aboutsummaryrefslogtreecommitdiff
path: root/tests
diff options
context:
space:
mode:
Diffstat (limited to 'tests')
-rw-r--r--tests/pcap/imaps.pcapbin5540 -> 10704 bytes
-rw-r--r--tests/result/6in4tunnel.pcap.out4
-rw-r--r--tests/result/dtls2.pcap.out2
-rw-r--r--tests/result/dtls_certificate.pcapng.out2
-rw-r--r--tests/result/imaps.pcap.out25
-rw-r--r--tests/result/pops.pcapng.out6
-rw-r--r--tests/result/smtps.pcapng.out2
-rw-r--r--tests/result/whatsapp_login_call.pcap.out2
-rw-r--r--tests/result/zoom.pcap.out4
9 files changed, 25 insertions, 22 deletions
diff --git a/tests/pcap/imaps.pcap b/tests/pcap/imaps.pcap
index c038b57e2..f0a2cdbe1 100644
--- a/tests/pcap/imaps.pcap
+++ b/tests/pcap/imaps.pcap
Binary files differ
diff --git a/tests/result/6in4tunnel.pcap.out b/tests/result/6in4tunnel.pcap.out
index a8d2f8c3d..f4522e3aa 100644
--- a/tests/result/6in4tunnel.pcap.out
+++ b/tests/result/6in4tunnel.pcap.out
@@ -1,6 +1,6 @@
-Guessed flow protos: 0
+Guessed flow protos: 2
-DPI Packets (TCP): 27 (5.40 pkts/flow)
+DPI Packets (TCP): 29 (5.80 pkts/flow)
DPI Packets (UDP): 4 (2.00 pkts/flow)
DPI Packets (other): 3 (1.00 pkts/flow)
Confidence DPI : 10 (flows)
diff --git a/tests/result/dtls2.pcap.out b/tests/result/dtls2.pcap.out
index fc0e49fc2..9b15cb1b6 100644
--- a/tests/result/dtls2.pcap.out
+++ b/tests/result/dtls2.pcap.out
@@ -26,4 +26,4 @@ JA3 Host Stats:
1 61.68.110.153 1
- 1 UDP 61.68.110.153:53045 <-> 212.32.214.39:61457 [proto: 30/DTLS][Encrypted][Confidence: DPI][cat: Web/5][14 pkts/2246 bytes <-> 16 pkts/2745 bytes][Goodput ratio: 74/75][382.15 sec][bytes ratio: -0.100 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/241 27857/28359 60550/60551 26256/25033][Pkt Len c2s/s2c min/avg/max/stddev: 123/102 160/172 325/867 46/180][Risk: ** Weak TLS Cipher **** TLS (probably) Not Carrying HTTPS **** Missing SNI TLS Extn **][Risk Score: 160][Risk Info: No ALPN / Cipher TLS_RSA_WITH_AES_256_CBC_SHA][DTLSv1.0][JA3C: 1b45c913a0c0fde5f263502e65999485][JA3S: 749bd1edea60396ffaa65213b7971718 (WEAK)][Issuer: C=US][Subject: C=US, CN=*.relay.ros.rockstargames.com][Validity: 2014-09-12 21:31:19 - 2037-02-15 21:31:19][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA][PLAIN TEXT (140912213119Z)][Plen Bins: 0,3,43,46,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 1 UDP 61.68.110.153:53045 <-> 212.32.214.39:61457 [proto: 30/DTLS][Encrypted][Confidence: DPI][cat: Web/5][14 pkts/2246 bytes <-> 16 pkts/2745 bytes][Goodput ratio: 74/75][382.15 sec][bytes ratio: -0.100 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/241 27857/28359 60550/60551 26256/25033][Pkt Len c2s/s2c min/avg/max/stddev: 123/102 160/172 325/867 46/180][Risk: ** Weak TLS Cipher **** TLS (probably) Not Carrying HTTPS **** Missing SNI TLS Extn **][Risk Score: 160][Risk Info: No ALPN / Cipher TLS_RSA_WITH_AES_256_CBC_SHA][DTLSv1.0][JA3C: 1b45c913a0c0fde5f263502e65999485][JA3S: 749bd1edea60396ffaa65213b7971718 (WEAK)][Issuer: C=US][Subject: C=US, CN=*.relay.ros.rockstargames.com][Certificate SHA-1: AB:59:0E:11:EC:94:4D:D5:D3:40:7E:6E:3B:8B:6A:19:CA:B7:85:2C][Validity: 2014-09-12 21:31:19 - 2037-02-15 21:31:19][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA][PLAIN TEXT (140912213119Z)][Plen Bins: 0,3,43,46,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/result/dtls_certificate.pcapng.out b/tests/result/dtls_certificate.pcapng.out
index b2a46769f..0437a2c59 100644
--- a/tests/result/dtls_certificate.pcapng.out
+++ b/tests/result/dtls_certificate.pcapng.out
@@ -25,4 +25,4 @@ JA3 Host Stats:
IP Address # JA3C
