From 843e4872706b07b9e78418986d35fc86bc156d60 Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Wed, 3 Jul 2024 18:02:07 +0200 Subject: Add infrastructure for explicit support of Fist Packet Classification (#2488) Let's start with some basic helpers and with FPC based on flow addresses. See: #2322 --- tests/cfgs/default/result/dns-tunnel-iodine.pcap.out | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tests/cfgs/default/result/dns-tunnel-iodine.pcap.out') diff --git a/tests/cfgs/default/result/dns-tunnel-iodine.pcap.out b/tests/cfgs/default/result/dns-tunnel-iodine.pcap.out index 471b45b63..dccdd2db7 100644 --- a/tests/cfgs/default/result/dns-tunnel-iodine.pcap.out +++ b/tests/cfgs/default/result/dns-tunnel-iodine.pcap.out @@ -23,4 +23,4 @@ DNS 434 70252 1 Acceptable 434 70252 1 - 1 UDP 10.0.2.30:44639 <-> 10.0.2.20:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: Network/14][222 pkts/26136 bytes <-> 212 pkts/44116 bytes][Goodput ratio: 64/80][24.49 sec][Hostname/SNI: vaaaakardli.pirate.sea][::][bytes ratio: -0.256 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 127/88 4005/4005 543/524][Pkt Len c2s/s2c min/avg/max/stddev: 82/93 118/208 323/1512 67/175][Risk: ** Susp DNS Traffic **** Minor Issues **][Risk Score: 60][Risk Info: DNS Record with zero TTL / Obsolete DNS record type][PLAIN TEXT (vaaaakardli)][Plen Bins: 0,40,1,15,29,3,0,1,8,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 UDP 10.0.2.30:44639 <-> 10.0.2.20:53 [proto: 5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][cat: Network/14][222 pkts/26136 bytes <-> 212 pkts/44116 bytes][Goodput ratio: 64/80][24.49 sec][Hostname/SNI: vaaaakardli.pirate.sea][::][bytes ratio: -0.256 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 127/88 4005/4005 543/524][Pkt Len c2s/s2c min/avg/max/stddev: 82/93 118/208 323/1512 67/175][Risk: ** Susp DNS Traffic **** Minor Issues **][Risk Score: 60][Risk Info: DNS Record with zero TTL / Obsolete DNS record type][PLAIN TEXT (vaaaakardli)][Plen Bins: 0,40,1,15,29,3,0,1,8,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] -- cgit v1.2.3