gfwleak/stellar-stellar
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add socks_decoder, stratum_decoder and session_flags

Browse Source
This commit is contained in:
root
2024-09-03 07:01:58 +00:00
parent a8206cffc0
commit 6f1ac6b36b
160 changed files with 11861 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
test/decoders/session_flags/pcap/1-dtls.192.168.44.32.pcap Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/192.168.56.19.56554.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":4}",
"common_flags_2": 2123980808,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":4,\"frequency\":6,\"runs\":6,\"longest_run\":6,\"overlapping_template_matching\":6,\"random_excursions\":6,\"random_excursions_variant\":6,\"poker_detect\":6,\"runs_distribution\":6,\"self_correlation\":6,\"binary_derivative\":6}",
"common_flags_3": 2123980936,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":21,\"C2S\":1,\"S2C\":4,\"frequency\":6,\"runs\":6,\"longest_run\":6,\"overlapping_template_matching\":6,\"random_excursions\":6,\"random_excursions_variant\":6,\"poker_detect\":6,\"runs_distribution\":6,\"self_correlation\":6,\"binary_derivative\":6}",
"common_flags_4": 2123981960,
"common_flags_str_4": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Client is Local\":1,\"Inbound\":21,\"Streaming\":100,\"C2S\":1,\"S2C\":4,\"frequency\":6,\"runs\":6,\"longest_run\":6,\"overlapping_template_matching\":6,\"random_excursions\":6,\"random_excursions_variant\":6,\"poker_detect\":6,\"runs_distribution\":6,\"self_correlation\":6,\"binary_derivative\":6}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/192.168.56.19.56555-47.93.59.84.443_869284834001082715.pcapng Normal file
View File

Binary file not shown.

17
test/decoders/session_flags/pcap/192.168.56.31.58530.json Normal file
View File

@@ -0,0 +1,17 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 1185898504,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"block_frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"rank\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"binary_derivative\":4}",
"common_flags_3": 1185898632,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":34,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"block_frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"rank\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"binary_derivative\":4}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/192.168.56.31.58530.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/192.168.64.61.62275.asymmetric.pcapng Normal file
View File

Binary file not shown.

14
test/decoders/session_flags/pcap/192.168.64.61.62275.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 1453269000,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"frequency\":3,\"block_frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"runs_distribution\":3,\"binary_derivative\":3}",
"common_flags_2": 1453269001,
"common_flags_str_2": "[Asymmetric,Client is Local]",
"common_flags_identify_info_2": "{\"Asymmetric\":10,\"Client is Local\":1,\"C2S\":1,\"frequency\":3,\"block_frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"runs_distribution\":3,\"binary_derivative\":3}",
"name": "base_0"
}
]

14
test/decoders/session_flags/pcap/192.168.64.67.53813.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 2126340104,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2126340232,
"common_flags_str_2": "[Client is Local,Inbound]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"Inbound\":18,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/192.168.64.67.53813.pcapng Normal file
View File

Binary file not shown.

11
test/decoders/session_flags/pcap/1_result.json Normal file
View File

@@ -0,0 +1,11 @@
[
{
"common_flags_0": 8208,
"common_flags_str_0": "[Server is Local,C2S]",
"common_flags_identify_info_0": "1,1,",
"common_flags_1": 24592,
"common_flags_str_1": "[Server is Local,C2S,S2C]",
"common_flags_identify_info_1": "1,1,2,",
"name": "session_flags_test"
}
]

BIN
test/decoders/session_flags/pcap/bilibili-dtls.pcap Normal file
View File

Binary file not shown.

23
test/decoders/session_flags/pcap/bilibili.json Normal file
View File

@@ -0,0 +1,23 @@
[
{
"common_flags_0": 16392,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"S2C\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":2,\"S2C\":1}",
"common_flags_2": 1585602568,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":2,\"S2C\":1,\"block_frequency\":5,\"overlapping_template_matching\":5,\"random_excursions\":5,\"random_excursions_variant\":5,\"poker_detect\":5,\"runs_distribution\":5,\"binary_derivative\":5}",
"common_flags_3": 1585602696,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":25,\"C2S\":2,\"S2C\":1,\"block_frequency\":5,\"overlapping_template_matching\":5,\"random_excursions\":5,\"random_excursions_variant\":5,\"poker_detect\":5,\"runs_distribution\":5,\"binary_derivative\":5}",
"common_flags_4": 1585603720,
"common_flags_str_4": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Client is Local\":1,\"Inbound\":25,\"Streaming\":186,\"C2S\":2,\"S2C\":1,\"block_frequency\":5,\"overlapping_template_matching\":5,\"random_excursions\":5,\"random_excursions_variant\":5,\"poker_detect\":5,\"runs_distribution\":5,\"binary_derivative\":5}",
"common_flags_5": 1585636488,
"common_flags_str_5": "[Client is Local,Inbound,Streaming,Bidirectional]",
"common_flags_identify_info_5": "{\"Client is Local\":1,\"Inbound\":25,\"Streaming\":186,\"C2S\":2,\"S2C\":1,\"Bidirectional\":8551,\"block_frequency\":5,\"overlapping_template_matching\":5,\"random_excursions\":5,\"random_excursions_variant\":5,\"poker_detect\":5,\"runs_distribution\":5,\"binary_derivative\":5}",
"name": "base_0"
}
]

