cisco / mercury

Mercury: network metadata capture and analysis
Other
430 stars 75 forks source link

TLS fingerprint format #23

Closed ColorlessCube3155 closed 11 months ago

ColorlessCube3155 commented 1 year ago

in doc/npf.md it is stated that:

The "tls/1" fingerprint format is

"tls/1" (TLS_Version) (TLS_Ciphersuite) [ QUIC_Extension* ]

and the older "tls" fingerprint format is

"tls/" (TLS_Version) (TLS_Ciphersuite) ((TLS_Extension)*)

but the mercury tool provides fingerprints of these formats:

"tls/1/(0303)...

or

tls/(0303)...

which means that either is the npf.md is wrong, and the format of the tls/1 should be changed to:

"tls/1/" (TLS_Version) (TLS_Ciphersuite) [ QUIC_Extension* ]

or that the resulting fingerprint from the mercury tool is incorrect and should be:

"tls/1(0303)...

I offer to fix the issue in case someone can confirm which is the incorrect one. (i believe it is the first case, and the npf.md tls/1 format should be changed to "tls/1/" (TLS_Version) ...)

davidmcgrew commented 11 months ago

Thanks for reporting the issue; Blake fixed this by changing the document as you suggested.