blob: 52c1f672c94911af0a75bb0b03e52c8392455933 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
HTTP 22 3182 2
TLS 106 11841 8
SIP 22 15356 1
Google 17 6375 1
Webex 1380 818407 43
Amazon 33 9742 2
JA3 Host Stats:
IP Address # JA3C
1 10.8.0.1 6
1 TCP 10.8.0.1:51155 <-> 62.109.224.120:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][256 pkts/14707 bytes <-> 257 pkts/329379 bytes][pktlen c2s avg(stddev)/entropy: 5.0(57.4)/36.0][pktlen s2c avg(stddev)/entropy: 2.7(1281.6)/3034.6][bytes ratio: -0.91][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
2 TCP 10.8.0.1:41348 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][28 pkts/4815 bytes <-> 28 pkts/104881 bytes][pktlen c2s avg(stddev)/entropy: 4.0(172.0)/205.7][pktlen s2c avg(stddev)/entropy: 3.8(3745.8)/4699.9][bytes ratio: -0.91][TLSv1.2][client: radcom.webex.com][JA3C: f9010d8c34749bdf7659b52227e6f91b][JA3S: c253ec3ad88e42f8da4032682892f9a0 (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
3 TCP 10.8.0.1:41346 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][48 pkts/11540 bytes <-> 47 pkts/80696 bytes][pktlen c2s avg(stddev)/entropy: 4.3(240.4)/233.4][pktlen s2c avg(stddev)/entropy: 3.5(1716.9)/3587.1][bytes ratio: -0.75][TLSv1.2][client: radcom.webex.com][JA3C: f9010d8c34749bdf7659b52227e6f91b][server: *.webex.com][JA3S: c253ec3ad88e42f8da4032682892f9a0 (INSECURE)][organization: Cisco Systems, Inc.][Cipher: TLS_RSA_WITH_RC4_128_MD5]
4 TCP 10.8.0.1:41358 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][19 pkts/2005 bytes <-> 19 pkts/40477 bytes][pktlen c2s avg(stddev)/entropy: 3.6(105.5)/135.5][pktlen s2c avg(stddev)/entropy: 3.3(2130.4)/2681.8][bytes ratio: -0.91][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
5 TCP 10.8.0.1:51194 <-> 62.109.224.120:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][12 pkts/1531 bytes <-> 12 pkts/34357 bytes][pktlen c2s avg(stddev)/entropy: 2.9(127.6)/150.1][pktlen s2c avg(stddev)/entropy: 2.2(2863.1)/4303.6][bytes ratio: -0.91][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
6 TCP 10.8.0.1:41354 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][13 pkts/2145 bytes <-> 13 pkts/24239 bytes][pktlen c2s avg(stddev)/entropy: 2.9(165.0)/193.3][pktlen s2c avg(stddev)/entropy: 2.4(1864.5)/2710.5][bytes ratio: -0.84][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
7 TCP 10.8.0.1:51154 <-> 62.109.224.120:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][55 pkts/12583 bytes <-> 50 pkts/6703 bytes][pktlen c2s avg(stddev)/entropy: 4.9(228.8)/153.6][pktlen s2c avg(stddev)/entropy: 5.0(134.1)/546.8][bytes ratio: 0.30][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
8 UDP 10.8.0.1:64538 -> 172.16.1.75:5060 [proto: 100/SIP][cat: VoIP/10][22 pkts/15356 bytes -> 0 pkts/0 bytes][pktlen c2s avg(stddev)/entropy: 4.5(698.0)/0.0][pktlen s2c avg(stddev)/entropy: 0.0(nan)/0.0][bytes ratio: 1.00][PLAIN TEXT (REGISTER sip)]
9 TCP 10.8.0.1:51857 <-> 62.109.229.158:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][29 pkts/4559 bytes <-> 21 pkts/5801 bytes][pktlen c2s avg(stddev)/entropy: 4.5(157.2)/108.2][pktlen s2c avg(stddev)/entropy: 2.1(276.2)/830.4][bytes ratio: -0.12][TLSv1][JA3C: 64ea4359ad4b496db653a3f30f7073e6][server: *.webex.com][JA3S: 4192c0a946c5bd9b544b4656d9f624a4 (WEAK)][Cipher: TLS_RSA_WITH_AES_128_CBC_SHA]
