vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-05-01 16:30:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Improved TCP fingerprint

Browse source
This commit is contained in:
Luca Deri 2024-10-20 22:25:55 +02:00
parent 5465eec56e
commit 14b076a58b
327 changed files with 4737 additions and 4727 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/cfgs/default/result/shell.pcap.out
View file

@ -28,7 +28,7 @@ Unrated 18 13422 4
Undetected flows:
1 TCP 127.0.0.1:54970 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][5 pkts/5526 bytes <-> 3 pkts/206 bytes][Goodput ratio: 94/0][1.26 sec][bytes ratio: 0.928 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 315/0 1259/0 545/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1105/69 5254/74 2074/4][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][TCP Fingerprint: 40962_64_65495_db1b9381215d/Unknown][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100]
1 TCP 127.0.0.1:54970 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][5 pkts/5526 bytes <-> 3 pkts/206 bytes][Goodput ratio: 94/0][1.26 sec][bytes ratio: 0.928 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 315/0 1259/0 545/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1105/69 5254/74 2074/4][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100]
2 UDP 127.0.0.1:58538 -> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/5230 bytes -> 0 pkts/0 bytes][Goodput ratio: 99/0][< 1 sec][Risk: ** Susp Entropy **** Possible Exploit Attempt **** Unidirectional Traffic **][Risk Score: 170][Risk Info: No server to client traffic / Shellscript found / Entropy: 4.969 (Executable?)][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100]
3 TCP 127.0.0.1:47638 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][4 pkts/1209 bytes <-> 4 pkts/272 bytes][Goodput ratio: 77/0][4.14 sec][bytes ratio: 0.633 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4140/0 1380/0 4140/0 1952/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 302/68 1003/74 405/3][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][TCP Fingerprint: 40962_64_65495_db1b9381215d/Unknown][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
3 TCP 127.0.0.1:47638 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][4 pkts/1209 bytes <-> 4 pkts/272 bytes][Goodput ratio: 77/0][4.14 sec][bytes ratio: 0.633 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4140/0 1380/0 4140/0 1952/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 302/68 1003/74 405/3][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][TCP Fingerprint: 2_64_65495_db1b9381215d/Unknown][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
4 UDP 127.0.0.1:54112 -> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/979 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Susp Entropy **** Possible Exploit Attempt **** Unidirectional Traffic **][Risk Score: 170][Risk Info: No server to client traffic / Shellscript found / Entropy: 5.378 (Executable?)][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]