vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-05-02 00:40:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Fixed probing attempt risk that was creating false positives

Browse source
This commit is contained in:
Luca Deri 2024-08-07 11:35:17 +02:00
parent 653175e724
commit fc4fb4d409
211 changed files with 3841 additions and 3850 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tests/cfgs/default/result/coap_mqtt.pcap.out
View file

@ -32,10 +32,10 @@ Acceptable 1061 100887 8
2 UDP 192.168.56.1:50312 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13947 bytes <-> 100 pkts/6247 bytes][Goodput ratio: 70/33][11.09 sec][bytes ratio: 0.381 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 111/111 154/150 10/9][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 139/62 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,11,38,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
3 UDP 192.168.56.1:50319 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13921 bytes <-> 100 pkts/6221 bytes][Goodput ratio: 70/32][10.92 sec][bytes ratio: 0.382 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 110/110 172/164 11/11][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 139/62 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,15,35,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
4 UDP 192.168.56.1:50311 <-> 192.168.56.101:17500 [proto: 121/Dropbox][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 121/Dropbox, Confidence: DPI][DPI packets: 1][cat: Cloud/13][100 pkts/13910 bytes <-> 100 pkts/6210 bytes][Goodput ratio: 70/32][11.20 sec][bytes ratio: 0.383 (Upload)][IAT c2s/s2c min/avg/max/stddev: 103/103 112/113 151/147 10/9][Pkt Len c2s/s2c min/avg/max/stddev: 136/59 139/62 143/66 2/2][PLAIN TEXT (messageType)][Plen Bins: 50,0,16,34,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
5 TCP 192.168.56.1:53528 <-> 192.168.56.101:17501 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][34 pkts/2662 bytes <-> 41 pkts/3133 bytes][Goodput ratio: 27/29][5.40 sec][bytes ratio: -0.081 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 195/158 4242/4438 810/757][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 78/76 114/140 25/36][Risk: ** Known Proto on Non Std Port **** Probing attempt **][Risk Score: 100][Risk Info: TCP connection with unidirectional traffic][PLAIN TEXT (17Info)][Plen Bins: 52,25,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
6 TCP 192.168.56.1:53522 <-> 192.168.56.101:17501 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 222/MQTT, Confidence: DPI][DPI packets: 1][cat: RPC/16][28 pkts/2166 bytes <-> 35 pkts/2698 bytes][Goodput ratio: 27/30][28.42 sec][bytes ratio: -0.109 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1340/1008 27310/27505 5807/5099][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 77/77 114/140 25/37][Risk: ** Known Proto on Non Std Port **** Probing attempt **][Risk Score: 100][Risk Info: No server to client traffic / TCP connection with unidirectional traffic][PLAIN TEXT (messageType)][Plen Bins: 51,24,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
7 TCP 192.168.56.1:53523 <-> 192.168.56.101:17501 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 222/MQTT, Confidence: DPI][DPI packets: 1][cat: RPC/16][28 pkts/2166 bytes <-> 35 pkts/2698 bytes][Goodput ratio: 27/30][14.07 sec][bytes ratio: -0.109 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 656/495 12952/13150 2750/2436][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 77/77 114/140 25/37][Risk: ** Known Proto on Non Std Port **** Probing attempt **][Risk Score: 100][Risk Info: No server to client traffic / TCP connection with unidirectional traffic][PLAIN TEXT (messageType)][Plen Bins: 51,24,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
8 TCP 192.168.56.101:17501 <-> 192.168.56.1:53524 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 222/MQTT, Confidence: DPI][DPI packets: 1][cat: RPC/16][34 pkts/2642 bytes <-> 26 pkts/2046 bytes][Goodput ratio: 30/28][0.92 sec][bytes ratio: 0.127 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 27/34 73/75 28/28][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 78/79 140/114 37/26][Risk: ** Known Proto on Non Std Port **** Probing attempt **][Risk Score: 100][Risk Info: No server to client traffic / TCP connection with unidirectional traffic][PLAIN TEXT (messageType)][Plen Bins: 48,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
5 TCP 192.168.56.1:53528 <-> 192.168.56.101:17501 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: RPC/16][34 pkts/2662 bytes <-> 41 pkts/3133 bytes][Goodput ratio: 27/29][5.40 sec][bytes ratio: -0.081 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 195/158 4242/4438 810/757][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 78/76 114/140 25/36][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][PLAIN TEXT (17Info)][Plen Bins: 52,25,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
6 TCP 192.168.56.1:53522 <-> 192.168.56.101:17501 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 222/MQTT, Confidence: DPI][DPI packets: 1][cat: RPC/16][28 pkts/2166 bytes <-> 35 pkts/2698 bytes][Goodput ratio: 27/30][28.42 sec][bytes ratio: -0.109 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1340/1008 27310/27505 5807/5099][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 77/77 114/140 25/37][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic][PLAIN TEXT (messageType)][Plen Bins: 51,24,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
7 TCP 192.168.56.1:53523 <-> 192.168.56.101:17501 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 222/MQTT, Confidence: DPI][DPI packets: 1][cat: RPC/16][28 pkts/2166 bytes <-> 35 pkts/2698 bytes][Goodput ratio: 27/30][14.07 sec][bytes ratio: -0.109 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 656/495 12952/13150 2750/2436][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 77/77 114/140 25/37][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic][PLAIN TEXT (messageType)][Plen Bins: 51,24,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
8 TCP 192.168.56.101:17501 <-> 192.168.56.1:53524 [proto: 222/MQTT][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 222/MQTT, Confidence: DPI][DPI packets: 1][cat: RPC/16][34 pkts/2642 bytes <-> 26 pkts/2046 bytes][Goodput ratio: 30/28][0.92 sec][bytes ratio: 0.127 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 27/34 73/75 28/28][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 78/79 140/114 37/26][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic][PLAIN TEXT (messageType)][Plen Bins: 48,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
9 UDP [bbbb::1]:46819 <-> [bbbb::3]:5683 [proto: 27/COAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 27/COAP, Confidence: DPI][DPI packets: 1][cat: RPC/16][3 pkts/262 bytes <-> 3 pkts/205 bytes][Goodput ratio: 29/9][87.03 sec][bytes ratio: 0.122 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 16604/16599 43490/43489 70376/70379 26886/26890][Pkt Len c2s/s2c min/avg/max/stddev: 85/66 87/68 92/73 3/3][PLAIN TEXT (storage)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
10 UDP [bbbb::1]:33499 <-> [bbbb::3]:5683 [proto: 27/COAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 27/COAP, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/147 bytes <-> 2 pkts/257 bytes][Goodput ratio: 16/52][1.15 sec][PLAIN TEXT (separate)][Plen Bins: 75,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
11 UDP [bbbb::1]:50250 <-> [bbbb::3]:5683 [proto: 27/COAP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 27/COAP, Confidence: DPI][DPI packets: 1][cat: RPC/16][2 pkts/158 bytes <-> 2 pkts/151 bytes][Goodput ratio: 21/18][8.41 sec][PLAIN TEXT (storage)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]