diff --git a/example/calls.conf b/example/calls.conf index 3debf393711..4e4b64c9cd3 100644 --- a/example/calls.conf +++ b/example/calls.conf @@ -6,6 +6,6 @@ #Generic limits --cfg=packets_limit_per_flow,255 -U 0 -T 0 #Stun ---cfg=stun,monitoring,1 --cfg=stun,max_packets_extra_dissection,255 +--cfg=stun,monitoring,1 --cfg=stun,max_packets_extra_dissection,200 #Zoom ---cfg=zoom,max_packets_extra_dissection,255 +--cfg=zoom,max_packets_extra_dissection,200 diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index 0ead2a0ea56..138308082c4 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -667,6 +667,7 @@ static int keep_extra_dissection(struct ndpi_detection_module_struct *ndpi_struc * for the other protocols, we stop after we have all metadata (if enabled) * for some specific protocol, we might know that some attributes are never used + * if monitoring is enabled, keep looking for (S)RTP anyway **After** extra dissection is ended, we might move to monitoring. Note that: * classification doesn't change while in monitoring! @@ -699,6 +700,11 @@ static int keep_extra_dissection(struct ndpi_detection_module_struct *ndpi_struc if(!is_subclassification_real(flow)) return 1; + if(is_monitoring_enabled(ndpi_struct, NDPI_PROTOCOL_STUN) && + (flow->detected_protocol_stack[1] != NDPI_PROTOCOL_SRTP && + flow->detected_protocol_stack[1] != NDPI_PROTOCOL_DTLS)) + return 1; + if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_TELEGRAM_VOIP && ndpi_struct->cfg.stun_peer_address_enabled) return 1; diff --git a/tests/cfgs/default/pcap/stun_signal_tcp.pcapng b/tests/cfgs/default/pcap/stun_signal_tcp.pcapng new file mode 100644 index 00000000000..01a08280da2 Binary files /dev/null and b/tests/cfgs/default/pcap/stun_signal_tcp.pcapng differ diff --git a/tests/cfgs/default/result/stun_signal_tcp.pcapng.out b/tests/cfgs/default/result/stun_signal_tcp.pcapng.out new file mode 100644 index 00000000000..3acbb0d25ba --- /dev/null +++ b/tests/cfgs/default/result/stun_signal_tcp.pcapng.out @@ -0,0 +1,27 @@ +DPI Packets (TCP): 10 (10.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 7 (7.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache stun: 3/2/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache fpc_dns: 0/1/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 0/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 1/1 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +SignalVoip 500 114216 1 + +Acceptable 500 114216 1 + + 1 TCP 192.168.1.117:51296 <-> 35.219.252.146:80 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 284/GoogleCloud, Confidence: IP address][DPI packets: 10][cat: VoIP/10][226 pkts/71104 bytes <-> 274 pkts/43112 bytes][Goodput ratio: 82/64][17.42 sec][Hostname/SNI: signal.org][bytes ratio: 0.245 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/68 2434/2433 281/278][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 315/157 1242/1474 338/185][Mapped IP/Port: 93.35.171.86:51262][Peer IP/Port: 93.33.26.150:37920][Relayed IP/Port: 35.219.252.146:13140][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (LODkFIIf)][Plen Bins: 0,21,18,20,5,0,0,0,21,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/monitoring/result/stun_signal.pcapng.out b/tests/cfgs/monitoring/result/stun_signal.pcapng.out index b71c6ece38a..91711a7990b 100644 --- a/tests/cfgs/monitoring/result/stun_signal.pcapng.out +++ b/tests/cfgs/monitoring/result/stun_signal.pcapng.out @@ -30,10 +30,10 @@ Acceptable 460 48496 23 1 UDP 192.168.12.169:43068 <-> 18.195.131.143:61156 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][Stream Content: Audio][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 106][DPI packets before monitoring: 33][cat: VoIP/10][48 pkts/4692 bytes <-> 