[JIRA] (BIT-1571) Connection summaries w/ IPv6 have poor readabiity

Development
1

I’m not sure I agree without additional context. ICMP exfil is a known technique. Wouldn’t you want to know if all of a sudden, you started seeing gigs of ICMP? Or is there some other limitation that would make detecting this problematic?

What I would recommend instead is simply adding the protocols to the ports. So, instead of “top ports: 53, 80, 443, 8” you would see: “top ports: 53/udp, 80/tcp, 443/tcp, 8/icmp”

Would this be sufficient to solve the ICMP/port number confusion?

2

Or don’t count it in the port statistics, but still count it in the protocol stats. So you would see a ton of protocol #1

But I think I like your suggestion better because it separates things like 53/tcp and 53/udp.