Actions
Task #4123
open
VJ
VJ
Task #4122: tracking: handle various TLS decrypt headers in proxies and decryption tools
Research: handle different flow tuples in TLS decrypt
Task #4123:
Research: handle different flow tuples in TLS decrypt
Effort:
Difficulty:
Label:
Description
Decrypted TLS traffic with special headers indicating the original tuple (see for example #2513) poses a challenge wrt tuple handling.
Rules looking at IP addresses might not work as expected, ip and port vars may be off.
This could perhaps be handled similar to how encapsulation on the IP level is handled: by tracking both tuples separately.
Actions