58 pkts/7630 bytes][Goodput ratio: 57/68][12.11 sec][bytes ratio: -0.238 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 224/234 1055/1059 250/294][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 98/132 146/306 23/72][Mapped IP/Port: 93.47.225.19:11914, 18.195.131.143:61156][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BrDwrhkDr//9e)][Plen Bins: 26,31,15,15,5,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.169:47767 <-> 18.195.131.143:61498 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][Stream Content: Audio][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 53][DPI packets before monitoring: 33][cat: VoIP/10][18 pkts/1900 bytes <-> 35 pkts/6496 bytes][Goodput ratio: 60/77][2.67 sec][bytes ratio: -0.547 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 173/74 665/630 186/150][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 106/186 146/306 26/92][Mapped IP/Port: 93.47.225.19:11932, 18.195.131.143:61498][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (80JiLM)][Plen Bins: 13,16,18,18,9,0,0,0,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 ICMP 35.158.183.167:0 <-> 192.168.12.169:0 [proto: 81/ICMP][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 81/ICMP, Confidence: DPI][DPI packets: 1][cat: Network/14][30 pkts/2780 bytes <-> 4 pkts/552 bytes][Goodput ratio: 55/69][51.83 sec][bytes ratio: 0.669 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 906/1 7931/1 2120/0][Pkt Len c2s/s2c min/avg/max/stddev: 90/138 93/138 98/138 4/0][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: No server to client traffic / Entropy: 5.051 (Executable?)][PLAIN TEXT (BJKHNYBG4)][Plen Bins: 0,88,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 4 UDP 192.168.12.169:43068 <-> 35.158.183.167:3478 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 26][DPI packets before monitoring: 7][cat: VoIP/10][13 pkts/1598 bytes <-> 13 pkts/1638 bytes][Goodput ratio: 66/67][31.02 sec][Hostname/SNI: signal.org][bytes ratio: -0.012 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 2090/2098 10035/10033 3616/3611][Pkt Len c2s/s2c min/avg/max/stddev: 62/102 123/126 174/190 47/25][Mapped IP/Port: 93.47.225.19:11910, 35.158.183.167:64458, 18.195.131.143:61156][Peer IP/Port: 18.195.131.143:61156, 18.195.131.143:52463, 18.195.131.143:57646, 18.195.131.143:58207][Relayed IP/Port: 35.158.183.167:64458][Rsp Origin IP/Port: 35.158.183.167:3478][Other IP/Port: 35.158.183.167:80][PLAIN TEXT (xYXlLJQ)][Plen Bins: 19,15,26,30,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 5 UDP 192.168.12.169:47767 <-> 35.158.122.211:3478 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 22][DPI packets before monitoring: 7][cat: VoIP/10][11 pkts/1338 bytes <-> 11 pkts/1354 bytes][Goodput ratio: 65/66][22.74 sec][Hostname/SNI: signal.org][bytes ratio: -0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 2483/2337 10020/10020 3944/4010][Pkt Len c2s/s2c min/avg/max/stddev: 62/102 122/123 158/190 44/25][Mapped IP/Port: 93.47.225.19:11928, 18.195.131.143:55640][Peer IP/Port: 18.195.131.143:54054, 18.195.131.143:61498, 18.195.131.143:55640, 18.195.131.143:50716][Relayed IP/Port: 35.158.122.211:51358][Rsp Origin IP/Port: 35.158.122.211:3478][Other IP/Port: 35.158.122.211:80][PLAIN TEXT (rMfcsrHE)][Plen Bins: 18,18,27,31,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 6 UDP 192.168.12.169:39950 <-> 35.158.183.167:3478 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 22][DPI packets before monitoring: 7][cat: VoIP/10][11 pkts/1282 bytes <-> 11 pkts/1290 bytes][Goodput ratio: 64/64][30.98 sec][Hostname/SNI: signal.org][bytes ratio: -0.003 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 3757/3735 10023/10021 4493/4510][Pkt Len c2s/s2c