diff options
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/pcap/tls_torrent.pcapng | bin | 0 -> 6656 bytes | |||
| -rw-r--r-- | tests/result/tls_torrent.pcapng.out | 12 |
2 files changed, 12 insertions, 0 deletions
diff --git a/tests/pcap/tls_torrent.pcapng b/tests/pcap/tls_torrent.pcapng Binary files differnew file mode 100644 index 000000000..29d42c7bf --- /dev/null +++ b/tests/pcap/tls_torrent.pcapng diff --git a/tests/result/tls_torrent.pcapng.out b/tests/result/tls_torrent.pcapng.out new file mode 100644 index 000000000..8534da1d5 --- /dev/null +++ b/tests/result/tls_torrent.pcapng.out @@ -0,0 +1,12 @@ +Guessed flow protos: 0 + +DPI Packets (TCP): 7 (7.00 pkts/flow) + +BitTorrent 7 6308 1 + +JA3 Host Stats: + IP Address # JA3C + 1 10.10.10.1 1 + + + 1 TCP 10.10.10.1:443 <-> 192.168.0.1:58842 [proto: 91.37/TLS.BitTorrent][Encrypted][cat: Download/7][6 pkts/5922 bytes <-> 1 pkts/386 bytes][Goodput ratio: 94/86][0.16 sec][Hostname/SNI: web.utorrent.com][bytes ratio: 0.878 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 32/0 147/0 58/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/386 987/386 1454/386 651/0][Risk: ** TLS (probably) not carrying HTTPS **** Possibly Malicious JA3 Fingerprint **][Risk Score: 60][TLSv1.2][JA3C: fd80fa9c6120cdeea8520510f3c644ac][ServerNames: *.utorrent.com,utorrent.com][JA3S: 6f84bbe9810ec4ea9061cc1a02eaf83c][Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2][Subject: CN=*.utorrent.com][Certificate SHA-1: E4:8F:E4:15:C7:D0:B7:EA:E6:F6:B1:B4:40:F0:13:D1:5E:7F:64:E8][Firefox][Validity: 2021-09-27 07:16:05 - 2022-09-24 22:26:57][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,0,0,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,60,0,0,0,0] |