10 TCP 10.8.0.1:46211 <-> 54.241.32.14:443 [proto: 91.178/TLS.Amazon][cat: Web/5][16 pkts/1984 bytes <-> 14 pkts/7584 bytes][pktlen c2s avg(stddev)/entropy: 3.3(124.0)/148.6][pktlen s2c avg(stddev)/entropy: 2.9(541.7)/614.4][bytes ratio: -0.59][TLSv1][client: api.crittercism.com][JA3C: 54ae5fcb0159e2ddf6a50e149221c7c7][server: *.crittercism.com][JA3S: c800cea031c10ffe47e1d72c9264577a (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
11 TCP 10.8.0.1:41386 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][9 pkts/1417 bytes <-> 8 pkts/6984 bytes][pktlen c2s avg(stddev)/entropy: 2.5(157.4)/178.5][pktlen s2c avg(stddev)/entropy: 1.4(873.0)/1443.8][bytes ratio: -0.66][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
12 TCP 10.8.0.1:41419 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][7 pkts/1309 bytes <-> 7 pkts/6930 bytes][pktlen c2s avg(stddev)/entropy: 2.2(187.0)/192.5][pktlen s2c avg(stddev)/entropy: 1.3(990.0)/1507.6][bytes ratio: -0.68][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
13 TCP 10.8.0.1:52730 <-> 173.243.4.76:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][9 pkts/1369 bytes <-> 8 pkts/6621 bytes][pktlen c2s avg(stddev)/entropy: 2.5(152.1)/166.2][pktlen s2c avg(stddev)/entropy: 1.8(827.6)/1098.7][bytes ratio: -0.66][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
14 TCP 10.8.0.1:44492 <-> 64.68.104.140:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][9 pkts/1369 bytes <-> 8 pkts/6600 bytes][pktlen c2s avg(stddev)/entropy: 2.5(152.1)/166.2][pktlen s2c avg(stddev)/entropy: 1.9(825.0)/1028.2][bytes ratio: -0.66][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
15 TCP 10.8.0.1:45814 <-> 62.109.231.3:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][8 pkts/1315 bytes <-> 8 pkts/6653 bytes][pktlen c2s avg(stddev)/entropy: 2.3(164.4)/172.4][pktlen s2c avg(stddev)/entropy: 1.9(831.6)/1033.3][bytes ratio: -0.67][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
16 TCP 10.8.0.1:47498 <-> 209.197.222.159:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][7 pkts/1261 bytes <-> 7 pkts/6535 bytes][pktlen c2s avg(stddev)/entropy: 2.2(180.1)/178.9][pktlen s2c avg(stddev)/entropy: 1.3(933.6)/1446.8][bytes ratio: -0.68][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
17 TCP 10.8.0.1:57647 <-> 64.68.121.153:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][7 pkts/1261 bytes <-> 7 pkts/6535 bytes][pktlen c2s avg(stddev)/entropy: 2.2(180.1)/178.9][pktlen s2c avg(stddev)/entropy: 1.3(933.6)/1446.8][bytes ratio: -0.68][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
18 TCP 10.8.0.1:37129 <-> 64.68.105.98:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][9 pkts/1369 bytes <-> 9 pkts/5838 bytes][pktlen c2s avg(stddev)/entropy: 2.5(152.1)/166.2][pktlen s2c avg(stddev)/entropy: 1.4(648.7)/1254.8][bytes ratio: -0.62][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
