diff --git a/report.txt b/report.txt new file mode 100644 index 0000000..b4c6616 --- /dev/null +++ b/report.txt @@ -0,0 +1,13 @@ +INFO_SEC: Rule 105: no value of MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT +INFO_SEC: Rule 96: no value of MMT_SEC_5G_DOS_HTTP2_MS_LIMIT +INFO_SEC: Rule 96: set MMT_SEC_5G_DOS_HTTP2_MS_LIMIT=80 +INFO_SEC: Rule 96: no value of MMT_SEC_5G_DOS_HTTP2_MS_LIMIT +INFO_SEC: Rule 96: set MMT_SEC_5G_DOS_HTTP2_MS_LIMIT=80 +INFO_SEC: Rule 96: no value of MMT_SEC_5G_DOS_HTTP2_MS_LIMIT +INFO_SEC: Rule 96: set MMT_SEC_5G_DOS_HTTP2_MS_LIMIT=80 +INFO_SEC: Rule 96: no value of MMT_SEC_5G_DOS_HTTP2_MS_LIMIT +INFO_SEC: Rule 96: set MMT_SEC_5G_DOS_HTTP2_MS_LIMIT=50 +INFO_SEC: Rule 112: no value of MMT_SEC_5G_DOS_HTTP2_MS_LIMIT +INFO_SEC: Rule 112: set MMT_SEC_SUCI_REQUESTS_MS_LIMIT=10 +INFO_SEC: Rule 79.dtls_v12_ciphersuites: no value of MMT_SEC_DTLS_CIPHER_ALLOWLIST +INFO_SEC: Analyzing pcap file /home/frank/Documents/thales/Attack_NGAP.pcap diff --git a/report.txtmmt-security-362055.csv b/report.txtmmt-security-362055.csv new file mode 100644 index 0000000..83cdf19 --- /dev/null +++ b/report.txtmmt-security-362055.csv @@ -0,0 +1,313 @@ +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451903.239130,"counter":15,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451903.239130,"counter":15,"attributes":[["ngap.procedure_code",21]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451903.239312,"counter":17,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451903.239312,"counter":17,"attributes":[["ngap.procedure_code",21]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.904229,"counter":23,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.904229,"counter":23,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451907.904229,"counter":23,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451907.904229,"counter":23,"attributes":[["meta.utime",1690451907.904229]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.904520,"counter":24,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.904520,"counter":24,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451907.904520,"counter":24,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451907.904520,"counter":24,"attributes":[["meta.utime",1690451907.904520]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.924030,"counter":27,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.924030,"counter":27,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451907.924030,"counter":27,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451907.924030,"counter":27,"attributes":[["meta.utime",1690451907.924030]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.924154,"counter":28,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.924154,"counter":28,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451907.924154,"counter":28,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451907.924154,"counter":28,"attributes":[["meta.utime",1690451907.924154]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.937284,"counter":30,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.937284,"counter":30,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451907.937284,"counter":30,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451907.937284,"counter":30,"attributes":[["meta.utime",1690451907.937284]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451907.924154,"counter":28,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451907.937384,"counter":31,"attributes":[["meta.utime",1690451907.937384]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.937494,"counter":32,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.937494,"counter":32,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451907.937284,"counter":30,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451907.937494,"counter":32,"attributes":[["meta.utime",1690451907.937494]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.949220,"counter":34,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.949220,"counter":34,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.949389,"counter":36,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.949389,"counter":36,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451907.924030,"counter":27,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451907.949389,"counter":36,"attributes":[["meta.utime",1690451907.949389]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.965999,"counter":38,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.965999,"counter":38,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.966397,"counter":40,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.966397,"counter":40,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.984704,"counter":42,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.984704,"counter":42,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.985017,"counter":44,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.985017,"counter":44,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.994040,"counter":46,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.994040,"counter":46,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451907.994332,"counter":48,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451907.994332,"counter":48,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.000493,"counter":50,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.000493,"counter":50,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.000824,"counter":52,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.000824,"counter":52,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.006001,"counter":54,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.006001,"counter":54,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.006299,"counter":56,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.006299,"counter":56,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.010525,"counter":58,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.010525,"counter":58,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.010844,"counter":60,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.010844,"counter":60,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.017270,"counter":62,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.017270,"counter":62,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.017617,"counter":64,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.017617,"counter":64,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.048085,"counter":66,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.048085,"counter":66,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.048634,"counter":68,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.048634,"counter":68,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.076543,"counter":70,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.076543,"counter":70,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.077106,"counter":72,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.077106,"counter":72,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.092915,"counter":74,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.092915,"counter":74,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.093249,"counter":76,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.093249,"counter":76,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.117039,"counter":78,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.117039,"counter":78,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.117285,"counter":80,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.117285,"counter":80,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.145030,"counter":82,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.145030,"counter":82,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.145325,"counter":84,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.145325,"counter":84,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.177597,"counter":86,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.177597,"counter":86,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.177921,"counter":88,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.177921,"counter":88,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.201313,"counter":90,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.201313,"counter":90,"attributes":[["ngap.procedure_code",14]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.201560,"counter":92,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.201560,"counter":92,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.230989,"counter":94,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.230989,"counter":94,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.231416,"counter":96,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.231416,"counter":96,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.263493,"counter":98,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.263493,"counter":98,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.263879,"counter":100