Sniffing

The settings of a sniff action, and what each sniffer reports. Sniffing reads the start of a TCP connection; the destination is never rewritten. A connection is sniffed at most once.

Structure

json

{
  "type": "sniff",
  "settings": {
    "sniffers": [{ "type": "tls" }, { "type": "http" }],
    "timeout": "300ms"
  }
}

Fields

`sniffers`

list of sniffersRequired

The sniffers to run.

`timeout`

durationDefault: 300ms

How long to wait for enough bytes to recognise the connection.

Sniffers

Neither takes settings.

Type	Reads	Reports
`tls`	a TLS ClientHello	the server name (SNI) and a browser-family guess
`http`	an HTTP/1 request	the `Host` and every header, with `:method` and `:path`

Later rules read the results through sniffed_protocol, sniffed_request_header, sniffed_browser_family and the domain fields.

Sniffing ​

Structure ​

Fields ​

sniffers ​