mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-05-19 07:54:24 +00:00
3a087e951d
As a general rule, the higher the confidence value, the higher the "reliability/precision" of the classification. In other words, this new field provides an hint about "how" the flow classification has been obtained. For example, the application may want to ignore classification "by-port" (they are not real DPI classifications, after all) or give a second glance at flows classified via LRU caches (because of false positives). Setting only one value for the confidence field is a bit tricky: more work is probably needed in the next future to tweak/fix/improve the logic.
13 lines
672 B
Text
13 lines
672 B
Text
Guessed flow protos: 0
|
|
|
|
DPI Packets (UDP): 1 (1.00 pkts/flow)
|
|
Confidence DPI : 1 (flows)
|
|
|
|
QUIC 1 1230 1
|
|
|
|
JA3 Host Stats:
|
|
IP Address # JA3C
|
|
1 193.167.0.252 1
|
|
|
|
|
|
1 UDP 193.167.0.252:44083 -> 193.167.100.100:443 [proto: 188/QUIC][Encrypted][Confidence: DPI][cat: Web/5][1 pkts/1230 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][Hostname/SNI: server4][ALPN: hq-29][TLS Supported Versions: TLSv1.3;TLSv1.3 (draft);TLSv1.3 (draft);TLSv1.3 (draft)][TLSv1.3][JA3C: fe94e313a5d76fb687c85443cdfa8170][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0]
|