diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2022-12-23 10:04:08 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-12-23 10:04:08 +0100 |
| commit | 3de76812d978060c433864c2f72de113746d70e8 (patch) | |
| tree | 1aba718f97276647f9859467ee51e2f652b6eca1 | |
| parent | 5fafe8374a5cc0cc890053c5bf0cb81b3bda80c9 (diff) | |
Remove some old protocols (#1832)
These protocols:
* have been addeded in the OpenDPI era
* have never been updated since then
* we don't have any pcap examples [*]
If (and it is a big if...) some of these protocols are still somehow
used and if someone is still interested in them, we can probably
re-add them starting from scratch (because the current detection
rules are probably outdated)
Protocols removed: DIRECT_DOWNLOAD_LINK, APPLEJUICE, DIRECTCONNECT,
OPENFT, FASTTRACK, SHOUTCAST, THUNDER, AYIYA, STEALTHNET, FIESTA,
FLORENSIA, AIMINI, SOPCAST
PPSTREAM dissector works (...) only on UDP.
[*]: with do have an AIMINI test pcap but it was some trivial http
traffic detected only by hostname matching, on domains no more
available...
228 files changed, 249 insertions, 2732 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 894b8c1f9..856778dc8 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -50,10 +50,10 @@ typedef enum { NDPI_PROTOCOL_POSTGRES = 19, NDPI_PROTOCOL_MYSQL = 20, NDPI_PROTOCOL_MS_OUTLOOK = 21, /* Hotmail / Microsoft Outlook / Exchange */ - NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK = 22, + NDPI_PROTOCOL_FREE_22 = 22, /* FREE */ NDPI_PROTOCOL_MAIL_POPS = 23, - NDPI_PROTOCOL_APPLEJUICE = 24, - NDPI_PROTOCOL_DIRECTCONNECT = 25, + NDPI_PROTOCOL_FREE_24 = 24, /* FREE */ + NDPI_PROTOCOL_FREE_25 = 25, /* FREE */ NDPI_PROTOCOL_NTOP = 26, NDPI_PROTOCOL_COAP = 27, NDPI_PROTOCOL_VMWARE = 28, @@ -61,8 +61,8 @@ typedef enum { NDPI_PROTOCOL_DTLS = 30, NDPI_PROTOCOL_UBNTAC2 = 31, /* Ubiquity UBNT AirControl = 2 */ NDPI_PROTOCOL_KONTIKI = 32, - NDPI_PROTOCOL_OPENFT = 33, - NDPI_PROTOCOL_FASTTRACK = 34, + NDPI_PROTOCOL_FREE_33 = 33, /* FREE */ + NDPI_PROTOCOL_FREE_34 = 34, /* FREE */ NDPI_PROTOCOL_GNUTELLA = 35, NDPI_PROTOCOL_EDONKEY = 36, NDPI_PROTOCOL_BITTORRENT = 37, @@ -84,17 +84,17 @@ typedef enum { NDPI_PROTOCOL_CPHA = 53, NDPI_PROTOCOL_PPSTREAM = 54, NDPI_PROTOCOL_ZATTOO = 55, - NDPI_PROTOCOL_SHOUTCAST = 56, - NDPI_PROTOCOL_SOPCAST = 57, + NDPI_PROTOCOL_FREE_56 = 56, /* FREE */ + NDPI_PROTOCOL_FREE_57 = 57, /* FREE */ NDPI_PROTOCOL_DISCORD = 58, NDPI_PROTOCOL_TVUPLAYER = 59, NDPI_PROTOCOL_MONGODB = 60, NDPI_PROTOCOL_PLURALSIGHT = 61, - NDPI_PROTOCOL_THUNDER = 62, + NDPI_PROTOCOL_FREE_62 = 62, /* FREE */ NDPI_PROTOCOL_OCSP = 63, NDPI_PROTOCOL_VXLAN = 64, NDPI_PROTOCOL_IRC = 65, - NDPI_PROTOCOL_AYIYA = 66, + NDPI_PROTOCOL_FREE_66 = 66, /* FREE */ NDPI_PROTOCOL_JABBER = 67, NDPI_PROTOCOL_NATS = 68, NDPI_PROTOCOL_AMONG_US = 69, @@ -126,8 +126,8 @@ typedef enum { NDPI_PROTOCOL_IAX = 95, NDPI_PROTOCOL_TFTP = 96, NDPI_PROTOCOL_AFP = 97, - NDPI_PROTOCOL_STEALTHNET = 98, - NDPI_PROTOCOL_AIMINI = 99, + NDPI_PROTOCOL_FREE_98 = 98, /* FREE */ + NDPI_PROTOCOL_FREE_99 = 99, /* FREE */ NDPI_PROTOCOL_SIP = 100, NDPI_PROTOCOL_TRUPHONE = 101, NDPI_PROTOCOL_IP_ICMPV6 = 102, @@ -135,8 +135,8 @@ typedef enum { NDPI_PROTOCOL_ARMAGETRON = 104, NDPI_PROTOCOL_CROSSFIRE = 105, NDPI_PROTOCOL_DOFUS = 106, - NDPI_PROTOCOL_FIESTA = 107, - NDPI_PROTOCOL_FLORENSIA = 108, + NDPI_PROTOCOL_FREE_107 = 107, /* FREE */ + NDPI_PROTOCOL_FREE_108 = 108, /* FREE */ NDPI_PROTOCOL_GUILDWARS = 109, NDPI_PROTOCOL_AMAZON_ALEXA = 110, NDPI_PROTOCOL_KERBEROS = 111, diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index be07c517c..d489b4cdf 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -53,10 +53,7 @@ void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, st void init_diameter_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_afp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_applejuice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_armagetron_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_ayiya_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_amqp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_bgp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_bittorrent_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); @@ -71,16 +68,11 @@ void init_crossfire_dissector(struct ndpi_detection_module_struct *ndpi_struct, void init_dcerpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dhcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dhcpv6_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_directconnect_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dns_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dofus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_directdownloadlink_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dropbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_eaq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_edonkey_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_fasttrack_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_fiesta_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_florensia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_ftp_control_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_ftp_data_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_gnutella_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); @@ -118,7 +110,6 @@ void init_nfs_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int3 void init_noe_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_non_tcp_udp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_ntp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_openft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_openvpn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_oracle_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_postgres_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); @@ -144,13 +135,11 @@ void init_skype_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in void init_smb_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_snmp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_socrates_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_sopcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_socks_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_spotify_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_ssh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_tls_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_starcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_stealthnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_syslog_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); @@ -160,7 +149,6 @@ void init_teamviewer_dissector(struct ndpi_detection_module_struct *ndpi_struct, void init_telegram_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_telnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_tftp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_thunder_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_tvuplayer_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_usenet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_wsd_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 093150407..d9de63d5e 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -730,15 +730,9 @@ struct ndpi_flow_tcp_struct { /* NDPI_PROTOCOL_DOFUS */ u_int32_t dofus_stage:1; - /* NDPI_PROTOCOL_FIESTA */ - u_int32_t fiesta_stage:2; - /* NDPI_PROTOCOL_WORLDOFWARCRAFT */ u_int32_t wow_stage:2; - /* NDPI_PROTOCOL_SHOUTCAST */ - u_int32_t shoutcast_stage:2; - /* NDPI_PROTOCOL_RTP */ u_int32_t rtp_special_packets_seen:1; @@ -761,9 +755,6 @@ struct ndpi_flow_tcp_struct { u_int8_t prev_zmq_pkt_len; u_char prev_zmq_pkt[10]; - /* NDPI_PROTOCOL_PPSTREAM */ - u_int32_t ppstream_stage:3; - /* NDPI_PROTOCOL_MEMCACHED */ u_int8_t memcached_matches; @@ -783,9 +774,6 @@ struct ndpi_flow_udp_struct { /* NDPI_PROTOCOL_TFTP */ u_int32_t tftp_stage:2; - /* NDPI_PROTOCOL_AIMINI */ - u_int32_t aimini_stage:5; - /* NDPI_PROTOCOL_XBOX */ u_int32_t xbox_stage:1; @@ -1533,9 +1521,6 @@ struct ndpi_flow_struct { u_int8_t bittorrent_stage; // can be 0 - 255 u_int8_t bt_check_performed : 1; - /* NDPI_PROTOCOL_DIRECTCONNECT */ - u_int8_t directconnect_stage:2; // 0 - 1 - /* NDPI_PROTOCOL_HTTP */ u_int8_t http_detected:1; @@ -1545,12 +1530,6 @@ struct ndpi_flow_struct { /* NDPI_PROTOCOL_ZATTOO */ u_int8_t zattoo_stage:3; - /* NDPI_PROTOCOL_THUNDER */ - u_int8_t thunder_stage:2; // 0 - 3 - - /* NDPI_PROTOCOL_FLORENSIA */ - u_int8_t florensia_stage:1; - /* NDPI_PROTOCOL_SOCKS */ u_int8_t socks5_stage:2, socks4_stage:2; // 0 - 3 diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 97317a1c1..c67e7b2c8 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1049,10 +1049,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_build_default_ports(ports_a, 80, 0 /* ntop */, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_subprotocols(ndpi_str, NDPI_PROTOCOL_HTTP, - NDPI_PROTOCOL_AIMINI, NDPI_PROTOCOL_CROSSFIRE, NDPI_PROTOCOL_SOAP, - NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, NDPI_PROTOCOL_GNUTELLA, + NDPI_PROTOCOL_CROSSFIRE, NDPI_PROTOCOL_SOAP, + NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_GNUTELLA, NDPI_PROTOCOL_MAPLESTORY, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_WORLDOFWARCRAFT, - NDPI_PROTOCOL_THUNDER, NDPI_PROTOCOL_IRC, + NDPI_PROTOCOL_IRC, NDPI_PROTOCOL_IPP, NDPI_PROTOCOL_MPEGDASH, NDPI_PROTOCOL_RTSP, @@ -1113,16 +1113,16 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "MySQL", NDPI_PROTOCOL_CATEGORY_DATABASE, ndpi_build_default_ports(ports_a, 3306, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, - "Direct_Download_Link", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_22, + "Free22", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_APPLEJUICE, - "AppleJuice", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_24, + "Free24", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_DIRECTCONNECT, - "DirectConnect", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_25, + "Free25", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_NATS, @@ -1145,12 +1145,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Kontiki", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_OPENFT, - "OpenFT", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_33, + "Free33", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FASTTRACK, - "FastTrack", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_34, + "Free34", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_GNUTELLA, @@ -1265,12 +1265,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Zattoo", NDPI_PROTOCOL_CATEGORY_VIDEO, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_SHOUTCAST, - "ShoutCast", NDPI_PROTOCOL_CATEGORY_MUSIC, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_56, + "Free56", NDPI_PROTOCOL_CATEGORY_MUSIC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_SOPCAST, - "Sopcast", NDPI_PROTOCOL_CATEGORY_VIDEO, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_57, + "Free57", NDPI_PROTOCOL_CATEGORY_VIDEO, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DISCORD, @@ -1285,8 +1285,8 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Pluralsight", NDPI_PROTOCOL_CATEGORY_VIDEO, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_THUNDER, - "Thunder", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_62, + "Free62", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_OCSP, @@ -1301,8 +1301,8 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "IRC", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 194, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 194, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AYIYA, - "Ayiya", NDPI_PROTOCOL_CATEGORY_NETWORK, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_66, + "Free66", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 5072, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_JABBER, @@ -1447,12 +1447,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "CHECKMK", NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, ndpi_build_default_ports(ports_a, 6556, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_STEALTHNET, - "Stealthnet", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_98, + "Free98", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_AIMINI, - "Aimini", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_99, + "Free99", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SIP, @@ -1483,12 +1483,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Dofus", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FIESTA, - "Fiesta", NDPI_PROTOCOL_CATEGORY_GAME, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_107, + "Free107", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FLORENSIA, - "Florensia", NDPI_PROTOCOL_CATEGORY_GAME, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_108, + "Free108", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_GUILDWARS, @@ -4225,21 +4225,12 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* EDONKEY */ init_edonkey_dissector(ndpi_str, &a); - /* FASTTRACK */ - init_fasttrack_dissector(ndpi_str, &a); - /* GNUTELLA */ init_gnutella_dissector(ndpi_str, &a); - /* DIRECTCONNECT */ - init_directconnect_dissector(ndpi_str, &a); - /* NATS */ init_nats_dissector(ndpi_str, &a); - /* APPLEJUICE */ - init_applejuice_dissector(ndpi_str, &a); - /* SOCKS */ init_socks_dissector(ndpi_str, &a); @@ -4270,9 +4261,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* NON_TCP_UDP */ init_non_tcp_udp_dissector(ndpi_str, &a); - /* SOPCAST */ - init_sopcast_dissector(ndpi_str, &a); - /* TVUPLAYER */ init_tvuplayer_dissector(ndpi_str, &a); @@ -4294,12 +4282,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* SSH */ init_ssh_dissector(ndpi_str, &a); - /* AYIYA */ - init_ayiya_dissector(ndpi_str, &a); - - /* THUNDER */ - init_thunder_dissector(ndpi_str, &a); - /* VNC */ init_vnc_dissector(ndpi_str, &a); @@ -4360,21 +4342,12 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* ICECAST */ init_icecast_dissector(ndpi_str, &a); - /* SHOUTCAST */ - init_shoutcast_dissector(ndpi_str, &a); - /* KERBEROS */ init_kerberos_dissector(ndpi_str, &a); - /* OPENFT */ - init_openft_dissector(ndpi_str, &a); - /* SYSLOG */ init_syslog_dissector(ndpi_str, &a); - /* DIRECT_DOWNLOAD_LINK */ - init_directdownloadlink_dissector(ndpi_str, &a); - /* NETBIOS */ init_netbios_dissector(ndpi_str, &a); @@ -4399,9 +4372,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* PPTP */ init_pptp_dissector(ndpi_str, &a); - /* STEALTHNET */ - init_stealthnet_dissector(ndpi_str, &a); - /* DHCPV6 */ init_dhcpv6_dissector(ndpi_str, &a); @@ -4414,12 +4384,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* cpha */ init_cpha_dissector(ndpi_str, &a); - /* AIMINI */ - init_aimini_dissector(ndpi_str, &a); - - /* FLORENSIA */ - init_florensia_dissector(ndpi_str, &a); - /* MAPLESTORY */ init_maplestory_dissector(ndpi_str, &a); @@ -4429,9 +4393,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* WORLD_OF_KUNG_FU */ init_world_of_kung_fu_dissector(ndpi_str, &a); - /* FIESTA */ - init_fiesta_dissector(ndpi_str, &a); - /* CROSSIFIRE */ init_crossfire_dissector(ndpi_str, &a); diff --git a/src/lib/protocols/aimini.c b/src/lib/protocols/aimini.c deleted file mode 100644 index 4e08612c6..000000000 --- a/src/lib/protocols/aimini.c +++ /dev/null @@ -1,270 +0,0 @@ -/* - * aimini.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_AIMINI - -#include "ndpi_api.h" - - -static void ndpi_int_aimini_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ - /* ndpi_protocol_type_t protocol_type */) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AIMINI, NDPI_PROTOCOL_HTTP, NDPI_CONFIDENCE_DPI); -} - - -void ndpi_search_aimini(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search aimini\n"); - - if (packet->udp != NULL) { - if (flow->l4.udp.aimini_stage == 0) { - if (packet->payload_packet_len == 64 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010b) { - flow->l4.udp.aimini_stage = 1; - NDPI_LOG_DBG2(ndpi_struct, "stage = 1\n"); - return; - } - if (packet->payload_packet_len == 136 - && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165)) { - flow->l4.udp.aimini_stage = 4; - NDPI_LOG_DBG2(ndpi_struct, "stage = 4\n"); - return; - } - if (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101) { - flow->l4.udp.aimini_stage = 7; - NDPI_LOG_DBG2(ndpi_struct, "stage = 7\n"); - return; - } - if (packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) { - flow->l4.udp.aimini_stage = 10; - NDPI_LOG_DBG2(ndpi_struct, "stage = 10\n"); - return; - } - if (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) { - flow->l4.udp.aimini_stage = 13; - NDPI_LOG_DBG2(ndpi_struct, "stage = 13\n"); - return; - } - if (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) { - flow->l4.udp.aimini_stage = 16; - NDPI_LOG_DBG2(ndpi_struct, "stage = 16\n"); - return; - } - } - /* first packet chronology: (len, value): (64, 0x010b), (>100, 0x0115), (16, 0x010c || 64, 0x010b || 88, 0x0115), - * (16, 0x010c || 64, 0x010b || >100, 0x0115) - */ - if (flow->l4.udp.aimini_stage == 1 && packet->payload_packet_len > 100 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0115) { - flow->l4.udp.aimini_stage = 2; - NDPI_LOG_DBG2(ndpi_struct, "stage = 2\n"); - return; - } - if (flow->l4.udp.aimini_stage == 2 && - ((packet->payload_packet_len == 16 && get_u_int16_t(packet->payload, 0) == htons(0x010c)) || - (packet->payload_packet_len == 64 && get_u_int16_t(packet->payload, 0) == htons(0x010b)) || - (packet->payload_packet_len == 88 && get_u_int16_t(packet->payload, 0) == ntohs(0x0115)))) { - flow->l4.udp.aimini_stage = 3; - NDPI_LOG_DBG2(ndpi_struct, "stage = 3\n"); - return; - } - if (flow->l4.udp.aimini_stage == 3 - && ((packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) - || (packet->payload_packet_len == 64 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010b) - || (packet->payload_packet_len > 100 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0115))) { - NDPI_LOG_INFO(ndpi_struct, "found aimini (64, 0x010b), (>300, 0x0115), " - "(16, 0x010c || 64, 0x010b), (16, 0x010c || 64, 0x010b || >100, 0x0115).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* second packet chronology: (len, value): (136, 0x01c9), (136, 0x01c9),(136, 0x01c9),(136, 0x01c9 || 32, 0x01ca) */ - - if (flow->l4.udp.aimini_stage == 4 && packet->payload_packet_len == 136 - && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165)) { - flow->l4.udp.aimini_stage = 5; - NDPI_LOG_DBG2(ndpi_struct, "stage = 5\n"); - return; - } - if (flow->l4.udp.aimini_stage == 5 && (packet->payload_packet_len == 136 - && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 - || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165))) { - flow->l4.udp.aimini_stage = 6; - NDPI_LOG_DBG2(ndpi_struct, "stage = 6\n"); - return; - } - if (flow->l4.udp.aimini_stage == 6 && ((packet->payload_packet_len == 136 - && ((ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165) - || ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9)) - || (packet->payload_packet_len == 32 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (136, 0x01c9), (136, 0x01c9)," "(136, 0x01c9),(136, 0x01c9 || 32, 0x01ca).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* third packet chronology: (len, value): (88, 0x0101), (88, 0x0101),(88, 0x0101),(88, 0x0101) */ - - if (flow->l4.udp.aimini_stage == 7 && packet->payload_packet_len == 88 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101) { - flow->l4.udp.aimini_stage = 8; - NDPI_LOG_DBG2(ndpi_struct, "stage = 8\n"); - return; - } - if (flow->l4.udp.aimini_stage == 8 - && (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101)) { - flow->l4.udp.aimini_stage = 9; - NDPI_LOG_DBG2(ndpi_struct, "stage = 9\n"); - return; - } - if (flow->l4.udp.aimini_stage == 9 - && (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101)) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (88, 0x0101), (88, 0x0101)," "(88, 0x0101),(88, 0x0101).