[Bro] More crypto ID

James Lay jlay at slave-tothe-box.net
Fri Jul 8 13:13:09 PDT 2016


FYI:

2016-07-01T12:35:15-0600        CyqleS3tHf607yRdrj      192.168.1.101   
38151   31.13.76.102    443     TLSv12  unknown-52393   -       
graph.facebook.com     F-       h2      T       
Fq3gsi3bxz1RdtYqej,FiQmMNkbUAqhiOOkk    (empty) 
CN=*.facebook.com,O=Facebook\\, Inc.,L=Menlo Park,ST=CA,C=US    
CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert 
Inc,C=US       -       -       ok

unkonwn-52393 is apparently QUIC crypto.

James


More information about the Bro mailing list