aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/include/ndpi_protocol_ids.h1
-rw-r--r--src/lib/inc_generated/ndpi_asn_goto.c.inc91
-rw-r--r--src/lib/ndpi_content_match.c.inc36
-rw-r--r--src/lib/ndpi_main.c2
-rw-r--r--tests/result/synscan.pcap.out4
-rw-r--r--tests/result/tls_invalid_reads.pcap.out4
-rwxr-xr-xutils/asn_update.sh7
7 files changed, 140 insertions, 5 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 3594e363b..7e8d5e315 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -321,6 +321,7 @@ typedef enum {
NDPI_PROTOCOL_SOFTETHER = 290,
NDPI_PROTOCOL_MPEGDASH = 291,
NDPI_PROTOCOL_DAZN = 292,
+ NDPI_PROTOCOL_GOTO = 293, /* GoTo products, mainly GoToMeeting */
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"
diff --git a/src/lib/inc_generated/ndpi_asn_goto.c.inc b/src/lib/inc_generated/ndpi_asn_goto.c.inc
new file mode 100644
index 000000000..17935b031
--- /dev/null
+++ b/src/lib/inc_generated/ndpi_asn_goto.c.inc
@@ -0,0 +1,91 @@
+/*
+ *
+ * This file is generated automatically and part of nDPI
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/* ****************************************************** */
+
+
+static ndpi_network ndpi_protocol_goto_protocol_list[] = {
+ { 0x17EFE300 /* 23.239.227.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x404A1100 /* 64.74.17.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x404A1200 /* 64.74.18.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x405F8000 /* 64.95.128.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x43D94400 /* 67.217.68.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D94600 /* 67.217.70.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x43D94800 /* 67.217.72.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D94B00 /* 67.217.75.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D94C00 /* 67.217.76.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x43D94E00 /* 67.217.78.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D95000 /* 67.217.80.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x43D95200 /* 67.217.82.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D95400 /* 67.217.84.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D95600 /* 67.217.86.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D95800 /* 67.217.88.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D95A00 /* 67.217.90.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x43D95C00 /* 67.217.92.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x43D95E00 /* 67.217.94.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x44400000 /* 68.64.0.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x44400800 /* 68.64.8.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x44400A00 /* 68.64.10.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x44400C00 /* 68.64.12.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x44400E00 /* 68.64.14.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x44401100 /* 68.64.17.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x44401200 /* 68.64.18.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x44401400 /* 68.64.20.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x44401600 /* 68.64.22.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x44401800 /* 68.64.24.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x44401B00 /* 68.64.27.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x44401C00 /* 68.64.28.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x44401E00 /* 68.64.30.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0x4E6C7400 /* 78.108.116.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ { 0x4E6C7800 /* 78.108.120.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x4E6C7E00 /* 78.108.126.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0x5FAC4600 /* 95.172.70.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xADC70000 /* 173.199.0.0/21 */, 21, NDPI_PROTOCOL_GOTO },
+ { 0xADC70C00 /* 173.199.12.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xADC70F00 /* 173.199.15.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xADC71100 /* 173.199.17.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xADC71200 /* 173.199.18.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xADC71400 /* 173.199.20.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xADC71700 /* 173.199.23.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xADC71A00 /* 173.199.26.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xADC71E00 /* 173.199.30.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xADC72000 /* 173.199.32.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xADC72B00 /* 173.199.43.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xADC72C00 /* 173.199.44.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ { 0xADC73200 /* 173.199.50.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xADC73400 /* 173.199.52.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ { 0xADC73C00 /* 173.199.60.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ { 0xBC422B00 /* 188.66.43.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xCAAD1900 /* 202.173.25.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xCEB76400 /* 206.183.100.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xD873D000 /* 216.115.208.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xD873D200 /* 216.115.210.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xD873D500 /* 216.115.213.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xD873D600 /* 216.115.214.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xD873D900 /* 216.115.217.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xD873DA00 /* 216.115.218.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xD873DD00 /* 216.115.221.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xD873DE00 /* 216.115.222.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xD8DB7200 /* 216.219.114.0/23 */, 23, NDPI_PROTOCOL_GOTO },
+ { 0xD8DB7400 /* 216.219.116.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xD8DB7700 /* 216.219.119.0/24 */, 24, NDPI_PROTOCOL_GOTO },
+ { 0xD8DB7800 /* 216.219.120.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ /* End */
+ { 0x0, 0, 0 }
+};
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 16e0c0af0..2fe501ab8 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -749,6 +749,22 @@ static ndpi_network host_protocol_list[] = {
https://help.salesforce.com/s/articleView?id=000321501&type=1
*/
+ /*
+ GoTo products (mainly GoToMeeting)
+ Some of the IPs reported at
+ https://support.goto.com/connect/help/what-are-gotoconnects-ip-blocks-gotoconnect-gotoconnects-ip-blocks
+ are not present in the GoTo/LogMeIn/Citrix ASn
+ To be extra safe, add here the entire list.