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* fourth packet chronology: (len, value): (104, 0x0102), (104, 0x0102), (104, 0x0102), (104, 0x0102) */ - - if (flow->l4.udp.aimini_stage == 10 && packet->payload_packet_len == 104 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) { - flow->l4.udp.aimini_stage = 11; - NDPI_LOG_DBG2(ndpi_struct, "stage = 11\n"); - return; - } - if (flow->l4.udp.aimini_stage == 11 - && (packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102)) { - flow->l4.udp.aimini_stage = 12; - NDPI_LOG_DBG2(ndpi_struct, "stage = 12\n"); - return; - } - if (flow->l4.udp.aimini_stage == 12 - && ((packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) - || (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (104, 0x0102), (104, 0x0102), " "(104, 0x0102), (104, 0x0102).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* fifth packet chronology (len, value): (32,0x01ca), (32,0x01ca), (32,0x01ca), ((136, 0x0166) || (32,0x01ca)) */ - - if (flow->l4.udp.aimini_stage == 13 && packet->payload_packet_len == 32 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) { - flow->l4.udp.aimini_stage = 14; - NDPI_LOG_DBG2(ndpi_struct, "stage = 14\n"); - return; - } - if (flow->l4.udp.aimini_stage == 14 - && ((packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) - || (packet->payload_packet_len == 136 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0166))) { - flow->l4.udp.aimini_stage = 15; - NDPI_LOG_DBG2(ndpi_struct, "stage = 15\n"); - return; - } - if (flow->l4.udp.aimini_stage == 15 - && ((packet->payload_packet_len == 136 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0166) - || (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (32,0x01ca), (32,0x01ca), (32,0x01ca), ((136, 0x0166)||(32,0x01ca)).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* sixth packet chronology (len, value): (16, 0x010c), (16, 0x010c), (16, 0x010c), (16, 0x010c) */ - - if (flow->l4.udp.aimini_stage == 16 && packet->payload_packet_len == 16 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) { - flow->l4.udp.aimini_stage = 17; - NDPI_LOG_DBG2(ndpi_struct, "stage = 17\n"); - return; - } - if (flow->l4.udp.aimini_stage == 17 - && (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c)) { - flow->l4.udp.aimini_stage = 18; - NDPI_LOG_DBG2(ndpi_struct, "stage = 18\n"); - return; - } - if (flow->l4.udp.aimini_stage == 18 - && (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c)) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (16, 0x010c), (16, 0x010c), (16, 0x010c), (16, 0x010c).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - } - - if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP) { - if (flow->http.method == NDPI_HTTP_METHOD_GET) - { - if ((LINE_STARTS(packet->http_url_name, "/download/") == 1 || - LINE_STARTS(packet->http_url_name, "/player/") == 1 || - LINE_STARTS(packet->http_url_name, "/webcounter/") == 1 || - LINE_STARTS(packet->http_url_name, "/play/") == 1 || - LINE_STARTS(packet->http_url_name, "/search/") == 1 || - LINE_STARTS(packet->http_url_name, "/member/") == 1) && - (LINE_ENDS(packet->host_line, ".aimini.net") == 1 || - LINE_ENDS(packet->host_line, ".aimini.com") == 1)) - { - NDPI_LOG_INFO(ndpi_struct, "found AIMINI HTTP traffic\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - } else if (flow->http.method == NDPI_HTTP_METHOD_POST) - { - if ((LINE_STARTS(packet->http_url_name, "/upload/") == 1 || - LINE_STARTS(packet->http_url_name, "/member/") == 1) && - (LINE_ENDS(packet->host_line, ".aimini.net") == 1 || - LINE_ENDS(packet->host_line, ".aimini.com") == 1)) - { - NDPI_LOG_INFO(ndpi_struct, "found AIMINI HTTP traffic\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - -} - - -void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Aimini", ndpi_struct, *id, - NDPI_PROTOCOL_AIMINI, - ndpi_search_aimini, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/applejuice.c b/src/lib/protocols/applejuice.c deleted file mode 100644 index a8d2e810c..000000000 --- a/src/lib/protocols/applejuice.c +++ /dev/null @@ -1,67 +0,0 @@ -/* - * applejuice.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_APPLEJUICE - -#include "ndpi_api.h" - - -static void ndpi_int_applejuice_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_APPLEJUICE, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_applejuice_tcp(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search applejuice\n"); - - if ((packet->payload_packet_len > 7) && (packet->payload[6] == 0x0d) - && (packet->payload[7] == 0x0a) - && (memcmp(packet->payload, "ajprot", 6) == 0)) { - NDPI_LOG_INFO(ndpi_struct, "found applejuice\n"); - ndpi_int_applejuice_add_connection(ndpi_struct, flow); - return; - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_applejuice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("AppleJuice", ndpi_struct, *id, - NDPI_PROTOCOL_APPLEJUICE, - ndpi_search_applejuice_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/ayiya.c b/src/lib/protocols/ayiya.c deleted file mode 100644 index 43b0c84c9..000000000 --- a/src/lib/protocols/ayiya.c +++ /dev/null @@ -1,87 +0,0 @@ -/* - * ayiya.c - * - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -/* - http://en.wikipedia.org/wiki/Anything_In_Anything - http://tools.ietf.org/html/rfc4891 -*/ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_AYIYA - -#include "ndpi_api.h" - -struct ayiya { - u_int8_t flags[3]; - u_int8_t next_header; - u_int32_t epoch; - u_int8_t identity[16]; - u_int8_t signature[20]; -}; - -void ndpi_search_ayiya(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search AYIYA\n"); - - if(packet->udp && (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN)) { - /* Ayiya is udp based, port 5072 */ - u_int16_t port_to_match = htons(5072); - - if ((packet->udp->source == port_to_match || packet->udp->dest == port_to_match) - /* check for ayiya new packet */ - && (packet->payload_packet_len > 44) - ) { - /* FINISH */ - struct ayiya *a = (struct ayiya*)packet->payload; - u_int32_t epoch = ntohl(a->epoch), now; - u_int32_t fiveyears = 86400 * 365 * 5; - - now = packet->current_time_ms; - - if((epoch >= (now - fiveyears)) && (epoch <= (now+86400 /* 1 day */))) { - NDPI_LOG_INFO(ndpi_struct, "found AYIYA\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AYIYA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); - } - - return; - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - } -} - - -void init_ayiya_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Ayiya", ndpi_struct, *id, - NDPI_PROTOCOL_AYIYA, - ndpi_search_ayiya, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/directconnect.c b/src/lib/protocols/directconnect.c deleted file mode 100644 index 01caf79ff..000000000 --- a/src/lib/protocols/directconnect.c +++ /dev/null @@ -1,207 +0,0 @@ -/* - * directconnect.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DIRECTCONNECT - -#include "ndpi_api.h" - - -//#define NDPI_DEBUG_DIRECTCONNECT -//#define NDPI_DIRECTCONNECT_PORT_DEBUG -//#define NDPI_DEBUG_DIRECTCONNECT_CONN - - -#define DIRECT_CONNECT_TYPE_HUB 0 -#define DIRECT_CONNECT_TYPE_PEER 1 -#define DIRECT_CONNECT_ADC_PEER 2 - -static u_int32_t skip_unknown_headers(const u_int8_t * payload, u_int32_t payload_len, u_int32_t pos) -{ - u_int32_t i = pos; - while (i < payload_len && payload[i] != 0x0a) - i++; - - i++; - return i; - -} - -static u_int16_t parse_binf_message(struct ndpi_detection_module_struct - *ndpi_struct, const u_int8_t * payload, uint32_t payload_len) -{ - u_int32_t i = 4; - u_int16_t bytes_read = 0; - u_int16_t ssl_port = 0; - while (i < payload_len) { - i = skip_unknown_headers(payload, payload_len, i); - if((i + 30) < payload_len) { - if(memcmp(&payload[i], "DCTM", 4) == 0) { - if(memcmp(&payload[i + 15], "ADCS", 4) == 0) { - ssl_port = ntohs_ndpi_bytestream_to_number(&payload[i + 25], 5, &bytes_read); - NDPI_LOG_DBG2(ndpi_struct, "DC ssl port parsed %d\n", ssl_port); - } - } - } else { - break; - } - - } - return ssl_port; -} - -static void ndpi_int_directconnect_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow, - const u_int8_t connection_type) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -static void ndpi_search_directconnect_tcp(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) { - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_DIRECTCONNECT) { - if(packet->payload_packet_len >= 40 && memcmp(&packet->payload[0], "BINF", 4) == 0) { - parse_binf_message(ndpi_struct, - &packet->payload[4], - packet->payload_packet_len - 4); - } - - return; - - } - - if(flow->directconnect_stage == 0) { - - if(packet->payload_packet_len > 6) { - if(packet->payload[0] == '$' - && packet->payload[packet->payload_packet_len - 1] == '|' - && (memcmp(&packet->payload[1], "Lock ", 5) == 0)) { - NDPI_LOG_DBG2(ndpi_struct, "maybe first dc connect to hub detected\n"); - flow->directconnect_stage = 1; - return; - } - if(packet->payload_packet_len > 7 - && packet->payload[0] == '$' - && packet->payload[packet->payload_packet_len - 1] == '|' - && (memcmp(&packet->payload[1], "MyNick ", 7) == 0)) { - NDPI_LOG_DBG2(ndpi_struct, "maybe first dc connect between peers detected\n"); - flow->directconnect_stage = 2; - return; - } - - } - if(packet->payload_packet_len >= 11) { - /* did not see this pattern in any trace */ - if(memcmp(&packet->payload[0], "HSUP ADBAS0", 11) == 0 - || memcmp(&packet->payload[0], "HSUP ADBASE", 11) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found DC HSUP ADBAS0 E\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); - return; - /* did not see this pattern in any trace */ - } else if(memcmp(&packet->payload[0], "CSUP ADBAS0", 11) == 0 || - memcmp(&packet->payload[0], "CSUP ADBASE", 11) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found DC CSUP ADBAS0 E\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_ADC_PEER); - return; - - } - - } - - } else if(flow->directconnect_stage == 1) { - if(packet->payload_packet_len >= 11) { - /* did not see this pattern in any trace */ - if(memcmp(&packet->payload[0], "HSUP ADBAS0", 11) == 0 - || memcmp(&packet->payload[0], "HSUP ADBASE", 11) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found DC HSUP ADBAS E in second packet\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); - return; - /* did not see this pattern in any trace */ - } else if(memcmp(&packet->payload[0], "CSUP ADBAS0", 11) == 0 || - memcmp(&packet->payload[0], "CSUP ADBASE", 11) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found DC HSUP ADBAS0 E in second packet\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_ADC_PEER); - return; - - } - } - /* get client hello answer or server message */ - if(packet->payload_packet_len > 6) { - if((packet->payload[0] == '$' || packet->payload[0] == '<') - && packet->payload[packet->payload_packet_len - 1] == '|') { - NDPI_LOG_INFO(ndpi_struct, "found DC second\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); - return; - } else { - NDPI_LOG_DBG2(ndpi_struct, "second dc not detected\n"); - } - - } - } else if(flow->directconnect_stage == 2) { - /* get client hello answer or server message */ - if(packet->payload_packet_len > 6) { - if(packet->payload[0] == '$' && packet->payload[packet->payload_packet_len - 1] == '|') { - NDPI_LOG_INFO(ndpi_struct, "found DC between peers\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_PEER); - return; - } else { - NDPI_LOG_DBG2(ndpi_struct, "second dc between peers not detected\n"); - } - } - - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - -} - -void ndpi_search_directconnect(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search DC\n"); - - if(packet->tcp != NULL) { - ndpi_search_directconnect_tcp(ndpi_struct, flow); - } -} - - -void init_directconnect_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("DirectConnect", ndpi_struct, *id, - NDPI_PROTOCOL_DIRECTCONNECT, - ndpi_search_directconnect, - /* TODO: UDP?*/ - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/directdownloadlink.c b/src/lib/protocols/directdownloadlink.c deleted file mode 100644 index 2821490b6..000000000 --- a/src/lib/protocols/directdownloadlink.c +++ /dev/null @@ -1,726 +0,0 @@ -/* - * directdownloadlink.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK - -#include "ndpi_api.h" - - -#ifdef NDPI_DEBUG_DIRECT_DOWNLOAD_LINK -//#define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_NOTHING_FOUND -//#define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_PACKET_TOO_SMALL -#define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_IP -#endif - -static void ndpi_int_direct_download_link_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - - - -/* - return 0 if nothing has been detected - return 1 if it is a megaupload packet -*/ -u_int8_t search_ddl_domains(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - u_int16_t filename_start = 0; - u_int16_t i = 1; - u_int16_t host_line_len_without_port; - - if (packet->payload_packet_len < 100) { - NDPI_LOG_DBG2(ndpi_struct, "DDL: Packet too small\n"); - goto end_ddl_nothing_found; - } - - - - if (memcmp(packet->payload, "POST ", 5) == 0) { - filename_start = 5; // POST - NDPI_LOG_DBG2(ndpi_struct, "DDL: POST FOUND\n"); - } else if (memcmp(packet->payload, "GET ", 4) == 0) { - filename_start = 4; // GET - NDPI_LOG_DBG2(ndpi_struct, "DDL: GET FOUND\n"); - } else { - goto end_ddl_nothing_found; - } - // parse packet - ndpi_parse_packet_line_info(ndpi_struct, flow); - - if (packet->host_line.ptr == NULL) { - NDPI_LOG_DBG2(ndpi_struct, "DDL: NO HOST FOUND\n"); - goto end_ddl_nothing_found; - } - - NDPI_LOG_DBG2(ndpi_struct, "DDL: Host: found\n"); - - if (packet->line[0].len < 9 + filename_start - || memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) != 0) { - NDPI_LOG_DBG2(ndpi_struct, "DDL: PACKET NOT HTTP CONFORM.\nXXX%.*sXXX\n", - 8, &packet->line[0].ptr[packet->line[0].len - 9]); - goto end_ddl_nothing_found; - } - // BEGIN OF AUTOMATED CODE GENERATION - // first see if we have ':port' at the end of the line - host_line_len_without_port = packet->host_line.len; - if (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] >= '0' - && packet->host_line.ptr[packet->host_line.len - i] <= '9') { - i = 2; - while (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] >= '0' - && packet->host_line.ptr[host_line_len_without_port - i] <= '9') { - NDPI_LOG_DBG2(ndpi_struct, "DDL: number found\n"); - i++; - } - if (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] == ':') { - NDPI_LOG_DBG2(ndpi_struct, "DDL: ':' found\n"); - host_line_len_without_port = host_line_len_without_port - i; - } - } - // then start automated code generation - - if (host_line_len_without_port >= 0 + 4 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 4], ".com", 4) == 0) { - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'd') { - if (host_line_len_without_port >= 5 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 6], "4share", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "fileclou", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 5 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "uploa", 5) == 0) { - if (host_line_len_without_port >= 10 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 6], "files-", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "mega", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "rapid", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "turbo", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'o') { - if (host_line_len_without_port >= 5 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 6], "badong", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "fileh", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'g') { - if (host_line_len_without_port >= 5 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 2], "in", 2) == 0) { - if (host_line_len_without_port >= 7 + 4 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 4], "shar", 4) == 0) { - if (host_line_len_without_port >= 11 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 11 - 4], "best", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 11 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 11 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 11 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 11 - 5], "quick", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 11 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 11 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 7 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 6], "upload", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 7 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 7 - 6 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "sharebi", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 8], "bigfilez", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'e') { - if (host_line_len_without_port >= 5 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 3], "fil", 3) == 0) { - if (host_line_len_without_port >= 8 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 2], "mo", 2) == 0) { - if (host_line_len_without_port >= 10 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "china", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 2 + 1 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 2 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 2 - 1] == '.')) { - goto end_ddl_found; - } - } - if (host_line_len_without_port >= 8 + 3 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 3], "hot", 3) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 6], "keepmy", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 1 - && packet->host_line.ptr[host_line_len_without_port - 8 - 1] == 'e') { - if (host_line_len_without_port >= 9 + 3 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 3], "sav", 3) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 3 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 9 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 5], "sendm", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 8 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 8], "sharebig", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 3 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 3], "up-", 3) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 1 && packet->host_line.ptr[host_line_len_without_port - 5 - 1] == 'r') { - if (host_line_len_without_port >= 6 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 3], "sha", 3) == 0) { - if (host_line_len_without_port >= 9 + 1 - && packet->host_line.ptr[host_line_len_without_port - 9 - 1] == '-') { - if (host_line_len_without_port >= 10 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "easy", - 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == - '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "fast", - 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == - '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "live", - 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == - '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 9 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "ftp2", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 9 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "gige", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 9 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "mega", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 9 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 5], "rapid", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 6 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 7], "mediafi", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 6 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 6 