blob: 8b9c19b9589c361e0c73d46a05bf1119242cd6ee (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
DAEMON-EVENT: init
DAEMON-EVENT: [Processed: 0 pkts][ZLib][compressions: 0|diff: 0 / 0]
DAEMON-EVENT: [Flows][active: 0 / 0|skipped: 0|!detected: 0|guessed: 0|detection-updates: 0|updates: 0]
new: [.....1] [ip4][..tcp] [...172.16.8.201][49157] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [.....1] [ip4][..tcp] [...172.16.8.201][49157] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
new: [.....2] [ip4][..tcp] [...172.16.8.201][49158] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [.....2] [ip4][..tcp] [...172.16.8.201][49158] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
new: [.....3] [ip4][..tcp] [...172.16.8.201][49159] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [.....4] [ip4][..tcp] [...172.16.8.201][49160] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [.....4] [ip4][..tcp] [...172.16.8.201][49160] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
detection-update: [.....4] [ip4][..tcp] [...172.16.8.201][49160] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
new: [.....5] [ip4][..tcp] [...172.16.8.201][49156] -> [.....172.16.8.8][..445] [MIDSTREAM]
new: [.....6] [ip4][..tcp] [...172.16.8.201][49162] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [.....7] [ip4][..tcp] [...172.16.8.201][49161] -> [.....172.16.8.8][..389] [MIDSTREAM]
new: [.....8] [ip4][..tcp] [...172.16.8.201][49166] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [.....8] [ip4][..tcp] [...172.16.8.201][49166] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
new: [.....9] [ip4][..tcp] [...172.16.8.201][49167] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [.....9] [ip4][..tcp] [...172.16.8.201][49167] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
new: [....10] [ip4][..tcp] [...172.16.8.201][49168] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....11] [ip4][..tcp] [...172.16.8.201][49165] -> [.....172.16.8.8][49155] [MIDSTREAM]
new: [....12] [ip4][..tcp] [...172.16.8.201][49169] -> [.....172.16.8.8][..389] [MIDSTREAM]
new: [....13] [ip4][..tcp] [...172.16.8.201][49170] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....14] [ip4][..tcp] [...172.16.8.201][49171] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [....14] [ip4][..tcp] [...172.16.8.201][49171] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
detection-update: [....14] [ip4][..tcp] [...172.16.8.201][49171] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
new: [....15] [ip4][..tcp] [...172.16.8.201][49173] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....16] [ip4][..tcp] [...172.16.8.201][49172] -> [.....172.16.8.8][..389] [MIDSTREAM]
new: [....17] [ip4][..tcp] [...172.16.8.201][49175] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....18] [ip4][..tcp] [...172.16.8.201][49176] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [....18] [ip4][..tcp] [...172.16.8.201][49176] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
detection-update: [....18] [ip4][..tcp] [...172.16.8.201][49176] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
new: [....19] [ip4][..tcp] [...172.16.8.201][49174] -> [.....172.16.8.8][..445] [MIDSTREAM]
new: [....20] [ip4][..tcp] [...172.16.8.201][49179] -> [.....172.16.8.8][..389] [MIDSTREAM]
new: [....21] [ip4][..tcp] [...172.16.8.201][49180] -> [.....172.16.8.8][..389] [MIDSTREAM]
new: [....22] [ip4][..tcp] [...172.16.8.201][49181] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [....22] [ip4][..tcp] [...172.16.8.201][49181] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
new: [....23] [ip4][..tcp] [...172.16.8.201][49182] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [....23] [ip4][..tcp] [...172.16.8.201][49182] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
