1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
DAEMON-EVENT: init
DAEMON-EVENT: [Processed: 0 pkts][ZLib][compressions: 0|diff: 0 / 0]
DAEMON-EVENT: [Flows][active: 0 / 0|skipped: 0|!detected: 0|guessed: 0|detection-updates: 0|updates: 0]
new: [.....1] [ip4][..tcp] [..192.168.180.2][47699] -> [.64.233.184.188][.5228]
new: [.....2] [ip4][..udp] [..192.168.180.2][38472] -> [........8.8.8.8][...53]
detected: [.....2] [ip4][..udp] [..192.168.180.2][38472] -> [........8.8.8.8][...53] [DNS.OCS][Media][Fun]
new: [.....3] [ip4][..udp] [..192.168.180.2][40097] -> [........8.8.8.8][...53]
detected: [.....3] [ip4][..udp] [..192.168.180.2][40097] -> [........8.8.8.8][...53] [DNS.Crashlytics][DataTransfer][Acceptable]
new: [.....4] [ip4][..udp] [..192.168.180.2][.1291] -> [........8.8.8.8][...53]
detected: [.....4] [ip4][..udp] [..192.168.180.2][.1291] -> [........8.8.8.8][...53] [DNS.Google][Web][Acceptable]
new: [.....5] [ip4][..tcp] [..192.168.180.2][48250] -> [.178.248.208.54][...80]
new: [.....6] [ip4][..tcp] [..192.168.180.2][39263] -> [..23.21.230.199][..443]
new: [.....7] [ip4][..tcp] [..192.168.180.2][53356] -> [137.135.129.206][...80]
detected: [.....5] [ip4][..tcp] [..192.168.180.2][48250] -> [.178.248.208.54][...80] [HTTP.OCS][Media][Fun]
detected: [.....7] [ip4][..tcp] [..192.168.180.2][53356] -> [137.135.129.206][...80] [HTTP.Azure][Cloud][Acceptable]
new: [.....8] [ip4][..tcp] [..192.168.180.2][44959] -> [137.135.129.206][...80]
detected: [.....8] [ip4][..tcp] [..192.168.180.2][44959] -> [137.135.129.206][...80] [HTTP.Azure][Cloud][Acceptable]
new: [.....9] [ip4][..udp] [..192.168.180.2][48770] -> [........8.8.8.8][...53]
detected: [.....9] [ip4][..udp] [..192.168.180.2][48770] -> [........8.8.8.8][...53] [DNS.PlayStore][SoftwareUpdate][Safe]
new: [....10] [ip4][..tcp] [..192.168.180.2][41223] -> [..216.58.208.46][..443]
detected: [....10] [ip4][..tcp] [..192.168.180.2][41223] -> [..216.58.208.46][..443] [TLS.Google][Web][Acceptable]
RISK: Obsolete TLS (v1.1 or older)
detected: [.....6] [ip4][..tcp] [..192.168.180.2][39263] -> [..23.21.230.199][..443] [TLS.Crashlytics][DataTransfer][Acceptable]
RISK: Obsolete TLS (v1.1 or older)
new: [....11] [ip4][..udp] [..192.168.180.2][.3621] -> [........8.8.8.8][...53]
detected: [....11] [ip4][..udp] [..192.168.180.2][.3621] -> [........8.8.8.8][...53] [DNS.Google][Web][Acceptable]
new: [....12] [ip4][..tcp] [..192.168.180.2][46166] -> [.137.135.131.52][.5122]
new: [....13] [ip4][..tcp] [..192.168.180.2][49881] -> [.178.248.208.54][...80]
new: [....14] [ip4][..udp] [..192.168.180.2][.2589] -> [........8.8.8.8][...53]
detected: [....14] [ip4][..udp] [..192.168.180.2][.2589] -> [........8.8.8.8][...53] [DNS.OCS][Media][Fun]
detected: [....13] [ip4][..tcp] [..192.168.180.2][49881] -> [.178.248.208.54][...80] [HTTP.OCS][Media][Fun]
