search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
96 stars 4.92k forks source link

Packetbeat TLS: client/server_hello.timestamp validity #5587

Closed andrewkroh closed 6 years ago

andrewkroh commented 6 years ago

We should double check the code for parsing and converting these values. Based on various IETF discussions it sounds like the field may not be actually populated with the date. There's also this draft: https://tools.ietf.org/id/draft-mathewson-no-gmtunixtime-00.txt At a minimum we should add something to the documentation of these fields to explain this and prevent confusion.

@timestamp tls.client_hello.extensions.server_name_indication tls.client_hello.timestamp tls.server_hello.timestamp
November 14th 2017, 12:30:46.120 live.github.com 2013-12-07T16:30:05.000Z 2105-08-08T07:33:37.000Z
November 14th 2017, 12:32:03.969 live.github.com 2013-12-07T16:30:05.000Z 2105-08-08T07:33:37.000Z
November 14th 2017, 12:34:36.843 va.crowbird.com 1973-09-08T17:43:24.000Z -
November 14th 2017, 12:34:36.843 va.crowbird.com 1990-10-11T02:27:53.000Z -
November 14th 2017, 12:34:39.509 duckduckgo.com 2087-07-06T13:21:54.000Z 1980-02-29T18:16:01.000Z
November 14th 2017, 12:34:39.926 icons.duckduckgo.com 2014-11-01T03:24:14.000Z 2024-11-24T22:07:21.000Z
November 14th 2017, 12:34:39.997 api.momentumdash.com 1979-05-28T11:53:01.000Z 2017-11-14T17:02:32.000Z
November 14th 2017, 12:34:40.930 www.google.com 2012-01-13T23:33:56.000Z 2017-11-14T17:02:32.000Z
November 14th 2017, 12:34:41.056 www.gstatic.com 1994-05-18T01:38:17.000Z 2017-11-14T17:02:32.000Z
November 14th 2017, 12:34:41.056 fonts.gstatic.com 2066-01-23T08:54:07.000Z 2017-11-14T17:02:32.000Z
November 14th 2017, 12:34:41.210 adservice.google.com 2042-06-14T06:43:28.000Z 2017-11-14T17:02:33.000Z
November 14th 2017, 12:34:41.254 query.yahooapis.com 2082-06-25T08:41:27.000Z 2029-11-09T04:32:24.000Z
November 14th 2017, 12:34:42.348 ogs.google.com 2043-10-09T21:59:42.000Z 2017-11-14T17:02:34.000Z
November 14th 2017, 12:34:45.266 adobe.com 2083-09-26T23:33:01.000Z 2042-02-07T17:59:33.000Z
November 14th 2017, 12:34:45.267 adobe.com 1980-09-20T18:44:39.000Z 2092-12-02T22:43:12.000Z
November 14th 2017, 12:34:46.102 www.adobe.com 2045-03-19T09:00:18.000Z 1982-03-03T01:32:29.000Z
November 14th 2017, 12:34:46.102 www.adobe.com 2082-08-12T20:56:14.000Z 2024-05-03T01:01:23.000Z
November 14th 2017, 12:34:47.147 wwwimages2.adobe.com 2092-01-29T23:01:37.000Z 2030-04-17T03:48:21.000Z
November 14th 2017, 12:34:47.147 wwwimages2.adobe.com 2031-08-11T05:45:18.000Z 2056-04-21T17:48:24.000Z
November 14th 2017, 12:34:47.148 wwwimages2.adobe.com 1976-11-07T02:47:38.000Z 2057-05-05T19:52:31.000Z
November 14th 2017, 12:34:47.148 wwwimages2.adobe.com 2057-05-20T01:57:27.000Z 2042-07-29T21:08:57.000Z
November 14th 2017, 12:34:47.148 wwwimages2.adobe.com 2043-10-08T00:55:30.000Z 2054-07-26T21:12:26.000Z
November 14th 2017, 12:34:48.644 use.typekit.com 2058-01-22T02:36:19.000Z 2030-02-05T23:22:33.000Z