+ TODO: are we able to autogenerate this list?
+ */
+ { 0xC724F800 /* 199.36.248.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ { 0xC7577800 /* 199.87.120.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ { 0xA2FA3C00 /* 162.250.60.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ { 0x2D0CC400 /* 45.12.196.0/22 */, 22, NDPI_PROTOCOL_GOTO },
+ { 0xCAAD1800 /* 202.173.24.0/21 */, 21, NDPI_PROTOCOL_GOTO },
+ { 0xADC70000 /* 173.199.0.0/18 */, 18, NDPI_PROTOCOL_GOTO },
+ { 0x17EFE000 /* 23.239.224.0/19 */, 19, NDPI_PROTOCOL_GOTO },
+
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_content_match_host_protocol_list.c.inc"
#endif
@@ -1648,6 +1664,26 @@ static ndpi_protocol_match host_match[] =
{ "daznedge.net", "Dazn", NDPI_PROTOCOL_DAZN, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
{ "dcavoddazn.akamaized.net", "Dazn", NDPI_PROTOCOL_DAZN, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "goto.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "getgo.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "gotomeeting.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "expertcity.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "goto-rtc.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "logmeininc.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "gotowebinar.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "gototraining.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "launchdarkly.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "api-pub.mltree.net", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "getgocdn.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "cdngetgo.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "gotomeet.at", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "gotomeet.me", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "getgoservices.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "getgoservices.net", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "gotoconference.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "gotoroom.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "joinwebinar.com", "GoTo", NDPI_PROTOCOL_GOTO, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_content_match_host_match.c.inc"
#endif
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2abec633b..1e90d4bf1 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -83,6 +83,7 @@
#include "inc_generated/ndpi_asn_bloomberg.c.inc"
#include "inc_generated/ndpi_asn_citrix.c.inc"
#include "inc_generated/ndpi_asn_edgecast.c.inc"
+#include "inc_generated/ndpi_asn_goto.c.inc"
/* Third party libraries */
#include "third_party/include/ndpi_patricia.h"
@@ -2538,6 +2539,7 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs
ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_bloomberg_protocol_list);
ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_citrix_protocol_list);
ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_edgecast_protocol_list);
+ ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_goto_protocol_list);
}
}
diff --git a/tests/result/synscan.pcap.out b/tests/result/synscan.pcap.out
index 0dbe68c50..66ac42622 100644
--- a/tests/result/synscan.pcap.out
+++ b/tests/result/synscan.pcap.out
@@ -104,7 +104,7 @@ iSCSI 2 116 2
43 TCP 172.16.0.8:36050 -> 64.13.134.52:2605 [proto: 13/BGP][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
44 TCP 172.16.0.8:36050 -> 64.13.134.52:3000 [proto: 26/ntop][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
45 TCP 172.16.0.8:36050 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][ClearText][Confidence: Match by port][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 46 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 293/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 46 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 294/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
47 TCP 172.16.0.8:36050 -> 64.13.134.52:3306 [proto: 20/MySQL][ClearText][Confidence: Match by port][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
48 TCP 172.16.0.8:36050 -> 64.13.134.52:3389 [proto: 88/RDP][ClearText][Confidence: Match by port][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