19 TCP 10.8.0.1:51370 <-> 64.68.105.97:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][8 pkts/1315 bytes <-> 8 pkts/5784 bytes][pktlen c2s avg(stddev)/entropy: 2.3(164.4)/172.4][pktlen s2c avg(stddev)/entropy: 1.9(723.0)/919.0][bytes ratio: -0.63][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
20 TCP 10.8.0.1:55669 <-> 173.243.0.110:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][11 pkts/1830 bytes <-> 12 pkts/4811 bytes][pktlen c2s avg(stddev)/entropy: 2.9(166.4)/167.4][pktlen s2c avg(stddev)/entropy: 1.9(400.9)/757.6][bytes ratio: -0.45][TLSv1][JA3C: 64ea4359ad4b496db653a3f30f7073e6][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
21 TCP 10.8.0.1:55665 <-> 173.243.0.110:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][11 pkts/1798 bytes <-> 11 pkts/4757 bytes][pktlen c2s avg(stddev)/entropy: 2.9(163.5)/167.4][pktlen s2c avg(stddev)/entropy: 1.2(432.5)/1117.3][bytes ratio: -0.45][TLSv1][JA3C: 64ea4359ad4b496db653a3f30f7073e6][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
22 TCP 10.8.0.1:55671 <-> 173.243.0.110:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][11 pkts/1798 bytes <-> 11 pkts/4757 bytes][pktlen c2s avg(stddev)/entropy: 2.9(163.5)/167.4][pktlen s2c avg(stddev)/entropy: 1.2(432.5)/1117.3][bytes ratio: -0.45][TLSv1][JA3C: 64ea4359ad4b496db653a3f30f7073e6][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
23 TCP 10.8.0.1:55687 <-> 173.243.0.110:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][11 pkts/1798 bytes <-> 11 pkts/4757 bytes][pktlen c2s avg(stddev)/entropy: 2.9(163.5)/167.4][pktlen s2c avg(stddev)/entropy: 1.2(432.5)/1117.3][bytes ratio: -0.45][TLSv1][JA3C: 64ea4359ad4b496db653a3f30f7073e6][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
24 TCP 10.8.0.1:43433 <-> 216.58.208.40:443 [proto: 91.126/TLS.Google][cat: Web/5][9 pkts/1540 bytes <-> 8 pkts/4835 bytes][pktlen c2s avg(stddev)/entropy: 2.6(171.1)/167.6][pktlen s2c avg(stddev)/entropy: 1.2(604.4)/1199.5][bytes ratio: -0.52][TLSv1.2][client: ssl.google-analytics.com][JA3C: 75edb912bc6f0a222ae3e3e47f5c89b1][server: *.google-analytics.com][JA3S: 389ed42c02ebecc32e73aa31def07e14][organization: Google Inc][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
25 TCP 10.8.0.1:51646 <-> 114.29.204.49:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][9 pkts/895 bytes <-> 8 pkts/4398 bytes][pktlen c2s avg(stddev)/entropy: 2.7(99.4)/101.1][pktlen s2c avg(stddev)/entropy: 1.5(549.8)/889.3][bytes ratio: -0.66][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
26 TCP 10.8.0.1:52219 <-> 64.68.121.100:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][8 pkts/841 bytes <-> 7 pkts/4376 bytes][pktlen c2s avg(stddev)/entropy: 2.5(105.1)/105.9][pktlen s2c avg(stddev)/entropy: 0.6(625.1)/1375.1][bytes ratio: -0.68][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
27 TCP 10.8.0.1:55969 <-> 64.68.121.99:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][8 pkts/841 bytes <-> 7 pkts/4376 bytes][pktlen c2s avg(stddev)/entropy: 2.5(105.1)/105.9][pktlen s2c avg(stddev)/entropy: 0.6(625.1)/1375.1][bytes ratio: -0.68][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