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "gigasiz", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "sendspac", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "sharebe", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 11 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 11], "sharebigfli", 11) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "fileserv", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 's') { - if (host_line_len_without_port >= 5 + 1 && packet->host_line.ptr[host_line_len_without_port - 5 - 1] == 'e') { - if (host_line_len_without_port >= 6 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 10], "depositfil", - 10) == 0 && (packet->host_line.ptr[host_line_len_without_port - 6 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 6 - 10 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 6 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 8], "megashar", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 6 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 6 - 8 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "fileupyour", 10) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 11 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 11], "filefactory", 11) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 11 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 11 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 't') { - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "filefron", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "uploadingi", 10) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 11 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 11], "yourfilehos", 11) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'r') { - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "mytempdi", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "uploadpowe", 10) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "mega.1280", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "filesonic", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 4 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 4], ".net", 4) == 0) { - if (host_line_len_without_port >= 4 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "badongo", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'd') { - if (host_line_len_without_port >= 5 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 3], "loa", 3) == 0) { - if (host_line_len_without_port >= 8 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "fast-", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 2], "up", 2) == 0) { - if (host_line_len_without_port >= 10 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "file-", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 6], "simple", - 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == - '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 3 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 3], "wii", 3) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 3 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "filesen", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 5], "filer", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "livedepot", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'e') { - if (host_line_len_without_port >= 5 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "mofil", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 17 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 17], "odsiebie.najlepsz", - 17) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 17 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 17 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "zshar", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'u') { - if (host_line_len_without_port >= 1 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 6], "data.h", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 1 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 1 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 1 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 2], ".r", 2) == 0) { - if (host_line_len_without_port >= 3 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 10], "filearchiv", 10) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 10 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 3 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 8], "filepost", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 3 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 7], "ifolder", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 11 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 11], "filehost.tv", 11) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 0 - 11 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 0 - 11 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 0 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 3], ".to", 3) == 0) { - if (host_line_len_without_port >= 3 + 1 && packet->host_line.ptr[host_line_len_without_port - 3 - 1] == 'e') { - if (host_line_len_without_port >= 4 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "filesaf", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 8], "sharebas", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 3 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 5], "files", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 3 + 1 && packet->host_line.ptr[host_line_len_without_port - 3 - 1] == 'd') { - if (host_line_len_without_port >= 4 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 3], "loa", 3) == 0) { - if (host_line_len_without_port >= 7 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 7], "file-up", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 7 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 7 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 3 + 1 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 3 - 1] == '.')) { - goto end_ddl_found; - } - } - if (host_line_len_without_port >= 4 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "uploade", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'z') { - if (host_line_len_without_port >= 1 + 14 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 14], "leteckaposta.c", 14) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 1 - 14 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 1 - 14 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 1 + 12 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 12], "yourfiles.bi", 12) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 1 - 12 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 1 - 12 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'n') { - if (host_line_len_without_port >= 1 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 9], "netload.i", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 1 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 1 - 9 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 1 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 2], ".v", 2) == 0) { - if (host_line_len_without_port >= 3 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 7], "4shared", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 3 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 9], "megashare", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 9 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 3], ".de", 3) == 0) { - if (host_line_len_without_port >= 3 + 5 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 5], "share", 5) == 0) { - if (host_line_len_without_port >= 8 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "rapid", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "ultra", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 3 + 15 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 15], "uploadyourfiles", 15) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 15 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 15 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 14 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 14], "speedshare.org", 14) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 0 - 14 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 0 - 14 - 1] == '.')) { - goto end_ddl_found; - } - // END OF AUTOMATED CODE GENERATION - - /* This is the hard way. We do this in order to find the download of services when other - domains are involved. This is not significant if ddl is blocked. --> then the link can not be started because - the ads are not viewed. But when ddl is only limited then the download is the important part. - */ - - end_ddl_nothing_found: - NDPI_LOG_DBG2(ndpi_struct, - "Nothing Found\n"); - return 0; - - end_ddl_found: - NDPI_LOG_INFO(ndpi_struct, "found DIRECT DOWNLOAD LINK\n"); - ndpi_int_direct_download_link_add_connection(ndpi_struct, flow); - return 1; -} - - -void ndpi_search_direct_download_link_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - /* do not detect again if it is already ddl */ - if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK) { - if (search_ddl_domains(ndpi_struct, flow) != 0) { - return; - } - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - } - -} - -void init_directdownloadlink_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Direct_Download_Link", ndpi_struct, *id, - NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, - ndpi_search_direct_download_link_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - diff --git a/src/lib/protocols/fasttrack.c b/src/lib/protocols/fasttrack.c deleted file mode 100644 index 88693967a..000000000 --- a/src/lib/protocols/fasttrack.c +++ /dev/null @@ -1,95 +0,0 @@ -/* - * fasttrack.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FASTTRACK - -#include "ndpi_api.h" - - -static void ndpi_int_fasttrack_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FASTTRACK, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - - -void ndpi_search_fasttrack_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search FASTTRACK\n"); - - if ( (packet->payload != NULL) - && (packet->payload_packet_len > 6) - && (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a)) { - NDPI_LOG_DBG2(ndpi_struct, "detected 0d0a at the end of the packet\n"); - - if (memcmp(packet->payload, "GIVE ", 5) == 0 && packet->payload_packet_len >= 8) { - u_int16_t i; - for (i = 5; i < (packet->payload_packet_len - 2); i++) { - // make shure that the argument to GIVE is numeric - if (!(packet->payload[i] >= '0' && packet->payload[i] <= '9')) { - goto exclude_fasttrack; - } - } - - NDPI_LOG_INFO(ndpi_struct, "found FASTTRACK\n"); - ndpi_int_fasttrack_add_connection(ndpi_struct, flow); - return; - } - - if (packet->payload_packet_len > 50 && memcmp(packet->payload, "GET /", 5) == 0) { - u_int16_t a = 0; - NDPI_LOG_DBG2(ndpi_struct, "detected GET /. \n"); - - ndpi_parse_packet_line_info(ndpi_struct, flow); - for (a = 0; a < packet->parsed_lines; a++) { - if ((packet->line[a].len > 17 && memcmp(packet->line[a].ptr, "X-Kazaa-Username: ", 18) == 0) - || (packet->line[a].len > 23 && memcmp(packet->line[a].ptr, "User-Agent: PeerEnabler/", 24) == 0)) { - NDPI_LOG_INFO(ndpi_struct, - "found FASTTRACK X-Kazaa-Username: || User-Agent: PeerEnabler/\n"); - ndpi_int_fasttrack_add_connection(ndpi_struct, flow); - return; - } - } - } - } - - exclude_fasttrack: - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_fasttrack_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("FastTrack", ndpi_struct, *id, - NDPI_PROTOCOL_FASTTRACK, - ndpi_search_fasttrack_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/fiesta.c b/src/lib/protocols/fiesta.c deleted file mode 100644 index 40e813bf1..000000000 --- a/src/lib/protocols/fiesta.c +++ /dev/null @@ -1,105 +0,0 @@ -/* - * fiesta.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FIESTA - -#include "ndpi_api.h" - - -static void ndpi_int_fiesta_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FIESTA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_fiesta(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search fiesta\n"); - - if (flow->l4.tcp.fiesta_stage == 0 && packet->payload_packet_len == 5 - && get_u_int16_t(packet->payload, 0) == ntohs(0x0407) - && (packet->payload[2] == 0x08) - && (packet->payload[4] == 0x00 || packet->payload[4] == 0x01)) { - - NDPI_LOG_DBG2(ndpi_struct, "maybe fiesta symmetric, first packet\n"); - flow->l4.tcp.fiesta_stage = 1 + packet->packet_direction; - goto maybe_fiesta; - } - if (flow->l4.tcp.fiesta_stage == (2 - packet->packet_direction) - && ((packet->payload_packet_len > 1 && packet->payload_packet_len - 1 == packet->payload[0]) - || (packet->payload_packet_len > 3 && packet->payload[0] == 0 - && get_l16(packet->payload, 1) == packet->payload_packet_len - 3))) { - NDPI_LOG_DBG2(ndpi_struct, "Maybe fiesta\n"); - goto maybe_fiesta; - } - if (flow->l4.tcp.fiesta_stage == (1 + packet->packet_direction)) { - if (packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x03050c01)) { - goto add_fiesta; - } - if (packet->payload_packet_len == 5 && get_u_int32_t(packet->payload, 0) == htonl(0x04030c01) - && packet->payload[4] == 0) { - goto add_fiesta; - } - if (packet->payload_packet_len == 6 && get_u_int32_t(packet->payload, 0) == htonl(0x050e080b)) { - goto add_fiesta; - } - if (packet->payload_packet_len == 100 && packet->payload[0] == 0x63 && packet->payload[61] == 0x52 - && packet->payload[81] == 0x5a && get_u_int16_t(packet->payload, 1) == htons(0x3810) - && get_u_int16_t(packet->payload, 62) == htons(0x6f75)) { - goto add_fiesta; - } - if (packet->payload_packet_len > 3 && packet->payload_packet_len - 1 == packet->payload[0] - && get_u_int16_t(packet->payload, 1) == htons(0x140c)) { - goto add_fiesta; - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - return; - - maybe_fiesta: - NDPI_LOG_DBG2(ndpi_struct, "Stage is set to %d\n", flow->l4.tcp.fiesta_stage); - return; - - add_fiesta: - NDPI_LOG_INFO(ndpi_struct, "found fiesta\n"); - ndpi_int_fiesta_add_connection(ndpi_struct, flow); - return; -} - - -void init_fiesta_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Fiesta", ndpi_struct, *id, - NDPI_PROTOCOL_FIESTA, - ndpi_search_fiesta, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/florensia.c b/src/lib/protocols/florensia.c deleted file mode 100644 index 13bbe7d4d..000000000 --- a/src/lib/protocols/florensia.c +++ /dev/null @@ -1,130 +0,0 @@ -/* - * florensia.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FLORENSIA - -#include "ndpi_api.h" - - -static void ndpi_florensia_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FLORENSIA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_florensia(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search florensia\n"); - - if (packet->tcp != NULL) { - if (packet->payload_packet_len == 5 && get_l16(packet->payload, 0) == packet->payload_packet_len - && packet->payload[2] == 0x65 && packet->payload[4] == 0xff) { - if (flow->florensia_stage == 1) { - NDPI_LOG_INFO(ndpi_struct, "found florensia\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - if (packet->payload_packet_len > 8 && get_l16(packet->payload, 0) == packet->payload_packet_len - && get_u_int16_t(packet->payload, 2) == htons(0x0201) && get_u_int32_t(packet->payload, 4) == htonl(0xFFFFFFFF)) { - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - if (packet->payload_packet_len == 406 && get_l16(packet->payload, 0) == packet->payload_packet_len - && packet->payload[2] == 0x63) { - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - if (packet->payload_packet_len == 12 && get_l16(packet->payload, 0) == packet->payload_packet_len - && get_u_int16_t(packet->payload, 2) == htons(0x0301)) { - if (flow->florensia_stage == 1) { - NDPI_LOG_INFO(ndpi_struct, "found florensia\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - - if (flow->florensia_stage == 1) { - if (packet->payload_packet_len == 8 && get_l16(packet->payload, 0) == packet->payload_packet_len - && get_u_int16_t(packet->payload, 2) == htons(0x0302) && get_u_int32_t(packet->payload, 4) == htonl(0xFFFFFFFF)) { - NDPI_LOG_INFO(ndpi_struct, "found florensia asymmetrically\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - if (packet->payload_packet_len == 24 && get_l16(packet->payload, 0) == packet->payload_packet_len - && get_u_int16_t(packet->payload, 2) == htons(0x0202) - && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) == htonl(0xFFFFFFFF)) { - NDPI_LOG_INFO(ndpi_struct, "found florensia\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - if (flow->packet_counter < 10 && packet->payload_packet_len >=2 && - get_l16(packet->payload, 0) == packet->payload_packet_len) { - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia\n"); - return; - } - } - } - - if (packet->udp != NULL) { - if (flow->florensia_stage == 0 && packet->payload_packet_len == 6 - && get_u_int16_t(packet->payload, 0) == ntohs(0x0503) && get_u_int32_t(packet->payload, 2) == htonl(0xFFFF0000)) { - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - if (flow->florensia_stage == 1 && packet->payload_packet_len == 8 - && get_u_int16_t(packet->payload, 0) == ntohs(0x0500) && get_u_int16_t(packet->payload, 4) == htons(0x4191)) { - NDPI_LOG_INFO(ndpi_struct, "found florensia\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_florensia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Florensia", ndpi_struct, *id, - NDPI_PROTOCOL_FLORENSIA, - ndpi_search_florensia, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/openft.c b/src/lib/protocols/openft.c deleted file mode 100644 index c9bfd4ea8..000000000 --- a/src/lib/protocols/openft.c +++ /dev/null @@ -1,67 +0,0 @@ -/* - * openft.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_OPENFT - -#include "ndpi_api.h" - -static void ndpi_int_openft_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OPENFT, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_openft_tcp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 5 && memcmp(packet->payload, "GET /", 5) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "HTTP packet detected\n"); - ndpi_parse_packet_line_info(ndpi_struct, flow); - if (packet->parsed_lines >= 2 - && packet->line[1].len > 13 && memcmp(packet->line[1].ptr, "X-OpenftAlias:", 14) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found OpenFT\n"); - ndpi_int_openft_add_connection(ndpi_struct, flow); - return; - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_openft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("OpenFT", ndpi_struct, *id, - NDPI_PROTOCOL_OPENFT, - ndpi_search_openft_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/ppstream.c b/src/lib/protocols/ppstream.c index d54a994af..a1c68e404 100644 --- a/src/lib/protocols/ppstream.c +++ b/src/lib/protocols/ppstream.c @@ -228,7 +228,7 @@ void init_ppstream_dissector(struct ndpi_detection_module_struct *ndpi_struct, u ndpi_set_bitmask_protocol_detection("PPStream", ndpi_struct, *id, NDPI_PROTOCOL_PPSTREAM, ndpi_search_ppstream, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); diff --git a/src/lib/protocols/shoutcast.c b/src/lib/protocols/shoutcast.c deleted file mode 100644 index 155e2cea7..000000000 --- a/src/lib/protocols/shoutcast.c +++ /dev/null @@ -1,118 +0,0 @@ -/* - * shoutcast.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SHOUTCAST - -#include "ndpi_api.h" - -static void ndpi_int_shoutcast_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SHOUTCAST, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_shoutcast_tcp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - - NDPI_LOG_DBG(ndpi_struct, "search shoutcast\n"); - - if (flow->packet_counter == 1) { -/* this case in paul_upload_oddcast_002.pcap */ - if (packet->payload_packet_len >= 6 - && packet->payload_packet_len < 80 && memcmp(packet->payload, "123456", 6) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "Shoutcast stage 1, \"123456\"\n"); - return; - } - if (flow->packet_counter < 3 - && flow->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP - ) { - NDPI_LOG_DBG2(ndpi_struct, - "http detected, need next packet for shoutcast detection.