tls_ssl30.yml

name: SSL 3.0 Traffic
description: Check that SSL v3.0 is properly parsed.
requirements:
  protocols: [tls]
marks: [tls]
pcap: tls_ssl30.pcap
probe:
  protocols: [tls]
at_least_one: [tls_server_version, tls_cipher_suite, tls_client_version, tls_ja3,
  tls_subject_cn, tls_validity_not_before, tls_validity_not_after, tls_public_key_alg]

flows:
  - src_ip: 10.100.50.48
    dst_ip: 10.100.50.139
    ip_version: 4
    protocol: 6
    bytes: 3302
    bytes@rev: 2919
    packets: 15
    packets@rev: 11
    src_port: 44854
    dst_port: 7001
    tls_server_version: 0x0300
    tls_cipher_suite: 0xc014
    tls_client_version: 0x0300
    tls_subject_cn: ''
    tls_validity_not_before: 1679647830
    tls_validity_not_after: 1682239830
    tls_public_key_alg: rsaEncryption
    tls_ja3: '0x77bfeeb56cc1af3a4241cf31c4a49e1a'