 6 UDP 192.168.2.100:14500 <-> 109.237.187.225:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][34 pkts/24848 bytes <-> 41 pkts/17850 bytes][Goodput ratio: 94/90][11474.04 sec][bytes ratio: 0.164 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 55649/558992261317132288 1440343/4237012657 276939/0][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 731/435 1374/1374 517/426][Risk: ** Malformed Packet **][Risk Score: 10][Risk Info: No server to client traffic / Invalid IPSec/ISAKMP Header][PLAIN TEXT (17Uv 2)][Plen Bins: 0,0,9,13,26,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,4,2,0,0,0,6,0,0,0,0,0,0,0,0,18,0,0,0,0,0,0] + 5 UDP 192.168.2.100:14500 <-> 109.237.187.193:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][43 pkts/32226 bytes <-> 47 pkts/14246 bytes][Goodput ratio: 94/86][18892.62 sec][bytes ratio: 0.387 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 66479/485440637135486976 1521662/18446744073664032328 281113/0][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 749/303 1374/1070 516/284][PLAIN TEXT (@7Ac9 )][Plen Bins: 0,0,12,13,27,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,0,7,0,0,0,5,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0] + 6 UDP 192.168.2.100:14500 <-> 109.237.187.225:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][34 pkts/24848 bytes <-> 41 pkts/17850 bytes][Goodput ratio: 94/90][11474.04 sec][bytes ratio: 0.164 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 55649/558992261317132288 1440343/18446744073651596977 276939/0][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 731/435 1374/1374 517/426][Risk: ** Malformed Packet **][Risk Score: 10][Risk Info: No server to client traffic / Invalid IPSec/ISAKMP Header][PLAIN TEXT (17Uv 2)][Plen Bins: 0,0,9,13,26,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,4,2,0,0,0,6,0,0,0,0,0,0,0,0,18,0,0,0,0,0,0] 7 UDP 192.168.2.100:14500 <-> 109.237.187.194:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][22 pkts/15216 bytes <-> 23 pkts/8650 bytes][Goodput ratio: 94/89][13749.36 sec][bytes ratio: 0.275 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 60292/56941 1020541/1007809 240062/230637][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 692/376 1374/1374 518/361][Plen Bins: 0,0,8,13,29,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,2,6,0,0,0,4,0,0,0,0,0,0,0,0,15,0,0,0,0,0,0] 8 UDP 192.168.2.100:14500 <-> 109.237.187.131:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][21 pkts/15042 bytes <-> 24 pkts/7632 bytes][Goodput ratio: 94/87][10912.86 sec][bytes ratio: 0.327 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 27756/24780 439840/418574 106400/93007][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 716/318 1374/1070 518/302][PLAIN TEXT (90dItt)][Plen Bins: 0,0,13,13,27,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,0,6,0,0,0,6,0,0,0,0,0,0,0,0,13,0,0,0,0,0,0] - 9 UDP 192.168.2.100:10500 <-> 109.237.187.195:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][18 pkts/14940 bytes <-> 18 pkts/3816 bytes][Goodput ratio: 95/80][15261.44 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 36/36 192067/1317624635595948032 998367/4281859929 327148/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 10 UDP 192.168.2.100:10500 <-> 109.237.187.193:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][16 pkts/13280 bytes <-> 16 pkts/3392 bytes][Goodput ratio: 95/80][18889.28 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 39/37 306418/1537228718622113792 1523984/4249462086 469614/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 9 UDP 192.168.2.100:10500 <-> 109.237.187.195:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][18 pkts/14940 bytes <-> 18 pkts/3816 bytes][Goodput ratio: 95/80][15261.44 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 36/36 192067/1317624635595948032 998367/18446744073696444249 327148/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 10 UDP 192.168.2.100:10500 <-> 109.237.187.193:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][16 pkts/13280 bytes <-> 16 pkts/3392 bytes][Goodput ratio: 95/80][18889.28 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 39/37 306418/1537228718622113792 