\n"); - if (packet->payload_packet_len > 4 - && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) != htonl(0x0d0a0d0a)) { - NDPI_LOG_DBG2(ndpi_struct, "segmented packet found\n"); - flow->l4.tcp.shoutcast_stage = 1 + packet->packet_direction; - } - return; - } - - - /* else - goto exclude_shoutcast; */ - - } - /* evtl. für asym detection noch User-Agent:Winamp dazunehmen. */ - if (packet->payload_packet_len > 11 && memcmp(packet->payload, "ICY 200 OK\x0d\x0a", 12) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found shoutcast by ICY 200 OK\n"); - ndpi_int_shoutcast_add_connection(ndpi_struct, flow); - return; - } - if (flow->l4.tcp.shoutcast_stage == 1 + packet->packet_direction - && flow->packet_direction_counter[packet->packet_direction] < 5) { - return; - } - - if (flow->packet_counter == 2) { - if (packet->payload_packet_len == 2 && memcmp(packet->payload, "\x0d\x0a", 2) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "Shoutcast stage 1 continuation\n"); - return; - } else if (packet->payload_packet_len > 3 && memcmp(&packet->payload[0], "OK2", 3) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "Shoutcast stage 2, OK2 found\n"); - return; - } else - goto exclude_shoutcast; - } else if (flow->packet_counter == 3 || flow->packet_counter == 4) { - if (packet->payload_packet_len > 3 && memcmp(&packet->payload[0], "OK2", 3) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "Shoutcast stage 2, OK2 found\n"); - return; - } else if (packet->payload_packet_len > 4 && memcmp(&packet->payload[0], "icy-", 4) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found Shoutcast\n"); - ndpi_int_shoutcast_add_connection(ndpi_struct, flow); - return; - } else - goto exclude_shoutcast; - } - - exclude_shoutcast: - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_shoutcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("ShoutCast", ndpi_struct, *id, - NDPI_PROTOCOL_SHOUTCAST, - ndpi_search_shoutcast_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - diff --git a/src/lib/protocols/sopcast.c b/src/lib/protocols/sopcast.c deleted file mode 100644 index b903538cc..000000000 --- a/src/lib/protocols/sopcast.c +++ /dev/null @@ -1,223 +0,0 @@ -/* - * sopcast.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SOPCAST - -#include "ndpi_api.h" - - -static void ndpi_int_sopcast_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOPCAST, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -/** - * this function checks for sopcast tcp pattern - * - * NOTE: if you add more patterns please keep the number of if levels - * low, it is already complex enough - */ - -#if !defined(WIN32) -static inline -#elif defined(MINGW_GCC) -__mingw_forceinline static -#else -__forceinline static -#endif -u_int8_t ndpi_int_is_sopcast_tcp(const u_int8_t * payload, const u_int16_t payload_len) -{ - if (payload[2] != payload[3] - 4 && payload[2] != payload[3] + 4) - return 0; - - if (payload[2] != payload[4] - 1 && payload[2] != payload[4] + 1) - return 0; - - if (payload[25] != payload[25 + 16 - 1] + 1 && payload[25] != payload[25 + 16 - 1] - 1) { - - if (payload[3] != payload[25] && - payload[3] != payload[25] - 4 && payload[3] != payload[25] + 4 && payload[3] != payload[25] - 21) { - return 0; - } - } - - if (payload[4] != payload[28] || - payload[28] != payload[30] || - payload[30] != payload[31] || - get_u_int16_t(payload, 30) != get_u_int16_t(payload, 32) || get_u_int16_t(payload, 32) != get_u_int16_t(payload, 34)) { - - if ((payload[2] != payload[5] - 1 && payload[2] != payload[5] + 1) || - payload[2] != payload[25] || - payload[4] != payload[28] || - payload[4] != payload[31] || - payload[4] != payload[32] || - payload[4] != payload[33] || - payload[4] != payload[34] || - payload[4] != payload[35] || payload[4] != payload[30] || payload[2] != payload[36]) { - return 0; - } - } - - if (payload[42] != payload[53]) - return 0; - - if (payload[45] != payload[46] + 1 && payload[45] != payload[46] - 1) - return 0; - - if (payload[45] != payload[49] || payload[46] != payload[50] || payload[47] != payload[51]) - return 0; - - return 1; -} - -static void ndpi_search_sopcast_tcp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (flow->packet_counter == 1 && packet->payload_packet_len == 54 && get_u_int16_t(packet->payload, 0) == ntohs(0x0036)) { - if (ndpi_int_is_sopcast_tcp(packet->payload, packet->payload_packet_len)) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast TCP \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - -} - -static void ndpi_search_sopcast_udp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search sopcast. \n"); - - if (packet->payload_packet_len == 52 && packet->payload[0] == 0xff - && packet->payload[1] == 0xff && packet->payload[2] == 0x01 - && packet->payload[8] == 0x02 && packet->payload[9] == 0xff - && packet->payload[10] == 0x00 && packet->payload[11] == 0x2c - && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if I. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - if ((packet->payload_packet_len == 80 || packet->payload_packet_len == 28 || packet->payload_packet_len == 94) - && packet->payload[0] == 0x00 && (packet->payload[2] == 0x02 || packet->payload[2] == 0x01) - && packet->payload[8] == 0x01 && packet->payload[9] == 0xff - && packet->payload[10] == 0x00 && packet->payload[11] == 0x14 - && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if II. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - /* this case has been seen once. Please remove this comment, if you see it another time */ - if (packet->payload_packet_len == 60 && packet->payload[0] == 0x00 - && packet->payload[2] == 0x01 - && packet->payload[8] == 0x03 && packet->payload[9] == 0xff - && packet->payload[10] == 0x00 && packet->payload[11] == 0x34 - && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if III. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - if (packet->payload_packet_len == 42 && packet->payload[0] == 0x00 - && packet->payload[1] == 0x02 && packet->payload[2] == 0x01 - && packet->payload[3] == 0x07 && packet->payload[4] == 0x03 - && packet->payload[8] == 0x06 - && packet->payload[9] == 0x01 && packet->payload[10] == 0x00 - && packet->payload[11] == 0x22 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if IV. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - if (packet->payload_packet_len == 28 && packet->payload[0] == 0x00 - && packet->payload[1] == 0x0c && packet->payload[2] == 0x01 - && packet->payload[3] == 0x07 && packet->payload[4] == 0x00 - && packet->payload[8] == 0x01 - && packet->payload[9] == 0x01 && packet->payload[10] == 0x00 - && packet->payload[11] == 0x14 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if V. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - /* this case has been seen once. Please remove this comment, if you see it another time */ - if (packet->payload_packet_len == 286 && packet->payload[0] == 0x00 - && packet->payload[1] == 0x02 && packet->payload[2] == 0x01 - && packet->payload[3] == 0x07 && packet->payload[4] == 0x03 - && packet->payload[8] == 0x06 - && packet->payload[9] == 0x01 && packet->payload[10] == 0x01 - && packet->payload[11] == 0x16 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if VI. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - if (packet->payload_packet_len == 76 && packet->payload[0] == 0xff - && packet->payload[1] == 0xff && packet->payload[2] == 0x01 - && packet->payload[8] == 0x0c && packet->payload[9] == 0xff - && packet->payload[10] == 0x00 && packet->payload[11] == 0x44 - && packet->payload[16] == 0x01 && packet->payload[15] == 0x01 - && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if VII. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - - /* Attention please: no asymmetric detection necessary. This detection works asymmetrically as well. */ - - NDPI_LOG_DBG(ndpi_struct, "exclude sopcast. \n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOPCAST); - -} - -void ndpi_search_sopcast(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->udp != NULL) - ndpi_search_sopcast_udp(ndpi_struct, flow); - if (packet->tcp != NULL) - ndpi_search_sopcast_tcp(ndpi_struct, flow); - -} - - -void init_sopcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Sopcast", ndpi_struct, *id, - NDPI_PROTOCOL_SOPCAST, - ndpi_search_sopcast, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - diff --git a/src/lib/protocols/stealthnet.c b/src/lib/protocols/stealthnet.c deleted file mode 100644 index f4099e194..000000000 --- a/src/lib/protocols/stealthnet.c +++ /dev/null @@ -1,69 +0,0 @@ -/* - * stealthnet.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_STEALTHNET - -#include "ndpi_api.h" - - -static void ndpi_int_stealthnet_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STEALTHNET, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_stealthnet(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search stealthnet\n"); - - if (packet->payload_packet_len > 40 - && memcmp(packet->payload, "LARS REGENSBURGER'S FILE SHARING PROTOCOL", 41) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found stealthnet\n"); - ndpi_int_stealthnet_add_connection(ndpi_struct, flow); - return; - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - -} - - -void init_stealthnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - - ndpi_set_bitmask_protocol_detection("Stealthnet", ndpi_struct, *id, - NDPI_PROTOCOL_STEALTHNET, - ndpi_search_stealthnet, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - diff --git a/src/lib/protocols/thunder.c b/src/lib/protocols/thunder.c deleted file mode 100644 index 258e7750f..000000000 --- a/src/lib/protocols/thunder.c +++ /dev/null @@ -1,193 +0,0 @@ -/* - * thunder.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_THUNDER - -#include "ndpi_api.h" - - -static void ndpi_int_thunder_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow/* , ndpi_protocol_type_t protocol_type */) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_THUNDER, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - - - -#if !defined(WIN32) -static inline -#elif defined(MINGW_GCC) -__mingw_forceinline static -#else -__forceinline static -#endif -void ndpi_int_search_thunder_udp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30 - && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) { - if (flow->thunder_stage == 3) { - NDPI_LOG_INFO(ndpi_struct, "found THUNDER udp\n"); - ndpi_int_thunder_add_connection(ndpi_struct, flow); - return; - } - - flow->thunder_stage++; - NDPI_LOG_DBG2(ndpi_struct, - "maybe thunder udp packet detected, stage increased to %u\n", flow->thunder_stage); - return; - } - - NDPI_LOG_DBG(ndpi_struct, "excluding thunder udp at stage %u\n", flow->thunder_stage); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER); -} - - -#if !defined(WIN32) -static inline -#elif defined(MINGW_GCC) -__mingw_forceinline static -#else -__forceinline static -#endif -void ndpi_int_search_thunder_tcp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30 - && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) { - if (flow->thunder_stage == 3) { - NDPI_LOG_INFO(ndpi_struct, "found THUNDER tcp\n"); - ndpi_int_thunder_add_connection(ndpi_struct, flow); - return; - } - - flow->thunder_stage++; - NDPI_LOG_DBG2(ndpi_struct, - "maybe thunder tcp packet detected, stage increased to %u\n", flow->thunder_stage); - return; - } - - if (flow->thunder_stage == 0 && packet->payload_packet_len > 17 - && memcmp(packet->payload, "POST / HTTP/1.1\r\n", 17) == 0) { - ndpi_parse_packet_line_info(ndpi_struct, flow); - - NDPI_LOG_DBG2(ndpi_struct, - "maybe thunder http POST packet detected, parsed packet lines: %u, empty line set %u (at: %u)\n", - packet->parsed_lines, packet->empty_line_position_set, packet->empty_line_position); - - if (packet->empty_line_position_set != 0 && - packet->content_line.ptr != NULL && - packet->content_line.len == 24 && - memcmp(packet->content_line.ptr, "application/octet-stream", - 24) == 0 && packet->empty_line_position_set < (packet->payload_packet_len - 8) - && packet->payload_packet_len > (packet->empty_line_position + 5) - && packet->payload[packet->empty_line_position + 2] >= 0x30 - && packet->payload[packet->empty_line_position + 2] < 0x40 - && packet->payload[packet->empty_line_position + 3] == 0x00 - && packet->payload[packet->empty_line_position + 4] == 0x00 - && packet->payload[packet->empty_line_position + 5] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, - "found thunder http POST packet application does match\n"); - ndpi_int_thunder_add_connection(ndpi_struct, flow); - return; - } - } - NDPI_LOG_DBG(ndpi_struct, "excluding thunder tcp at stage %u\n", flow->thunder_stage); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER); -} - - -#if !defined(WIN32) -static inline -#elif defined(MINGW_GCC) -__mingw_forceinline static -#else -__forceinline static -#endif -void ndpi_int_search_thunder_http(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 5 - && memcmp(packet->payload, "GET /", 5) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "HTTP packet detected\n"); - ndpi_parse_packet_line_info(ndpi_struct, flow); - - if (packet->parsed_lines > 7 - && packet->parsed_lines < 11 - && packet->line[1].len > 10 - && memcmp(packet->line[1].ptr, "Accept: */*", 11) == 0 - && packet->line[2].len > 22 - && memcmp(packet->line[2].ptr, "Cache-Control: no-cache", - 23) == 0 && packet->line[3].len > 16 - && memcmp(packet->line[3].ptr, "Connection: close", 17) == 0 - && packet->line[4].len > 6 - && memcmp(packet->line[4].ptr, "Host: ", 6) == 0 - && packet->line[5].len > 15 - && memcmp(packet->line[5].ptr, "Pragma: no-cache", 16) == 0 - && packet->user_agent_line.ptr != NULL - && packet->user_agent_line.len > 49 - && memcmp(packet->user_agent_line.ptr, - "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)", 50) == 0) { - NDPI_LOG_INFO(ndpi_struct, - "found thunder HTTP download detected\n"); - ndpi_int_thunder_add_connection(ndpi_struct, flow); - } - } -} - -void ndpi_search_thunder(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - // - //struct ndpi_id_struct *src = flow->src; - //struct ndpi_id_struct *dst = flow->dst; - - if (packet->tcp != NULL) { - ndpi_int_search_thunder_http(ndpi_struct, flow); - ndpi_int_search_thunder_tcp(ndpi_struct, flow); - } else if (packet->udp != NULL) { - ndpi_int_search_thunder_udp(ndpi_struct, flow); - } -} - - -void init_thunder_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Thunder", ndpi_struct, *id, - NDPI_PROTOCOL_THUNDER, - ndpi_search_thunder, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/tests/pcap/aimini-http.pcap b/tests/pcap/aimini-http.pcap Binary files differdeleted file mode 100644 index e844cd094..000000000 --- a/tests/pcap/aimini-http.pcap +++ /dev/null diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out index c07d774de..7947eb95a 100644 --- a/tests/result/1kxun.pcap.out +++ b/tests/result/1kxun.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow) Confidence Unknown : 14 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 177 (flows) -Num dissector calls: 4824 (24.49 diss/flow) +Num dissector calls: 4395 (22.31 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/45/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/443-chrome.pcap.out b/tests/result/443-chrome.pcap.out index 6562ef8d5..02479494d 100644 --- a/tests/result/443-chrome.pcap.out +++ b/tests/result/443-chrome.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 129 (129.00 diss/flow) +Num dissector calls: 116 (116.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/443-opvn.pcap.out b/tests/result/443-opvn.pcap.out index e6f8ccbc6..1495a2c69 100644 --- a/tests/result/443-opvn.pcap.out +++ b/tests/result/443-opvn.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 130 (130.00 diss/flow) +Num dissector calls: 117 (117.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/4in4tunnel.pcap.out b/tests/result/4in4tunnel.pcap.out index 3391c8797..f5caa2ccc 100644 --- a/tests/result/4in4tunnel.pcap.out +++ b/tests/result/4in4tunnel.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 5 (5.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 178 (178.00 diss/flow) +Num dissector calls: 173 (173.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/6in4tunnel.pcap.out b/tests/result/6in4tunnel.pcap.out index b7ddc71fa..663da9a8b 100644 --- a/tests/result/6in4tunnel.pcap.out +++ b/tests/result/6in4tunnel.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 29 (5.80 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) DPI Packets (other): 3 (1.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 28 (2.80 diss/flow) +Num dissector calls: 25 (2.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/6in6tunnel.pcap.out b/tests/result/6in6tunnel.pcap.out index b45a11252..a746abada 100644 --- a/tests/result/6in6tunnel.pcap.out +++ b/tests/result/6in6tunnel.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 124 (124.00 diss/flow) +Num dissector calls: 119 (119.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/EAQ.pcap.out b/tests/result/EAQ.pcap.out index ee07089fb..64cefa32d 100644 --- a/tests/result/EAQ.pcap.out +++ b/tests/result/EAQ.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) DPI Packets (UDP): 116 (4.00 pkts/flow) Confidence DPI : 31 (flows) -Num dissector calls: 4364 (140.77 diss/flow) +Num dissector calls: 4213 (135.90 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/KakaoTalk_chat.pcap.out b/tests/result/KakaoTalk_chat.pcap.out index 8035fe770..4406ae624 100644 --- a/tests/result/KakaoTalk_chat.pcap.out +++ b/tests/result/KakaoTalk_chat.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 5 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 651 (17.13 diss/flow) +Num dissector calls: 599 (15.76 diss/flow) LRU cache ookla: 0/1/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out index 09dd19100..0da95b68c 100644 --- a/tests/result/KakaoTalk_talk.pcap.out +++ b/tests/result/KakaoTalk_talk.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 6 (1.20 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 8 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 890 (44.50 diss/flow) +Num dissector calls: 818 (40.90 diss/flow) LRU cache ookla: 0/2/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/Oscar.pcap.out b/tests/result/Oscar.pcap.out index 56d06cc22..0b87499ae 100644 --- a/tests/result/Oscar.pcap.out +++ b/tests/result/Oscar.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 360 (360.00 diss/flow) +Num dissector calls: 330 (330.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/WebattackRCE.pcap.out b/tests/result/WebattackRCE.pcap.out index 00183ca2f..6c1769d03 100644 --- a/tests/result/WebattackRCE.pcap.out +++ b/tests/result/WebattackRCE.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 797 DPI Packets (TCP): 797 (1.00 pkts/flow) Confidence DPI : 797 (flows) -Num dissector calls: 11955 (15.00 diss/flow) +Num dissector calls: 9564 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/WebattackSQLinj.pcap.out b/tests/result/WebattackSQLinj.pcap.out index a7b2595de..027fbe8d9 100644 --- a/tests/result/WebattackSQLinj.pcap.out +++ b/tests/result/WebattackSQLinj.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 54 (6.00 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 135 (15.00 diss/flow) +Num dissector calls: 108 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/WebattackXSS.pcap.out b/tests/result/WebattackXSS.pcap.out index 907e68670..4d2cb78e9 100644 --- a/tests/result/WebattackXSS.pcap.out +++ b/tests/result/WebattackXSS.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 639 DPI Packets (TCP): 3972 (6.01 pkts/flow) Confidence Match by port : 639 (flows) Confidence DPI : 22 (flows) -Num dissector calls: 330 (0.50 diss/flow) +Num dissector calls: 264 (0.40 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/activision.pcap.out b/tests/result/activision.pcap.out index eb9deb0cc..716e0caf8 100644 --- a/tests/result/activision.pcap.out +++ b/tests/result/activision.