49 TCP 172.16.0.8:36050 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
@@ -165,7 +165,7 @@ iSCSI 2 116 2
104 TCP 172.16.0.8:36051 -> 64.13.134.52:2605 [proto: 13/BGP][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
105 TCP 172.16.0.8:36051 -> 64.13.134.52:3000 [proto: 26/ntop][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
106 TCP 172.16.0.8:36051 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][ClearText][Confidence: Match by port][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 107 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 293/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 107 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 294/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
108 TCP 172.16.0.8:36051 -> 64.13.134.52:3306 [proto: 20/MySQL][ClearText][Confidence: Match by port][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
109 TCP 172.16.0.8:36051 -> 64.13.134.52:3389 [proto: 88/RDP][ClearText][Confidence: Match by port][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
110 TCP 172.16.0.8:36051 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out
index d816b1416..6b77f9578 100644
--- a/tests/result/tls_invalid_reads.pcap.out
+++ b/tests/result/tls_invalid_reads.pcap.out
@@ -4,8 +4,8 @@ DPI Packets (TCP): 11 (3.67 pkts/flow)
Confidence DPI : 3 (flows)
TLS 7 1827 1
-Citrix 1 64 1
Crashlytics 3 560 1
+GoTo 1 64 1
JA3 Host Stats:
IP Address # JA3C
@@ -14,4 +14,4 @@ JA3 Host Stats:
1 TCP 192.168.10.101:3967 <-> 206.33.61.113:443 [proto: 91/TLS][Encrypted][Confidence: DPI][cat: Web/5][4 pkts/330 bytes <-> 3 pkts/1497 bytes][Goodput ratio: 31/89][0.08 sec][bytes ratio: -0.639 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/38 25/19 58/38 24/19][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 82/499 156/905 43/346][Risk: ** Obsolete TLS (v1.1 or older) **][Risk Score: 100][Risk Info: 0301][TLSv1][JA3S: 53611273a714cb4789c8222932efd5a7 (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5][Plen Bins: 0,0,0,33,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 10.191.139.17:58552 <-> 54.221.224.45:443 [VLAN: 2][proto: GTP:91.275/TLS.Crashlytics][Encrypted][Confidence: DPI][cat: DataTransfer/4][2 pkts/442 bytes <-> 1 pkts/118 bytes][Goodput ratio: 41/0][0.23 sec][Hostname/SNI: e.crashlytics.com][ALPN: ][Risk: ** TLS Suspicious Extn **][Risk Score: 100][TLSv1.2][JA3C: 9d5430e6dfce44459702b74d790df353][Firefox][PLAIN TEXT (e.crashlytics.com)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 3 TCP 74.80.160.99:3258 -> 67.217.77.28:443 [proto: 91.132/TLS.Citrix][Encrypted][Confidence: DPI][cat: Network/14][1 pkts/64 bytes -> 0 pkts/0 bytes][Goodput ratio: 15/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 3 TCP 74.80.160.99:3258 -> 67.217.77.28:443 [proto: 91.293/TLS.GoTo][Encrypted][Confidence: DPI][cat: VoIP/10][1 pkts/64 bytes -> 0 pkts/0 bytes][Goodput ratio: 15/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/utils/asn_update.sh b/utils/asn_update.sh
index 81098ab6a..45940bfa2 100755
--- a/utils/asn_update.sh
+++ b/utils/asn_update.sh
@@ -114,7 +114,7 @@ DEST=../src/lib/inc_generated/ndpi_asn_bloomberg.c.inc
create_list NDPI_PROTOCOL_BLOOMBERG $DEST "AS8188" "AS58850" "AS33220" "AS33181" "AS199559" "AS17063" "AS13908" "AS10361"
echo "(3) Bloomberg IPs are available in $DEST"
-echo "(1) Downloading Citrix routes..." #Citrix or a more generic LogMeIn stuff?
+echo "(1) Downloading Citrix routes..."
DEST=../src/lib/inc_generated/ndpi_asn_citrix.c.inc
create_list NDPI_PROTOCOL_CITRIX $DEST "AS395424" "AS21866" "AS213380" "AS20104" "AS16815"
echo "(3) Citrix IPs are available in $DEST"
@@ -124,6 +124,11 @@ DEST=../src/lib/inc_generated/ndpi_asn_edgecast.c.inc
create_list NDPI_PROTOCOL_EDGECAST $DEST "AS15133"
echo "(3) Edgecast IPs are available in $DEST"
+echo "(1) Downloading LogMeIn/GoTo..."
+DEST=../src/lib/inc_generated/ndpi_asn_goto.c.inc
+create_list NDPI_PROTOCOL_GOTO $DEST "AS395424" "AS21866" "AS213380" "AS20104" "AS16815"
+echo "(3) LogMeIn/GoTo IPs are available in $DEST"
+
if [ ${TOTAL_ASN} -eq ${FAILED_ASN} ]; then
printf '%s: %s\n' "${0}" "All download(s) failed, ./get_routes_by_asn.sh broken?"
exit 1
Powered by cgit, Themed by Ted Yin.