Avoid useless host automa lookup (#1724)

The host automa is used for two tasks:
* protocol sub-classification (obviously);
* DGA evaluation: the idea is that if a domain is present in this
automa, it can't be a DGA, regardless of its format/name.

In most dissectors both checks are executed, i.e. the code is something
like:

```
ndpi_match_host_subprotocol(..., flow->host_server_name, ...);
ndpi_check_dga_name(..., flow->host_server_name,...);

```

In that common case, we can perform only one automa lookup: if we check the
sub-classification before the DGA, we can avoid the second lookup in
the DGA function itself.

120 files changed, 127 insertions, 124 deletions

diff --git a/example/ndpiReader.c b/example/ndpiReader.c
index 68151c939..cd8a48f66 100644
--- a/example/ndpiReader.c
+++ b/example/ndpiReader.c
@@ -4330,12 +4330,12 @@ static void dgaUnitTest() {
 
   for(i=0; non_dga[i] != NULL; i++) {
     if(debug) printf("Checking non DGA %s\n", non_dga[i]);
-    assert(ndpi_check_dga_name(ndpi_str, NULL, (char*)non_dga[i], 1) == 0);
+    assert(ndpi_check_dga_name(ndpi_str, NULL, (char*)non_dga[i], 1, 1) == 0);
   }
 
   for(i=0; dga[i] != NULL; i++) {
     if(debug) printf("Checking DGA %s\n", non_dga[i]);
-    assert(ndpi_check_dga_name(ndpi_str, NULL, (char*)dga[i], 1) == 1);
+    assert(ndpi_check_dga_name(ndpi_str, NULL, (char*)dga[i], 1, 1) == 1);
   }
 
   ndpi_exit_detection_module(ndpi_str);
diff --git a/src/include/ndpi_api.h.in b/src/include/ndpi_api.h.in
index 0fd177557..cf6c1e469 100644
--- a/src/include/ndpi_api.h.in
+++ b/src/include/ndpi_api.h.in
@@ -1149,7 +1149,7 @@ extern "C" {
   /* DGA */
   int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
 			  struct ndpi_flow_struct *flow,
-			  char *name, u_int8_t is_hostname);
+			  char *name, u_int8_t is_hostname, u_int8_t check_subproto);
 
   /* Serializer (supports JSON, TLV, CSV) */
 
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index fed529297..1f47daa7c 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -8511,7 +8511,7 @@ static int ndpi_is_vowel(char c) {
 
 int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
 			struct ndpi_flow_struct *flow,
-			char *name, u_int8_t is_hostname) {
+			char *name, u_int8_t is_hostname, u_int8_t check_subproto) {
   if(ndpi_dga_function != NULL) {
     /* A custom DGA function is defined */
     int rc = ndpi_dga_function(name, is_hostname);
@@ -8542,7 +8542,8 @@ int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
     if(flow && (flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN))
       return(0); /* Ignore DGA check for protocols already fully detected */
 
-    if(ndpi_match_string_subprotocol(ndpi_str, name, strlen(name), &ret_match) > 0)
+    if(check_subproto &&
+       ndpi_match_string_subprotocol(ndpi_str, name, strlen(name), &ret_match) > 0)
       return(0); /* Ignore DGA for known domain names */
 
     if(isdigit((int)name[0])) {
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index ecf283a77..e12ece12c 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -529,8 +529,6 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
     if(j > 0) {
       ndpi_protocol_match_result ret_match;
 
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
-
       ret.app_protocol = ndpi_match_host_subprotocol(ndpi_struct, flow,
 						     flow->host_server_name,
 						     strlen(flow->host_server_name),
@@ -544,6 +542,8 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
 	ret.master_protocol = checkDNSSubprotocol(s_port, d_port);
       else
 	ret.master_protocol = NDPI_PROTOCOL_DNS;
+
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 0);
     }
 
