From 3e06bcce8dc558239c4a7e33e936adde8c05791f Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Thu, 30 Mar 2023 08:45:17 +0200 Subject: Add another example of custom rules (#1923) Add an example where traffic matching the same IP, but different ports is classified to different protocols. Close #189 --- .../custom_rules_same-ip_multiple_ports.pcapng.out | 27 ++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 tests/result/custom_rules_same-ip_multiple_ports.pcapng.out (limited to 'tests/result') diff --git a/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out b/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out new file mode 100644 index 000000000..8fe727c04 --- /dev/null +++ b/tests/result/custom_rules_same-ip_multiple_ports.pcapng.out @@ -0,0 +1,27 @@ +Guessed flow protos: 0 + +DPI Packets (TCP): 2 (1.00 pkts/flow) +Confidence Unknown : 2 (flows) +Num dissector calls: 0 (0.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 4/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia protocols: 2/2 (search/found) + +CustomProtocolA 3 222 1 +CustomProtocolB 2 148 1 + + 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.339/TLS.CustomProtocolA][IP: 339/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 2 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 340/CustomProtocolB][IP: 340/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] -- cgit v1.2.3