min/avg/max/stddev: 62/102 117/117 162/134 48/13][Mapped IP/Port: 93.47.225.19:11911][Peer IP/Port: 18.195.131.143:61156, 18.195.131.143:52463, 18.195.131.143:57646, 18.195.131.143:58207][Relayed IP/Port: 35.158.183.167:52495][Rsp Origin IP/Port: 35.158.183.167:3478][Other IP/Port: 35.158.183.167:80][PLAIN TEXT (ovaKDk)][Plen Bins: 22,18,31,27,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 7 UDP 192.168.12.169:37970 <-> 35.158.122.211:3478 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 20][DPI packets before monitoring: 7][cat: VoIP/10][10 pkts/1196 bytes <-> 10 pkts/1164 bytes][Goodput ratio: 65/64][22.74 sec][Hostname/SNI: signal.org][bytes ratio: 0.014 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 1760/2672 10017/10018 3250/3952][Pkt Len c2s/s2c min/avg/max/stddev: 62/102 120/116 158/134 45/13][Mapped IP/Port: 93.47.225.19:11929][Peer IP/Port: 18.195.131.143:54054, 18.195.131.143:61498, 18.195.131.143:55640, 18.195.131.143:50716][Relayed IP/Port: 35.158.122.211:51073][Rsp Origin IP/Port: 35.158.122.211:3478][Other IP/Port: 35.158.122.211:80][PLAIN TEXT (BSFWxqj)][Plen Bins: 20,20,30,30,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 4 UDP 192.168.12.169:43068 <-> 35.158.183.167:3478 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 26][cat: VoIP/10][13 pkts/1598 bytes <-> 13 pkts/1638 bytes][Goodput ratio: 66/67][31.02 sec][Hostname/SNI: signal.org][bytes ratio: -0.012 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 2090/2098 10035/10033 3616/3611][Pkt Len c2s/s2c min/avg/max/stddev: 62/102 123/126 174/190 47/25][Mapped IP/Port: 93.47.225.19:11910, 35.158.183.167:64458, 18.195.131.143:61156][Peer IP/Port: 18.195.131.143:61156, 18.195.131.143:52463, 18.195.131.143:57646, 18.195.131.143:58207][Relayed IP/Port: 35.158.183.167:64458][Rsp Origin IP/Port: 35.158.183.167:3478][Other IP/Port: 35.158.183.167:80][PLAIN TEXT (xYXlLJQ)][Plen Bins: 19,15,26,30,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 UDP 192.168.12.169:47767 <-> 35.158.122.211:3478 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 22][cat: VoIP/10][11 pkts/1338 bytes <-> 11 pkts/1354 bytes][Goodput ratio: 65/66][22.74 sec][Hostname/SNI: signal.org][bytes ratio: -0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 2483/2337 10020/10020 3944/4010][Pkt Len c2s/s2c min/avg/max/stddev: 62/102 122/123 158/190 44/25][Mapped IP/Port: 93.47.225.19:11928, 18.195.131.143:55640][Peer IP/Port: 18.195.131.143:54054, 18.195.131.143:61498, 18.195.131.143:55640, 18.195.131.143:50716][Relayed IP/Port: 35.158.122.211:51358][Rsp Origin IP/Port: 35.158.122.211:3478][Other IP/Port: 35.158.122.211:80][PLAIN TEXT (rMfcsrHE)][Plen Bins: 18,18,27,31,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 6 UDP 192.168.12.169:39950 <-> 35.158.183.167:3478 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 22][cat: VoIP/10][11 pkts/1282 bytes <-> 11 pkts/1290 bytes][Goodput ratio: 64/64][30.98 sec][Hostname/SNI: signal.org][bytes ratio: -0.003 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 3757/3735 10023/10021 4493/4510][Pkt Len c2s/s2c min/avg/max/stddev: 62/102 117/117 162/134 48/13][Mapped IP/Port: 93.47.225.19:11911][Peer IP/Port: 18.195.131.143:61156, 18.195.131.143:52463, 18.195.131.143:57646, 18.195.131.143:58207][Relayed IP/Port: 35.158.183.167:52495][Rsp Origin IP/Port: 35.158.183.167:3478][Other IP/Port: 35.158.183.167:80][PLAIN TEXT (ovaKDk)][Plen Bins: 22,18,31,27,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 7 UDP 192.168.12.169:37970 <-> 35.158.122.211:3478 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 20][cat: VoIP/10][10 pkts/1196 bytes <-> 10 pkts/1164 bytes][Goodput ratio: 65/64][22.74 sec][Hostname/SNI: signal.org][bytes ratio: 0.014 