- 1 UDP 191.62.60.190:443 -> 163.205.15.180:38876 [proto: 91.147/TLS.WindowsUpdate][Encrypted][Confidence: DPI][cat: SoftwareUpdate/19][1 pkts/1486 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Risk: ** TLS Cert Expired **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No client to server traffic / 27/Feb/2017 12:00:00 - 27/Feb/2019 00:00:00][JA3S: 953c1507994f72697446de4eff6e300b][Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Update Secure Server CA 1][Subject: C=US, ST=Washington, L=Redmond, O=Microsoft, OU=DSP, CN=www.update.microsoft.com][Certificate SHA-1: D1:88:0F:51:C1:01:91:72:A1:A4:6E:69:F4:33:7F:FE:3E:C4:F0:39][Validity: 2017-02-27 12:00:00 - 2019-02-27 00:00:00][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][PLAIN TEXT (Washington1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0]
+ 1 UDP 191.62.60.190:443 -> 163.205.15.180:38876 [proto: 30.147/DTLS.WindowsUpdate][Encrypted][Confidence: DPI][cat: SoftwareUpdate/19][1 pkts/1486 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Risk: ** TLS Cert Expired **** Unidirectional Traffic **][Risk Score: 110][Risk Info: No client to server traffic / 27/Feb/2017 12:00:00 - 27/Feb/2019 00:00:00][JA3S: 953c1507994f72697446de4eff6e300b][Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Update Secure Server CA 1][Subject: C=US, ST=Washington, L=Redmond, O=Microsoft, OU=DSP, CN=www.update.microsoft.com][Certificate SHA-1: D1:88:0F:51:C1:01:91:72:A1:A4:6E:69:F4:33:7F:FE:3E:C4:F0:39][Validity: 2017-02-27 12:00:00 - 2019-02-27 00:00:00][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][PLAIN TEXT (Washington1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0]
diff --git a/tests/result/imaps.pcap.out b/tests/result/imaps.pcap.out
index bb044d893..27dbdd669 100644
--- a/tests/result/imaps.pcap.out
+++ b/tests/result/imaps.pcap.out
@@ -1,8 +1,8 @@
-Guessed flow protos: 0
+Guessed flow protos: 1
-DPI Packets (TCP): 7 (7.00 pkts/flow)
-Confidence DPI : 1 (flows)
-Num dissector calls: 3 (3.00 diss/flow)
+DPI Packets (TCP): 15 (7.50 pkts/flow)
+Confidence DPI : 2 (flows)
+Num dissector calls: 6 (3.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
@@ -10,20 +10,23 @@ LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
-Automa host: 1/1 (search/found)
-Automa domain: 1/0 (search/found)
+Automa host: 3/1 (search/found)
+Automa domain: 2/0 (search/found)
Automa tls cert: 0/0 (search/found)
-Automa risk mask: 1/0 (search/found)
+Automa risk mask: 2/0 (search/found)
Automa common alpns: 0/0 (search/found)
-Patricia risk mask: 2/0 (search/found)
+Patricia risk mask: 6/0 (search/found)
Patricia risk: 0/0 (search/found)
-Patricia protocols: 4/0 (search/found)
+Patricia protocols: 12/0 (search/found)
ntop 20 5196 1
+IMAPS 8 4378 1
JA3 Host Stats:
IP Address # JA3C
- 1 192.168.1.8 1
+ 1 192.168.0.1 1
+ 2 192.168.1.8 1
- 1 TCP 192.168.1.8:50506 <-> 167.99.215.164:993 [proto: 91.26/TLS.ntop][Encrypted][Confidence: DPI][cat: Network/14][10 pkts/1220 bytes <-> 10 pkts/3976 bytes][Goodput ratio: 45/83][0.33 sec][Hostname/SNI: mail.ntop.org][bytes ratio: -0.530 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 33/22 77/43 26/19][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 122/398 293/1506 78/557][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: 4923a265be4d81c68ecda45bb89cdf6a][ServerNames: mail.ntop.org][JA3S: b653c251b0ee54c3088fe7bb997cf59d][Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3][Subject: CN=mail.ntop.org][Certificate SHA-1: F1:9A:35:30:96:57:5E:56:81:28:2C:D9:45:A5:83:21:9E:E8:C5:DF][Firefox][Validity: 2020-04-18 00:15:22 - 2020-07-17 00:15:22][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][Plen Bins: 0,20,10,10,20,10,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0]