,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.263879,"counter":100,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.296741,"counter":102,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.296741,"counter":102,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.297018,"counter":104,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.297018,"counter":104,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.498425,"counter":106,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.498425,"counter":106,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.500629,"counter":108,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.500629,"counter":108,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451908.702570,"counter":110,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451908.702570,"counter":110,"attributes":[["ngap.procedure_code",29]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451917.966307,"counter":113,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451917.966307,"counter":113,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451917.966307,"counter":113,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451917.966307,"counter":113,"attributes":[["meta.utime",1690451917.966307]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.000646,"counter":116,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.000646,"counter":116,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.006420,"counter":117,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.006420,"counter":117,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451918.006420,"counter":117,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451918.006420,"counter":117,"attributes":[["meta.utime",1690451918.006420]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.029798,"counter":120,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.029798,"counter":120,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.030047,"counter":121,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.030047,"counter":121,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.234447,"counter":124,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.234447,"counter":124,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451918.234447,"counter":124,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451918.234447,"counter":124,"attributes":[["meta.utime",1690451918.234447]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.271972,"counter":127,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.271972,"counter":127,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.275122,"counter":128,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.275122,"counter":128,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451918.275122,"counter":128,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451918.275122,"counter":128,"attributes":[["meta.utime",1690451918.275122]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.289481,"counter":131,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.289481,"counter":131,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.289666,"counter":132,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.289666,"counter":132,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.490436,"counter":134,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.490436,"counter":134,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451918.490436,"counter":134,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451918.490436,"counter":134,"attributes":[["meta.utime",1690451918.490436]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.527238,"counter":138,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.527238,"counter":138,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.530430,"counter":139,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.530430,"counter":139,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451918.530430,"counter":139,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451918.530430,"counter":139,"attributes":[["meta.utime",1690451918.530430]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.545884,"counter":142,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.545884,"counter":142,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.546127,"counter":143,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.546127,"counter":143,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451918.234447,"counter":124,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451918.546127,"counter":143,"attributes":[["meta.utime",1690451918.546127]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.750432,"counter":146,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.750432,"counter":146,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451918.750432,"counter":146,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451918.750432,"counter":146,"attributes":[["meta.utime",1690451918.750432]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451917.966307,"counter":113,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451918.750432,"counter":146,"attributes":[["meta.utime",1690451918.750432]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.791066,"counter":149,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.791066,"counter":149,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.795817,"counter":150,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.795817,"counter":150,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451918.795817,"counter":150,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451918.795817,"counter":150,"attributes":[["meta.utime",1690451918.795817]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451918.490436,"counter":134,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451918.811882,"counter":152,"attributes":[["meta.utime",1690451918.811882]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.812850,"counter":153,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.812850,"counter":153,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451918.813135,"counter":154,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451918.813135,"counter":154,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451918.006420,"counter":117,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451918.813135,"counter":154,"attributes":[["meta.utime",1690451918.813135]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451919.014364,"counter":156,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451919.014364,"counter":156,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451919.014364,"counter":156,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451919.014364,"counter":156,"attributes":[["meta.utime",1690451919.014364]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451919.049447,"counter":160,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451919.049447,"counter":160,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451918.275122,"counter":128,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451919.146369,"counter":162,"attributes":[["meta.utime",1690451919.146369]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.000250,"counter":166,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.000250,"counter":166,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.000520,"counter":167,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.000520,"counter":167,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.029749,"counter":170,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.029749,"counter":170,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.126384,"counter":172,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.126384,"counter":172,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.273083,"counter":179,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.273083,"counter":179,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.273332,"counter":180,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.273332,"counter":180,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.291656,"counter":183,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.291656,"counter":183,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.291919,"counter":184,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.291919,"counter":184,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.527671,"counter":189,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.527671,"counter":189,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.527920,"counter":190,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.527920,"counter":190,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.548050,"counter":193,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.548050,"counter":193,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.548288,"counter":194,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.548288,"counter":194,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.790777,"counter":199,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.790777,"counter":199,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