Tushar Pasi

ndpi tls certificate length and entropy output in csv format

1

TLS certificate length in not present in the output "ndpi": {"confidence": {"6":"DPI"},"proto":"TLS","proto_id":"91","proto_by_ip":"Unknown","proto_by_ip_id":0,"encrypted":1,"breed":"Safe","category_id":5,"category":"Web","hostname":"acplgs.goskope.com","tls": {"version":"TLSv1.2","server_names":"*.goskope.com,*.au.goskope.com,*.eu.goskope.com,*.de.goskope.com,*.us2.goskope.com,*.ams1.goskope.com,*.dfw3.goskope.com,*.fra2.goskope.com,*.lon2.goskope.com,*.lon3.goskope.com,*.mel2.goskope.com,*.ruh1.goskope.com,*.sin2.goskope.com,*.sjc1.goskope.com,*.sjc2.goskope.com,*.yyz1.goskope.com,*.yyz2.goskope.com,*.zur2.goskope.com,goskope.com","ja3":"07ff1e545ef8ab3fcf8a4dc9272221c2","ja3s":"c4b2785a87896e19d37eee932070cb22","unsafe_cipher":0,"cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","issuerDN":"C=BE, O=GlobalSign nv-sa, CN=GlobalSign RSA OV SSL CA 2018","subjectDN":"C=US, ST=California, L=Santa Clara, O=Netskope, Inc., CN=*.goskope.com","advertised_alpns":"http\/1.1","negotiated_alpn":"http\/1.1","tls_supported_versions":"TLSv1.3,TLSv1.2,TLSv1.1,TLSv1","fingerprint":"CC:CD:64:93:0E:6D:DB:30:4C:8E:92:84:38:7A:70:B9:42:59:F4:FB"}}. The csv output...

With live traffic, expired flows are not properly exported by ndpiReader

9

This is the command "sudo /usr/local/ndpi/bin/ndpiReader -i ens192 -k output.json -K json -m 300" I have run on my Ubuntu machine and the traffic statistics are: Traffic statistics: Ethernet bytes:...