From 7da4abe6ad3da29bf81cedc899190df3d1b78811 Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Sun, 30 Aug 2020 20:45:20 +0200 Subject: QUIC: add support for GQUIC T050 and T051 QUIC versioning wasn't complex enough without T05X family... These versions are very similar to Q050, but use TLS as their handshake protocol. --- tests/pcap/quic_t50.pcap | Bin 0 -> 8636 bytes tests/pcap/quic_t51.pcap | Bin 0 -> 584014 bytes tests/result/quic_t50.pcap.out | 8 ++++++++ tests/result/quic_t51.pcap.out | 8 ++++++++ 4 files changed, 16 insertions(+) create mode 100644 tests/pcap/quic_t50.pcap create mode 100644 tests/pcap/quic_t51.pcap create mode 100644 tests/result/quic_t50.pcap.out create mode 100644 tests/result/quic_t51.pcap.out (limited to 'tests') diff --git a/tests/pcap/quic_t50.pcap b/tests/pcap/quic_t50.pcap new file mode 100644 index 000000000..d1bfccfc6 Binary files /dev/null and b/tests/pcap/quic_t50.pcap differ diff --git a/tests/pcap/quic_t51.pcap b/tests/pcap/quic_t51.pcap new file mode 100644 index 000000000..7b35f0275 Binary files /dev/null and b/tests/pcap/quic_t51.pcap differ diff --git a/tests/result/quic_t50.pcap.out b/tests/result/quic_t50.pcap.out new file mode 100644 index 000000000..775a2152a --- /dev/null +++ b/tests/result/quic_t50.pcap.out @@ -0,0 +1,8 @@ +GoogleServices 12 8420 1 + +JA3 Host Stats: + IP Address # JA3C + 1 40.154.127.200 1 + + + 1 UDP 40.154.127.200:49836 <-> 166.240.188.209:443 [proto: 188.239/QUIC.GoogleServices][cat: Web/5][6 pkts/3146 bytes <-> 6 pkts/5274 bytes][Goodput ratio: 92/95][0.42 sec][ALPN: h3-T050][TLS Supported Versions: TLSv1.3][bytes ratio: -0.253 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 61/61 178/136 71/62][Pkt Len c2s/s2c min/avg/max/stddev: 75/68 524/879 1392/1392 614/541][TLSv1.3][Client: fonts.googleapis.com][JA3C: a2fc589336b7c13b674c1bab24655ce7][Plen Bins: 8,25,8,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,41,0,0,0,0,0] diff --git a/tests/result/quic_t51.pcap.out b/tests/result/quic_t51.pcap.out new file mode 100644 index 000000000..681a781ab --- /dev/null +++ b/tests/result/quic_t51.pcap.out @@ -0,0 +1,8 @@ +Google 642 573718 1 + +JA3 Host Stats: + IP Address # JA3C + 1 187.227.136.152 1 + + + 1 UDP 187.227.136.152:55356 <-> 211.247.147.90:443 [proto: 188.126/QUIC.Google][cat: Web/5][171 pkts/29017 bytes <-> 471 pkts/544701 bytes][Goodput ratio: 75/96][90.07 sec][ALPN: h3-T051][TLS Supported Versions: TLSv1.3][bytes ratio: -0.899 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 690/100 24967/10162 3233/822][Pkt Len c2s/s2c min/avg/max/stddev: 75/67 170/1156 1392/1392 256/1252][TLSv1.3][Client: www.google.com][JA3C: 92e76078d514999cd950474995dab2b5][PLAIN TEXT (OO RJ/ Q)][Plen Bins: 11,29,2,1,0,2,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,51,0,0,0,0,0] -- cgit v1.2.3