.791029,"counter":200,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.791029,"counter":200,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.815125,"counter":203,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.815125,"counter":203,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451924.815367,"counter":204,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451924.815367,"counter":204,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451925.049882,"counter":209,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451925.049882,"counter":209,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451925.050125,"counter":210,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451925.050125,"counter":210,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451927.957316,"counter":213,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451927.957316,"counter":213,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451927.957316,"counter":213,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451927.957316,"counter":213,"attributes":[["meta.utime",1690451927.957316]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451927.971338,"counter":216,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451927.971338,"counter":216,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451927.973043,"counter":217,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451927.973043,"counter":217,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451927.973043,"counter":217,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451927.973043,"counter":217,"attributes":[["meta.utime",1690451927.973043]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451927.982162,"counter":220,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451927.982162,"counter":220,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451927.982339,"counter":221,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451927.982339,"counter":221,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.186370,"counter":224,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.186370,"counter":224,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451928.186370,"counter":224,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451928.186370,"counter":224,"attributes":[["meta.utime",1690451928.186370]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.209940,"counter":227,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.209940,"counter":227,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.211463,"counter":228,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.211463,"counter":228,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451928.211463,"counter":228,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451928.211463,"counter":228,"attributes":[["meta.utime",1690451928.211463]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.220599,"counter":231,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.220599,"counter":231,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.220779,"counter":232,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.220779,"counter":232,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.422350,"counter":234,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.422350,"counter":234,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451928.422350,"counter":234,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451928.422350,"counter":234,"attributes":[["meta.utime",1690451928.422350]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.459915,"counter":238,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.459915,"counter":238,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.467349,"counter":239,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.467349,"counter":239,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451928.467349,"counter":239,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451928.467349,"counter":239,"attributes":[["meta.utime",1690451928.467349]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451928.186370,"counter":224,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451928.488334,"counter":241,"attributes":[["meta.utime",1690451928.488334]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.489970,"counter":242,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.489970,"counter":242,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.490356,"counter":243,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.490356,"counter":243,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451927.957316,"counter":213,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451928.490356,"counter":243,"attributes":[["meta.utime",1690451928.490356]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.694339,"counter":245,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.694339,"counter":245,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451928.694339,"counter":245,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451928.694339,"counter":245,"attributes":[["meta.utime",1690451928.694339]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451928.726477,"counter":249,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451928.726477,"counter":249,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451927.973043,"counter":217,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451928.826437,"counter":251,"attributes":[["meta.utime",1690451928.826437]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.000693,"counter":255,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.000693,"counter":255,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.000944,"counter":256,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.000944,"counter":256,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.029960,"counter":259,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.029960,"counter":259,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.138453,"counter":261,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.138453,"counter":261,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.272650,"counter":266,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.272650,"counter":266,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.272913,"counter":267,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.272913,"counter":267,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.292750,"counter":270,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.292750,"counter":270,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.394451,"counter":272,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.394451,"counter":272,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.528167,"counter":277,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.528167,"counter":277,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.528467,"counter":278,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.528467,"counter":278,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.547055,"counter":281,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.547055,"counter":281,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.646378,"counter":283,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.646378,"counter":283,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.790529,"counter":287,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.790529,"counter":287,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.790811,"counter":288,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.790811,"counter":288,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.814498,"counter":291,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.814498,"counter":291,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451930.814742,"counter":292,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451930.814742,"counter":292,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451931.047801,"counter":297,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451931.047801,"counter":297,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451931.047922,"counter":298,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451931.047922,"counter":298,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451933.975288,"counter":303,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451933.975288,"counter":303,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451933.975565,"counter":304,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451933.975565,"counter":304,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451933.984707,"counter":307,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451933.984707,"counter":307,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451933.984932,"counter":308,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451933.984932,"counter":308,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.212155,"counter":313,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.212155,"counter":313,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.212413,"counter":314,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.212