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 1760/2672 10017/10018 3250/3952][Pkt Len c2s/s2c min/avg/max/stddev: 62/102 120/116 158/134 45/13][Mapped IP/Port: 93.47.225.19:11929][Peer IP/Port: 18.195.131.143:54054, 18.195.131.143:61498, 18.195.131.143:55640, 18.195.131.143:50716][Relayed IP/Port: 35.158.122.211:51073][Rsp Origin IP/Port: 35.158.122.211:3478][Other IP/Port: 35.158.122.211:80][PLAIN TEXT (BSFWxqj)][Plen Bins: 20,20,30,30,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 8 ICMP 35.158.122.211:0 <-> 192.168.12.169:0 [proto: 81/ICMP][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 81/ICMP, Confidence: DPI][DPI packets: 1][cat: Network/14][17 pkts/1578 bytes <-> 2 pkts/276 bytes][Goodput ratio: 55/69][22.73 sec][bytes ratio: 0.702 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1052/0 7992/0 2154/0][Pkt Len c2s/s2c min/avg/max/stddev: 90/138 93/138 98/138 4/0][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: No server to client traffic / Entropy: 5.051 (Executable?)][PLAIN TEXT (braaHWB)][Plen Bins: 0,89,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 9 UDP 192.168.12.169:39950 -> 35.158.183.167:443 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 16][cat: VoIP/10][16 pkts/1056 bytes -> 0 pkts/0 bytes][Goodput ratio: 36/0][23.80 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 37/0 1416/0 7961/0 2721/0][Pkt Len c2s/s2c min/avg/max/stddev: 62/0 66/0 70/0 4/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 3478][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 10 UDP 192.168.12.169:43068 -> 35.158.183.167:443 [proto: 78.269/STUN.SignalVoip][IP: 265/AmazonAWS][ClearText][Confidence: DPI (cache)][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 16][cat: VoIP/10][16 pkts/1056 bytes -> 0 pkts/0 bytes][Goodput ratio: 36/0][23.82 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 60/0 1419/0 7937/0 2708/0][Pkt Len c2s/s2c min/avg/max/stddev: 62/0 66/0 70/0 4/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic / Expected on port 3478][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/ndpireader_conf_file/pcap/stun_signal_tcp.pcapng b/tests/cfgs/ndpireader_conf_file/pcap/stun_signal_tcp.pcapng new file mode 120000 index 00000000000..3cb20d6596c --- /dev/null +++ b/tests/cfgs/ndpireader_conf_file/pcap/stun_signal_tcp.pcapng @@ -0,0 +1 @@ +../../default/pcap/stun_signal_tcp.pcapng \ No newline at end of file diff --git a/tests/cfgs/ndpireader_conf_file/result/signal_videocall.pcapng.out b/tests/cfgs/ndpireader_conf_file/result/signal_videocall.pcapng.out index 7926a6a3e97..f5258d10a6c 100644 --- a/tests/cfgs/ndpireader_conf_file/result/signal_videocall.pcapng.out +++ b/tests/cfgs/ndpireader_conf_file/result/signal_videocall.pcapng.out @@ -1,4 +1,4 @@ -DPI Packets (UDP): 291 (97.00 pkts/flow) +DPI Packets (UDP): 334 (111.33 pkts/flow) Confidence DPI (cache) : 1 (flows) Confidence DPI : 2 (flows) Num dissector calls: 8 (2.67 diss/flow) @@ -25,6 +25,6 @@ SignalVoip 334 123259 3 Acceptable 334 123259 3 - 1 UDP 192.168.12.67:47926 <-> 35.219.252.146:56377 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Stream Content: Audio, Video][Encrypted][Confidence: DPI][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 255][cat: VoIP/10][167 pkts/87565 bytes <-> 131 pkts/31930 bytes][Goodput ratio: 92/83][10.75 sec][bytes ratio: 0.466 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 64/82 2304/2449 291/279][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 524/244 1223/900 385/198][Mapped IP/Port: 93.35.168.30:45266, 35.219.252.146:56377][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (17uAgN)][Plen Bins: 3,28,9,7,0,0,0,0,16,8,1,0,0,1,1,0,1,1,0,1,0,0,0,0,7,3,0,1,0,0,1,1,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 