new: [....24] [ip4][..tcp] [...172.16.8.201][49183] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....25] [ip4][..tcp] [...172.16.8.201][49186] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....26] [ip4][..tcp] [...172.16.8.201][49185] -> [.....172.16.8.8][49155] [MIDSTREAM]
new: [....27] [ip4][..tcp] [...172.16.8.201][49187] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [....27] [ip4][..tcp] [...172.16.8.201][49187] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
new: [....28] [ip4][..tcp] [...172.16.8.201][49188] -> [.....172.16.8.8][...88] [MIDSTREAM]
detected: [....28] [ip4][..tcp] [...172.16.8.201][49188] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
RISK: Unidirectional Traffic
new: [....29] [ip4][..tcp] [...172.16.8.201][49189] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....30] [ip4][..tcp] [...172.16.8.201][49190] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....31] [ip4][..tcp] [...172.16.8.201][49192] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....32] [ip4][..tcp] [...172.16.8.201][49191] -> [.....172.16.8.8][..389] [MIDSTREAM]
new: [....33] [ip4][..tcp] [...172.16.8.201][49193] -> [.....172.16.8.8][..389] [MIDSTREAM]
new: [....34] [ip4][..tcp] [...172.16.8.201][49195] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....35] [ip4][..tcp] [...172.16.8.201][49196] -> [.....172.16.8.8][...88] [MIDSTREAM]
new: [....36] [ip4][..tcp] [...172.16.8.201][49194] -> [.....172.16.8.8][..445] [MIDSTREAM]
not-detected: [....11] [ip4][..tcp] [...172.16.8.201][49165] -> [.....172.16.8.8][49155] [Unknown][Unknown][Unrated]
idle: [....11] [ip4][..tcp] [...172.16.8.201][49165] -> [.....172.16.8.8][49155]
not-detected: [....26] [ip4][..tcp] [...172.16.8.201][49185] -> [.....172.16.8.8][49155] [Unknown][Unknown][Unrated]
idle: [....26] [ip4][..tcp] [...172.16.8.201][49185] -> [.....172.16.8.8][49155]
idle: [.....1] [ip4][..tcp] [...172.16.8.201][49157] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [.....2] [ip4][..tcp] [...172.16.8.201][49158] -> [.....172.16.8.8][...88]
guessed: [.....3] [ip4][..tcp] [...172.16.8.201][49159] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [.....3] [ip4][..tcp] [...172.16.8.201][49159] -> [.....172.16.8.8][...88]
idle: [.....4] [ip4][..tcp] [...172.16.8.201][49160] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
guessed: [.....6] [ip4][..tcp] [...172.16.8.201][49162] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [.....6] [ip4][..tcp] [...172.16.8.201][49162] -> [.....172.16.8.8][...88]
idle: [.....8] [ip4][..tcp] [...172.16.8.201][49166] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [.....9] [ip4][..tcp] [...172.16.8.201][49167] -> [.....172.16.8.8][...88]
guessed: [....10] [ip4][..tcp] [...172.16.8.201][49168] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....10] [ip4][..tcp] [...172.16.8.201][49168] -> [.....172.16.8.8][...88]
guessed: [....13] [ip4][..tcp] [...172.16.8.201][49170] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....13] [ip4][..tcp] [...172.16.8.201][49170] -> [.....172.16.8.8][...88]
idle: [....14] [ip4][..tcp] [...172.16.8.201][49171] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
guessed: [....15] [ip4][..tcp] [...172.16.8.201][49173] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....15] [ip4][..tcp] [...172.16.8.201][49173] -> [.....172.16.8.8][...88]
guessed: [....17] [ip4][..tcp] [...172.16.8.201][49175] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....17] [ip4][..tcp] [...172.16.8.201][49175] -> [.....172.16.8.8][...88]