14
test/decoders/session_flags/pcap/dns_asymmetric.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 8208,
"common_flags_str_0": "[Server is Local]",
"common_flags_identify_info_0": "{\"Server is Local\":1,\"C2S\":1}",
"common_flags_1": 8209,
"common_flags_str_1": "[Asymmetric,Server is Local]",
"common_flags_identify_info_1": "{\"Asymmetric\":10,\"Server is Local\":1,\"C2S\":1}",
"common_flags_2": 24593,
"common_flags_str_2": "[Asymmetric,Server is Local]",
"common_flags_identify_info_2": "{\"Asymmetric\":10,\"Server is Local\":1,\"C2S\":1,\"S2C\":12}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/dns_asymmetric.pcap Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/douyin.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 2124242952,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"common_flags_3": 2124244104,
"common_flags_str_3": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":6036,\"Streaming\":6036,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"common_flags_4": 2124244650,
"common_flags_str_4": "[Bulky,Client is Local,Download,Inbound,Pseudo Unidirectional,Streaming]",
"common_flags_identify_info_4": "{\"Bulky\":6042,\"Client is Local\":1,\"Download\":6042,\"Inbound\":6036,\"Pseudo Unidirectional\":6042,\"Streaming\":6036,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/douyin.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/ftp-data.pcap Normal file
View File

Binary file not shown.

26
test/decoders/session_flags/pcap/https_download.json Normal file
View File

@@ -0,0 +1,26 @@
[{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local,C2S]",
"common_flags_identify_info_0": "1,1,",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local,C2S,S2C]",
"common_flags_identify_info_1": "1,1,2,",
"common_flags_2": 28680,
"common_flags_str_2": "[Client is Local,Random Looking,C2S,S2C]",
"common_flags_identify_info_2": "1,4,1,2,",
"common_flags_3": 28808,
"common_flags_str_3": "[Client is Local,Inbound,Random Looking,C2S,S2C]",
"common_flags_identify_info_3": "1,1188,4,1,2,",
"common_flags_4": 29832,
"common_flags_str_4": "[Client is Local,Inbound,Streaming,Random Looking,C2S,S2C]",
"common_flags_identify_info_4": "1,1188,1662,4,1,2,",
"common_flags_5": 30344,
"common_flags_str_5": "[Client is Local,Inbound,Pseudo Unidirectional,Streaming,Random Looking,C2S,S2C]",
"common_flags_identify_info_5": "1,1188,3546,1662,4,1,2,",
"common_flags_6": 30346,
"common_flags_str_6": "[Bulky,Client is Local,Inbound,Pseudo Unidirectional,Streaming,Random Looking,C2S,S2C]",
"common_flags_identify_info_6": "4095,1,1188,3546,1662,4,1,2,",
"common_flags_7": 30378,
"common_flags_str_7": "[Bulky,Client is Local,Download,Inbound,Pseudo Unidirectional,Streaming,Random Looking,C2S,S2C]",
"common_flags_identify_info_7": "4095,1,4201,1188,3546,1662,4,1,2,"
}]

BIN
test/decoders/session_flags/pcap/https_download.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/mix-quic-ssl-quic-mail.pcap Normal file
View File

Binary file not shown.