1523984/18446744073664046406 469614/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 11 UDP 192.168.2.100:10500 <-> 109.237.187.130:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][12 pkts/9960 bytes <-> 12 pkts/2544 bytes][Goodput ratio: 95/80][< 1 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 35/35 252278/252277 1325428/1325428 408560/408559][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 12 UDP 192.168.2.100:10500 <-> 109.237.187.225:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][10 pkts/8300 bytes <-> 10 pkts/2120 bytes][Goodput ratio: 95/80][11474.15 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 31/32 6872697/2305843009213693952 45333681/4237027358 15713330/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 12 UDP 192.168.2.100:10500 <-> 109.237.187.225:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][10 pkts/8300 bytes <-> 10 pkts/2120 bytes][Goodput ratio: 95/80][11474.15 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 31/32 6872697/2305843009213693952 45333681/18446744073651611678 15713330/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 13 UDP 192.168.2.100:42593 <-> 109.237.187.193:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][6 pkts/3464 bytes <-> 9 pkts/5922 bytes][Goodput ratio: 93/94][< 1 sec][bytes ratio: -0.262 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 486/359 1429/1442 536/526][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 577/658 1198/1198 452/478][Plen Bins: 0,0,6,13,13,0,6,0,6,0,0,0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,34,0,0,0,0,0,0,0,0,0,0,0] 14 UDP 192.168.2.100:43811 <-> 109.237.187.193:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][6 pkts/3480 bytes <-> 9 pkts/5778 bytes][Goodput ratio: 93/93][2.75 sec][bytes ratio: -0.248 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 512/366 1540/1553 591/565][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 580/642 1150/1150 421/460][PLAIN TEXT ( GZFVi)][Plen Bins: 0,0,6,13,13,0,6,0,0,0,0,6,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,41,0,0,0,0,0,0,0,0,0,0,0,0,0] - 15 UDP 192.168.2.100:10500 <-> 109.237.187.194:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][8 pkts/6640 bytes <-> 8 pkts/1696 bytes][Goodput ratio: 95/80][13749.45 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 37/37 224522/3074457437244227584 1021965/4279696240 400616/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 15 UDP 192.168.2.100:10500 <-> 109.237.187.194:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][8 pkts/6640 bytes <-> 8 pkts/1696 bytes][Goodput ratio: 95/80][13749.45 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 37/37 224522/3074457437244227584 1021965/18446744073694280560 400616/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 16 UDP 192.168.2.100:14500 <-> 109.237.187.129:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][7 pkts/5014 bytes <-> 8 pkts/2544 bytes][Goodput ratio: 94/87][14.86 sec][bytes ratio: 0.327 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 292/2460 676/13183 264/4802][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 716/318 1374/1070 518/302][PLAIN TEXT (OSfrCu Y)][Plen Bins: 0,0,13,13,27,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,0,6,0,0,0,6,0,0,0,0,0,0,0,0,13,0,0,0,0,0,0] 17 UDP 192.168.2.100:14500 <-> 109.237.187.226:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][7 pkts/5014 bytes <-> 8 pkts/2544 bytes][Goodput ratio: 94/87][< 1 sec][bytes ratio: 0.327 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/16 251/2354 683/12812 252/4684][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 716/318 1374/1070 518/302][PLAIN TEXT (LpIBBE)][Plen Bins: 0,0,13,13,27,0,6,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,6,0,0,6,0,0,0,6,0,0,0,0,0,0,0,0,13,0,0,0,0,0,0] 18 UDP 192.168.2.100:41618 <-> 109.237.187.194:4500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][7 pkts/3670 bytes <-> 8 pkts/3652 bytes][Goodput ratio: 92/91][< 1 sec][bytes ratio: 0.002 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 659/558 2402/2418 908/871][Pkt Len c2s/s2c min/avg/max/stddev: 138/122 524/456 1150/1150 415/408][Plen Bins: 