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 404 (101.00 diss/flow) +Num dissector calls: 384 (96.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/agora-sd-rtn.pcap.out b/tests/result/agora-sd-rtn.pcap.out index 2dc65eb64..d791f1f52 100644 --- a/tests/result/agora-sd-rtn.pcap.out +++ b/tests/result/agora-sd-rtn.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 26 (1.00 pkts/flow) Confidence DPI : 26 (flows) -Num dissector calls: 2444 (94.00 diss/flow) +Num dissector calls: 2314 (89.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/aimini-http.pcap.out b/tests/result/aimini-http.pcap.out deleted file mode 100644 index 096bbfed3..000000000 --- a/tests/result/aimini-http.pcap.out +++ /dev/null @@ -1,28 +0,0 @@ -Guessed flow protos: 0 - -DPI Packets (TCP): 36 (9.00 pkts/flow) -Confidence DPI : 4 (flows) -Num dissector calls: 76 (19.00 diss/flow) -LRU cache ookla: 0/0/0 (insert/search/found) -LRU cache bittorrent: 0/0/0 (insert/search/found) -LRU cache zoom: 0/0/0 (insert/search/found) -LRU cache stun: 0/0/0 (insert/search/found) -LRU cache tls_cert: 0/0/0 (insert/search/found) -LRU cache mining: 0/0/0 (insert/search/found) -LRU cache msteams: 0/0/0 (insert/search/found) -LRU cache stun_zoom: 0/0/0 (insert/search/found) -Automa host: 4/0 (search/found) -Automa domain: 4/0 (search/found) -Automa tls cert: 0/0 (search/found) -Automa risk mask: 0/0 (search/found) -Automa common alpns: 0/0 (search/found) -Patricia risk mask: 16/0 (search/found) -Patricia risk: 0/0 (search/found) -Patricia protocols: 16/0 (search/found) - -Aimini 133 86722 4 - - 1 TCP 10.101.0.2:28501 <-> 10.102.0.2:80 [proto: 7.99/HTTP.Aimini][IP: 0/Unknown][ClearText][Confidence: DPI][cat: Download/7][38 pkts/36756 bytes <-> 34 pkts/28010 bytes][Goodput ratio: 94/93][0.00 sec][Hostname/SNI: www.aimini.net][bytes ratio: 0.135 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 1/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 967/824 1514/1514 664/699][URL: www.aimini.net/member/signup/][StatusCode: 200][User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17][PLAIN TEXT (GET /member/signup/ HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,4,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,83,0,0] - 2 TCP 10.101.0.2:28503 <-> 10.102.0.2:80 [proto: 7.99/HTTP.Aimini][IP: 0/Unknown][ClearText][Confidence: DPI][cat: Download/7][12 pkts/1920 bytes <-> 18 pkts/13384 bytes][Goodput ratio: 63/92][0.00 sec][Hostname/SNI: www.aimini.net][bytes ratio: -0.749 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 160/744 658/1514 223/696][URL: www.aimini.net/search/?q=pictures&sca=][StatusCode: 200][User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17][PLAIN TEXT (GET /search/)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,67,0,0] - 3 TCP 10.101.0.2:28502 <-> 10.102.0.2:80 [proto: 7.99/HTTP.Aimini][IP: 0/Unknown][ClearText][Confidence: DPI][cat: Download/7][10 pkts/2690 bytes <-> 8 pkts/1544 bytes][Goodput ratio: 78/70][0.00 sec][Hostname/SNI: www.aimini.com][bytes ratio: 0.271 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 269/193 585/339 255/132][URL: www.aimini.com/webcounter/w.php?___hm=.net_SignUp_&_lh_=http://www.aimini.net/member/signup/&__Refer_=http://www.aimini.net/][StatusCode: 200][User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17][PLAIN TEXT (GET /webcounter/w.php)][Plen Bins: 0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 4 TCP 10.101.0.2:28504 <-> 10.102.0.2:80 [proto: 7.99/HTTP.Aimini][IP: 0/Unknown][ClearText][Confidence: DPI][cat: Download/7][8 pkts/1556 bytes <-> 5 pkts/862 bytes][Goodput ratio: 70/66][0.00 sec][Hostname/SNI: www.aimini.com][bytes ratio: 0.287 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 194/172 596/339 232/136][URL: www.aimini.com/webcounter/w.php?___hm=.net_Search_&_lh_=http://www.aimini.net/search/?q=pictures&sca=&__Refer_=http://www.aimini.net/][StatusCode: 200][User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17][PLAIN TEXT (GET /webcounter/w.php)][Plen Bins: 0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/alexa-app.pcapng.out b/tests/result/alexa-app.pcapng.out index 3653e8723..de0e954d4 100644 --- a/tests/result/alexa-app.pcapng.out +++ b/tests/result/alexa-app.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow) DPI Packets (other): 6 (1.00 pkts/flow) Confidence Match by port : 14 (flows) Confidence DPI : 146 (flows) -Num dissector calls: 543 (3.39 diss/flow) +Num dissector calls: 473 (2.96 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/alicloud.pcap.out b/tests/result/alicloud.pcap.out index 42898e5eb..784c08309 100644 --- a/tests/result/alicloud.pcap.out +++ b/tests/result/alicloud.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 60 (4.00 pkts/flow) Confidence DPI : 15 (flows) -Num dissector calls: 1830 (122.00 diss/flow) +Num dissector calls: 1635 (109.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/amqp.pcap.out b/tests/result/amqp.pcap.out index f5ba7759d..715270f24 100644 --- a/tests/result/amqp.pcap.out +++ b/tests/result/amqp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (3.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 413 (137.67 diss/flow) +Num dissector calls: 371 (123.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/android.pcap.out b/tests/result/android.pcap.out index c3aa80b39..475fa0a7c 100644 --- a/tests/result/android.pcap.out +++ b/tests/result/android.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 4 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 60 (flows) -Num dissector calls: 280 (4.44 diss/flow) +Num dissector calls: 257 (4.08 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out index c3be0a420..74b455c6d 100644 --- a/tests/result/anyconnect-vpn.pcap.out +++ b/tests/result/anyconnect-vpn.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 61 (flows) -Num dissector calls: 939 (13.61 diss/flow) +Num dissector calls: 877 (12.71 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/avast.pcap.out b/tests/result/avast.pcap.out index 2aed40a3d..5c6e9d9f8 100644 --- a/tests/result/avast.pcap.out +++ b/tests/result/avast.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 40 (4.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 1230 (123.00 diss/flow) +Num dissector calls: 1100 (110.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/avast_securedns.pcapng.out b/tests/result/avast_securedns.pcapng.out index 5b0f63c05..547cb991a 100644 --- a/tests/result/avast_securedns.pcapng.out +++ b/tests/result/avast_securedns.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 39 (1.00 pkts/flow) Confidence DPI : 39 (flows) -Num dissector calls: 3549 (91.00 diss/flow) +Num dissector calls: 3354 (86.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/117/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/bittorrent.pcap.out b/tests/result/bittorrent.pcap.out index 8d03ee46a..3ac65446e 100644 --- a/tests/result/bittorrent.pcap.out +++ b/tests/result/bittorrent.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 24 (1.00 pkts/flow) Confidence DPI : 24 (flows) -Num dissector calls: 2114 (88.08 diss/flow) +Num dissector calls: 1828 (76.17 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 120/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/bittorrent_utp.pcap.out b/tests/result/bittorrent_utp.pcap.out index 6fa47e0ea..1b0be1fd3 100644 --- a/tests/result/bittorrent_utp.pcap.out +++ b/tests/result/bittorrent_utp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 81 (81.00 diss/flow) +Num dissector calls: 76 (76.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 5/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/bot.pcap.out b/tests/result/bot.pcap.out index 5e1bc143e..783dc6a41 100644 --- a/tests/result/bot.pcap.out +++ b/tests/result/bot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/cassandra.pcap.out b/tests/result/cassandra.pcap.out index 4c128f6e6..a8bd4e04b 100644 --- a/tests/result/cassandra.pcap.out +++ b/tests/result/cassandra.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 18 (9.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 362 (181.00 diss/flow) +Num dissector calls: 332 (166.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/cloudflare-warp.pcap.out b/tests/result/cloudflare-warp.pcap.out index 0cd0f0068..12075cb10 100644 --- a/tests/result/cloudflare-warp.pcap.out +++ b/tests/result/cloudflare-warp.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 188 (23.50 diss/flow) +Num dissector calls: 173 (21.62 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/coap_mqtt.pcap.out b/tests/result/coap_mqtt.pcap.out index fb346a0f5..5c9d7be1c 100644 --- a/tests/result/coap_mqtt.pcap.out +++ b/tests/result/coap_mqtt.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (1.75 pkts/flow) DPI Packets (UDP): 12 (1.00 pkts/flow) Confidence DPI : 16 (flows) -Num dissector calls: 352 (22.00 diss/flow) +Num dissector calls: 300 (18.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/collectd.pcap.out b/tests/result/collectd.pcap.out index 983a5355f..33fa52f54 100644 --- a/tests/result/collectd.pcap.out +++ b/tests/result/collectd.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 13 (1.62 pkts/flow) Confidence Match by port : 3 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 404 (50.50 diss/flow) +Num dissector calls: 389 (48.62 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/corba.pcap.out b/tests/result/corba.pcap.out index 9b2bba127..c0dcf2cc9 100644 --- a/tests/result/corba.pcap.out +++ b/tests/result/corba.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 228 (76.00 diss/flow) +Num dissector calls: 189 (63.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/crynet.pcap.out b/tests/result/crynet.pcap.out index 129b7256d..9da37d657 100644 --- a/tests/result/crynet.pcap.out +++ b/tests/result/crynet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 424 (106.00 diss/flow) +Num dissector calls: 404 (101.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dcerpc.pcap.out b/tests/result/dcerpc.pcap.out index b172bf1ce..d89f5c3e4 100644 --- a/tests/result/dcerpc.pcap.out +++ b/tests/result/dcerpc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 216 (54.00 diss/flow) +Num dissector calls: 196 (49.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dhcp-fuzz.pcapng.out b/tests/result/dhcp-fuzz.pcapng.out index b4099f936..c00dffeb8 100644 --- a/tests/result/dhcp-fuzz.pcapng.out +++ b/tests/result/dhcp-fuzz.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 109 (109.00 diss/flow) +Num dissector calls: 104 (104.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/discord.pcap.out b/tests/result/discord.pcap.out index a525f5cd7..b401a2914 100644 --- a/tests/result/discord.pcap.out +++ b/tests/result/discord.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) DPI Packets (UDP): 60 (1.82 pkts/flow) Confidence DPI : 34 (flows) -Num dissector calls: 4069 (119.68 diss/flow) +Num dissector calls: 3904 (114.82 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out b/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out index febea1f67..a6101325e 100644 --- a/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out +++ b/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 256 (1.04 pkts/flow) Confidence DPI : 245 (flows) -Num dissector calls: 21984 (89.73 diss/flow) +Num dissector calls: 20759 (84.73 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/513/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dnscrypt-v2.pcap.out b/tests/result/dnscrypt-v2.pcap.out index 06ba9367e..8545b48ad 100644 --- a/tests/result/dnscrypt-v2.pcap.out +++ b/tests/result/dnscrypt-v2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 6 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 378 (126.00 diss/flow) +Num dissector calls: 363 (121.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dnscrypt_skype_false_positive.pcapng.out b/tests/result/dnscrypt_skype_false_positive.pcapng.out index 9f1fc3382..69bcbfb59 100644 --- a/tests/result/dnscrypt_skype_false_positive.pcapng.out +++ b/tests/result/dnscrypt_skype_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 127 (127.00 diss/flow) +Num dissector calls: 122 (122.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/doq.pcapng.out b/tests/result/doq.pcapng.out index 09e71bd61..e4674ee61 100644 --- a/tests/result/doq.pcapng.out +++ b/tests/result/doq.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 65 (32.50 diss/flow) +Num dissector calls: 60 (30.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/doq_adguard.pcapng.out b/tests/result/doq_adguard.pcapng.out index 2680d038f..0aae97804 100644 --- a/tests/result/doq_adguard.pcapng.out +++ b/tests/result/doq_adguard.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 61 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/drda_db2.pcap.out b/tests/result/drda_db2.pcap.out index 74972d68d..463468ae6 100644 --- a/tests/result/drda_db2.pcap.out +++ b/tests/result/drda_db2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 89 (89.00 diss/flow) +Num dissector calls: 76 (76.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/elasticsearch.pcap.out b/tests/result/elasticsearch.pcap.out index ce7c4fa67..220a24486 100644 --- a/tests/result/elasticsearch.pcap.out +++ b/tests/result/elasticsearch.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 16 (2.29 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 896 (128.00 diss/flow) +Num dissector calls: 805 (115.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/emotet.pcap.out b/tests/result/emotet.pcap.out index b677fab60..3f32bb523 100644 --- a/tests/result/emotet.pcap.out +++ b/tests/result/emotet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 48 (8.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 206 (34.33 diss/flow) +Num dissector calls: 183 (30.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ethereum.pcap.out b/tests/result/ethereum.pcap.out index f6e9b61d4..0f365da67 100644 --- a/tests/result/ethereum.pcap.out +++ b/tests/result/ethereum.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 217 (3.88 pkts/flow) DPI Packets (UDP): 18 (1.00 pkts/flow) Confidence Match by port : 3 (flows) Confidence DPI : 71 (flows) -Num dissector calls: 593 (8.01 diss/flow) +Num dissector calls: 539 (7.28 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/exe_download.pcap.out b/tests/result/exe_download.pcap.out index c31e90f01..202d39f73 100644 --- a/tests/result/exe_download.pcap.out +++ b/tests/result/exe_download.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/exe_download_as_png.pcap.out b/tests/result/exe_download_as_png.pcap.out index 988402dc0..7d0eb973b 100644 --- a/tests/result/exe_download_as_png.pcap.out +++ b/tests/result/exe_download_as_png.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fastcgi.pcap.out b/tests/result/fastcgi.pcap.out index df0f4dc5c..e27ee2872 100644 --- a/tests/result/fastcgi.pcap.out +++ b/tests/result/fastcgi.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 160 (160.00 diss/flow) +Num dissector calls: 146 (146.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fix.pcap.out b/tests/result/fix.pcap.out index 036f11e53..a2cd932c9 100644 --- a/tests/result/fix.pcap.out +++ b/tests/result/fix.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (1.00 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1104 (92.00 diss/flow) +Num dissector calls: 948 (79.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fix2.pcap.out b/tests/result/fix2.pcap.out index f1711651d..7abddbc4f 100644 --- a/tests/result/fix2.pcap.out +++ b/tests/result/fix2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 184 (92.00 diss/flow) +Num dissector calls: 158 (79.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ftp-start-tls.pcap.out b/tests/result/ftp-start-tls.pcap.out index e7351527c..96d79a4e2 100644 --- a/tests/result/ftp-start-tls.pcap.out +++ b/tests/result/ftp-start-tls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 17 (17.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 159 (159.00 diss/flow) +Num dissector calls: 145 (145.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ftp.pcap.out b/tests/result/ftp.pcap.out index e6eeefaf8..1af6b3147 100644 --- a/tests/result/ftp.pcap.out +++ b/tests/result/ftp.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 49 (16.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 669 (223.00 diss/flow) +Num dissector calls: 612 (204.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ftp_failed.pcap.out b/tests/result/ftp_failed.pcap.out index 063713433..3537298e0 100644 --- a/tests/result/ftp_failed.pcap.out +++ b/tests/result/ftp_failed.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 159 (159.00 diss/flow) +Num dissector calls: 145 (145.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out index 131583b5d..3b1a8963c 100644 --- a/tests/result/fuzz-2006-06-26-2594.pcap.out +++ b/tests/result/fuzz-2006-06-26-2594.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 30 (flows) Confidence Match by port : 28 (flows) Confidence DPI : 193 (flows) -Num dissector calls: 5648 (22.50 diss/flow) +Num dissector calls: 5305 (21.14 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/129/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fuzz-2006-09-29-28586.pcap.out b/tests/result/fuzz-2006-09-29-28586.pcap.out index 7f2cb6d99..73f2ed1a9 100644 --- a/tests/result/fuzz-2006-09-29-28586.pcap.out +++ b/tests/result/fuzz-2006-09-29-28586.pcap.out @@ -5,7 +5,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 3 (flows) Confidence Match by port : 26 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 1043 (26.08 diss/flow) +Num dissector calls: 928 (23.20 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fuzz-2020-02-16-11740.pcap.out b/tests/result/fuzz-2020-02-16-11740.pcap.out index 3be32e644..59851d41f 100644 --- a/tests/result/fuzz-2020-02-16-11740.pcap.out +++ b/tests/result/fuzz-2020-02-16-11740.pcap.out @@ -5,7 +5,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Unknown : 19 (flows) Confidence Match by port : 3 (flows) Confidence DPI : 55 (flows) -Num dissector calls: 1805 (23.44 diss/flow) +Num dissector calls: 1725 (22.40 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/57/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fuzz-2021-10-13.pcap.out b/tests/result/fuzz-2021-10-13.pcap.out index 8f3509f57..92c94af44 100644 --- a/tests/result/fuzz-2021-10-13.pcap.out +++ b/tests/result/fuzz-2021-10-13.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 128 (128.00 diss/flow) +Num dissector calls: 115 (115.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/genshin-impact.pcap.out b/tests/result/genshin-impact.pcap.out index 6d2cc266b..45ae7b81f 100644 --- a/tests/result/genshin-impact.pcap.out +++ b/tests/result/genshin-impact.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 520 (86.67 diss/flow) +Num dissector calls: 471 (78.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/gnutella.pcap.out b/tests/result/gnutella.pcap.out index 66f19a91e..94d25b2c7 100644 --- a/tests/result/gnutella.pcap.out +++ b/tests/result/gnutella.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow) Confidence Unknown : 592 (flows) Confidence Match by port : 1 (flows) Confidence DPI : 167 (flows) -Num dissector calls: 67770 (89.17 diss/flow) +Num dissector calls: 65122 (85.69 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/1776/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/google_ssl.pcap.out b/tests/result/google_ssl.pcap.out index 2d0e41957..cf8dfa984 100644 --- a/tests/result/google_ssl.pcap.out +++ b/tests/result/google_ssl.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 28 (28.