65
test/decoders/session_flags/pcap/mix.json Normal file
View File

@@ -0,0 +1,65 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 109076488,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4}",
"common_flags_3": 109078186,
"common_flags_str_3": "[Bulky,Client is Local,Download,Inbound,Pseudo Unidirectional,Streaming]",
"common_flags_identify_info_3": "{\"Bulky\":2250,\"Client is Local\":1,\"Download\":2250,\"Inbound\":2250,\"Pseudo Unidirectional\":2250,\"Streaming\":2250,\"C2S\":1,\"S2C\":2,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4}",
"name": "base_0"
},
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 1451237384,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"overlapping_template_matching\":10,\"random_excursions\":10,\"random_excursions_variant\":10,\"runs_distribution\":10,\"binary_derivative\":10}",
"common_flags_2": 1451237385,
"common_flags_str_2": "[Asymmetric,Client is Local]",
"common_flags_identify_info_2": "{\"Asymmetric\":4168,\"Client is Local\":1,\"C2S\":1,\"overlapping_template_matching\":10,\"random_excursions\":10,\"random_excursions_variant\":10,\"runs_distribution\":10,\"binary_derivative\":10}",
"name": "base_1"
},
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 2126323720,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2126340104,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":6,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 2126340232,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":29,\"C2S\":1,\"S2C\":6,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_2"
},
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 1186291720,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"common_flags_2": 1186291848,
"common_flags_str_2": "[Client is Local,Inbound]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"Inbound\":21,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"common_flags_3": 1186292872,
"common_flags_str_3": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":21,\"Streaming\":100,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"common_flags_4": 1186292874,
"common_flags_str_4": "[Bulky,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Bulky\":430,\"Client is Local\":1,\"Inbound\":21,\"Streaming\":100,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"common_flags_5": 1186292878,
"common_flags_str_5": "[Bulky,CBR Streaming,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_5": "{\"Bulky\":430,\"CBR Streaming\":6984,\"Client is Local\":1,\"Inbound\":21,\"Streaming\":100,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"name": "base_3"
}
]

17
test/decoders/session_flags/pcap/quic_asymmetric.json Normal file
View File

@@ -0,0 +1,17 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 2126323720,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2126340104,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":14,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 2126340232,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":84,\"C2S\":1,\"S2C\":14,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/quic_asymmetric.pcapng Normal file
View File

Binary file not shown.

14
test/decoders/session_flags/pcap/quic_asymmetric_1.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 16392,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"S2C\":1}",
"common_flags_1": 1452294152,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"S2C\":1,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"binary_derivative\":2}",
"common_flags_2": 1452294153,
"common_flags_str_2": "[Asymmetric,Client is Local]",
"common_flags_identify_info_2": "{\"Asymmetric\":37,\"Client is Local\":1,\"S2C\":1,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/quic_asymmetric_1.pcap Normal file
View File

Binary file not shown.

26
test/decoders/session_flags/pcap/quic_online_streaming.json Normal file
View File

@@ -0,0 +1,26 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 2124226568,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_2": 2124242952,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":4,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_3": 2124244104,
"common_flags_str_3": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":291,\"Streaming\":291,\"C2S\":1,\"S2C\":4,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_4": 2124244106,
"common_flags_str_4": "[Bulky,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Bulky\":630,\"Client is Local\":1,\"Inbound\":291,\"Streaming\":291,\"C2S\":1,\"S2C\":4,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_5": 2124276874,
"common_flags_str_5": "[Bulky,Client is Local,Inbound,Streaming,Bidirectional]",
"common_flags_identify_info_5": "{\"Bulky\":630,\"Client is Local\":1,\"Inbound\":291,\"Streaming\":291,\"C2S\":1,\"S2C\":4,\"Bidirectional\":7315,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_6": 2124276938,
"common_flags_str_6": "[Bulky,Client is Local,Interactive,Inbound,Streaming,Bidirectional]",
"common_flags_identify_info_6": "{\"Bulky\":630,\"Client is Local\":1,\"Interactive\":25786,\"Inbound\":291,\"Streaming\":291,\"C2S\":1,\"S2C\":4,\"Bidirectional\":7315,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/quic_online_streaming.pcap Normal file
View File

Binary file not shown.

29
test/decoders/session_flags/pcap/ssh-interactive.json Normal file
View File

@@ -0,0 +1,29 @@
[
{
"common_flags_0": 8208,
"common_flags_str_0": "[Server is Local]",
"common_flags_identify_info_0": "{\"Server is Local\":1,\"C2S\":1}",
"common_flags_1": 24592,
"common_flags_str_1": "[Server is Local]",
"common_flags_identify_info_1": "{\"Server is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 111173648,
"common_flags_str_2": "[Server is Local]",
"common_flags_identify_info_2": "{\"Server is Local\":1,\"C2S\":1,\"S2C\":2,\"rank\":7,\"overlapping_template_matching\":7,\"random_excursions\":7,\"random_excursions_variant\":7}",
"common_flags_3": 111173904,
"common_flags_str_3": "[Server is Local,Outbound]",
"common_flags_identify_info_3": "{\"Server is Local\":1,\"Outbound\":40,\"C2S\":1,\"S2C\":2,\"rank\":7,\"overlapping_template_matching\":7,\"random_excursions\":7,\"random_excursions_variant\":7}",
"common_flags_4": 111173968,
"common_flags_str_4": "[Server is Local,Interactive,Outbound]",
"common_flags_identify_info_4": "{\"Server is Local\":1,\"Interactive\":52,\"Outbound\":40,\"C2S\":1,\"S2C\":2,\"rank\":7,\"overlapping_template_matching\":7,\"random_excursions\":7,\"random_excursions_variant\":7}",
"name": "base_0"
},
{
"common_flags_0": 16400,
"common_flags_str_0": "[Server is Local]",
"common_flags_identify_info_0": "{\"Server is Local\":1,\"S2C\":1}",
"common_flags_1": 16401,
"common_flags_str_1": "[Asymmetric,Server is Local]",
"common_flags_identify_info_1": "{\"Asymmetric\":2,\"Server is Local\":1,\"S2C\":1}",
"name": "base_1"
}
]