28 TCP 10.8.0.1:49048 <-> 23.44.253.243:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][7 pkts/1181 bytes <-> 7 pkts/4021 bytes][pktlen c2s avg(stddev)/entropy: 2.2(168.7)/157.6][pktlen s2c avg(stddev)/entropy: 1.3(574.4)/988.7][bytes ratio: -0.55][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: www.webex.com][JA3S: 714ac86d50db68420429ca897688f5f3 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
29 TCP 10.8.0.1:47116 <-> 114.29.202.139:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][7 pkts/461 bytes <-> 6 pkts/4231 bytes][pktlen c2s avg(stddev)/entropy: 2.7(65.9)/22.0][pktlen s2c avg(stddev)/entropy: 1.2(705.2)/1054.1][bytes ratio: -0.80][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
30 TCP 10.8.0.1:47841 <-> 114.29.200.11:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/407 bytes <-> 5 pkts/4177 bytes][pktlen c2s avg(stddev)/entropy: 2.5(67.8)/23.2][pktlen s2c avg(stddev)/entropy: 0.4(835.4)/1562.8][bytes ratio: -0.82][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f][server: *.webex.com][JA3S: 91589ea825a2ee41810c85fab06d2ef6 (WEAK)][Cipher: TLS_RSA_WITH_AES_256_CBC_SHA]
31 TCP 10.8.0.1:33551 <-> 80.74.110.68:443 [proto: 91/TLS][cat: Web/5][10 pkts/1465 bytes <-> 11 pkts/1065 bytes][pktlen c2s avg(stddev)/entropy: 2.7(146.5)/160.9][pktlen s2c avg(stddev)/entropy: 2.9(96.8)/101.6][bytes ratio: 0.16][TLSv1][JA3C: dff8a0aa1c904aaea76c5bf624e88333][JA3S: 6dfe5eb347aa509fc445e5628d467a2b (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
32 TCP 10.8.0.1:33553 <-> 80.74.110.68:443 [proto: 91/TLS][cat: Web/5][10 pkts/1388 bytes <-> 10 pkts/1087 bytes][pktlen c2s avg(stddev)/entropy: 2.6(138.8)/162.8][pktlen s2c avg(stddev)/entropy: 2.7(108.7)/127.1][bytes ratio: 0.12][TLSv1][JA3C: dff8a0aa1c904aaea76c5bf624e88333][JA3S: 6dfe5eb347aa509fc445e5628d467a2b (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
33 TCP 10.8.0.1:33512 <-> 80.74.110.68:443 [proto: 91/TLS][cat: Web/5][9 pkts/1357 bytes <-> 9 pkts/615 bytes][pktlen c2s avg(stddev)/entropy: 2.5(150.8)/167.8][pktlen s2c avg(stddev)/entropy: 3.0(68.3)/40.5][bytes ratio: 0.38][TLSv1][JA3C: dff8a0aa1c904aaea76c5bf624e88333][JA3S: 6dfe5eb347aa509fc445e5628d467a2b (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
34 TCP 10.8.0.1:33554 <-> 80.74.110.68:443 [proto: 91/TLS][cat: Web/5][9 pkts/1357 bytes <-> 9 pkts/615 bytes][pktlen c2s avg(stddev)/entropy: 2.5(150.8)/167.8][pktlen s2c avg(stddev)/entropy: 3.0(68.3)/40.5][bytes ratio: 0.38][TLSv1][JA3C: dff8a0aa1c904aaea76c5bf624e88333][JA3S: 6dfe5eb347aa509fc445e5628d467a2b (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
35 TCP 10.8.0.1:59756 <-> 78.46.237.91:80 [proto: 7/HTTP][cat: Web/5][6 pkts/970 bytes <-> 6 pkts/821 bytes][Host: cp.pushwoosh.com][pktlen c2s avg(stddev)/entropy: 1.8(161.7)/194.2][pktlen s2c avg(stddev)/entropy: 1.7(136.8)/185.2][bytes ratio: 0.08][PLAIN TEXT (POST /j)]
36 TCP 10.8.0.1:33559 <-> 80.74.110.68:443 [proto: 91/TLS][cat: Web/5][7 pkts/1280 bytes <-> 6 pkts/453 bytes][pktlen c2s avg(stddev)/entropy: 2.2(182.9)/180.3][pktlen s2c avg(stddev)/entropy: 2.4(75.5)/48.1][bytes ratio: 0.48][TLSv1][JA3C: dff8a0aa1c904aaea76c5bf624e88333][JA3S: 6dfe5eb347aa509fc445e5628d467a2b (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