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 225 (225.00 diss/flow) +Num dissector calls: 206 (206.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/gtp_false_positive.pcapng.out b/tests/result/gtp_false_positive.pcapng.out index 675436f39..26a806c21 100644 --- a/tests/result/gtp_false_positive.pcapng.out +++ b/tests/result/gtp_false_positive.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 7 (2.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) -Num dissector calls: 400 (133.33 diss/flow) +Num dissector calls: 385 (128.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/gtp_prime.pcapng.out b/tests/result/gtp_prime.pcapng.out index 985fda54c..e919ff079 100644 --- a/tests/result/gtp_prime.pcapng.out +++ b/tests/result/gtp_prime.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 52 (52.00 diss/flow) +Num dissector calls: 47 (47.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/h323.pcap.out b/tests/result/h323.pcap.out index 9a0e28b48..697d98084 100644 --- a/tests/result/h323.pcap.out +++ b/tests/result/h323.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 131 (65.50 diss/flow) +Num dissector calls: 118 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/hangout.pcap.out b/tests/result/hangout.pcap.out index 95ee7343e..a46af7701 100644 --- a/tests/result/hangout.pcap.out +++ b/tests/result/hangout.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 74 (74.00 diss/flow) +Num dissector calls: 69 (69.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/hpvirtgrp.pcap.out b/tests/result/hpvirtgrp.pcap.out index f60d605f3..9c00c1dda 100644 --- a/tests/result/hpvirtgrp.pcap.out +++ b/tests/result/hpvirtgrp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 37 (4.11 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 1008 (112.00 diss/flow) +Num dissector calls: 891 (99.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/hsrp2_ipv6.pcapng.out b/tests/result/hsrp2_ipv6.pcapng.out index 4b40c2608..60b4c56b2 100644 --- a/tests/result/hsrp2_ipv6.pcapng.out +++ b/tests/result/hsrp2_ipv6.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 102 (51.00 diss/flow) +Num dissector calls: 92 (46.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http-crash-content-disposition.pcap.out b/tests/result/http-crash-content-disposition.pcap.out index 9c4c81da4..dfca9cff7 100644 --- a/tests/result/http-crash-content-disposition.pcap.out +++ b/tests/result/http-crash-content-disposition.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http-lines-split.pcap.out b/tests/result/http-lines-split.pcap.out index 492fa7ea6..5f504a7c1 100644 --- a/tests/result/http-lines-split.pcap.out +++ b/tests/result/http-lines-split.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http-manipulated.pcap.out b/tests/result/http-manipulated.pcap.out index d82e912ad..6f3bec10f 100644 --- a/tests/result/http-manipulated.pcap.out +++ b/tests/result/http-manipulated.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 30 (15.00 diss/flow) +Num dissector calls: 24 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http_auth.pcap.out b/tests/result/http_auth.pcap.out index e0258b66d..cb692fd24 100644 --- a/tests/result/http_auth.pcap.out +++ b/tests/result/http_auth.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http_guessed_host_and_guessed.pcapng.out b/tests/result/http_guessed_host_and_guessed.pcapng.out index 22ae008c8..da647d33f 100644 --- a/tests/result/http_guessed_host_and_guessed.pcapng.out +++ b/tests/result/http_guessed_host_and_guessed.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 129 (129.00 diss/flow) +Num dissector calls: 116 (116.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out index 552c91149..d7a7c81e0 100644 --- a/tests/result/http_ipv6.pcap.out +++ b/tests/result/http_ipv6.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (5.92 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence Match by port : 7 (flows) Confidence DPI : 8 (flows) -Num dissector calls: 147 (9.80 diss/flow) +Num dissector calls: 142 (9.47 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http_on_sip_port.pcap.out b/tests/result/http_on_sip_port.pcap.out index 453544e72..dcc7ccd1b 100644 --- a/tests/result/http_on_sip_port.pcap.out +++ b/tests/result/http_on_sip_port.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 16 (16.00 diss/flow) +Num dissector calls: 13 (13.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/i3d.pcap.out b/tests/result/i3d.pcap.out index f4ff7ed89..56bb959d8 100644 --- a/tests/result/i3d.pcap.out +++ b/tests/result/i3d.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 392 (98.00 diss/flow) +Num dissector calls: 372 (93.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/imap-starttls.pcap.out b/tests/result/imap-starttls.pcap.out index ce3f964a0..724ffa060 100644 --- a/tests/result/imap-starttls.pcap.out +++ b/tests/result/imap-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 19 (19.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 211 (211.00 diss/flow) +Num dissector calls: 195 (195.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/imap.pcap.out b/tests/result/imap.pcap.out index 995793594..a887c0463 100644 --- a/tests/result/imap.pcap.out +++ b/tests/result/imap.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 211 (211.00 diss/flow) +Num dissector calls: 195 (195.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/imo.pcap.out b/tests/result/imo.pcap.out index 284442798..10598135e 100644 --- a/tests/result/imo.pcap.out +++ b/tests/result/imo.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 7 (3.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 290 (145.00 diss/flow) +Num dissector calls: 280 (140.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out index 8272b481e..ad441bba8 100644 --- a/tests/result/instagram.pcap.out +++ b/tests/result/instagram.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 7 (flows) Confidence DPI : 30 (flows) -Num dissector calls: 1927 (50.71 diss/flow) +Num dissector calls: 1780 (46.84 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/15/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/iphone.pcap.out b/tests/result/iphone.pcap.out index c9c7b63f2..0354a9eea 100644 --- a/tests/result/iphone.pcap.out +++ b/tests/result/iphone.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 55 (1.77 pkts/flow) DPI Packets (other): 5 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 50 (flows) -Num dissector calls: 363 (7.12 diss/flow) +Num dissector calls: 344 (6.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ipp.pcap.out b/tests/result/ipp.pcap.out index f72b05502..2f6289423 100644 --- a/tests/result/ipp.pcap.out +++ b/tests/result/ipp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 21 (7.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 57 (19.00 diss/flow) +Num dissector calls: 48 (16.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/irc.pcap.out b/tests/result/irc.pcap.out index 4a38b51fb..f47cd8437 100644 --- a/tests/result/irc.pcap.out +++ b/tests/result/irc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 165 (165.00 diss/flow) +Num dissector calls: 151 (151.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/jabber.pcap.out b/tests/result/jabber.pcap.out index e40262529..2c10d5f2b 100644 --- a/tests/result/jabber.pcap.out +++ b/tests/result/jabber.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 74 (6.17 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1481 (123.42 diss/flow) +Num dissector calls: 1346 (112.17 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/kerberos.pcap.out b/tests/result/kerberos.pcap.out index ad0451509..b969ba6b7 100644 --- a/tests/result/kerberos.pcap.out +++ b/tests/result/kerberos.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (2.14 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 23 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 4096 (113.78 diss/flow) +Num dissector calls: 3741 (103.92 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/kismet.pcap.out b/tests/result/kismet.pcap.out index 7bd36e174..9dffaf72d 100644 --- a/tests/result/kismet.pcap.out +++ b/tests/result/kismet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 125 (125.00 diss/flow) +Num dissector calls: 112 (112.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/kontiki.pcap.out b/tests/result/kontiki.pcap.out index 8b5089fb6..5410162f9 100644 --- a/tests/result/kontiki.pcap.out +++ b/tests/result/kontiki.pcap.out @@ -4,7 +4,7 @@ DPI Packets (UDP): 6 (1.50 pkts/flow) DPI Packets (other): 4 (1.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 6 (flows) -Num dissector calls: 328 (41.00 diss/flow) +Num dissector calls: 312 (39.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/line.pcap.out b/tests/result/line.pcap.out index 6ab60aa43..fbb93a2cb 100644 --- a/tests/result/line.pcap.out +++ b/tests/result/line.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 13 (6.50 pkts/flow) DPI Packets (UDP): 40 (13.33 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 722 (144.40 diss/flow) +Num dissector calls: 707 (141.40 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/lisp_registration.pcap.out b/tests/result/lisp_registration.pcap.out index c8f398b07..18e64595f 100644 --- a/tests/result/lisp_registration.pcap.out +++ b/tests/result/lisp_registration.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 202 (50.50 diss/flow) +Num dissector calls: 176 (44.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/log4j-webapp-exploit.pcap.out b/tests/result/log4j-webapp-exploit.pcap.out index 7fdd7de7f..75ca0ee27 100644 --- a/tests/result/log4j-webapp-exploit.pcap.out +++ b/tests/result/log4j-webapp-exploit.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 63 (9.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 470 (67.14 diss/flow) +Num dissector calls: 416 (59.43 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/lru_ipv6_caches.pcapng.out b/tests/result/lru_ipv6_caches.pcapng.out index dca6f6d78..8d8ed3ca5 100644 --- a/tests/result/lru_ipv6_caches.pcapng.out +++ b/tests/result/lru_ipv6_caches.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 42 (4.67 pkts/flow) Confidence Unknown : 4 (flows) Confidence DPI (cache) : 2 (flows) Confidence DPI : 6 (flows) -Num dissector calls: 1253 (104.42 diss/flow) +Num dissector calls: 1208 (100.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/12/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/malware.pcap.out b/tests/result/malware.pcap.out index 3d8eef892..8bd6bfc97 100644 --- a/tests/result/malware.pcap.out +++ b/tests/result/malware.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 18 (3.60 diss/flow) +Num dissector calls: 15 (3.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/memcached.cap.out b/tests/result/memcached.cap.out index 48cde8f9b..241e1dfd7 100644 --- a/tests/result/memcached.cap.out +++ b/tests/result/memcached.cap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 130 (130.00 diss/flow) +Num dissector calls: 117 (117.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mgcp.pcapng.out b/tests/result/mgcp.pcapng.out index 74efbc869..1098d00cf 100644 --- a/tests/result/mgcp.pcapng.out +++ b/tests/result/mgcp.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 38 (19.00 diss/flow) +Num dissector calls: 36 (18.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/monero.pcap.out b/tests/result/monero.pcap.out index 29ebc58fd..b66f89920 100644 --- a/tests/result/monero.pcap.out +++ b/tests/result/monero.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 64 (32.00 diss/flow) +Num dissector calls: 52 (26.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mongo_false_positive.pcapng.out b/tests/result/mongo_false_positive.pcapng.out index 226a29dfc..575897f83 100644 --- a/tests/result/mongo_false_positive.pcapng.out +++ b/tests/result/mongo_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (26.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 435 (435.00 diss/flow) +Num dissector calls: 401 (401.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mongodb.pcap.out b/tests/result/mongodb.pcap.out index 9ba93870a..3e47797f5 100644 --- a/tests/result/mongodb.pcap.out +++ b/tests/result/mongodb.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 27 (3.38 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 115 (14.38 diss/flow) +Num dissector calls: 102 (12.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mpeg-dash.pcap.out b/tests/result/mpeg-dash.pcap.out index 3d561c496..17a1f47f5 100644 --- a/tests/result/mpeg-dash.pcap.out +++ b/tests/result/mpeg-dash.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 3 DPI Packets (TCP): 13 (3.25 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 76 (19.00 diss/flow) +Num dissector calls: 64 (16.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mpeg.pcap.out b/tests/result/mpeg.pcap.out index 2b5ab16b0..92375b083 100644 --- a/tests/result/mpeg.pcap.out +++ b/tests/result/mpeg.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mpegts.pcap.out b/tests/result/mpegts.pcap.out index 07e3c1a91..2884fbfc8 100644 --- a/tests/result/mpegts.pcap.out +++ b/tests/result/mpegts.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 69 (69.00 diss/flow) +Num dissector calls: 64 (64.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mssql_tds.pcap.out b/tests/result/mssql_tds.pcap.out index 942901b76..dbb86e0f7 100644 --- a/tests/result/mssql_tds.pcap.out +++ b/tests/result/mssql_tds.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 18 (1.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 299 (24.92 diss/flow) +Num dissector calls: 280 (23.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nats.pcap.out b/tests/result/nats.pcap.out index 126264521..1cf24e6a9 100644 --- a/tests/result/nats.pcap.out +++ b/tests/result/nats.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 24 (12.00 diss/flow) +Num dissector calls: 20 (10.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out index 45052ad00..0227259c2 100644 --- a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out +++ b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out index 66a081a1d..a9f00bb7f 100644 --- a/tests/result/nest_log_sink.pcap.out +++ b/tests/result/nest_log_sink.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 130 (10.00 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 1933 (138.07 diss/flow) +Num dissector calls: 1765 (126.07 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/netbios.pcap.out b/tests/result/netbios.pcap.out index 81f0b0de4..1ac20952f 100644 --- a/tests/result/netbios.pcap.out +++ b/tests/result/netbios.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 14 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 14 (flows) -Num dissector calls: 143 (9.53 diss/flow) +Num dissector calls: 130 (8.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/netflix.pcap.out b/tests/result/netflix.pcap.out index 0d9b93a1c..da4c406c8 100644 --- a/tests/result/netflix.pcap.out +++ b/tests/result/netflix.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (2.08 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 60 (flows) -Num dissector calls: 456 (7.48 diss/flow) +Num dissector calls: 375 (6.15 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/netflowv9.pcap.out b/tests/result/netflowv9.pcap.out index aa34159ac..a511aa78a 100644 --- a/tests/result/netflowv9.pcap.out +++ b/tests/result/netflowv9.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 55 (55.00 diss/flow) +Num dissector calls: 50 (50.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nfsv2.pcap.out b/tests/result/nfsv2.pcap.out index cda555a23..ed0aa8e1b 100644 --- a/tests/result/nfsv2.pcap.out +++ b/tests/result/nfsv2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 7 (1.00 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 162 (23.14 diss/flow) +Num dissector calls: 147 (21.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nfsv3.pcap.out b/tests/result/nfsv3.pcap.out index 218986cdc..20ec44279 100644 --- a/tests/result/nfsv3.pcap.out +++ b/tests/result/nfsv3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence DPI : 8 (flows) -Num dissector calls: 194 (24.25 diss/flow) +Num dissector calls: 176 (22.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nintendo.pcap.out b/tests/result/nintendo.pcap.out index c7cba9cc9..30f14ae5f 100644 --- a/tests/result/nintendo.pcap.out +++ b/tests/result/nintendo.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 5 (flows) Confidence Match by port : 1 (flows) Confidence DPI : 15 (flows) -Num dissector calls: 1310 (62.38 diss/flow) +Num dissector calls: 1250 (59.52 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/15/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nntp.pcap.out b/tests/result/nntp.pcap.out index c06d0e81a..61d020eba 100644 --- a/tests/result/nntp.pcap.out +++ b/tests/result/nntp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 137 (137.00 diss/flow) +Num dissector calls: 124 (124.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ocs.pcap.out b/tests/result/ocs.pcap.out index c69b88a05..e7cf619ed 100644 --- a/tests/result/ocs.pcap.out +++ b/tests/result/ocs.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 92 (7.67 pkts/flow) DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 18 (flows) -Num dissector calls: 88 (4.40 diss/flow) +Num dissector calls: 73 (3.65 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ocsp.pcapng.out b/tests/result/ocsp.pcapng.out index 037e6cc05..41fcc3268 100644 --- a/tests/result/ocsp.pcapng.out +++ b/tests/result/ocsp.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 60 (6.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 150 (15.00 diss/flow) +Num dissector calls: 120 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ookla.pcap.out b/tests/result/ookla.pcap.out index 31a75000a..51ce83bdc 100644 --- a/tests/result/ookla.pcap.out +++ b/tests/result/ookla.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 16 (8.00 pkts/flow) Confidence DPI (cache) : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 113 (56.50 diss/flow) +Num dissector calls: 97 (48.50 diss/flow) LRU cache ookla: 3/1/1 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out index 999f386b4..97d0f32bd 100644 --- a/tests/result/openvpn.pcap.out +++ b/tests/result/openvpn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) DPI Packets (UDP): 5 (2.50 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 409 (136.33 diss/flow) +Num dissector calls: 385 (128.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/oracle12.pcapng.out b/tests/result/oracle12.pcapng.out index 6dd44d55e..66b742c81 100644 --- a/tests/result/oracle12.pcapng.out +++ b/tests/result/oracle12.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 20 (20.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 305 (305.00 diss/flow) +Num dissector calls: 282 (282.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pgsql.pcap.out b/tests/result/pgsql.pcap.out index a8c024ee9..0d1c5d4fe 100644 --- a/tests/result/pgsql.pcap.out +++ b/tests/result/pgsql.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (6.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 780 (130.00 diss/flow) +Num dissector calls: 702 (117.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pop3.pcap.out b/tests/result/pop3.pcap.out index b1c1e33d7..a91d37329 100644 --- a/tests/result/pop3.pcap.out +++ b/tests/result/pop3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 186 (186.00 diss/flow) +Num dissector calls: 171 (171.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pop3_stls.pcap.out b/tests/result/pop3_stls.pcap.out index ccce236ec..16497e800 100644 --- a/tests/result/pop3_stls.pcap.out +++ b/tests/result/pop3_stls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 18 (18.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 241 (241.00 diss/flow) +Num dissector calls: 223 (223.