tls13_0rtt.yml

name: TLS 1.3 Traffic with 0-RTT Handshake
description: Check that TLS 1.3 is properly parsed when Zero Round Trip Time is used
  in a handshake.
requirements:
  protocols: [tls]
marks: [tls]
pcap: tls13_0rtt.pcap
probe:
  protocols: [tls]
at_least_one: [tls_server_version, tls_cipher_suite, tls_sni, tls_client_version,
  tls_ja3]

flows:
  - src_ip: 172.16.1.117
    dst_ip: 172.16.1.130
    ip_version: 4
    protocol: 6
    bytes: 871
    bytes@rev: 2015
    packets: 10
    packets@rev: 7
    src_port: 35120
    dst_port: 4433
    tls_server_version: 0x7f1c
    tls_cipher_suite: 0x1302
    tls_sni: dogfish.lan
    tls_client_version: 0x7f1c
    tls_ja3: '0xa66e498c488aa0523759691248cdfb01'
  - src_ip: 172.16.1.117
    dst_ip: 172.16.1.130
    ip_version: 4
    protocol: 6
    bytes: 1214
    bytes@rev: 792
    packets: 9
    packets@rev: 5
    src_port: 35122
    dst_port: 4433
    tls_server_version: 0x7f1c
    tls_cipher_suite: 0x1302
    tls_sni: dogfish.lan
    tls_client_version: 0x7f1c
    tls_ja3: '0x7802ad1a89a41b351fb2ac5b7c9834bf'