jmhIcoding/flowcontainer

Content_type和Handshake_type对应问题

Closed this issue · 1 comments

mfdycs commented
extension = ["tls.record.content_type", "tls.handshake.type"]
ssl_flows = extract(infile=pcap_file, filter='tls', extension=extension)

运行结果如下:

tls.record.content_type: [('22', 0), ('22', 1), ('22,22,22', 2), ('22,20,22', 3), ('20,22', 4), ('23', 5), ('23', 6), ('23', 7), ('23', 8), ('23', 9), ('23', 10)]
tls.handshake.type: [('1', 0), ('2', 1), ('11,12,14', 2), ('16', 3)]

其中的 tls.record.content_typetls.handshake.type 无法一一对应上,请问应该如何解决

mfdycs commented

大晚上的脑子晕乎了,直接对应即可,,,