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pps.pcap.out b/tests/result/pps.pcap.out index 8370b157e..6b4d0ed13 100644 --- a/tests/result/pps.pcap.out +++ b/tests/result/pps.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 201 (4.57 pkts/flow) Confidence Unknown : 34 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 71 (flows) -Num dissector calls: 6631 (61.97 diss/flow) +Num dissector calls: 6248 (58.39 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/102/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pptp.pcap.out b/tests/result/pptp.pcap.out index 801f19b61..3a5bda306 100644 --- a/tests/result/pptp.pcap.out +++ b/tests/result/pptp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 51 (51.00 diss/flow) +Num dissector calls: 42 (42.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/punycode-idn.pcap.out b/tests/result/punycode-idn.pcap.out index 909b1d5af..84219891a 100644 --- a/tests/result/punycode-idn.pcap.out +++ b/tests/result/punycode-idn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 17 (5.67 diss/flow) +Num dissector calls: 14 (4.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic-33.pcapng.out b/tests/result/quic-33.pcapng.out index a092cff38..a503b0ba4 100644 --- a/tests/result/quic-33.pcapng.out +++ b/tests/result/quic-33.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 64 (64.00 diss/flow) +Num dissector calls: 59 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic-34.pcap.out b/tests/result/quic-34.pcap.out index 41c542d06..a96e536d8 100644 --- a/tests/result/quic-34.pcap.out +++ b/tests/result/quic-34.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 61 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic-fuzz-overflow.pcapng.out b/tests/result/quic-fuzz-overflow.pcapng.out index 6cda2cccd..d3a71d6ce 100644 --- a/tests/result/quic-fuzz-overflow.pcapng.out +++ b/tests/result/quic-fuzz-overflow.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 61 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic-v2-01.pcapng.out b/tests/result/quic-v2-01.pcapng.out index 2d478d915..ac44400a9 100644 --- a/tests/result/quic-v2-01.pcapng.out +++ b/tests/result/quic-v2-01.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 61 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic.pcap.out b/tests/result/quic.pcap.out index f56017673..3502a3dd9 100644 --- a/tests/result/quic.pcap.out +++ b/tests/result/quic.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 12 (1.20 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 9 (flows) -Num dissector calls: 218 (21.80 diss/flow) +Num dissector calls: 208 (20.80 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic_0RTT.pcap.out b/tests/result/quic_0RTT.pcap.out index e3b745250..5f54739a4 100644 --- a/tests/result/quic_0RTT.pcap.out +++ b/tests/result/quic_0RTT.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 193 (96.50 diss/flow) +Num dissector calls: 183 (91.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic_frags_ch_in_multiple_packets.pcapng.out b/tests/result/quic_frags_ch_in_multiple_packets.pcapng.out index 1b33a5bfa..94f6d7e65 100644 --- a/tests/result/quic_frags_ch_in_multiple_packets.pcapng.out +++ b/tests/result/quic_frags_ch_in_multiple_packets.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 64 (64.00 diss/flow) +Num dissector calls: 59 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic_interop_V.pcapng.out b/tests/result/quic_interop_V.pcapng.out index 9af2e3711..c1c451367 100644 --- a/tests/result/quic_interop_V.pcapng.out +++ b/tests/result/quic_interop_V.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 63 (1.00 pkts/flow) DPI Packets (other): 14 (1.00 pkts/flow) Confidence DPI : 77 (flows) -Num dissector calls: 2767 (35.94 diss/flow) +Num dissector calls: 2557 (33.21 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quickplay.pcap.out b/tests/result/quickplay.pcap.out index 2c5abaf2c..f09de7f12 100644 --- a/tests/result/quickplay.pcap.out +++ b/tests/result/quickplay.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 8 DPI Packets (TCP): 78 (3.71 pkts/flow) Confidence DPI : 21 (flows) -Num dissector calls: 245 (11.67 diss/flow) +Num dissector calls: 197 (9.38 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/radius_false_positive.pcapng.out b/tests/result/radius_false_positive.pcapng.out index 2b49c58b5..c1602413c 100644 --- a/tests/result/radius_false_positive.pcapng.out +++ b/tests/result/radius_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 10 (10.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 203 (203.00 diss/flow) +Num dissector calls: 198 (198.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/raknet.pcap.out b/tests/result/raknet.pcap.out index 4f747e0de..4d7ad1fe7 100644 --- a/tests/result/raknet.pcap.out +++ b/tests/result/raknet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 24 (2.00 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1458 (121.50 diss/flow) +Num dissector calls: 1398 (116.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/reasm_crash_anon.pcapng.out b/tests/result/reasm_crash_anon.pcapng.out index 62d15db2f..1abdea29e 100644 --- a/tests/result/reasm_crash_anon.pcapng.out +++ b/tests/result/reasm_crash_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 343 (343.00 diss/flow) +Num dissector calls: 315 (315.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/reasm_segv_anon.pcapng.out b/tests/result/reasm_segv_anon.pcapng.out index 2df04b557..1dc811455 100644 --- a/tests/result/reasm_segv_anon.pcapng.out +++ b/tests/result/reasm_segv_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 273 (273.00 diss/flow) +Num dissector calls: 251 (251.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/riotgames.pcap.out b/tests/result/riotgames.pcap.out index 8474e1ae3..00889bc7b 100644 --- a/tests/result/riotgames.pcap.out +++ b/tests/result/riotgames.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 9 (1.00 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 897 (99.67 diss/flow) +Num dissector calls: 852 (94.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/rsh.pcap.out b/tests/result/rsh.pcap.out index 114ad230d..3e5b3cb10 100644 --- a/tests/result/rsh.pcap.out +++ b/tests/result/rsh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 314 (157.00 diss/flow) +Num dissector calls: 286 (143.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/rsync.pcap.out b/tests/result/rsync.pcap.out index 2678406d4..6b383384a 100644 --- a/tests/result/rsync.pcap.out +++ b/tests/result/rsync.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 179 (179.00 diss/flow) +Num dissector calls: 164 (164.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/rtmp.pcap.out b/tests/result/rtmp.pcap.out index 3667763d4..e009962e9 100644 --- a/tests/result/rtmp.pcap.out +++ b/tests/result/rtmp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 160 (160.00 diss/flow) +Num dissector calls: 146 (146.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/rx.pcap.out b/tests/result/rx.pcap.out index 9875ada36..e623c3e32 100644 --- a/tests/result/rx.pcap.out +++ b/tests/result/rx.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 10 (2.00 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 627 (125.40 diss/flow) +Num dissector calls: 602 (120.40 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sflow.pcap.out b/tests/result/sflow.pcap.out index e13b4a615..4b3d418ab 100644 --- a/tests/result/sflow.pcap.out +++ b/tests/result/sflow.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 110 (110.00 diss/flow) +Num dissector calls: 105 (105.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sip.pcap.out b/tests/result/sip.pcap.out index 753a54f21..c0c600956 100644 --- a/tests/result/sip.pcap.out +++ b/tests/result/sip.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 67 (16.75 diss/flow) +Num dissector calls: 62 (15.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sip_hello.pcapng.out b/tests/result/sip_hello.pcapng.out index f7a4fa217..a1b689827 100644 --- a/tests/result/sip_hello.pcapng.out +++ b/tests/result/sip_hello.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 213 (213.00 diss/flow) +Num dissector calls: 208 (208.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sites.pcapng.out b/tests/result/sites.pcapng.out index a96206e11..7b955fd5b 100644 --- a/tests/result/sites.pcapng.out +++ b/tests/result/sites.pcapng.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 229 (5.20 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence DPI : 43 (flows) -Num dissector calls: 57 (1.21 diss/flow) +Num dissector calls: 54 (1.15 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out index 64ee5595a..e06726df2 100644 --- a/tests/result/skype.pcap.out +++ b/tests/result/skype.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 59 (flows) Confidence Match by port : 28 (flows) Confidence DPI : 206 (flows) -Num dissector calls: 29278 (99.92 diss/flow) +Num dissector calls: 27117 (92.55 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/213/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out index e8e136d6c..e5efef9e8 100644 --- a/tests/result/skype_no_unknown.pcap.out +++ b/tests/result/skype_no_unknown.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 44 (flows) Confidence Match by port : 22 (flows) Confidence DPI : 201 (flows) -Num dissector calls: 24315 (91.07 diss/flow) +Num dissector calls: 22551 (84.46 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/156/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/skype_udp.pcap.out b/tests/result/skype_udp.pcap.out index 2e427c6af..62c0c6639 100644 --- a/tests/result/skype_udp.pcap.out +++ b/tests/result/skype_udp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 126 (126.00 diss/flow) +Num dissector calls: 121 (121.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smb_frags.pcap.out b/tests/result/smb_frags.pcap.out index 3d41aeb3d..047163150 100644 --- a/tests/result/smb_frags.pcap.out +++ b/tests/result/smb_frags.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 160 (160.00 diss/flow) +Num dissector calls: 146 (146.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smbv1.pcap.out b/tests/result/smbv1.pcap.out index b68989c25..c6c1e2a00 100644 --- a/tests/result/smbv1.pcap.out +++ b/tests/result/smbv1.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 162 (162.00 diss/flow) +Num dissector calls: 148 (148.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smpp_in_general.pcap.out b/tests/result/smpp_in_general.pcap.out index e3cd8bbd2..f4b642538 100644 --- a/tests/result/smpp_in_general.pcap.out +++ b/tests/result/smpp_in_general.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 90 (90.00 diss/flow) +Num dissector calls: 77 (77.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smtp-starttls.pcap.out b/tests/result/smtp-starttls.pcap.out index 715f38cc3..486224b15 100644 --- a/tests/result/smtp-starttls.pcap.out +++ b/tests/result/smtp-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 158 (79.00 diss/flow) +Num dissector calls: 144 (72.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smtp.pcap.out b/tests/result/smtp.pcap.out index ec6b56ab4..8eb99708f 100644 --- a/tests/result/smtp.pcap.out +++ b/tests/result/smtp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 205 (205.00 diss/flow) +Num dissector calls: 189 (189.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/soap.pcap.out b/tests/result/soap.pcap.out index f755b9706..3f8904ca6 100644 --- a/tests/result/soap.pcap.out +++ b/tests/result/soap.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 20 (6.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 393 (131.00 diss/flow) +Num dissector calls: 360 (120.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/socks-http-example.pcap.out b/tests/result/socks-http-example.pcap.out index 84c2cb3e4..c2c92aa6b 100644 --- a/tests/result/socks-http-example.pcap.out +++ b/tests/result/socks-http-example.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 29 (9.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 500 (166.67 diss/flow) +Num dissector calls: 455 (151.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/softether.pcap.out b/tests/result/softether.pcap.out index f83f93faa..b7bee6d0c 100644 --- a/tests/result/softether.pcap.out +++ b/tests/result/softether.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 31 (10.33 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 379 (94.75 diss/flow) +Num dissector calls: 361 (90.25 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/someip-tp.pcap.out b/tests/result/someip-tp.pcap.out index e1f69fd0b..41ab4505a 100644 --- a/tests/result/someip-tp.pcap.out +++ b/tests/result/someip-tp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 72 (72.00 diss/flow) +Num dissector calls: 67 (67.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/someip-udp-method-call.pcapng.out b/tests/result/someip-udp-method-call.pcapng.out index 2a2b44d93..cba79dea0 100644 --- a/tests/result/someip-udp-method-call.pcapng.out +++ b/tests/result/someip-udp-method-call.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 144 (72.00 diss/flow) +Num dissector calls: 134 (67.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sql_injection.pcap.out b/tests/result/sql_injection.pcap.out index 05bb71628..871e2e895 100644 --- a/tests/result/sql_injection.pcap.out +++ b/tests/result/sql_injection.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ssdp-m-search-ua.pcap.out b/tests/result/ssdp-m-search-ua.pcap.out index a8af95315..fa13e91c7 100644 --- a/tests/result/ssdp-m-search-ua.pcap.out +++ b/tests/result/ssdp-m-search-ua.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 33 (33.00 diss/flow) +Num dissector calls: 30 (30.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ssdp-m-search.pcap.out b/tests/result/ssdp-m-search.pcap.out index 0c021104e..ba7f0b8ca 100644 --- a/tests/result/ssdp-m-search.pcap.out +++ b/tests/result/ssdp-m-search.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 33 (33.00 diss/flow) +Num dissector calls: 30 (30.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out index 88f46f7b9..226cdb0e2 100644 --- a/tests/result/starcraft_battle.pcap.out +++ b/tests/result/starcraft_battle.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 12 (flows) Confidence DPI : 39 (flows) -Num dissector calls: 1541 (29.63 diss/flow) +Num dissector calls: 1410 (27.12 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/steam.pcap.out b/tests/result/steam.pcap.out index 4ab0c91b9..70ec32fe4 100644 --- a/tests/result/steam.pcap.out +++ b/tests/result/steam.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 55 (1.00 pkts/flow) Confidence DPI : 55 (flows) -Num dissector calls: 1485 (27.00 diss/flow) +Num dissector calls: 1320 (24.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/steam_datagram_relay_ping.pcapng.out b/tests/result/steam_datagram_relay_ping.pcapng.out index 5472477e8..4437b1115 100644 --- a/tests/result/steam_datagram_relay_ping.pcapng.out +++ b/tests/result/steam_datagram_relay_ping.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 27 (27.00 diss/flow) +Num dissector calls: 24 (24.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/stun.pcap.out b/tests/result/stun.pcap.out index bba1726c0..7e1dc7c26 100644 --- a/tests/result/stun.pcap.out +++ b/tests/result/stun.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 13 (4.33 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 596 (149.00 diss/flow) +Num dissector calls: 567 (141.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/stun_signal.pcapng.out b/tests/result/stun_signal.pcapng.out index 05bb9ebd5..16c5f7183 100644 --- a/tests/result/stun_signal.pcapng.out +++ b/tests/result/stun_signal.pcapng.out @@ -4,7 +4,7 @@ DPI Packets (UDP): 72 (3.43 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence DPI (partial) : 1 (flows) Confidence DPI : 22 (flows) -Num dissector calls: 2330 (101.30 diss/flow) +Num dissector calls: 2255 (98.04 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/24/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/syncthing.pcap.out b/tests/result/syncthing.pcap.out index 1eb3d054c..433e94139 100644 --- a/tests/result/syncthing.pcap.out +++ b/tests/result/syncthing.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 414 (103.50 diss/flow) +Num dissector calls: 394 (98.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/syslog.pcap.out b/tests/result/syslog.pcap.out index 943c02462..08c7caba3 100644 --- a/tests/result/syslog.pcap.out +++ b/tests/result/syslog.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 10 (5.00 pkts/flow) DPI Packets (UDP): 20 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 21 (flows) -Num dissector calls: 63 (2.86 diss/flow) +Num dissector calls: 55 (2.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/targusdataspeed_false_positives.pcap.out b/tests/result/targusdataspeed_false_positives.pcap.out index 452a4e7a3..64e91893e 100644 --- a/tests/result/targusdataspeed_false_positives.pcap.out +++ b/tests/result/targusdataspeed_false_positives.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 2 DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 162 (81.00 diss/flow) +Num dissector calls: 152 (76.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 10/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out index d8897466b..e7887be4b 100644 --- a/tests/result/teams.pcap.out +++ b/tests/result/teams.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by port : 1 (flows) Confidence DPI (partial) : 1 (flows) Confidence DPI : 80 (flows) -Num dissector calls: 615 (7.41 diss/flow) +Num dissector calls: 591 (7.12 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/teamspeak3.pcap.out b/tests/result/teamspeak3.pcap.out index 6fb97b23e..d658fb01d 100644 --- a/tests/result/teamspeak3.pcap.out +++ b/tests/result/teamspeak3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 205 (102.50 diss/flow) +Num dissector calls: 195 (97.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/teamviewer.pcap.out b/tests/result/teamviewer.pcap.out index c72e293cd..999da0e1b 100644 --- a/tests/result/teamviewer.pcap.out +++ b/tests/result/teamviewer.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 154 (77.00 diss/flow) +Num dissector calls: 149 (74.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/telegram.pcap.out b/tests/result/telegram.pcap.out index f15009a94..9047a2518 100644 --- a/tests/result/telegram.pcap.out +++ b/tests/result/telegram.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 5 DPI Packets (UDP): 93 (1.94 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 46 (flows) -Num dissector calls: 1676 (34.92 diss/flow) +Num dissector calls: 1576 (32.83 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/telnet.pcap.out b/tests/result/telnet.pcap.out index 8f596797a..b3a662978 100644 --- a/tests/result/telnet.pcap.out +++ b/tests/result/telnet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 159 (159.00 diss/flow) +Num dissector calls: 145 (145.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tftp.pcap.out b/tests/result/tftp.pcap.out index 1f60b251e..6597ed37a 100644 --- a/tests/result/tftp.pcap.out +++ b/tests/result/tftp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 13 (1.86 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 317 (45.29 diss/flow) +Num dissector calls: 307 (43.86 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/threema.pcap.out b/tests/result/threema.pcap.out index 8202050e3..ba12fa1d2 100644 --- a/tests/result/threema.pcap.out +++ b/tests/result/threema.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 66 (11.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 1308 (218.00 diss/flow) +Num dissector calls: 1208 (201.