idle: [....18] [ip4][..tcp] [...172.16.8.201][49176] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....22] [ip4][..tcp] [...172.16.8.201][49181] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....23] [ip4][..tcp] [...172.16.8.201][49182] -> [.....172.16.8.8][...88]
guessed: [....24] [ip4][..tcp] [...172.16.8.201][49183] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....24] [ip4][..tcp] [...172.16.8.201][49183] -> [.....172.16.8.8][...88]
guessed: [....25] [ip4][..tcp] [...172.16.8.201][49186] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....25] [ip4][..tcp] [...172.16.8.201][49186] -> [.....172.16.8.8][...88]
idle: [....27] [ip4][..tcp] [...172.16.8.201][49187] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....28] [ip4][..tcp] [...172.16.8.201][49188] -> [.....172.16.8.8][...88]
guessed: [....29] [ip4][..tcp] [...172.16.8.201][49189] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....29] [ip4][..tcp] [...172.16.8.201][49189] -> [.....172.16.8.8][...88]
guessed: [....30] [ip4][..tcp] [...172.16.8.201][49190] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....30] [ip4][..tcp] [...172.16.8.201][49190] -> [.....172.16.8.8][...88]
guessed: [....31] [ip4][..tcp] [...172.16.8.201][49192] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....31] [ip4][..tcp] [...172.16.8.201][49192] -> [.....172.16.8.8][...88]
guessed: [....34] [ip4][..tcp] [...172.16.8.201][49195] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....34] [ip4][..tcp] [...172.16.8.201][49195] -> [.....172.16.8.8][...88]
guessed: [....35] [ip4][..tcp] [...172.16.8.201][49196] -> [.....172.16.8.8][...88] [Kerberos][Unknown][Network][Acceptable]
idle: [....35] [ip4][..tcp] [...172.16.8.201][49196] -> [.....172.16.8.8][...88]
guessed: [.....7] [ip4][..tcp] [...172.16.8.201][49161] -> [.....172.16.8.8][..389] [LDAP][Unknown][System][Acceptable]
idle: [.....7] [ip4][..tcp] [...172.16.8.201][49161] -> [.....172.16.8.8][..389]
guessed: [....12] [ip4][..tcp] [...172.16.8.201][49169] -> [.....172.16.8.8][..389] [LDAP][Unknown][System][Acceptable]
idle: [....12] [ip4][..tcp] [...172.16.8.201][49169] -> [.....172.16.8.8][..389]
guessed: [....16] [ip4][..tcp] [...172.16.8.201][49172] -> [.....172.16.8.8][..389] [LDAP][Unknown][System][Acceptable]
idle: [....16] [ip4][..tcp] [...172.16.8.201][49172] -> [.....172.16.8.8][..389]
guessed: [....20] [ip4][..tcp] [...172.16.8.201][49179] -> [.....172.16.8.8][..389] [LDAP][Unknown][System][Acceptable]
idle: [....20] [ip4][..tcp] [...172.16.8.201][49179] -> [.....172.16.8.8][..389]
guessed: [....21] [ip4][..tcp] [...172.16.8.201][49180] -> [.....172.16.8.8][..389] [LDAP][Unknown][System][Acceptable]
idle: [....21] [ip4][..tcp] [...172.16.8.201][49180] -> [.....172.16.8.8][..389]
guessed: [....32] [ip4][..tcp] [...172.16.8.201][49191] -> [.....172.16.8.8][..389] [LDAP][Unknown][System][Acceptable]
idle: [....32] [ip4][..tcp] [...172.16.8.201][49191] -> [.....172.16.8.8][..389]
guessed: [....33] [ip4][..tcp] [...172.16.8.201][49193] -> [.....172.16.8.8][..389] [LDAP][Unknown][System][Acceptable]
idle: [....33] [ip4][..tcp] [...172.16.8.201][49193] -> [.....172.16.8.8][..389]
guessed: [.....5] [ip4][..tcp] [...172.16.8.201][49156] -> [.....172.16.8.8][..445] [SMBv23][Unknown][System][Acceptable]
idle: [.....5] [ip4][..tcp] [...172.16.8.201][49156] -> [.....172.16.8.8][..445]
guessed: [....19] [ip4][..tcp] [...172.16.8.201][49174] -> [.....172.16.8.8][..445] [SMBv23][Unknown][System][Acceptable]
idle: [....19] [ip4][..tcp] [...172.16.8.201][49174] -> [.....172.16.8.8][..445]
guessed: [....36] [ip4][..tcp] [...172.16.8.201][49194] -> [.....172.16.8.8][..445] [SMBv23][Unknown][System][Acceptable]
idle: [....36] [ip4][..tcp] [...172.16.8.201][49194] -> [.....172.16.8.8][..445]
DAEMON-EVENT: shutdown
|