413,"counter":314,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.222640,"counter":317,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.222640,"counter":317,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.222877,"counter":318,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.222877,"counter":318,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.460549,"counter":323,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.460549,"counter":323,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.460790,"counter":324,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.460790,"counter":324,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.491518,"counter":327,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.491518,"counter":327,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.491757,"counter":328,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.491757,"counter":328,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.726315,"counter":333,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.726315,"counter":333,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451934.726554,"counter":334,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451934.726554,"counter":334,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.000512,"counter":339,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.000512,"counter":339,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.000754,"counter":340,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.000754,"counter":340,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.030163,"counter":343,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.030163,"counter":343,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.030278,"counter":344,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.030278,"counter":344,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.272984,"counter":349,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.272984,"counter":349,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.273225,"counter":350,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.273225,"counter":350,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.291134,"counter":353,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.291134,"counter":353,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.291394,"counter":354,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.291394,"counter":354,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.528161,"counter":359,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.528161,"counter":359,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.528420,"counter":360,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.528420,"counter":360,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.547196,"counter":363,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.547196,"counter":363,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.547433,"counter":364,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.547433,"counter":364,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.791146,"counter":369,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.791146,"counter":369,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.791399,"counter":370,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.791399,"counter":370,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.814567,"counter":373,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.814567,"counter":373,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451936.814819,"counter":374,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451936.814819,"counter":374,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451937.048729,"counter":379,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451937.048729,"counter":379,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451937.048879,"counter":380,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451937.048879,"counter":380,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451937.967471,"counter":383,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451937.967471,"counter":383,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451937.967471,"counter":383,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451937.967471,"counter":383,"attributes":[["meta.utime",1690451937.967471]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451937.992888,"counter":386,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451937.992888,"counter":386,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451939.973229,"counter":392,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451939.973229,"counter":392,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451939.973487,"counter":393,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451939.973487,"counter":393,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451939.984288,"counter":396,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451939.984288,"counter":396,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451939.984540,"counter":397,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451939.984540,"counter":397,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.211760,"counter":402,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.211760,"counter":402,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.211995,"counter":403,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.211995,"counter":403,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.222150,"counter":406,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.222150,"counter":406,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.222401,"counter":407,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.222401,"counter":407,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.459914,"counter":412,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.459914,"counter":412,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.460146,"counter":413,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.460146,"counter":413,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.489133,"counter":416,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.489133,"counter":416,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.489209,"counter":417,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.489209,"counter":417,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.726650,"counter":422,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.726650,"counter":422,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451940.726908,"counter":423,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451940.726908,"counter":423,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.001232,"counter":428,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.001232,"counter":428,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.001480,"counter":429,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.001480,"counter":429,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.031707,"counter":432,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.031707,"counter":432,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.031960,"counter":433,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.031960,"counter":433,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.274366,"counter":438,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.274366,"counter":438,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.274623,"counter":439,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.274623,"counter":439,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.289816,"counter":442,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.289816,"counter":442,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.289932,"counter":443,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.289932,"counter":443,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.527657,"counter":448,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.527657,"counter":448,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.527876,"counter":449,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.527876,"counter":449,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.548256,"counter":452,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.548256,"counter":452,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.548511,"counter":453,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.548511,"counter":453,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.790730,"counter":458,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.790730,"counter":458,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.791004,"counter":459,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.791004,"counter":459,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.814768,"counter":462,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.814768,"counter":462,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451942.815091,"counter":463,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451942.815091,"counter":463,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