November 14th 2017, 12:34:48.644 wwwimages.adobe.com 2036-09-23T07:49:29.000Z 2094-10-15T19:00:50.000Z
November 14th 2017, 12:34:48.648 play.google.com 1970-12-27T13:31:21.000Z 2017-11-14T17:02:40.000Z
November 14th 2017, 12:34:48.650 www.adobe.com 2002-05-26T07:09:51.000Z 2028-01-01T05:31:08.000Z
November 14th 2017, 12:34:48.710 wwwimages2.adobe.com 2025-09-07T21:12:41.000Z 2055-09-23T15:23:29.000Z
November 14th 2017, 12:34:48.742 wwwimages2.adobe.com 2087-06-26T00:09:33.000Z 2044-09-15T06:55:58.000Z
November 14th 2017, 12:34:48.754 www.adobe.com 2026-07-19T21:53:36.000Z 2052-06-05T21:32:08.000Z
November 14th 2017, 12:34:48.827 use.typekit.com 2100-02-15T13:20:43.000Z 2088-04-22T13:32:44.000Z
November 14th 2017, 12:34:49.021 geo2.adobe.com 2083-10-22T07:19:51.000Z 2101-11-26T12:23:48.000Z
November 14th 2017, 12:34:49.068 wwwimages.adobe.com 2063-07-30T06:15:01.000Z 2038-03-27T09:40:50.000Z
November 14th 2017, 12:34:49.121 static.adobelogin.com 2102-11-19T15:48:37.000Z 2061-05-25T22:55:54.000Z
November 14th 2017, 12:34:49.259 adobeid-na1.services.adobe.com 2016-03-05T16:25:19.000Z 2028-04-05T19:40:33.000Z
November 14th 2017, 12:34:49.410 adobeid-na1.services.adobe.com 2000-01-01T14:02:44.000Z 2037-05-01T19:04:20.000Z
November 14th 2017, 12:34:49.496 wwwimages.adobe.com 2077-08-31T10:32:56.000Z 1987-01-18T12:15:42.000Z
November 14th 2017, 12:34:49.708 ims-na1.adobelogin.com 2013-10-21T02:54:53.000Z 1980-06-20T23:51:56.000Z
November 14th 2017, 12:34:50.259 play.google.com 2092-06-30T17:45:44.000Z 2017-11-14T17:02:41.000Z
November 14th 2017, 12:34:51.216 scss-prod-ue1-notif-41.adobesc.com 2017-11-14T17:02:42.000Z 2061-12-09T08:08:12.000Z
November 14th 2017, 12:34:58.084 duckduckgo.com 1997-12-21T19:34:32.000Z 2070-08-28T20:22:00.000Z
November 14th 2017, 12:35:03.585 avatars2.githubusercontent.com 1976-03-14T09:19:51.000Z 1993-05-30T16:07:57.000Z
November 14th 2017, 12:35:03.591 avatars2.githubusercontent.com 2093-12-15T06:02:24.000Z 2017-07-25T03:11:58.000Z
November 14th 2017, 12:35:03.596 avatars2.githubusercontent.com 2097-07-08T00:30:18.000Z 2001-06-01T06:42:40.000Z
November 14th 2017, 12:35:03.624 avatars0.githubusercontent.com 1975-10-13T09:59:22.000Z 1978-10-30T10:28:17.000Z
November 14th 2017, 12:35:03.628 avatars0.githubusercontent.com 2078-04-04T10:41:49.000Z 1989-07-05T18:13:23.000Z
November 14th 2017, 12:35:03.629 avatars0.githubusercontent.com 2048-09-04T21:03:40.000Z 2080-05-18T02:21:22.000Z
November 14th 2017, 12:35:03.632 avatars0.githubusercontent.com 2098-02-27T23:13:26.000Z 2085-09-02T20:49:07.000Z
November 14th 2017, 12:35:03.639 avatars0.githubusercontent.com 2035-07-14T01:37:11.000Z 1982-04-01T17:22:23.000Z
November 14th 2017, 12:35:03.646 avatars0.githubusercontent.com 2096-08-16T14:10:45.000Z 2056-02-07T13:24:28.000Z
November 14th 2017, 12:35:03.648 avatars1.githubusercontent.com 1973-11-23T00:06:36.000Z 2018-09-04T19:56:53.000Z
November 14th 2017, 12:35:03.649 api.github.com 2035-01-06T06:06:35.000Z 1991-12-20T20:03:22.000Z
November 14th 2017, 12:35:03.649 assets-cdn.github.com 2081-08-10T18:19:45.000Z 2073-09-25T12:51:22.000Z