UDP 192.168.12.67:47926 <-> 35.219.252.146:56377 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Stream Content: Audio, Video][Encrypted][Confidence: DPI][FPC: 78.269/STUN.SignalVoip, Confidence: DPI][DPI packets: 298][DPI packets before monitoring: 201][cat: VoIP/10][167 pkts/87565 bytes <-> 131 pkts/31930 bytes][Goodput ratio: 92/83][10.75 sec][bytes ratio: 0.466 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 64/82 2304/2449 291/279][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 524/244 1223/900 385/198][Mapped IP/Port: 93.35.168.30:45266, 35.219.252.146:56377][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (17uAgN)][Plen Bins: 3,28,9,7,0,0,0,0,16,8,1,0,0,1,1,0,1,1,0,1,0,0,0,0,7,3,0,1,0,0,1,1,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.12.67:47926 <-> 35.219.252.146:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 26][cat: VoIP/10][13 pkts/1258 bytes <-> 13 pkts/1454 bytes][Goodput ratio: 57/62][10.01 sec][Hostname/SNI: signal.org][bytes ratio: -0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 6/6 804/804 4015/4015 1248/1248][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 97/112 162/126 43/14][Mapped IP/Port: 93.35.168.30:45265][Peer IP/Port: 35.219.252.146:56377, 35.219.252.146:34099, 35.219.252.146:37175][Relayed IP/Port: 35.219.252.146:40378][PLAIN TEXT (BFODsIPgWuCIX)][Plen Bins: 34,19,30,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.12.67:47926 <-> 35.216.234.234:3478 [proto: 78.269/STUN.SignalVoip][IP: 284/GoogleCloud][ClearText][Confidence: DPI (cache)][FPC: 78/STUN, Confidence: DPI][DPI packets: 10][cat: VoIP/10][5 pkts/510 bytes <-> 5 pkts/542 bytes][Goodput ratio: 59/61][10.02 sec][Hostname/SNI: signal.org][bytes ratio: -0.030 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5/4 2503/2503 9988/9988 4321/4321][Pkt Len c2s/s2c min/avg/max/stddev: 62/94 102/108 158/126 46/15][Mapped IP/Port: 93.35.168.30:45265][Relayed IP/Port: 35.216.234.234:29688][PLAIN TEXT (42oPBlgi)][Plen Bins: 30,30,20,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/ndpireader_conf_file/result/stun_signal_tcp.pcapng.out b/tests/cfgs/ndpireader_conf_file/result/stun_signal_tcp.pcapng.out new file mode 100644 index 00000000000..4cb750eb1f8 --- /dev/null +++ b/tests/cfgs/ndpireader_conf_file/result/stun_signal_tcp.pcapng.out @@ -0,0 +1,27 @@ +DPI Packets (TCP): 500 (500.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 7 (7.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache stun: 27/2/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache fpc_dns: 0/1/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 0/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 1/1 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +SignalVoip 500 114216 1 + +Acceptable 500 114216 1 + + 1 TCP 192.168.1.117:51296 <-> 35.219.252.146:80 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Stream Content: Audio, Video][Encrypted][Confidence: DPI][FPC: 284/GoogleCloud, Confidence: IP address][DPI packets: 500][DPI packets before monitoring: 204][cat: VoIP/10][226 pkts/71104 bytes <-> 274 pkts/43112 bytes][Goodput ratio: 82/64][17.42 sec][Hostname/SNI: signal.org][bytes ratio: 0.245 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/68 2434/2433 281/278][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 315/157 1242/1474 338/185][Mapped IP/Port: 93.35.171.86:51262, 35.219.252.146:13140, 93.33.26.150:37920][Peer IP/Port: 93.33.26.150:37920, 35.219.252.146:17691, 35.219.252.146:38054, 35.219.252.146:18788][Relayed IP/Port: 35.219.252.146:13140][TCP Fingerprint: 2_128_64240_6bb88f5575fd/Windows][PLAIN TEXT (LODkFIIf)][Plen Bins: 0,21,18,20,5,0,0,0,21,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]