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tinc.pcap.out b/tests/result/tinc.pcap.out index 77ef30ec6..87664acc1 100644 --- a/tests/result/tinc.pcap.out +++ b/tests/result/tinc.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 19 (9.50 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI (cache) : 2 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 544 (136.00 diss/flow) +Num dissector calls: 502 (125.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls-appdata.pcap.out b/tests/result/tls-appdata.pcap.out index 5ec5aed1f..34305588e 100644 --- a/tests/result/tls-appdata.pcap.out +++ b/tests/result/tls-appdata.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 17 (8.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 131 (65.50 diss/flow) +Num dissector calls: 118 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out index ce9ee3032..0388f5b2a 100644 --- a/tests/result/tls_certificate_too_long.pcap.out +++ b/tests/result/tls_certificate_too_long.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 620 (17.71 diss/flow) +Num dissector calls: 569 (16.26 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls_false_positives.pcapng.out b/tests/result/tls_false_positives.pcapng.out index 1fe286f61..ebff2f8be 100644 --- a/tests/result/tls_false_positives.pcapng.out +++ b/tests/result/tls_false_positives.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 30 (30.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 442 (442.00 diss/flow) +Num dissector calls: 401 (401.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out index 8efdbccb6..9f0427ab0 100644 --- a/tests/result/tls_invalid_reads.pcap.out +++ b/tests/result/tls_invalid_reads.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 10 (3.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 131 (43.67 diss/flow) +Num dissector calls: 118 (39.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls_missing_ch_frag.pcap.out b/tests/result/tls_missing_ch_frag.pcap.out index c994a7f36..5d5ffdc45 100644 --- a/tests/result/tls_missing_ch_frag.pcap.out +++ b/tests/result/tls_missing_ch_frag.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 130 (130.00 diss/flow) +Num dissector calls: 117 (117.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/toca-boca.pcap.out b/tests/result/toca-boca.pcap.out index 2f95f4812..1472f0181 100644 --- a/tests/result/toca-boca.pcap.out +++ b/tests/result/toca-boca.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 4 DPI Packets (UDP): 21 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence DPI : 17 (flows) -Num dissector calls: 453 (21.57 diss/flow) +Num dissector calls: 433 (20.62 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tor.pcap.out b/tests/result/tor.pcap.out index eb9b2aa19..ce013fadb 100644 --- a/tests/result/tor.pcap.out +++ b/tests/result/tor.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 43 (5.38 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 10 (flows) -Num dissector calls: 51 (4.64 diss/flow) +Num dissector calls: 48 (4.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/trickbot.pcap.out b/tests/result/trickbot.pcap.out index 7253a9d92..a0584603d 100644 --- a/tests/result/trickbot.pcap.out +++ b/tests/result/trickbot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ultrasurf.pcap.out b/tests/result/ultrasurf.pcap.out index a9d60e757..e71dc8b8f 100644 --- a/tests/result/ultrasurf.pcap.out +++ b/tests/result/ultrasurf.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 13 (4.33 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 126 (42.00 diss/flow) +Num dissector calls: 113 (37.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out index 5f2fa7561..90344d491 100644 --- a/tests/result/viber.pcap.out +++ b/tests/result/viber.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (1.93 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence DPI : 25 (flows) -Num dissector calls: 553 (19.07 diss/flow) +Num dissector calls: 518 (17.86 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/vnc.pcap.out b/tests/result/vnc.pcap.out index 781c217c3..0e8b3667d 100644 --- a/tests/result/vnc.pcap.out +++ b/tests/result/vnc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 274 (137.00 diss/flow) +Num dissector calls: 246 (123.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wa_video.pcap.out b/tests/result/wa_video.pcap.out index dc33be885..8dbcfe738 100644 --- a/tests/result/wa_video.pcap.out +++ b/tests/result/wa_video.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 33 (33.00 pkts/flow) DPI Packets (UDP): 13 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 539 (38.50 diss/flow) +Num dissector calls: 495 (35.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wa_voice.pcap.out b/tests/result/wa_voice.pcap.out index 309cd4b56..6fa698dce 100644 --- a/tests/result/wa_voice.pcap.out +++ b/tests/result/wa_voice.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 33 (1.57 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 27 (flows) -Num dissector calls: 448 (16.00 diss/flow) +Num dissector calls: 402 (14.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/waze.pcap.out b/tests/result/waze.pcap.out index 3b17c495e..f18979a47 100644 --- a/tests/result/waze.pcap.out +++ b/tests/result/waze.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 9 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 389 (11.79 diss/flow) +Num dissector calls: 338 (10.24 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/webex.pcap.out b/tests/result/webex.pcap.out index 597c7f1f0..9afa58673 100644 --- a/tests/result/webex.pcap.out +++ b/tests/result/webex.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 17 (8.50 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 3 (flows) Confidence DPI : 53 (flows) -Num dissector calls: 326 (5.72 diss/flow) +Num dissector calls: 315 (5.53 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/websocket.pcap.out b/tests/result/websocket.pcap.out index 3c47dcf62..89852524f 100644 --- a/tests/result/websocket.pcap.out +++ b/tests/result/websocket.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 108 (108.00 diss/flow) +Num dissector calls: 95 (95.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out index b354d12e9..cf167f77b 100644 --- a/tests/result/wechat.pcap.out +++ b/tests/result/wechat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 24 (flows) Confidence DPI : 78 (flows) -Num dissector calls: 322 (3.13 diss/flow) +Num dissector calls: 309 (3.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/weibo.pcap.out b/tests/result/weibo.pcap.out index b7bb2b77e..b794831f3 100644 --- a/tests/result/weibo.pcap.out +++ b/tests/result/weibo.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 100 (3.33 pkts/flow) DPI Packets (UDP): 44 (3.14 pkts/flow) Confidence Match by port : 21 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 602 (13.68 diss/flow) +Num dissector calls: 562 (12.77 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whatsapp.pcap.out b/tests/result/whatsapp.pcap.out index 244bc789a..af25bd911 100644 --- a/tests/result/whatsapp.pcap.out +++ b/tests/result/whatsapp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 344 (4.00 pkts/flow) Confidence DPI : 86 (flows) -Num dissector calls: 13158 (153.00 diss/flow) +Num dissector calls: 11954 (139.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out index b6852790f..9e600f4b9 100644 --- a/tests/result/whatsapp_login_call.pcap.out +++ b/tests/result/whatsapp_login_call.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 35 (1.21 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 20 (flows) Confidence DPI : 37 (flows) -Num dissector calls: 333 (5.84 diss/flow) +Num dissector calls: 302 (5.30 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whatsapp_login_chat.pcap.out b/tests/result/whatsapp_login_chat.pcap.out index 8bede1f7d..5fe31d854 100644 --- a/tests/result/whatsapp_login_chat.pcap.out +++ b/tests/result/whatsapp_login_chat.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 17 (5.67 pkts/flow) DPI Packets (UDP): 7 (1.17 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 308 (34.22 diss/flow) +Num dissector calls: 277 (30.78 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whatsapp_voice_and_message.pcap.out b/tests/result/whatsapp_voice_and_message.pcap.out index 7851aaa59..54c5fa2c8 100644 --- a/tests/result/whatsapp_voice_and_message.pcap.out +++ b/tests/result/whatsapp_voice_and_message.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 20 (4.00 pkts/flow) DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence DPI : 13 (flows) -Num dissector calls: 493 (37.92 diss/flow) +Num dissector calls: 428 (32.92 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whois.pcapng.out b/tests/result/whois.pcapng.out index 0ed0a713e..9f335454e 100644 --- a/tests/result/whois.pcapng.out +++ b/tests/result/whois.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 16 (5.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 192 (64.00 diss/flow) +Num dissector calls: 177 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/windowsupdate_over_http.pcap.out b/tests/result/windowsupdate_over_http.pcap.out index 63bc5f09c..ec86b99a4 100644 --- a/tests/result/windowsupdate_over_http.pcap.out +++ b/tests/result/windowsupdate_over_http.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wireguard.pcap.out b/tests/result/wireguard.pcap.out index ae76bf57c..7808d6392 100644 --- a/tests/result/wireguard.pcap.out +++ b/tests/result/wireguard.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 149 (149.00 diss/flow) +Num dissector calls: 144 (144.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wow.pcap.out b/tests/result/wow.pcap.out index 8f7997696..cec353537 100644 --- a/tests/result/wow.pcap.out +++ b/tests/result/wow.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (7.20 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 133 (26.60 diss/flow) +Num dissector calls: 109 (21.80 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/xiaomi.pcap.out b/tests/result/xiaomi.pcap.out index e5b5cc2ea..2c9be006b 100644 --- a/tests/result/xiaomi.pcap.out +++ b/tests/result/xiaomi.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 19 (2.71 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 717 (102.43 diss/flow) +Num dissector calls: 636 (90.86 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/xss.pcap.out b/tests/result/xss.pcap.out index 7660bab82..88049ff18 100644 --- a/tests/result/xss.pcap.out +++ b/tests/result/xss.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 9 (4.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 15 (7.50 diss/flow) +Num dissector calls: 12 (6.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/z3950.pcapng.out b/tests/result/z3950.pcapng.out index 47804ab8e..b1b67fd69 100644 --- a/tests/result/z3950.pcapng.out +++ b/tests/result/z3950.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 490 (245.00 diss/flow) +Num dissector calls: 453 (226.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/zattoo.pcap.out b/tests/result/zattoo.pcap.out index 2386e4647..8c81f3b2a 100644 --- a/tests/result/zattoo.pcap.out +++ b/tests/result/zattoo.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 15 (7.50 diss/flow) +Num dissector calls: 12 (6.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/zcash.pcap.out b/tests/result/zcash.pcap.out index 8cae41690..8d57f23a8 100644 --- a/tests/result/zcash.pcap.out +++ b/tests/result/zcash.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 26 (26.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out index e79a61f25..cfed69c91 100644 --- a/tests/result/zoom.pcap.out +++ b/tests/result/zoom.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 23 (1.35 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by port : 2 (flows) Confidence DPI : 31 (flows) -Num dissector calls: 705 (21.36 diss/flow) +Num dissector calls: 653 (19.79 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 7/0/0 (insert/search/found) diff --git a/tests/result/zoom2.pcap.out b/tests/result/zoom2.pcap.out index b4026f934..dffc43cc5 100644 --- a/tests/result/zoom2.pcap.out +++ b/tests/result/zoom2.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 15 (5.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 491 (98.20 diss/flow) +Num dissector calls: 476 (95.20 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 1/0/0 (insert/search/found) diff --git a/tests/result/zoom_p2p.pcapng.out b/tests/result/zoom_p2p.pcapng.out index 44b87e0fa..e3fe5bf4e 100644 --- a/tests/result/zoom_p2p.pcapng.out +++ b/tests/result/zoom_p2p.pcapng.out @@ -4,7 +4,7 @@ DPI Packets (UDP): 88 (8.80 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence DPI (partial cache): 4 (flows) Confidence DPI : 8 (flows) -Num dissector calls: 1099 (91.58 diss/flow) +Num dissector calls: 1079 (89.92 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/12/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/windows/nDPI.vcxproj b/windows/nDPI.vcxproj index 1ae3e8cbe..1cb0ce836 100644 --- a/windows/nDPI.vcxproj +++ b/windows/nDPI.vcxproj @@ -202,10 +202,7 @@ <ClCompile Include="..\src\lib\protocols\z3950.c" /> <ClCompile Include="..\src\lib\protocols\zabbix.c" /> <ClCompile Include="..\src\lib\third_party\src\ahocorasick.c" /> - <ClCompile Include="..\src\lib\protocols\aimini.c" /> - <ClCompile Include="..\src\lib\protocols\applejuice.c" /> <ClCompile Include="..\src\lib\protocols\armagetron.c" /> - <ClCompile Include="..\src\lib\protocols\ayiya.c" /> <ClCompile Include="..\src\lib\protocols\bgp.c" /> <ClCompile Include="..\src\lib\protocols\bittorrent.c" /> <ClCompile Include="..\src\lib\protocols\btlib.c" /> @@ -217,17 +214,12 @@ <ClCompile Include="..\src\lib\protocols\dcerpc.c" /> <ClCompile Include="..\src\lib\protocols\dhcp.c" /> <ClCompile Include="..\src\lib\protocols\dhcpv6.c" /> - <ClCompile Include="..\src\lib\protocols\directconnect.c" /> - <ClCompile Include="..\src\lib\protocols\directdownloadlink.c" /> <ClCompile Include="..\src\lib\protocols\dns.c" /> <ClCompile Include="..\src\lib\protocols\dofus.c" /> <ClCompile Include="..\src\lib\protocols\drda.c" /> <ClCompile Include="..\src\lib\protocols\dropbox.c" /> <ClCompile Include="..\src\lib\protocols\eaq.c" /> <ClCompile Include="..\src\lib\protocols\edonkey.c" /> - <ClCompile Include="..\src\lib\protocols\fasttrack.c" /> - <ClCompile Include="..\src\lib\protocols\fiesta.c" /> - <ClCompile Include="..\src\lib\protocols\florensia.c" /> <ClCompile Include="..\src\lib\protocols\ftp_control.c" /> <ClCompile Include="..\src\lib\protocols\ftp_data.c" /> <ClCompile Include="..\src\lib\protocols\git.c" /> @@ -265,7 +257,6 @@ <ClCompile Include="..\src\lib\protocols\noe.c" /> <ClCompile Include="..\src\lib\protocols\non_tcp_udp.c" /> <ClCompile Include="..\src\lib\protocols\ntp.c" /> - <ClCompile Include="..\src\lib\protocols\openft.c" /> <ClCompile Include="..\src\lib\protocols\openvpn.c" /> <ClCompile Include="..\src\lib\protocols\oracle.c" /> <ClCompile Include="..\src\lib\protocols\postgres.c" /> @@ -283,18 +274,15 @@ <ClCompile Include="..\src\lib\protocols\rtsp.c" /> <ClCompile Include="..\src\lib\protocols\rx.c" /> <ClCompile Include="..\src\lib\protocols\sflow.c" /> - <ClCompile Include="..\src\lib\protocols\shoutcast.c" /> <ClCompile Include="..\src\lib\protocols\sip.c" /> <ClCompile Include="..\src\lib\protocols\skinny.c" /> <ClCompile Include="..\src\lib\protocols\skype.c" /> <ClCompile Include="..\src\lib\protocols\smb.c" /> <ClCompile Include="..\src\lib\protocols\socks45.c" /> - <ClCompile Include="..\src\lib\protocols\sopcast.c" /> <ClCompile Include="..\src\lib\protocols\spotify.c" /> <ClCompile Include="..\src\lib\protocols\ssdp.c" /> <ClCompile Include="..\src\lib\protocols\ssh.c" /> <ClCompile Include="..\src\lib\protocols\starcraft.c" /> - <ClCompile Include="..\src\lib\protocols\stealthnet.c" /> <ClCompile Include="..\src\lib\protocols\steam.c" /> <ClCompile Include="..\src\lib\protocols\stun.c" /> <ClCompile Include="..\src\lib\protocols\syslog.c" /> @@ -305,7 +293,6 @@ <ClCompile Include="..\src\lib\protocols\telnet.c" /> <ClCompile Include="..\src\lib\protocols\teredo.c" /> <ClCompile Include="..\src\lib\protocols\tftp.c" /> - <ClCompile Include="..\src\lib\protocols\thunder.c" /> <ClCompile Include="..\src\lib\protocols\tplink_shp.c" /> <ClCompile Include="..\src\lib\protocols\tuya_lp.c" /> <ClCompile Include="..\src\lib\protocols\tvuplayer.c" /> diff --git a/windows/nDPI.vcxproj.filters b/windows/nDPI.vcxproj.filters index 4c1a0ab8f..b3e28e89a 100644 --- a/windows/nDPI.vcxproj.filters +++ b/windows/nDPI.vcxproj.filters @@ -3,10 +3,7 @@ <ItemGroup> <ClCompile Include="..\src\lib\protocols\afp.c" /> <ClCompile Include="..\src\lib\protocols\bjnp.c" /> - <ClCompile Include="..\src\lib\protocols\aimini.c" /> - <ClCompile Include="..\src\lib\protocols\applejuice.c" /> <ClCompile Include="..\src\lib\protocols\armagetron.c" /> - <ClCompile Include="..\src\lib\protocols\ayiya.c" /> <ClCompile Include="..\src\lib\protocols\bgp.c" /> <ClCompile Include="..\src\lib\protocols\bittorrent.c" /> <ClCompile Include="..\src\lib\protocols\btlib.c" /> @@ -18,17 +15,12 @@ <ClCompile Include="..\src\lib\protocols\dcerpc.c" /> <ClCompile Include="..\src\lib\protocols\dhcp.c" /> <ClCompile Include="..\src\lib\protocols\dhcpv6.c" /> - <ClCompile Include="..\src\lib\protocols\directconnect.c" /> - <ClCompile Include="..\src\lib\protocols\directdownloadlink.c" /> <ClCompile Include="..\src\lib\protocols\dns.c" /> <ClCompile Include="..\src\lib\protocols\dofus.c" /> <ClCompile Include="..\src\lib\protocols\drda.c" /> <ClCompile Include="..\src\lib\protocols\dropbox.c" /> <ClCompile Include="..\src\lib\protocols\eaq.c" /> <ClCompile Include="..\src\lib\protocols\edonkey.c" /> - <ClCompile Include="..\src\lib\protocols\fasttrack.c" /> - <ClCompile Include="..\src\lib\protocols\fiesta.c" /> - <ClCompile Include="..\src\lib\protocols\florensia.c" /> <ClCompile Include="..\src\lib\protocols\ftp_control.c" /> <ClCompile Include="..\src\lib\protocols\ftp_data.c" /> <ClCompile Include="..\src\lib\protocols\git.c" /> @@ -65,7 +57,6 @@ <ClCompile Include="..\src\lib\protocols\noe.c" /> <ClCompile Include="..\src\lib\protocols\non_tcp_udp.c" /> <ClCompile Include="..\src\lib\protocols\ntp.c" /> - <ClCompile Include="..\src\lib\protocols\openft.c" /> <ClCompile Include="..\src\lib\protocols\openvpn.c" /> <ClCompile Include="..\src\lib\protocols\oracle.c" /> <ClCompile Include="..\src\lib\protocols\postgres.c" /> @@ -83,18 +74,15 @@ <ClCompile Include="..\src\lib\protocols\rtsp.c" /> <ClCompile Include="..\src\lib\protocols\rx.c" /> <ClCompile Include="..\src\lib\protocols\sflow.c" /> - <ClCompile Include="..\src\lib\protocols\shoutcast.c" /> <ClCompile Include="..\src\lib\protocols\sip.c" /> <ClCompile Include="..\src\lib\protocols\skinny.c" /> <ClCompile Include="..\src\lib\protocols\skype.c" /> <ClCompile Include="..\src\lib\protocols\smb.c" /> <ClCompile Include="..\src\lib\protocols\socks45.c" /> - <ClCompile Include="..\src\lib\protocols\sopcast.c" /> <ClCompile Include="..\src\lib\protocols\spotify.c" /> <ClCompile Include="..\src\lib\protocols\ssdp.c" /> <ClCompile Include="..\src\lib\protocols\ssh.c" /> <ClCompile Include="..\src\lib\protocols\starcraft.c" /> - <ClCompile Include="..\src\lib\protocols\stealthnet.c" /> <ClCompile Include="..\src\lib\protocols\steam.c" /> <ClCompile Include="..\src\lib\protocols\stun.c" /> <ClCompile Include="..\src\lib\protocols\syslog.c" /> @@ -105,7 +93,6 @@ <ClCompile Include="..\src\lib\protocols\telnet.c" /> <ClCompile Include="..\src\lib\protocols\teredo.c" /> <ClCompile Include="..\src\lib\protocols\tftp.c" /> - <ClCompile Include="..\src\lib\protocols\thunder.c" /> <ClCompile Include="..\src\lib\protocols\tplink_shp.c" /> <ClCompile Include="..\src\lib\protocols\tuya_lp.c" /> <ClCompile Include="..\src\lib\protocols\tvuplayer.c" /> |