451943.047440,"counter":468,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451943.047440,"counter":468,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451943.047566,"counter":469,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451943.047566,"counter":469,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451943.994636,"counter":474,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451943.994636,"counter":474,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451943.994897,"counter":475,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451943.994897,"counter":475,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451945.973017,"counter":480,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451945.973017,"counter":480,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451945.973286,"counter":481,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451945.973286,"counter":481,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451945.984207,"counter":484,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451945.984207,"counter":484,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451945.984476,"counter":485,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451945.984476,"counter":485,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.211602,"counter":490,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.211602,"counter":490,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.211850,"counter":491,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.211850,"counter":491,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.223364,"counter":494,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.223364,"counter":494,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.223583,"counter":495,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.223583,"counter":495,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.459705,"counter":500,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.459705,"counter":500,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.459938,"counter":501,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.459938,"counter":501,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.491785,"counter":504,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.491785,"counter":504,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.492039,"counter":505,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.492039,"counter":505,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.723850,"counter":510,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.723850,"counter":510,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451946.723961,"counter":511,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451946.723961,"counter":511,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451947.977715,"counter":514,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451947.977715,"counter":514,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451947.977715,"counter":514,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451947.977715,"counter":514,"attributes":[["meta.utime",1690451947.977715]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451948.020570,"counter":517,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451948.020570,"counter":517,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451948.025267,"counter":518,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451948.025267,"counter":518,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451948.025267,"counter":518,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451948.025267,"counter":518,"attributes":[["meta.utime",1690451948.025267]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451948.040567,"counter":521,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451948.040567,"counter":521,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451948.040768,"counter":522,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451948.040768,"counter":522,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451948.242335,"counter":524,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451948.242335,"counter":524,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451948.242335,"counter":524,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451948.242335,"counter":524,"attributes":[["meta.utime",1690451948.242335]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451948.275106,"counter":528,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451948.275106,"counter":528,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451949.994661,"counter":534,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451949.994661,"counter":534,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451949.994883,"counter":535,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451949.994883,"counter":535,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451951.973139,"counter":542,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451951.973139,"counter":542,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451951.973366,"counter":543,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451951.973366,"counter":543,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451951.983933,"counter":546,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451951.983933,"counter":546,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.086285,"counter":548,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.086285,"counter":548,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.211693,"counter":552,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.211693,"counter":552,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.211919,"counter":553,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.211919,"counter":553,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.223351,"counter":556,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.223351,"counter":556,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.223585,"counter":557,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.223585,"counter":557,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.459763,"counter":562,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.459763,"counter":562,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.460000,"counter":563,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.460000,"counter":563,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.491227,"counter":566,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.491227,"counter":566,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.491473,"counter":567,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.491473,"counter":567,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.726742,"counter":572,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.726742,"counter":572,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451952.726988,"counter":573,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451952.726988,"counter":573,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451954.021454,"counter":578,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451954.021454,"counter":578,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451954.021704,"counter":579,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451954.021704,"counter":579,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451954.041272,"counter":582,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451954.041272,"counter":582,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451954.041374,"counter":583,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451954.041374,"counter":583,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451954.275808,"counter":588,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451954.275808,"counter":588,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451954.276052,"counter":589,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451954.276052,"counter":589,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451955.996470,"counter":600,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451955.996470,"counter":600,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451955.996720,"counter":601,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451955.996720,"counter":601,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451957.983441,"counter":604,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451957.983441,"counter":604,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451957.983441,"counter":604,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451957.983441,"counter":604,"attributes":[["meta.utime",1690451957.983441]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451957.997353,"counter":607,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451957.997353,"counter":607,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451957.999228,"counter":608,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451957.999228,"counter":608,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451957.999228,"counter":608,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451957.999