     /* Report if this is a DNS query or reply */
diff --git a/src/lib/protocols/fastcgi.c b/src/lib/protocols/fastcgi.c
index 9fad2c044..f70bd6cf5 100644
--- a/src/lib/protocols/fastcgi.c
+++ b/src/lib/protocols/fastcgi.c
@@ -212,7 +212,7 @@ void ndpi_search_fastcgi(struct ndpi_detection_module_struct *ndpi_struct,
                                   strlen(flow->host_server_name),
                                   &ret_match, NDPI_PROTOCOL_FASTCGI);
       ndpi_check_dga_name(ndpi_struct, flow,
-                          flow->host_server_name, 1);
+                          flow->host_server_name, 1, 0);
       if(ndpi_is_valid_hostname(flow->host_server_name,
                                 strlen(flow->host_server_name)) == 0) {
         char str[128];
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 6fe6cab33..f9d6abd90 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -722,8 +722,6 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
     ndpi_hostname_sni_set(flow, packet->host_line.ptr, packet->host_line.len);
 
     if(strlen(flow->host_server_name) > 0) {
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
-
       if(ndpi_is_valid_hostname(flow->host_server_name,
 				strlen(flow->host_server_name)) == 0) {
 	char str[128];
@@ -749,6 +747,10 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
 
     ndpi_http_parse_subprotocol(ndpi_struct, flow);
 
+    if(strlen(flow->host_server_name) > 0) {
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 0);
+    }
+
     /**
        check result of host subprotocol detection
 
diff --git a/src/lib/protocols/netbios.c b/src/lib/protocols/netbios.c
index 710f18a71..45119ecbf 100644
--- a/src/lib/protocols/netbios.c
+++ b/src/lib/protocols/netbios.c
@@ -104,7 +104,7 @@ static void ndpi_int_netbios_add_connection(struct ndpi_detection_module_struct
 		 (u_int)(packet->payload_packet_len - off), name, sizeof(name)-1) > 0) {
       ndpi_hostname_sni_set(flow, (const u_int8_t *)name, strlen((char *)name));
 
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 1);
   }
 
   if(sub_protocol == NDPI_PROTOCOL_UNKNOWN)
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index af43bf7e5..7889dad4d 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1391,7 +1391,7 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
       flow->protos.tls_quic.hello_processed = 1; /* Allow matching of custom categories */
 
       ndpi_check_dga_name(ndpi_struct, flow,
-                          flow->host_server_name, 1);
+                          flow->host_server_name, 1, 0);
 
       if(ndpi_is_valid_hostname(flow->host_server_name,
 				strlen(flow->host_server_name)) == 0) {
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 98a8d8208..fe36555ed 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -1923,7 +1923,7 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
 		    }
 
 		    if(ndpi_check_dga_name(ndpi_struct, flow,
-					   sni, 1)) {
+					   sni, 1, 0)) {
 #ifdef DEBUG_TLS
 		      printf("[TLS] SNI: (DGA) [%s]\n", sni);
 #endif
diff --git a/tests/dga/dga_evaluate.c b/tests/dga/dga_evaluate.c
index fb32075db..98cc6a2b1 100644
--- a/tests/dga/dga_evaluate.c
+++ b/tests/dga/dga_evaluate.c
@@ -80,7 +80,7 @@ int main(int argc, char **argv) {
   while(fgets(buffer, sizeof(buffer), fd) != NULL) {
     char *hostname = strtok(buffer, "\n");
     
-    if(ndpi_check_dga_name(ndpi_str, NULL, hostname, 1)) {
+    if(ndpi_check_dga_name(ndpi_str, NULL, hostname, 1, 1)) {
       if(verbose)
 	printf("%10s\t%s\n", "[DGA]", hostname);
 	       
diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out
index dbc39c7d4..7f5bfe57b 100644
--- a/tests/result/1kxun.pcap.out
+++ b/tests/result/1kxun.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          277/115 (search/found)
+Automa host:          164/68 (search/found)
 Automa domain:        156/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     18/0 (search/found)
diff --git a/tests/result/6in4tunnel.pcap.out b/tests/result/6in4tunnel.pcap.out
index f4522e3aa..a210a980e 100644
--- a/tests/result/6in4tunnel.pcap.out
+++ b/tests/result/6in4tunnel.pcap.out
@@ -12,7 +12,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          13/7 (search/found)
+Automa host:          9/5 (search/found)
 Automa domain:        9/0 (search/found)
 Automa tls cert:      1/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/KakaoTalk_chat.pcap.out b/tests/result/KakaoTalk_chat.pcap.out
index 4799011d9..a01ec9e9b 100644
--- a/tests/result/KakaoTalk_chat.pcap.out
+++ b/tests/result/KakaoTalk_chat.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          62/60 (search/found)
+Automa host:          45/43 (search/found)
 Automa domain:        45/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     3/0 (search/found)
diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out
index 9df041e17..5a5a8a5db 100644
--- a/tests/result/KakaoTalk_talk.pcap.out
+++ b/tests/result/KakaoTalk_talk.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   2/2/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/4 (search/found)
+Automa host:          3/3 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      2/2 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/WebattackRCE.pcap.out b/tests/result/WebattackRCE.pcap.out
index 7a03badf0..f6c049216 100644
--- a/tests/result/WebattackRCE.pcap.out
+++ b/tests/result/WebattackRCE.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          1554/0 (search/found)
+Automa host:          777/0 (search/found)
 Automa domain:        777/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     777/0 (search/found)
diff --git a/tests/result/WebattackSQLinj.pcap.out b/tests/result/WebattackSQLinj.pcap.out
index acc8a58d7..50618a148 100644
--- a/tests/result/WebattackSQLinj.pcap.out
+++ b/tests/result/WebattackSQLinj.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          18/0 (search/found)
+Automa host:          9/0 (search/found)
 Automa domain:        9/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/WebattackXSS.pcap.out b/tests/result/WebattackXSS.pcap.out
index ef0bea31b..7b88dc170 100644
--- a/tests/result/WebattackXSS.pcap.out
+++ b/tests/result/WebattackXSS.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          44/0 (search/found)
+Automa host:          22/0 (search/found)
 Automa domain:        22/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/aimini-http.pcap.out b/tests/result/aimini-http.pcap.out
index a25745680..af1c60a53 100644
--- a/tests/result/aimini-http.pcap.out
+++ b/tests/result/aimini-http.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          8/0 (search/found)
+Automa host:          4/0 (search/found)
 Automa domain:        4/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/alexa-app.pcapng.out b/tests/result/alexa-app.pcapng.out
index 4ac2ddc01..e48382570 100644
--- a/tests/result/alexa-app.pcapng.out
+++ b/tests/result/alexa-app.pcapng.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          199/189 (search/found)
+Automa host:          166/160 (search/found)
 Automa domain:        166/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     82/0 (search/found)
diff --git a/tests/result/android.pcap.out b/tests/result/android.pcap.out
index 0c050fdc6..62c725251 100644
--- a/tests/result/android.pcap.out
+++ b/tests/result/android.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          92/80 (search/found)
+Automa host:          66/59 (search/found)
 Automa domain:        66/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     5/0 (search/found)
diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out
index 2c8b1feaf..75fd6aef4 100644
--- a/tests/result/anyconnect-vpn.pcap.out
+++ b/tests/result/anyconnect-vpn.pcap.out
@@ -15,7 +15,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          107/16 (search/found)
+Automa host:          70/11 (search/found)
 Automa domain:        69/0 (search/found)
 Automa tls cert:      4/0 (search/found)
 Automa risk mask:     10/0 (search/found)
diff --git a/tests/result/anydesk-2.pcap.out b/tests/result/anydesk-2.pcap.out
index aa515e84d..57d5f8bd8 100644
--- a/tests/result/anydesk-2.pcap.out
+++ b/tests/result/anydesk-2.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   2/2/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          6/6 (search/found)
+Automa host:          4/4 (search/found)
 Automa domain:        4/0 (search/found)
 Automa tls cert:      2/2 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/bad-dns-traffic.pcap.out b/tests/result/bad-dns-traffic.pcap.out
index 1110f92d5..d33677a00 100644
