lua:quic
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
lua:quic [2018/12/13 23:43] – [Explaining the scripts] veera | lua:quic [2019/08/14 20:25] (current) – [QUIC protocol analysis using the Trisul Scripting API] veera | ||
---|---|---|---|
Line 6: | Line 6: | ||
This article describes how you can pull out key indicators from QUIC into Trisul using the [[https:// | This article describes how you can pull out key indicators from QUIC into Trisul using the [[https:// | ||
+ | |||
+ | < | ||
+ | **UPDATES** | ||
+ | < | ||
The QUIC analysis LUA scripts can be found here in the [[https:// | The QUIC analysis LUA scripts can be found here in the [[https:// | ||
+ | </ | ||
+ | |||
+ | |||
===== Network Security Monitoring for QUIC ===== | ===== Network Security Monitoring for QUIC ===== | ||
Line 48: | Line 55: | ||
===== Flow Tags ===== | ===== Flow Tags ===== | ||
- | If you want to pull out all QUIC flows , then go to Tools > Explore Flows > then search for tag=QUIC | + | To pull out all QUIC flows go to Tools > Explore Flows > then search for tag=QUIC |
+ | |||
+ | Click to zoom the image, you can see the QUIC flows tagged with QUIC, ConnectionID, | ||
Line 58: | Line 67: | ||
===== Extract X.509 Certificate in QUIC ===== | ===== Extract X.509 Certificate in QUIC ===== | ||
- | Just as we do for all SSL flows, we pull out the certificates from the server. | + | Just as we do for all SSL flows, we pull out the certificates |
This took a while for me to get the certificate extraction right due to the following issues. | This took a while for me to get the certificate extraction right due to the following issues. | ||
Line 66: | Line 75: | ||
* the certificate spans multiple UDP packets hence needs some reassembly. Put together a very naive reassembly code in quic-dissect.lua | * the certificate spans multiple UDP packets hence needs some reassembly. Put together a very naive reassembly code in quic-dissect.lua | ||
- | This is the result of the extracted certificate. | + | |
+ | Go to Resources > SSL Certs > press ENTER or search | ||
lua/quic.1544724817.txt.gz · Last modified: 2018/12/13 23:43 by veera