FlowCarp Identifies Protocols
Brief
I am thrilled to announce the release of a brand new tool called FlowCarp!
FlowCarp is a simple command line tool that performs a very complicated task. It identifies the application layer protocol in network traffic without relying on port numbers, static signatures or code that tries to parse the application layer protocols. Instead, FlowCarp simply computes some statistical measurements on the traffic it sees and compares those measurements to models of known protocols.
This allows FlowCarp to identify even proprietary and undocumented protocols, including malware C2 protocols.
FlowCarp Demo Service
There’s a demo FlowCarp web service running on demo. flowcarp. com, which accepts PCAP or PcapNG data via HTTP POST requests. The demo service returns a data structure, which follows the Suricata Eve JSON format, containing flows and alerts.