new: [....15] [ip4][..tcp] [..192.168.180.2][36680] -> [.178.248.208.54][..443]
detected: [....15] [ip4][..tcp] [..192.168.180.2][36680] -> [.178.248.208.54][..443] [TLS.OCS][Media][Fun]
RISK: Obsolete TLS (v1.1 or older)
analyse: [....13] [ip4][..tcp] [..192.168.180.2][49881] -> [.178.248.208.54][...80] [HTTP.OCS][Media][Fun]
[min|max|avg|stddev|variance|entropy]
[IAT.........: 0.000| 0.929| 0.088| 0.173|29794.175| 0.000]
[PKTLEN......: 52.000| 715.000| 83.100| 113.800|12942.200| 4.500]
[BINS(c->s)..: 31,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[BINS(s->c)..: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[DIRECTIONS..: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[IATS........: 83797,14275,246872,572,450,68391,1837,71492,506,5433,4137,41728,146026,90832,71054,77421,63432,3718,80468,1653,86121,564,67336,32599,43283,386587,73735,2510,928563,31722,2140,0]
[PKTLENS.....: 60,52,715,64,72,72,80,72,72,72,72,72,64,52,64,64,64,52,52,52,52,64,64,64,64,52,52,64,64,52,64,64]
new: [....16] [ip4][..tcp] [..192.168.180.2][32946] -> [.64.233.184.188][..443]
detected: [....16] [ip4][..tcp] [..192.168.180.2][32946] -> [.64.233.184.188][..443] [TLS.GoogleServices][Web][Acceptable]
RISK: TLS (probably) Not Carrying HTTPS
new: [....17] [ip4][..udp] [..192.168.180.2][11793] -> [........8.8.8.8][...53]
detected: [....17] [ip4][..udp] [..192.168.180.2][11793] -> [........8.8.8.8][...53] [DNS.GoogleServices][Web][Acceptable]
new: [....18] [ip4][..tcp] [..192.168.180.2][47803] -> [..64.233.166.95][..443]
detected: [....18] [ip4][..tcp] [..192.168.180.2][47803] -> [..64.233.166.95][..443] [TLS.Google][Web][Acceptable]
RISK: Obsolete TLS (v1.1 or older)
update: [....14] [ip4][..udp] [..192.168.180.2][.2589] -> [........8.8.8.8][...53]
update: [.....3] [ip4][..udp] [..192.168.180.2][40097] -> [........8.8.8.8][...53]
update: [.....4] [ip4][..udp] [..192.168.180.2][.1291] -> [........8.8.8.8][...53]
update: [....11] [ip4][..udp] [..192.168.180.2][.3621] -> [........8.8.8.8][...53]
update: [.....2] [ip4][..udp] [..192.168.180.2][38472] -> [........8.8.8.8][...53]
update: [.....9] [ip4][..udp] [..192.168.180.2][48770] -> [........8.8.8.8][...53]
new: [....19] [ip4][..udp] [..192.168.180.2][24245] -> [........8.8.8.8][...53]
detected: [....19] [ip4][..udp] [..192.168.180.2][24245] -> [........8.8.8.8][...53] [DNS.OCS][Media][Fun]
new: [....20] [ip4][..tcp] [..192.168.180.2][42590] -> [178.248.208.210][...80]
detected: [....20] [ip4][..tcp] [..192.168.180.2][42590] -> [178.248.208.210][...80] [HTTP.OCS][Media][Fun]
analyse: [....20] [ip4][..tcp] [..192.168.180.2][42590] -> [178.248.208.210][...80] [HTTP.OCS][Media][Fun]
[min|max|avg|stddev|variance|entropy]
[IAT.........: 0.000| 0.079| 0.027| 0.030| 875.550| 0.000]
[PKTLEN......: 52.000| 204.000| 63.900| 26.300| 690.500| 4.900]