228,"counter":608,"attributes":[["meta.utime",1690451957.999228]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.009111,"counter":611,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.009111,"counter":611,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.009332,"counter":612,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.009332,"counter":612,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.210048,"counter":614,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.210048,"counter":614,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451958.210048,"counter":614,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451958.210048,"counter":614,"attributes":[["meta.utime",1690451958.210048]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.243392,"counter":618,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.243392,"counter":618,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.247732,"counter":619,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.247732,"counter":619,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451958.247732,"counter":619,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451958.247732,"counter":619,"attributes":[["meta.utime",1690451958.247732]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.262035,"counter":622,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.262035,"counter":622,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.262258,"counter":623,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.262258,"counter":623,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.465967,"counter":626,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.465967,"counter":626,"attributes":[["ngap.procedure_code",15]]}} +10,0,"",1696852279,105,"detected","attack","5G DoS attack in the control plane: total number of InitialUEMessage is greater than the limit fixed by the MMT_SEC_5G_DOS_NGAP_INITIALUEMESSAGE_MS_LIMIT environment variable",{"event_1":{"timestamp":1690451958.465967,"counter":626,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["ngap.procedure_code",15]]},"event_2":{"timestamp":1690451958.465967,"counter":626,"attributes":[["meta.utime",1690451958.465967]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451958.477733,"counter":629,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451958.477733,"counter":629,"attributes":[["ngap.procedure_code",46]]}} +10,0,"",1696852279,112,"detected","attack","5G SUCI attack recognition",{"event_1":{"timestamp":1690451957.983441,"counter":604,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["nas_5g.message_type",65]]},"event_2":{"timestamp":1690451958.578263,"counter":631,"attributes":[["meta.utime",1690451958.578263]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451960.020713,"counter":635,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451960.020713,"counter":635,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451960.020972,"counter":636,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451960.020972,"counter":636,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451960.043321,"counter":639,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451960.043321,"counter":639,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451960.146283,"counter":641,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451960.146283,"counter":641,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451960.275411,"counter":646,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451960.275411,"counter":646,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451960.275662,"counter":647,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451960.275662,"counter":647,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451961.995741,"counter":652,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451961.995741,"counter":652,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451961.996002,"counter":653,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451961.996002,"counter":653,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.004529,"counter":658,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.004529,"counter":658,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.004792,"counter":659,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.004792,"counter":659,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.010853,"counter":662,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.010853,"counter":662,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.114109,"counter":664,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.114109,"counter":664,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.244120,"counter":668,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.244120,"counter":668,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.244349,"counter":669,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.244349,"counter":669,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.264083,"counter":672,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.264083,"counter":672,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.264367,"counter":673,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.264367,"counter":673,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.479918,"counter":678,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.479918,"counter":678,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451964.480175,"counter":679,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451964.480175,"counter":679,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451966.020736,"counter":684,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451966.020736,"counter":684,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451966.021003,"counter":685,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451966.021003,"counter":685,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451966.041150,"counter":688,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451966.041150,"counter":688,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451966.041239,"counter":689,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451966.041239,"counter":689,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451966.275143,"counter":694,"attributes":[["ip.src","192.168.150.150"],["ip.dst","192.168.150.1"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451966.275143,"counter":694,"attributes":[["ngap.procedure_code",9]]}} +10,0,"",1696852279,103,"detected","attack","SCTP Protocol Identifier indicates that its payload is NGAP but the payload is not effectually NGAP",{"event_1":{"timestamp":1690451966.275406,"counter":695,"attributes":[["ip.src","192.168.150.1"],["ip.dst","192.168.150.200"],["sctp.dest_port",38412],["sctp_data.data_ppid",60]]},"event_2":{"timestamp":1690451966.275406,"counter":695,"attributes":[["ngap.procedure_code",9]]}} diff --git a/rules/106.http2_postflooding_recognition.xml b/rules/106.http2_postflooding_recognition.xml index 4122395..647da9b 100644 --- a/rules/106.http2_postflooding_recognition.xml +++ b/rules/106.http2_postflooding_recognition.xml @@ -49,8 +49,18 @@ static inline bool em_5g_check_msg_throughput( const void *data ){ } counter ++; - //if(counter >= limit_5g_dos_http2_per_ms) - //printf("Rule 96 Dos recognized\n"); + if(counter >= limit_5g_dos_http2_per_ms){ + struct timeval current_time; + gettimeofday(¤t_time, NULL); + + // Extract seconds and microseconds from the timeval structure + long seconds = current_time.tv_sec; + long milliseconds = current_time.tv_usec / 1000; + + printf("Security Timestamp: %ld.%03ld\n", seconds, milliseconds); + + } + return (counter >= limit_5g_dos_http2_per_ms); } ]]> diff --git a/rules/112.nas_suci_attack.xml b/rules/112.nas_suci_attack.xml index dd7dda6..acc15e0 100644 --- a/rules/112.nas_suci_attack.xml +++ b/rules/112.nas_suci_attack.xml @@ -6,18 +6,16 @@ It counts how many registration packets are sent. If the number of these packets #include - -static unsigned long int limit_5g_suci_requests_per_ms = 10; - +static unsigned long int limit_5g_suci_requests_per_ms = 20; void on_load(){ const char *str = getenv("MMT_SEC_SUCI_REQUESTS_MS_LIMIT"); if( str == NULL ){ mmt_info("Rule 112: no value of MMT_SEC_5G_DOS_HTTP2_MS_LIMIT" ); - limit_5g_suci_requests_per_ms=10; + limit_5g_suci_requests_per_ms=20; } else - limit_5g_suci_requests_per_ms = 10; + limit_5g_suci_requests_per_ms = strtoul( str, NULL, 0 ); mmt_info("Rule 112: set MMT_SEC_SUCI_REQUESTS_MS_LIMIT=%ld", limit_5g_suci_requests_per_ms ); } @@ -45,16 +43,16 @@ static inline bool em_5g_check_msg_throughput( const void *data ){ } counter ++; - //if(counter >= limit_5g_suci_requests_per_ms) - //printf("Rule 112 SUCI\n"); + return (counter >= limit_5g_suci_requests_per_ms); } ]]> + description="5G SUCI attack: The SUCI-Catcher attack exploits authentication mechanism. It fetches an authentication challenge associated + with the searched-for subscriber’s identity .Then, it sends this Authentication Request to all connecting UEs."> + description="5G SUCI attack" + boolean_expression="(( nas_5g.message_type == 86) && (ip.src != ip.dst) )"/>