--- a/tests/result/bad-dns-traffic.pcap.out
+++ b/tests/result/bad-dns-traffic.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          22/0 (search/found)
+Automa host:          11/0 (search/found)
 Automa domain:        11/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     3/0 (search/found)
diff --git a/tests/result/cachefly.pcapng.out b/tests/result/cachefly.pcapng.out
index 2041b91e8..55ce194aa 100644
--- a/tests/result/cachefly.pcapng.out
+++ b/tests/result/cachefly.pcapng.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          45/1 (search/found)
+Automa host:          44/1 (search/found)
 Automa domain:        44/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/capwap.pcap.out b/tests/result/capwap.pcap.out
index 5832772e3..653f4ec8b 100644
--- a/tests/result/capwap.pcap.out
+++ b/tests/result/capwap.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/chrome.pcap.out b/tests/result/chrome.pcap.out
index 46007b176..40323f170 100644
--- a/tests/result/chrome.pcap.out
+++ b/tests/result/chrome.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          12/0 (search/found)
+Automa host:          6/0 (search/found)
 Automa domain:        6/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/dlt_ppp.pcap.out b/tests/result/dlt_ppp.pcap.out
index 38d29f5c9..0bafa8427 100644
--- a/tests/result/dlt_ppp.pcap.out
+++ b/tests/result/dlt_ppp.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/dns-invalid-chars.pcap.out b/tests/result/dns-invalid-chars.pcap.out
index 5a06190f8..7600ae365 100644
--- a/tests/result/dns-invalid-chars.pcap.out
+++ b/tests/result/dns-invalid-chars.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/dns-tunnel-iodine.pcap.out b/tests/result/dns-tunnel-iodine.pcap.out
index 4957b33af..bb0d6ac31 100644
--- a/tests/result/dns-tunnel-iodine.pcap.out
+++ b/tests/result/dns-tunnel-iodine.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/dns_ambiguous_names.pcap.out b/tests/result/dns_ambiguous_names.pcap.out
index 598a22f14..b97f7c87d 100644
--- a/tests/result/dns_ambiguous_names.pcap.out
+++ b/tests/result/dns_ambiguous_names.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          29/29 (search/found)
+Automa host:          20/20 (search/found)
 Automa domain:        20/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/dns_exfiltration.pcap.out b/tests/result/dns_exfiltration.pcap.out
index ec79a5f24..93225b4e5 100644
--- a/tests/result/dns_exfiltration.pcap.out
+++ b/tests/result/dns_exfiltration.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/dns_fragmented.pcap.out b/tests/result/dns_fragmented.pcap.out
index d422071d0..9f7ba2bf0 100644
--- a/tests/result/dns_fragmented.pcap.out
+++ b/tests/result/dns_fragmented.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          83/0 (search/found)
+Automa host:          43/0 (search/found)
 Automa domain:        43/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     10/0 (search/found)
diff --git a/tests/result/dns_invert_query.pcapng.out b/tests/result/dns_invert_query.pcapng.out
index eabe40443..164645965 100644
--- a/tests/result/dns_invert_query.pcapng.out
+++ b/tests/result/dns_invert_query.pcapng.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/dns_long_domainname.pcap.out b/tests/result/dns_long_domainname.pcap.out
index 22d9aa131..c261f9078 100644
--- a/tests/result/dns_long_domainname.pcap.out
+++ b/tests/result/dns_long_domainname.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          3/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/dropbox.pcap.out b/tests/result/dropbox.pcap.out
index 1c403d6d3..e7edb0631 100644
--- a/tests/result/dropbox.pcap.out
+++ b/tests/result/dropbox.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          22/22 (search/found)
+Automa host:          17/17 (search/found)
 Automa domain:        17/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/emotet.pcap.out b/tests/result/emotet.pcap.out
index cccf79078..da15b7e1f 100644
--- a/tests/result/emotet.pcap.out
+++ b/tests/result/emotet.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          7/0 (search/found)
+Automa host:          4/0 (search/found)
 Automa domain:        4/0 (search/found)
 Automa tls cert:      1/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/exe_download.pcap.out b/tests/result/exe_download.pcap.out
index e8886d92f..f06299738 100644
--- a/tests/result/exe_download.pcap.out
+++ b/tests/result/exe_download.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/exe_download_as_png.pcap.out b/tests/result/exe_download_as_png.pcap.out
index c8ac42c2d..ea9ecf4b7 100644
--- a/tests/result/exe_download_as_png.pcap.out
+++ b/tests/result/exe_download_as_png.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/fastcgi.pcap.out b/tests/result/fastcgi.pcap.out
index 4ae44e284..ab1c8723d 100644
--- a/tests/result/fastcgi.pcap.out
+++ b/tests/result/fastcgi.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/firefox.pcap.out b/tests/result/firefox.pcap.out
index 18884ad3a..2332acf90 100644