37 TCP 10.8.0.1:59757 <-> 78.46.237.91:80 [proto: 7/HTTP][cat: Web/5][5 pkts/624 bytes <-> 5 pkts/767 bytes][Host: cp.pushwoosh.com][pktlen c2s avg(stddev)/entropy: 1.7(124.8)/131.8][pktlen s2c avg(stddev)/entropy: 1.4(153.4)/198.8][bytes ratio: -0.10][PLAIN TEXT (POST /j)]
38 UDP 10.8.0.1:51772 <-> 62.109.229.158:9000 [proto: 141/Webex][cat: VoIP/10][14 pkts/1071 bytes <-> 2 pkts/100 bytes][pktlen c2s avg(stddev)/entropy: 3.8(76.5)/14.4][pktlen s2c avg(stddev)/entropy: 1.0(50.0)/0.0][bytes ratio: 0.83]
39 TCP 10.8.0.1:41350 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/614 bytes <-> 5 pkts/399 bytes][pktlen c2s avg(stddev)/entropy: 2.2(102.3)/81.4][pktlen s2c avg(stddev)/entropy: 2.2(79.8)/36.1][bytes ratio: 0.21][TLSv1.2][client: radcom.webex.com][JA3C: f9010d8c34749bdf7659b52227e6f91b][JA3S: c253ec3ad88e42f8da4032682892f9a0 (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
40 TCP 10.8.0.1:41351 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][5 pkts/560 bytes <-> 4 pkts/345 bytes][pktlen c2s avg(stddev)/entropy: 2.0(112.0)/86.0][pktlen s2c avg(stddev)/entropy: 1.7(86.2)/55.9][bytes ratio: 0.24][TLSv1.2][client: radcom.webex.com][JA3C: f9010d8c34749bdf7659b52227e6f91b][JA3S: c253ec3ad88e42f8da4032682892f9a0 (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5]
41 TCP 10.8.0.1:51190 <-> 62.109.224.120:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][7 pkts/501 bytes <-> 4 pkts/216 bytes][pktlen c2s avg(stddev)/entropy: 2.8(71.6)/20.7][pktlen s2c avg(stddev)/entropy: 2.0(54.0)/0.0][bytes ratio: 0.40][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
42 TCP 10.8.0.1:37139 <-> 64.68.105.98:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/427 bytes <-> 5 pkts/270 bytes][pktlen c2s avg(stddev)/entropy: 2.5(71.2)/22.4][pktlen s2c avg(stddev)/entropy: 2.3(54.0)/0.0][bytes ratio: 0.23][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
43 TCP 10.8.0.1:41394 <-> 64.68.105.103:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/427 bytes <-> 5 pkts/270 bytes][pktlen c2s avg(stddev)/entropy: 2.5(71.2)/22.4][pktlen s2c avg(stddev)/entropy: 2.3(54.0)/0.0][bytes ratio: 0.23][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
44 TCP 10.8.0.1:41757 <-> 114.29.213.212:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/427 bytes <-> 5 pkts/270 bytes][pktlen c2s avg(stddev)/entropy: 2.5(71.2)/22.4][pktlen s2c avg(stddev)/entropy: 2.3(54.0)/0.0][bytes ratio: 0.23][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
45 TCP 10.8.0.1:47135 <-> 114.29.202.139:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/427 bytes <-> 5 pkts/270 bytes][pktlen c2s avg(stddev)/entropy: 2.5(71.2)/22.4][pktlen s2c avg(stddev)/entropy: 2.3(54.0)/0.0][bytes ratio: 0.23][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
46 TCP 10.8.0.1:51134 <-> 62.109.224.120:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/427 bytes <-> 5 pkts/270 bytes][pktlen c2s avg(stddev)/entropy: 2.5(71.2)/22.4][pktlen s2c avg(stddev)/entropy: 2.3(54.0)/0.0][bytes ratio: 0.23][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
47 TCP 10.8.0.1:51135 <-> 62.109.224.120:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/427 bytes <-> 5 pkts/270 bytes][pktlen c2s avg(stddev)/entropy: 2.5(71.2)/22.4][pktlen s2c avg(stddev)/entropy: 2.3(54.0)/0.0][bytes ratio: 0.23][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
48 TCP 10.8.0.1:51676 <-> 114.29.204.49:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][6 pkts/427 bytes <-> 5 pkts/270 bytes][pktlen c2s avg(stddev)/entropy: 2.5(71.2)/22.4][pktlen s2c avg(stddev)/entropy: 2.3(54.0)/0.0][bytes ratio: 0.23][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
49 TCP 10.8.0.1:33511 <-> 80.74.110.68:443 [proto: 91/TLS][cat: Web/5][4 pkts/452 bytes <-> 4 pkts/216 bytes][pktlen c2s avg(stddev)/entropy: 1.6(113.0)/91.0][pktlen s2c avg(stddev)/entropy: 2.0(54.0)/0.0][bytes ratio: 0.35][TLSv1][JA3C: dff8a0aa1c904aaea76c5bf624e88333]
50 TCP 10.8.0.1:51833 <-> 62.109.229.158:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][4 pkts/423 bytes <-> 4 pkts/216 bytes][pktlen c2s avg(stddev)/entropy: 1.7(105.8)/78.5][pktlen s2c avg(stddev)/entropy: 2.0(54.0)/0.0][bytes ratio: 0.32][TLSv1][JA3C: 64ea4359ad4b496db653a3f30f7073e6]
51 TCP 10.8.0.1:51839 <-> 62.109.229.158:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][4 pkts/423 bytes <-> 4 pkts/216 bytes][pktlen c2s avg(stddev)/entropy: 1.7(105.8)/78.5][pktlen s2c avg(stddev)/entropy: 2.0(54.0)/0.0][bytes ratio: 0.32][TLSv1][JA3C: 64ea4359ad4b496db653a3f30f7073e6]
52 TCP 10.8.0.1:41726 <-> 114.29.213.212:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][4 pkts/299 bytes <-> 4 pkts/216 bytes][pktlen c2s avg(stddev)/entropy: 1.9(74.8)/25.7][pktlen s2c avg(stddev)/entropy: 2.0(54.0)/0.0][bytes ratio: 0.16][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
53 TCP 10.8.0.1:51195 <-> 62.109.224.120:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][3 pkts/245 bytes <-> 2 pkts/108 bytes][pktlen c2s avg(stddev)/entropy: 1.5(81.7)/26.3][pktlen s2c avg(stddev)/entropy: 1.0(54.0)/0.0][bytes ratio: 0.39][TLSv1][JA3C: 7cb93b2404a98399e9f84c74fef1fb8f]
54 TCP 10.133.206.47:33459 <-> 80.74.110.68:443 [proto: 91/TLS][cat: Web/5][3 pkts/209 bytes <-> 2 pkts/108 bytes][pktlen c2s avg(stddev)/entropy: 1.6(69.7)/14.5][pktlen s2c avg(stddev)/entropy: 1.0(54.0)/0.0][bytes ratio: 0.32]
55 TCP 10.8.0.1:51859 <-> 62.109.229.158:443 [proto: 91.141/TLS.Webex][cat: VoIP/10][2 pkts/128 bytes <-> 1 pkts/54 bytes][pktlen c2s avg(stddev)/entropy: 1.0(64.0)/10.0][pktlen s2c avg(stddev)/entropy: 0.0(54.0)/0.0][bytes ratio: 0.41]
56 TCP 10.133.206.47:54651 <-> 185.63.147.10:443 [proto: 91/TLS][cat: Web/5][1 pkts/66 bytes <-> 2 pkts/108 bytes][pktlen c2s avg(stddev)/entropy: 0.0(66.0)/0.0][pktlen s2c avg(stddev)/entropy: 1.0(54.0)/0.0][bytes ratio: -0.24]
57 TCP 10.133.206.47:59447 <-> 107.20.242.44:443 [proto: 91.178/TLS.Amazon][cat: Web/5][1 pkts/66 bytes <-> 2 pkts/108 bytes][pktlen c2s avg(stddev)/entropy: 0.0(66.0)/0.0][pktlen s2c avg(stddev)/entropy: 1.0(54.0)/0.0][bytes ratio: -0.24]
|