0,0,6,13,27,0,6,0,0,0,0,0,6,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,27,0,0,0,0,0,0,0,0,0,0,0,0,0] - 19 UDP 192.168.2.100:10500 <-> 109.237.187.131:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][6 pkts/4980 bytes <-> 6 pkts/1272 bytes][Goodput ratio: 95/80][10912.94 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 34/35 147192/4611686018427387904 441504/4237516419 208110/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Risk: ** Malformed Packet **][Risk Score: 10][Risk Info: No server to client traffic / Invalid IPSec/ISAKMP Header][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 19 UDP 192.168.2.100:10500 <-> 109.237.187.131:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][6 pkts/4980 bytes <-> 6 pkts/1272 bytes][Goodput ratio: 95/80][10912.94 sec][bytes ratio: 0.593 (Upload)][IAT c2s/s2c min/avg/max/stddev: 34/35 147192/4611686018427387904 441504/18446744073652100739 208110/0][Pkt Len c2s/s2c min/avg/max/stddev: 818/94 830/212 842/330 12/118][Risk: ** Malformed Packet **][Risk Score: 10][Risk Info: No server to client traffic / Invalid IPSec/ISAKMP Header][Plen Bins: 0,25,0,0,0,0,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 20 UDP 192.168.2.100:41618 <-> 109.237.187.194:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][4 pkts/1816 bytes <-> 4 pkts/726 bytes][Goodput ratio: 91/77][< 1 sec][bytes ratio: 0.429 (Upload)][IAT c2s/s2c min/avg/max/stddev: 35/37 59/60 104/104 32/31][Pkt Len c2s/s2c min/avg/max/stddev: 378/80 454/182 530/458 65/160][Plen Bins: 0,38,0,0,0,0,0,0,0,0,12,12,0,12,12,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 21 UDP 192.168.2.100:42593 <-> 109.237.187.193:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][4 pkts/1816 bytes <-> 4 pkts/726 bytes][Goodput ratio: 91/77][< 1 sec][bytes ratio: 0.429 (Upload)][IAT c2s/s2c min/avg/max/stddev: 37/36 98/99 135/138 44/45][Pkt Len c2s/s2c min/avg/max/stddev: 378/80 454/182 530/458 65/160][Plen Bins: 0,38,0,0,0,0,0,0,0,0,12,12,0,12,12,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 22 UDP 192.168.2.100:43811 <-> 109.237.187.193:500 [proto: 79/IPSec][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 1][cat: VPN/2][4 pkts/1816 bytes <-> 4 pkts/726 bytes][Goodput ratio: 91/77][< 1 sec][bytes ratio: 0.429 (Upload)][IAT c2s/s2c min/avg/max/stddev: 42/46 125/126 180/179 60/57][Pkt Len c2s/s2c min/avg/max/stddev: 378/80 454/182 530/458 65/160][Plen Bins: 0,38,0,0,0,0,0,0,0,0,12,12,0,12,12,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/tls-appdata.pcap.out b/tests/cfgs/default/result/tls-appdata.pcap.out index 33c96c0c5..1456cdc06 100644 --- a/tests/cfgs/default/result/tls-appdata.pcap.out +++ b/tests/cfgs/default/result/tls-appdata.pcap.out @@ -25,5 +25,5 @@ Patricia protocols IPv6: 0/0 (search/found) TLS 120 119945 2 - 1 TCP 192.168.2.100:58976 <-> 52.223.198.7:443 [proto: 91/TLS][IP: 195/Twitch][Encrypted][Confidence: DPI][DPI packets: 11][cat: Web/5][65 pkts/15286 bytes <-> 49 pkts/103870 bytes][Goodput ratio: 77/97][4470.16 sec][bytes ratio: -0.743 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 86847/10887 1637911/4294921408 325792/64809][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 235/2120 1506/2958 476/1092][Plen Bins: 14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,33,0,51] + 1 TCP 192.168.2.100:58976 <-> 52.223.198.7:443 [proto: 91/TLS][IP: 195/Twitch][Encrypted][Confidence: DPI][DPI packets: 11][cat: Web/5][65 pkts/15286 bytes <-> 49 pkts/103870 bytes][Goodput ratio: 77/97][4470.16 sec][bytes ratio: -0.743 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 86847/10887 1637911/18446744073709505728 325792/64809][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 235/2120 1506/2958 476/1092][Plen Bins: 14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,33,0,51] 2 TCP 179.60.195.173:443 <-> 192.168.2.100:60636 [proto: 91/TLS][IP: 119/Facebook][Encrypted][Confidence: DPI][DPI packets: 6][cat: Web/5][3 pkts/627 bytes <-> 3 pkts/162 bytes][Goodput ratio: 68/0][0.22 sec][bytes ratio: 0.589 (Upload)][IAT c2s/s2c min/avg/max/stddev: 11/0 56/0 101/0 45/0][Pkt Len c2s/s2c min/avg/max/stddev: 201/54 209/54 225/54 11/0][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |