From 9a28475bba88b711b7075b58473b7e5b5df1f393 Mon Sep 17 00:00:00 2001 From: Toni Uhlig Date: Thu, 22 Sep 2022 19:07:08 +0200 Subject: Improved flown analyse event: * store packet directions * merged direction based IATs * merged direction based PKTLENs Signed-off-by: Toni Uhlig --- test/results/flow-info/443-curl.pcap.out | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'test/results/flow-info/443-curl.pcap.out') diff --git a/test/results/flow-info/443-curl.pcap.out b/test/results/flow-info/443-curl.pcap.out index d491b56a7..98e036b74 100644 --- a/test/results/flow-info/443-curl.pcap.out +++ b/test/results/flow-info/443-curl.pcap.out @@ -6,11 +6,13 @@ detection-update: [.....1] [ip4][..tcp] [...192.168.1.13][55523] -> [.178.62.197.130][..443] [TLS.ntop][Network][Safe] detection-update: [.....1] [ip4][..tcp] [...192.168.1.13][55523] -> [.178.62.197.130][..443] [TLS.ntop][Network][Safe] analyse: [.....1] [ip4][..tcp] [...192.168.1.13][55523] -> [.178.62.197.130][..443] [TLS.ntop][Network][Safe] - [min|max|avg|stddev] - [IAT(flow)...: 0.000| 0.784| 0.063| 0.190] - [IAT(c->s)...: 0.000| 0.784| 0.061| 0.188][IAT(s->c)...: 0.000| 0.784| 0.065| 0.193] - [PKTLEN(c->s): 66.000| 583.000| 119.600| 120.800][PKTLEN(s->c): 66.000|1506.000| 741.700| 666.100] + [min|max|avg|stddev|variance|entropy] + [IAT.........: 0.000| 0.784| 0.063| 0.190|36203.258| 0.000] + [PKTLEN......: 66.000| 1506.000| 411.200| 558.700|312115.000| 3.900] [BINS(c->s)..: 10,4,1,1,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] [BINS(s->c)..: 3,3,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0] + [DIRECTIONS..: 0,1,0,0,1,1,1,1,0,0,0,1,1,0,0,0,0,0,0,0,1,1,0,1,0,1,1,0,1,1,0,1] + [IATS........: 38692,38799,9627,47643,2769,1124,2,41874,4,11797,50900,31,39132,3,742,11,18,78,76,38549,8926,46564,784064,784044,367,123,462,127,121,240,248,0] + [PKTLENS.....: 78,74,66,583,66,1506,1506,197,66,66,192,117,123,66,66,119,122,108,133,104,66,104,66,281,66,1506,1506,66,1506,1062,66,1506] end: [.....1] [ip4][..tcp] [...192.168.1.13][55523] -> [.178.62.197.130][..443] [TLS.ntop][Network][Safe] DAEMON-EVENT: shutdown -- cgit v1.2.3