1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
DAEMON-EVENT: init
DAEMON-EVENT: [Processed: 0 pkts][ZLib][compressions: 0|diff: 0 / 0]
DAEMON-EVENT: [Flows][active: 0 / 0|skipped: 0|!detected: 0|guessed: 0|detection-updates: 0|updates: 0]
new: [.....1] [ip4][..udp] [......10.0.2.30][44639] -> [......10.0.2.20][...53]
detected: [.....1] [ip4][..udp] [......10.0.2.30][44639] -> [......10.0.2.20][...53] [DNS][Network][Acceptable]
detection-update: [.....1] [ip4][..udp] [......10.0.2.30][44639] -> [......10.0.2.20][...53] [DNS][Network][Acceptable]
RISK: Suspicious DNS Traffic
analyse: [.....1] [ip4][..udp] [......10.0.2.30][44639] -> [......10.0.2.20][...53] [DNS][Network][Acceptable]
[min|max|avg|stddev]
[IAT(flow)...: 0.000| 1.003| 0.162| 0.368]
[IAT(c->s)...: 0.000| 1.003| 0.279| 0.449][IAT(s->c)...: 0.000| 0.006| 0.001| 0.001]
[PKTLEN(c->s): 82.000| 323.000| 198.200| 107.600][PKTLEN(s->c): 93.000|1476.000| 317.400| 420.400]
[BINS(c->s)..: 0,6,4,1,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[BINS(s->c)..: 0,4,1,3,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0]
idle: [.....1] [ip4][..udp] [......10.0.2.30][44639] -> [......10.0.2.20][...53] [DNS][Network][Acceptable]
RISK: Suspicious DNS Traffic
DAEMON-EVENT: shutdown
|