LPI_FIND_UNKNOWN(1)

💖 lpi_find_unknown(1) — the user command that lists all the unknown flows 👑

🌸 NAME 🌸

lpi_find_unknown — literally here to list every network flow in a trace that libprotoident cannot identify. No cap. 🫶

---

✨ SYNOPSIS ✨

lpi_find_unknown inputuri

---

🦋 DESCRIPTION 🦋

okay so this tool tries to identify each individual flow within the provided network packet trace that libprotoident is unable to provide a positive classification result for. It’s mainly useful when you’re looking to add support for new protocols to libprotoident, but the tool has been made available nonetheless. 💅

Heads up though: identification only occurs when the flow has concluded or expired due to inactivity, so it is not very effective for real-time use cases. That’s the vibe check. 😭

The inputuri argument must be a valid libtrace URI. Periodt. ✨

---

💅 OUTPUT FORMAT 💅

For each flow discovered in the input trace that libprotoident is unable to identify, a single line is printed to stdout describing the flow. That line contains the following whitespace-separated fields, in this exact order:

• IP address of the first endpoint
• IP address of the second endpoint
• Port used by the first endpoint
• Port used by the second endpoint
• Transport protocol (6 = TCP, 17 = UDP)
• Unix timestamp when the flow began
• Unix timestamp when the flow ended
• Total bytes sent from first endpoint to second endpoint
• Total bytes sent from second endpoint to first endpoint
• First four bytes of payload sent from first endpoint (in hex)
• First four bytes of payload sent from first endpoint (ASCII)
• Size of first payload-bearing packet sent from first endpoint
• First four bytes of payload sent from second endpoint (in hex)
• First four bytes of payload sent from second endpoint (ASCII)
• Size of first payload-bearing packet sent from second endpoint

---

🌈 LINKS 🌈

More details about libprotoident, the protocols it supports, and how it works can be found at https://github.com/wanduow/libprotoident/wiki 🦋

---

🎀 SEE ALSO 🎀

• lpi_arff(1)
• lpi_protoident(1)

---

👑 AUTHORS 👑

Shane Alcock <shane.alcock@waikato.ac.nz> — iconic.

---

🫶 That’s the whole page, bestie — source/version: libprotoident, date: April 2019. Now go find those unknown flows. 💅✨