+ 1 TCP 192.168.1.8:50506 <-> 167.99.215.164:993 [proto: 51.26/IMAPS.ntop][Encrypted][Confidence: DPI][cat: Email/3][10 pkts/1220 bytes <-> 10 pkts/3976 bytes][Goodput ratio: 45/83][0.33 sec][Hostname/SNI: mail.ntop.org][bytes ratio: -0.530 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 33/22 77/43 26/19][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 122/398 293/1506 78/557][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: 4923a265be4d81c68ecda45bb89cdf6a][ServerNames: mail.ntop.org][JA3S: b653c251b0ee54c3088fe7bb997cf59d][Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3][Subject: CN=mail.ntop.org][Certificate SHA-1: F1:9A:35:30:96:57:5E:56:81:28:2C:D9:45:A5:83:21:9E:E8:C5:DF][Firefox][Validity: 2020-04-18 00:15:22 - 2020-07-17 00:15:22][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][PLAIN TEXT (mail.ntop.org)][Plen Bins: 0,20,10,10,20,10,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0]
+ 2 TCP 192.168.0.1:51529 <-> 10.10.10.1:993 [proto: 51/IMAPS][Encrypted][Confidence: DPI][cat: Email/3][4 pkts/1322 bytes <-> 4 pkts/3056 bytes][Goodput ratio: 78/91][0.22 sec][Hostname/SNI: imap.asia.secureserver.net][bytes ratio: -0.396 (Download)][IAT c2s/s2c min/avg/max/stddev: 1/0 46/68 136/135 64/68][Pkt Len c2s/s2c min/avg/max/stddev: 78/74 330/764 583/1454 252/690][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: 66b2d7acea2c20aeeebd69c8d44089d7][JA3S: a9e3ed16ee3208291487c8d2aa2ad924][Safari][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][PLAIN TEXT (imap.asia.secureserver.net)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0]
diff --git a/tests/result/pops.pcapng.out b/tests/result/pops.pcapng.out
index 862267786..0b1470474 100644
--- a/tests/result/pops.pcapng.out
+++ b/tests/result/pops.pcapng.out
@@ -1,6 +1,6 @@
-Guessed flow protos: 0
+Guessed flow protos: 1
-DPI Packets (TCP): 3 (3.00 pkts/flow)
+DPI Packets (TCP): 5 (5.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 3 (3.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
@@ -26,4 +26,4 @@ JA3 Host Stats:
1 192.168.0.1 1
- 1 TCP 192.168.0.1:55077 <-> 10.10.10.1:995 [proto: 23/POPS][Encrypted][Confidence: DPI][cat: Email/3][2 pkts/304 bytes <-> 3 pkts/2694 bytes][Goodput ratio: 60/94][0.55 sec][Hostname/SNI: pop.secureserver.net][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: 36f7277af969a6947a61ae0b815907a1][Firefox][PLAIN TEXT (pop.secureserver.net)][Plen Bins: 0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0,0,0,0,0]
+ 1 TCP 192.168.0.1:55077 <-> 10.10.10.1:995 [proto: 23/POPS][Encrypted][Confidence: DPI][cat: Email/3][2 pkts/304 bytes <-> 3 pkts/2694 bytes][Goodput ratio: 60/94][0.55 sec][Hostname/SNI: pop.secureserver.net][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: 36f7277af969a6947a61ae0b815907a1][JA3S: 245de059547a730e42852c315cdc5a02][Firefox][Cipher: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384][PLAIN TEXT (pop.secureserver.net)][Plen Bins: 0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0,0,0,0,0]
diff --git a/tests/result/smtps.pcapng.out b/tests/result/smtps.pcapng.out
index 48121197c..4f927c988 100644
--- a/tests/result/smtps.pcapng.out
+++ b/tests/result/smtps.pcapng.out
@@ -1,6 +1,6 @@
Guessed flow protos: 0
-DPI Packets (TCP): 3 (3.00 pkts/flow)
+DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 3 (3.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out
index 0f0eb2039..922c4b1bc 100644
--- a/tests/result/whatsapp_login_call.pcap.out
+++ b/tests/result/whatsapp_login_call.pcap.out
@@ -1,6 +1,6 @@
Guessed flow protos: 20
-DPI Packets (TCP): 93 (3.44 pkts/flow)
+DPI Packets (TCP): 105 (3.89 pkts/flow)
DPI Packets (UDP): 35 (1.21 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 4 (flows)
diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out
index 4da11fe91..85d5641f3 100644
--- a/tests/result/zoom.pcap.out
+++ b/tests/result/zoom.pcap.out
@@ -1,6 +1,6 @@
-Guessed flow protos: 4
+Guessed flow protos: 5
-DPI Packets (TCP): 118 (8.43 pkts/flow)
+DPI Packets (TCP): 119 (8.50 pkts/flow)
DPI Packets (UDP): 25 (1.47 pkts/flow)
DPI Packets (other): 2 (1.00 pkts/flow)
Confidence Match by IP : 2 (flows)
Powered by cgit, Themed by Ted Yin.