[BINS(c->s)..: 31,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[BINS(s->c)..: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[DIRECTIONS..: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[IATS........: 71399,1526,54762,1106,3570,59902,605,77,5328,64776,1667,1533,79495,5458,58361,1849,64604,1987,67520,26503,42864,25995,65439,972,48553,1253,1960,1270,75524,1445,4821,0]
[PKTLENS.....: 60,52,204,52,52,52,52,52,64,64,64,64,72,64,64,72,72,72,64,64,64,52,52,52,52,52,52,52,52,52,64,72]
update: [....17] [ip4][..udp] [..192.168.180.2][11793] -> [........8.8.8.8][...53]
idle: [....20] [ip4][..tcp] [..192.168.180.2][42590] -> [178.248.208.210][...80] [HTTP.OCS][Media][Fun]
end: [.....8] [ip4][..tcp] [..192.168.180.2][44959] -> [137.135.129.206][...80]
guessed: [....12] [ip4][..tcp] [..192.168.180.2][46166] -> [.137.135.131.52][.5122] [Azure][Cloud][Acceptable]
idle: [....12] [ip4][..tcp] [..192.168.180.2][46166] -> [.137.135.131.52][.5122]
guessed: [.....1] [ip4][..tcp] [..192.168.180.2][47699] -> [.64.233.184.188][.5228] [Google][Web][Acceptable]
idle: [.....1] [ip4][..tcp] [..192.168.180.2][47699] -> [.64.233.184.188][.5228]
end: [.....6] [ip4][..tcp] [..192.168.180.2][39263] -> [..23.21.230.199][..443] [TLS.Crashlytics][DataTransfer][Acceptable]
RISK: Obsolete TLS (v1.1 or older)
end: [.....7] [ip4][..tcp] [..192.168.180.2][53356] -> [137.135.129.206][...80]
idle: [....15] [ip4][..tcp] [..192.168.180.2][36680] -> [.178.248.208.54][..443] [TLS.OCS][Media][Fun]
RISK: Obsolete TLS (v1.1 or older)
idle: [....14] [ip4][..udp] [..192.168.180.2][.2589] -> [........8.8.8.8][...53]
idle: [....16] [ip4][..tcp] [..192.168.180.2][32946] -> [.64.233.184.188][..443] [TLS.GoogleServices][Web][Acceptable]
RISK: TLS (probably) Not Carrying HTTPS
end: [....13] [ip4][..tcp] [..192.168.180.2][49881] -> [.178.248.208.54][...80] [HTTP.OCS][Media][Fun]
idle: [.....3] [ip4][..udp] [..192.168.180.2][40097] -> [........8.8.8.8][...53]
idle: [.....4] [ip4][..udp] [..192.168.180.2][.1291] -> [........8.8.8.8][...53]
idle: [.....5] [ip4][..tcp] [..192.168.180.2][48250] -> [.178.248.208.54][...80]
end: [....10] [ip4][..tcp] [..192.168.180.2][41223] -> [..216.58.208.46][..443] [TLS.Google][Web][Acceptable]
RISK: Obsolete TLS (v1.1 or older)
idle: [....18] [ip4][..tcp] [..192.168.180.2][47803] -> [..64.233.166.95][..443] [TLS.Google][Web][Acceptable]
RISK: Obsolete TLS (v1.1 or older)
idle: [....17] [ip4][..udp] [..192.168.180.2][11793] -> [........8.8.8.8][...53]
idle: [....11] [ip4][..udp] [..192.168.180.2][.3621] -> [........8.8.8.8][...53]
idle: [.....2] [ip4][..udp] [..192.168.180.2][38472] -> [........8.8.8.8][...53]
idle: [.....9] [ip4][..udp] [..192.168.180.2][48770] -> [........8.8.8.8][...53]
idle: [....19] [ip4][..udp] [..192.168.180.2][24245] -> [........8.8.8.8][...53]
DAEMON-EVENT: shutdown
|