--- a/tests/result/firefox.pcap.out
+++ b/tests/result/firefox.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          12/0 (search/found)
+Automa host:          6/0 (search/found)
 Automa domain:        6/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/forticlient.pcap.out b/tests/result/forticlient.pcap.out
index 46d467aa0..92fa7adb8 100644
--- a/tests/result/forticlient.pcap.out
+++ b/tests/result/forticlient.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   1/4/4 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          10/0 (search/found)
+Automa host:          5/0 (search/found)
 Automa domain:        5/0 (search/found)
 Automa tls cert:      1/1 (search/found)
 Automa risk mask:     5/0 (search/found)
diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out
index ac707ee2b..1a9265e2c 100644
--- a/tests/result/fuzz-2006-06-26-2594.pcap.out
+++ b/tests/result/fuzz-2006-06-26-2594.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          286/0 (search/found)
+Automa host:          255/0 (search/found)
 Automa domain:        248/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     38/0 (search/found)
diff --git a/tests/result/fuzz-2006-09-29-28586.pcap.out b/tests/result/fuzz-2006-09-29-28586.pcap.out
index 7fef19a48..7c7bd9e92 100644
--- a/tests/result/fuzz-2006-09-29-28586.pcap.out
+++ b/tests/result/fuzz-2006-09-29-28586.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          6/0 (search/found)
+Automa host:          3/0 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/gnutella.pcap.out b/tests/result/gnutella.pcap.out
index 05b2089b2..12841112d 100644
--- a/tests/result/gnutella.pcap.out
+++ b/tests/result/gnutella.pcap.out
@@ -15,7 +15,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          24/0 (search/found)
+Automa host:          15/0 (search/found)
 Automa domain:        13/0 (search/found)
 Automa tls cert:      1/0 (search/found)
 Automa risk mask:     4/0 (search/found)
diff --git a/tests/result/http-lines-split.pcap.out b/tests/result/http-lines-split.pcap.out
index c86df1da1..dab0a6411 100644
--- a/tests/result/http-lines-split.pcap.out
+++ b/tests/result/http-lines-split.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/http-manipulated.pcap.out b/tests/result/http-manipulated.pcap.out
index 30837f58a..4ecc05e06 100644
--- a/tests/result/http-manipulated.pcap.out
+++ b/tests/result/http-manipulated.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/http_auth.pcap.out b/tests/result/http_auth.pcap.out
index a52dfb9d4..84c59e7b1 100644
--- a/tests/result/http_auth.pcap.out
+++ b/tests/result/http_auth.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/http_connect.pcap.out b/tests/result/http_connect.pcap.out
index 06b8b12a9..604fb388a 100644
--- a/tests/result/http_connect.pcap.out
+++ b/tests/result/http_connect.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          7/0 (search/found)
+Automa host:          4/0 (search/found)
 Automa domain:        4/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/http_on_sip_port.pcap.out b/tests/result/http_on_sip_port.pcap.out
index e81d61583..b6eba1bc2 100644
--- a/tests/result/http_on_sip_port.pcap.out
+++ b/tests/result/http_on_sip_port.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/imaps.pcap.out b/tests/result/imaps.pcap.out
index 27dbdd669..f8849b92a 100644
--- a/tests/result/imaps.pcap.out
+++ b/tests/result/imaps.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          3/1 (search/found)
+Automa host:          2/1 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out
index 877b48565..a88879c17 100644
--- a/tests/result/instagram.pcap.out
+++ b/tests/result/instagram.pcap.out
@@ -15,7 +15,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          36/36 (search/found)
+Automa host:          25/25 (search/found)
 Automa domain:        25/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/iphone.pcap.out b/tests/result/iphone.pcap.out
index d876fb9bc..7a0ac1d07 100644
--- a/tests/result/iphone.pcap.out
+++ b/tests/result/iphone.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          82/73 (search/found)
+Automa host:          62/53 (search/found)
 Automa domain:        62/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     3/3 (search/found)
diff --git a/tests/result/ipp.pcap.out b/tests/result/ipp.pcap.out
index 489608f99..6502b58b4 100644
--- a/tests/result/ipp.pcap.out
+++ b/tests/result/ipp.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          6/0 (search/found)
+Automa host:          3/0 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     3/0 (search/found)
diff --git a/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out b/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out
index a77547948..8b8644fc5 100644
--- a/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out
+++ b/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      1/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/log4j-webapp-exploit.pcap.out b/tests/result/log4j-webapp-exploit.pcap.out
index a7aa71bc2..89c5eb555 100644
