TIME: 10/24/2024-09:51:48.473308 PKT SRC: wire/pcap SRC IP: 10.7.10.136 DST IP: 10.7.100.11 PROTO: 6 SRC PORT: 59006 DST PORT: 443 TCP SEQ: 1926771825 TCP ACK: 2546653787 FLOW: to_server: TRUE, to_client: FALSE FLOW Start TS: 10/24/2024-09:51:48.417325 FLOW PKTS TODST: 5 FLOW PKTS TOSRC: 6 FLOW Total Bytes: 7537 FLOW IPONLY SET: TOSERVER: TRUE, TOCLIENT: TRUE FLOW ACTION: DROP: FALSE FLOW NOINSPECTION: PACKET: FALSE, PAYLOAD: TRUE, APP_LAYER: TRUE FLOW APP_LAYER: DETECTED: TRUE, PROTO 4 FLOWINT: "applayer.anomaly.count" => 1 FLOWINT: "tls.anomaly.count" => 1 PACKET LEN: 64 PACKET: 0000 00 15 B2 AB E7 DA 00 00 00 5E 00 01 81 00 00 64 ........ .^.....d 0010 08 00 45 00 00 28 5B 05 40 00 3F 06 5E 2A 0A 07 ..E..([. @.?.^*.. 0020 0A 88 0A 07 64 0B E6 7E 01 BB 72 D8 34 71 97 CA ....d..~ ..r.4q.. 0030 DA 5B 50 10 01 DA 29 B0 00 00 00 00 00 00 00 00 .[P...). ........ ALERT CNT: 2 ALERT MSG [00]: SURICATA TLS invalid record type ALERT GID [00]: 1 ALERT SID [00]: 2230002 ALERT REV [00]: 1 ALERT CLASS [00]: Generic Protocol Command Decode ALERT PRIO [00]: 3 ALERT FOUND IN [00]: STATE ALERT IN TX [00]: 0 STREAM DATA LEN: 28 STREAM DATA: 0000 0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A 21 11 00 0C .......Q UIT.!... 0010 5F 63 90 46 58 D8 BD 58 C7 52 01 BB _c.FX..X .R.. STREAM DATA LEN: 517 STREAM DATA: 0000 16 03 01 02 00 01 00 01 FC 03 03 7B E1 11 7C BE ........ ...{..|. 0010 59 EC 0D CC 41 8E 54 42 1F 15 D0 2C 5A 2D 54 ED Y...A.TB ...,Z-T. 0020 57 FC 91 D3 8B AF 7E DC 9B E0 9E 20 22 D9 A2 63 W.....~. ... "..c 0030 0D B5 A1 9C AB 1C EC 05 0B 46 9C B4 95 31 7A BF ........ .F...1z. 0040 07 B1 A3 40 97 CB 6F 97 18 43 A2 8D 00 3E 13 02 ...@..o. .C...>.. 0050 13 03 13 01 C0 2C C0 30 00 9F CC A9 CC A8 CC AA .....,.0 ........ 0060 C0 2B C0 2F 00 9E C0 24 C0 28 00 6B C0 23 C0 27 .+./...$ .(.k.#.' 0070 00 67 C0 0A C0 14 00 39 C0 09 C0 13 00 33 00 9D .g.....9 .....3.. 0080 00 9C 00 3D 00 3C 00 35 00 2F 00 FF 01 00 01 75 ...=.<.5 ./.....u 0090 00 00 00 13 00 11 00 00 0E 65 75 2E 73 6D 61 72 ........ .eu.smar 00A0 74 6B 65 79 2E 69 6F 00 0B 00 04 03 00 01 02 00 tkey.io. ........ 00B0 0A 00 16 00 14 00 1D 00 17 00 1E 00 19 00 18 01 ........ ........ 00C0 00 01 01 01 02 01 03 01 04 33 74 00 00 00 10 00 ........ .3t..... 00D0 0E 00 0C 02 68 32 08 68 74 74 70 2F 31 2E 31 00 ....h2.h ttp/1.1. 00E0 16 00 00 00 17 00 00 00 31 00 00 00 0D 00 2A 00 ........ 1.....*. 00F0 28 04 03 05 03 06 03 08 07 08 08 08 09 08 0A 08 (....... ........ 0100 0B 08 04 08 05 08 06 04 01 05 01 06 01 03 03 03 ........ ........ 0110 01 03 02 04 02 05 02 06 02 00 2B 00 05 04 03 04 ........ ..+..... 0120 03 03 00 2D 00 02 01 01 00 33 00 26 00 24 00 1D ...-.... .3.&.$.. 0130 00 20 BE B7 F7 69 11 B5 4D D7 6E 2A 2E 76 4F D0 . ...i.. M.n*.vO. 0140 29 6C D0 63 4D 37 57 9D EB 27 19 7B 94 E4 6F 46 )l.cM7W. .'.{..oF 0150 3E 10 00 15 00 AF 00 00 00 00 00 00 00 00 00 00 >....... ........ 0160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 01A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 01B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 01C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 01D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 01E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 01F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ 0200 00 00 00 00 00 ..... ALERT MSG [01]: SURICATA Applayer Detect protocol only one direction ALERT GID [01]: 1 ALERT SID [01]: 2260002 ALERT REV [01]: 1 ALERT CLASS [01]: Generic Protocol Command Decode ALERT PRIO [01]: 3 ALERT FOUND IN [01]: PACKET ALERT IN TX [01]: N/A