November 14th 2017, 12:35:03.651 avatars1.githubusercontent.com 1984-03-30T18:27:40.000Z 2088-09-09T16:20:27.000Z
November 14th 2017, 12:35:03.655 api.github.com 2102-05-21T16:53:54.000Z 2060-11-16T06:13:15.000Z
November 14th 2017, 12:35:03.657 assets-cdn.github.com 2039-06-10T17:20:48.000Z 1991-08-11T12:38:05.000Z
November 14th 2017, 12:35:03.657 api.github.com 2090-05-12T23:03:30.000Z 2077-08-10T19:44:07.000Z
November 14th 2017, 12:35:03.659 avatars1.githubusercontent.com 2078-01-04T17:26:05.000Z 2012-02-24T20:06:28.000Z
November 14th 2017, 12:35:03.659 avatars1.githubusercontent.com 2050-08-13T09:53:41.000Z 2005-01-28T18:29:38.000Z
November 14th 2017, 12:35:03.663 api.github.com 2080-11-18T08:36:06.000Z 2006-11-09T18:11:53.000Z
November 14th 2017, 12:35:03.665 assets-cdn.github.com 2013-07-31T12:57:20.000Z 1996-05-31T11:25:09.000Z
November 14th 2017, 12:35:03.671 github.com 2056-12-01T05:20:16.000Z 2098-04-10T05:59:53.000Z
November 14th 2017, 12:35:03.671 github.com 2059-06-06T12:07:54.000Z 2020-04-21T20:55:39.000Z
November 14th 2017, 12:35:03.673 github.com 1972-10-10T11:54:21.000Z 2048-04-13T03:47:52.000Z
November 14th 2017, 12:35:03.673 github.com 1983-01-14T20:18:57.000Z 2052-05-17T23:47:59.000Z
November 14th 2017, 12:35:03.680 github.com 2035-06-10T16:36:29.000Z 2062-10-21T08:27:51.000Z
November 14th 2017, 12:35:03.718 sourcegraph.com 2053-12-30T08:13:51.000Z 2017-11-14T17:02:54.000Z
November 14th 2017, 12:35:03.720 collector.githubapp.com 2021-04-04T12:31:53.000Z 1985-04-21T22:07:02.000Z
November 14th 2017, 12:35:03.722 avatars3.githubusercontent.com 1976-10-01T23:25:38.000Z 2081-11-04T11:51:15.000Z
November 14th 2017, 12:35:03.727 collector.githubapp.com 2057-07-09T13:47:49.000Z 2003-10-03T15:55:55.000Z
November 14th 2017, 12:35:03.727 avatars3.githubusercontent.com 2060-04-29T02:07:33.000Z 2043-06-14T14:08:10.000Z
November 14th 2017, 12:35:03.733 avatars3.githubusercontent.com 1970-07-12T17:15:16.000Z 2017-07-30T13:25:24.000Z
November 14th 2017, 12:35:03.737 avatars3.githubusercontent.com 2018-01-19T03:34:55.000Z 2090-09-08T22:01:54.000Z
November 14th 2017, 12:35:03.737 avatars3.githubusercontent.com 2022-10-25T07:01:25.000Z 2060-08-26T14:51:45.000Z
November 14th 2017, 12:35:03.738 collector.githubapp.com 2018-12-26T08:26:35.000Z 2037-12-26T15:33:31.000Z
November 14th 2017, 12:35:05.154 live.github.com 2013-12-07T16:30:05.000Z 2105-08-08T07:33:37.000Z
November 14th 2017, 12:35:05.937 api.github.com 2070-09-10T07:57:35.000Z 2033-11-17T21:21:00.000Z
November 14th 2017, 12:35:10.999 live.github.com 2052-11-05T03:09:17.000Z 1982-09-10T20:38:46.000Z
November 14th 2017, 12:35:31.849 scss-prod-ue1-notif-41.adobesc.com 2017-11-14T17:03:22.000Z 2017-03-15T03:03:23.000Z
November 14th 2017, 12:35:31.849 scss-prod-ue1-notif-41.adobesc.com 2017-11-14T17:03:22.000Z 2017-03-15T03:03:23.000Z
andrewkroh commented 6 years ago

Looks like the parsing and conversion is good. 👍

So we I think we just need to enhance the documentation around these fields.