--- a/tests/result/log4j-webapp-exploit.pcap.out
+++ b/tests/result/log4j-webapp-exploit.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          6/0 (search/found)
+Automa host:          3/0 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     3/0 (search/found)
diff --git a/tests/result/malformed_dns.pcap.out b/tests/result/malformed_dns.pcap.out
index 3d6257b7b..77b0cb14d 100644
--- a/tests/result/malformed_dns.pcap.out
+++ b/tests/result/malformed_dns.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/malware.pcap.out b/tests/result/malware.pcap.out
index ce8ec1822..c0fc29668 100644
--- a/tests/result/malware.pcap.out
+++ b/tests/result/malware.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          6/0 (search/found)
+Automa host:          4/0 (search/found)
 Automa domain:        4/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/mpeg-dash.pcap.out b/tests/result/mpeg-dash.pcap.out
index 30c2174e9..67abd250e 100644
--- a/tests/result/mpeg-dash.pcap.out
+++ b/tests/result/mpeg-dash.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          3/0 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/mpeg.pcap.out b/tests/result/mpeg.pcap.out
index 805334852..8f5369e36 100644
--- a/tests/result/mpeg.pcap.out
+++ b/tests/result/mpeg.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/2 (search/found)
+Automa host:          1/1 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out
index fa92ce156..0d06804e3 100644
--- a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out
+++ b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out
index 1934c7e6d..7cf3e6357 100644
--- a/tests/result/nest_log_sink.pcap.out
+++ b/tests/result/nest_log_sink.pcap.out
@@ -12,7 +12,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/netbios_wildcard_dns_query.pcap.out b/tests/result/netbios_wildcard_dns_query.pcap.out
index 8cd60f87a..cbaea83bf 100644
--- a/tests/result/netbios_wildcard_dns_query.pcap.out
+++ b/tests/result/netbios_wildcard_dns_query.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/netflix.pcap.out b/tests/result/netflix.pcap.out
index 1b0c8b172..0952ca97d 100644
--- a/tests/result/netflix.pcap.out
+++ b/tests/result/netflix.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          92/66 (search/found)
+Automa host:          72/50 (search/found)
 Automa domain:        72/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     13/0 (search/found)
diff --git a/tests/result/nintendo.pcap.out b/tests/result/nintendo.pcap.out
index fc70776e7..dc5c6839b 100644
--- a/tests/result/nintendo.pcap.out
+++ b/tests/result/nintendo.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          13/13 (search/found)
+Automa host:          10/10 (search/found)
 Automa domain:        10/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/no_sni.pcap.out b/tests/result/no_sni.pcap.out
index 11f6e0813..a1d7ac14f 100644
--- a/tests/result/no_sni.pcap.out
+++ b/tests/result/no_sni.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          5/1 (search/found)
+Automa host:          3/1 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/ocs.pcap.out b/tests/result/ocs.pcap.out
index bdaf75ede..3fa3304dc 100644
--- a/tests/result/ocs.pcap.out
+++ b/tests/result/ocs.pcap.out
@@ -12,7 +12,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          24/18 (search/found)
+Automa host:          16/12 (search/found)
 Automa domain:        16/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/ocsp.pcapng.out b/tests/result/ocsp.pcapng.out
index b1c0f8903..3d018a425 100644
--- a/tests/result/ocsp.pcapng.out
+++ b/tests/result/ocsp.pcapng.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          17/4 (search/found)
+Automa host:          10/3 (search/found)
 Automa domain:        10/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/pinterest.pcap.out b/tests/result/pinterest.pcap.out
index 8fc419ded..b8c354674 100644
--- a/tests/result/pinterest.pcap.out
+++ b/tests/result/pinterest.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          25/17 (search/found)
+Automa host:          22/17 (search/found)
 Automa domain:        22/0 (search/found)
 Automa tls cert:      2/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/pop3_stls.pcap.out b/tests/result/pop3_stls.pcap.out
index 4009a9757..9448ac394 100644
--- a/tests/result/pop3_stls.pcap.out
+++ b/tests/result/pop3_stls.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          3/0 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      1/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/pops.pcapng.out b/tests/result/pops.pcapng.out
index 0b1470474..b56732b72 100644
--- a/tests/result/pops.pcapng.out
+++ b/tests/result/pops.pcapng.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/pps.pcap.out b/tests/result/pps.pcap.out
index ccaf927e3..f41869f0d 100644
--- a/tests/result/pps.pcap.out
+++ b/tests/result/pps.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          113/33 (search/found)
+Automa host:          57/17 (search/found)
