1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
DAEMON-EVENT: init
DAEMON-EVENT: [Processed: 0 pkts][ZLib][compressions: 0|diff: 0 / 0]
DAEMON-EVENT: [Flows][active: 0 / 0|skipped: 0|!detected: 0|guessed: 0|detection-updates: 0|updates: 0]
new: [.....1] [ip4][..tcp] [...172.16.2.185][52494] -> [..192.168.2.142][.3389]
detected: [.....1] [ip4][..tcp] [...172.16.2.185][52494] -> [..192.168.2.142][.3389] [RDP][RemoteAccess][Acceptable]
RISK: Desktop/File Sharing
analyse: [.....1] [ip4][..tcp] [...172.16.2.185][52494] -> [..192.168.2.142][.3389] [RDP][RemoteAccess][Acceptable]
[min|max|avg|stddev]
[IAT(flow)...: 0.000| 0.086| 0.035| 0.023]
[IAT(c->s)...: 0.000| 0.083| 0.027| 0.024][IAT(s->c)...: 0.040| 0.086| 0.049| 0.012]
[PKTLEN(c->s): 44.000| 616.000| 125.700| 154.000][PKTLEN(s->c): 44.000|1223.000| 217.800| 327.800]
[BINS(c->s)..: 12,3,1,2,0,1,0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[BINS(s->c)..: 3,4,1,0,1,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0]
end: [.....1] [ip4][..tcp] [...172.16.2.185][52494] -> [..192.168.2.142][.3389] [RDP][RemoteAccess][Acceptable]
RISK: Desktop/File Sharing
DAEMON-EVENT: shutdown
|