BIN
test/decoders/session_flags/pcap/ssh-interactive.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/telegram_mtproto_ipv4_key_1.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/telegram_mtproto_ipv6_key_1.pcap Normal file
View File

Binary file not shown.

23
test/decoders/session_flags/pcap/tencent_meeting_video.json Normal file
View File

@@ -0,0 +1,23 @@
[
{
"common_flags_0": 16392,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"S2C\":1}",
"common_flags_1": 2126462984,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"S2C\":1,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2126471176,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":5,\"S2C\":1,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 2126471432,
"common_flags_str_3": "[Client is Local,Outbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Outbound\":414,\"C2S\":5,\"S2C\":1,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_4": 2126504200,
"common_flags_str_4": "[Client is Local,Outbound,Bidirectional]",
"common_flags_identify_info_4": "{\"Client is Local\":1,\"Outbound\":414,\"C2S\":5,\"S2C\":1,\"Bidirectional\":2448,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_5": 2126504204,
"common_flags_str_5": "[CBR Streaming,Client is Local,Outbound,Bidirectional]",
"common_flags_identify_info_5": "{\"CBR Streaming\":4095,\"Client is Local\":1,\"Outbound\":414,\"C2S\":5,\"S2C\":1,\"Bidirectional\":2448,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/tencent_meeting_video.pcapng Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/tencent_meeting_voice.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 16392,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"S2C\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":2,\"S2C\":1}",
"common_flags_2": 2123980808,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":2,\"S2C\":1,\"frequency\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"common_flags_3": 2123981064,
"common_flags_str_3": "[Client is Local,Outbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Outbound\":21,\"C2S\":2,\"S2C\":1,\"frequency\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"common_flags_4": 2124013832,
"common_flags_str_4": "[Client is Local,Outbound,Bidirectional]",
"common_flags_identify_info_4": "{\"Client is Local\":1,\"Outbound\":21,\"C2S\":2,\"S2C\":1,\"Bidirectional\":606,\"frequency\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/tencent_meeting_voice.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/tls1.2.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/tls1.2_no_reuse.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/tls_over_tls_1.2_no_reuse.pcap Normal file
View File

Binary file not shown.

14
test/decoders/session_flags/pcap/unidirectional.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 1185898504,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"block_frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"rank\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"binary_derivative\":4}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/unidirectional.pcap Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/wechat_voice_call.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 8208,
"common_flags_str_0": "[Server is Local]",
"common_flags_identify_info_0": "{\"Server is Local\":1,\"C2S\":1}",
"common_flags_1": 2123390992,
"common_flags_str_1": "[Server is Local]",
"common_flags_identify_info_1": "{\"Server is Local\":1,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2123391120,
"common_flags_str_2": "[Server is Local,Inbound]",
"common_flags_identify_info_2": "{\"Server is Local\":1,\"Inbound\":83,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 2123391124,
"common_flags_str_3": "[CBR Streaming,Server is Local,Inbound]",
"common_flags_identify_info_3": "{\"CBR Streaming\":3634,\"Server is Local\":1,\"Inbound\":83,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_4": 2123423892,
"common_flags_str_4": "[CBR Streaming,Server is Local,Inbound,Bidirectional]",
"common_flags_identify_info_4": "{\"CBR Streaming\":3634,\"Server is Local\":1,\"Inbound\":83,\"C2S\":1,\"S2C\":2,\"Bidirectional\":3808,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/wechat_voice_call.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/youtube-quic.pcap Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/youtube.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 1991270408,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 1991271560,
"common_flags_str_2": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"Inbound\":633,\"Streaming\":633,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 1991271562,
"common_flags_str_3": "[Bulky,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_3": "{\"Bulky\":635,\"Client is Local\":1,\"Inbound\":633,\"Streaming\":633,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_4": 1991271566,
"common_flags_str_4": "[Bulky,CBR Streaming,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Bulky\":635,\"CBR Streaming\":7070,\"Client is Local\":1,\"Inbound\":633,\"Streaming\":633,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]