vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-05-02 00:40:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Improved TCP fingepring calculation

Browse source 
Adde basidc OS detection based on TCP fingerprint
This commit is contained in:
Luca Deri 2024-10-18 23:47:34 +02:00
parent 819291b7e4
commit 0cc84e4fdd
345 changed files with 4834 additions and 4772 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tests/cfgs/default/result/hislip.pcap.out
View file

@ -24,7 +24,7 @@ HiSLIP 184 12204 4
Acceptable 184 12204 4
1 TCP 10.64.0.127:51056 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][39 pkts/2432 bytes <-> 23 pkts/1584 bytes][Goodput ratio: 12/20][214.30 sec][bytes ratio: 0.211 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 5039/8986 25879/26093 6570/7043][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 62/69 108/78 11/4][TCP Fingerprint: 128_8192_6bb88f5575fd][PLAIN TEXT (582390DAF)][Plen Bins: 97,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 10.64.0.127:51055 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][27 pkts/1765 bytes <-> 20 pkts/1466 bytes][Goodput ratio: 14/23][214.32 sec][bytes ratio: 0.093 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9060/14014 30021/30224 11869/12472][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 65/73 80/95 11/13][TCP Fingerprint: 128_8192_6bb88f5575fd][PLAIN TEXT (Query INTERRUPTED)][Plen Bins: 88,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
3 TCP 10.64.0.127:51054 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][23 pkts/1460 bytes <-> 16 pkts/1064 bytes][Goodput ratio: 11/15][246.85 sec][bytes ratio: 0.157 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9131/16221 30014/30221 11397/11595][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 63/66 108/78 12/6][TCP Fingerprint: 128_8192_6bb88f5575fd][PLAIN TEXT (582390DAF)][Plen Bins: 95,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
4 TCP 10.64.0.127:51053 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][20 pkts/1287 bytes <-> 16 pkts/1146 bytes][Goodput ratio: 10/20][246.86 sec][bytes ratio: 0.058 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 11678/16226 30021/30237 12754/12923][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 64/72 80/117 10/17][TCP Fingerprint: 128_8192_6bb88f5575fd][PLAIN TEXT (/Rohde)][Plen Bins: 83,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
1 TCP 10.64.0.127:51056 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][39 pkts/2432 bytes <-> 23 pkts/1584 bytes][Goodput ratio: 12/20][214.30 sec][bytes ratio: 0.211 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 5039/8986 25879/26093 6570/7043][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 62/69 108/78 11/4][TCP Fingerprint: 32770_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (582390DAF)][Plen Bins: 97,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 10.64.0.127:51055 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][27 pkts/1765 bytes <-> 20 pkts/1466 bytes][Goodput ratio: 14/23][214.32 sec][bytes ratio: 0.093 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9060/14014 30021/30224 11869/12472][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 65/73 80/95 11/13][TCP Fingerprint: 32770_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (Query INTERRUPTED)][Plen Bins: 88,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
3 TCP 10.64.0.127:51054 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][23 pkts/1460 bytes <-> 16 pkts/1064 bytes][Goodput ratio: 11/15][246.85 sec][bytes ratio: 0.157 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 9131/16221 30014/30221 11397/11595][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 63/66 108/78 12/6][TCP Fingerprint: 32770_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (582390DAF)][Plen Bins: 95,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
4 TCP 10.64.0.127:51053 <-> 10.64.0.72:4880 [proto: 372/HiSLIP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: IoT-Scada/31][20 pkts/1287 bytes <-> 16 pkts/1146 bytes][Goodput ratio: 10/20][246.86 sec][bytes ratio: 0.058 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 11678/16226 30021/30237 12754/12923][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 64/72 80/117 10/17][TCP Fingerprint: 32770_128_8192_6bb88f5575fd/Unknown][PLAIN TEXT (/Rohde)][Plen Bins: 83,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]