flowscope 0.22.0

Passive flow & session tracking for packet capture (runtime-free, cross-platform)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

//! Identify the application protocol riding an encrypted transport
//! (issue #138) — HTTP/2·3 and DNS-over-{TLS,QUIC,HTTPS} — from
//! only the ALPN, SNI, and L4 port. No decryption.
//!
//! Encrypted DNS is deliberately camouflaged: DoH is wire-identical
//! to HTTPS, DoT/DoQ hide on 443-adjacent infrastructure. The
//! passive tells are the negotiated ALPN token, the reserved
//! port 853, and — for DoH — the resolver's SNI hostname.
//!
//! Usage:
//!     cargo run --example encrypted_app_classify

use flowscope::app_proto::{Transport, classify};

/// (label, ALPN tokens, SNI, transport, server port)
type Case = (
    &'static str,
    &'static [&'static str],
    Option<&'static str>,
    Transport,
    u16,
);

fn main() {
    let cases: &[Case] = &[
        (
            "browser HTTPS",
            &["h2", "http/1.1"],
            Some("example.com"),
            Transport::Tls,
            443,
        ),
        (
            "HTTP/3",
            &["h3"],
            Some("cdn.example.com"),
            Transport::Quic,
            443,
        ),
        (
            "DoH (Cloudflare)",
            &["h2"],
            Some("cloudflare-dns.com"),
            Transport::Tls,
            443,
        ),
        (
            "DoH/3 (Google)",
            &["h3"],
            Some("dns.google"),
            Transport::Quic,
            443,
        ),
        ("DoT (ALPN)", &["dot"], None, Transport::Tls, 853),
        ("DoT (port only)", &[], None, Transport::Tls, 853),
        ("DoQ", &["doq"], None, Transport::Quic, 853),
        (
            "unknown TLS",
            &[],
            Some("internal.corp"),
            Transport::Tls,
            8443,
        ),
    ];

    println!("flow                 app_proto      encrypted-DNS?");
    println!("{}", "-".repeat(52));
    for (label, alpn, sni, transport, port) in cases {
        let proto = classify(alpn, *sni, *transport, *port);
        let dns_flag = if proto.is_encrypted_dns() {
            "yes ⚠"
        } else {
            ""
        };
        println!("{label:<20} {:<14} {dns_flag}", proto.as_str());
    }
}