1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
DAEMON-EVENT: init
DAEMON-EVENT: [Processed: 0 pkts][ZLib][compressions: 0|diff: 0 / 0]
DAEMON-EVENT: [Flows][active: 0 / 0|skipped: 0|!detected: 0|guessed: 0|detection-updates: 0|updates: 0]
new: [.....1] [ip4][..tcp] [...192.168.0.20][33632] -> [....192.168.0.7][.8080]
detected: [.....1] [ip4][..tcp] [...192.168.0.20][33632] -> [....192.168.0.7][.8080] [HTTP][Unknown][Web][Acceptable][wwww.lan]
RISK: Known Proto on Non Std Port
DAEMON-EVENT: [Processed: 10 pkts][ZLib][compressions: 0|diff: 0 / 0]
DAEMON-EVENT: [Flows][active: 1 / 1|skipped: 0|!detected: 0|guessed: 0|detection-updates: 0|updates: 0]
new: [.....2] [ip4][..tcp] [...192.168.0.20][33684] -> [....192.168.0.7][.8080]
detected: [.....2] [ip4][..tcp] [...192.168.0.20][33684] -> [....192.168.0.7][.8080] [HTTP][Unknown][Web][Acceptable][www.lan]
RISK: Known Proto on Non Std Port
analyse: [.....2] [ip4][..tcp] [...192.168.0.20][33684] -> [....192.168.0.7][.8080] [HTTP][Unknown][Web][Acceptable]
min| max| avg| stddev| variance| entropy
[IAT.........: 0.000| 0.073| 0.005| 0.018| 320.351| 1.200]
[PKTLEN......: 40.000| 5880.000| 1450.400| 1938.500| 3757919.500| 3.700]
[BINS(c->s)..: 14,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[BINS(s->c)..: 3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,10]
[DIRECTIONS..: 0,1,0,0,1,1,0,0,1,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1]
[IATS(ms)....: 0.2,0.2,0.1,0.3,0.2,0.4,72.8,73.1,0.2,0.4,0.1,0.1,0.0,0.0,0.0,0.0,0.1,0.1,0.1,0.1,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0]
[PKTLENS.....: 52,52,40,426,46,617,40,375,46,2960,40,4420,40,2960,40,4420,40,1500,40,4420,40,2960,40,4420,40,1500,40,5880,40,5880,40,2960]
[ENTROPIES...: 4.6,4.8,4.7,5.7,4.3,5.7,4.7,5.6,4.3,7.8,4.7,7.9,4.7,7.8,4.6,7.9,4.7,7.7,4.7,7.9,4.7,7.8,4.7,7.8,4.6,7.7,4.6,7.9,4.7,7.9,4.7,7.9]
end: [.....1] [ip4][..tcp] [...192.168.0.20][33632] -> [....192.168.0.7][.8080] [HTTP][Unknown][Web][Acceptable]
RISK: Known Proto on Non Std Port
end: [.....2] [ip4][..tcp] [...192.168.0.20][33684] -> [....192.168.0.7][.8080] [HTTP][Unknown][Web][Acceptable]
RISK: Known Proto on Non Std Port
DAEMON-EVENT: shutdown
|