 Automa domain:        57/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/punycode-idn.pcap.out b/tests/result/punycode-idn.pcap.out
index 84c9bc558..0f56c9639 100644
--- a/tests/result/punycode-idn.pcap.out
+++ b/tests/result/punycode-idn.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          8/3 (search/found)
+Automa host:          5/2 (search/found)
 Automa domain:        5/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/quic-23.pcap.out b/tests/result/quic-23.pcap.out
index 41f2339e2..377b1cfb2 100644
--- a/tests/result/quic-23.pcap.out
+++ b/tests/result/quic-23.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/quic-24.pcap.out b/tests/result/quic-24.pcap.out
index 0a3489438..4815bc387 100644
--- a/tests/result/quic-24.pcap.out
+++ b/tests/result/quic-24.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/quic-29.pcap.out b/tests/result/quic-29.pcap.out
index c46f6158c..c9e930594 100644
--- a/tests/result/quic-29.pcap.out
+++ b/tests/result/quic-29.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/quic_0RTT.pcap.out b/tests/result/quic_0RTT.pcap.out
index 9496dd97f..87f26aaf5 100644
--- a/tests/result/quic_0RTT.pcap.out
+++ b/tests/result/quic_0RTT.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          3/1 (search/found)
+Automa host:          2/1 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out b/tests/result/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out
index 9c44c8d7d..1b599110b 100644
--- a/tests/result/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out
+++ b/tests/result/quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          115/111 (search/found)
+Automa host:          113/111 (search/found)
 Automa domain:        113/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/quic_interop_V.pcapng.out b/tests/result/quic_interop_V.pcapng.out
index 374889117..03939e75b 100644
--- a/tests/result/quic_interop_V.pcapng.out
+++ b/tests/result/quic_interop_V.pcapng.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          114/3 (search/found)
+Automa host:          63/3 (search/found)
 Automa domain:        63/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     42/0 (search/found)
diff --git a/tests/result/quickplay.pcap.out b/tests/result/quickplay.pcap.out
index 8005f1472..5a1025638 100644
--- a/tests/result/quickplay.pcap.out
+++ b/tests/result/quickplay.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          67/11 (search/found)
+Automa host:          38/10 (search/found)
 Automa domain:        38/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     5/0 (search/found)
diff --git a/tests/result/reddit.pcap.out b/tests/result/reddit.pcap.out
index 8877baa6d..a20e84669 100644
--- a/tests/result/reddit.pcap.out
+++ b/tests/result/reddit.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          82/47 (search/found)
+Automa host:          70/47 (search/found)
 Automa domain:        70/0 (search/found)
 Automa tls cert:      2/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/safari.pcap.out b/tests/result/safari.pcap.out
index bbee98b07..c5ac693b5 100644
--- a/tests/result/safari.pcap.out
+++ b/tests/result/safari.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          16/0 (search/found)
+Automa host:          9/0 (search/found)
 Automa domain:        9/0 (search/found)
 Automa tls cert:      2/0 (search/found)
 Automa risk mask:     5/0 (search/found)
diff --git a/tests/result/selfsigned.pcap.out b/tests/result/selfsigned.pcap.out
index 6d3f0d27c..e9dcfc48a 100644
--- a/tests/result/selfsigned.pcap.out
+++ b/tests/result/selfsigned.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   1/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      1/1 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/signal.pcap.out b/tests/result/signal.pcap.out
index 4591debf5..4e48c8616 100644
--- a/tests/result/signal.pcap.out
+++ b/tests/result/signal.pcap.out
@@ -12,7 +12,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          19/15 (search/found)
+Automa host:          16/14 (search/found)
 Automa domain:        16/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/simple-dnscrypt.pcap.out b/tests/result/simple-dnscrypt.pcap.out
index 9c078ab33..f9494c498 100644
--- a/tests/result/simple-dnscrypt.pcap.out
+++ b/tests/result/simple-dnscrypt.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   1/3/3 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          16/16 (search/found)
+Automa host:          12/12 (search/found)
 Automa domain:        12/0 (search/found)
 Automa tls cert:      1/1 (search/found)
 Automa risk mask:     4/0 (search/found)
diff --git a/tests/result/sites.pcapng.out b/tests/result/sites.pcapng.out
index 3a6bd2cf0..6588f0a2d 100644
--- a/tests/result/sites.pcapng.out
+++ b/tests/result/sites.pcapng.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    1/0/0 (insert/search/found)
-Automa host:          58/43 (search/found)
+Automa host:          52/42 (search/found)
 Automa domain:        52/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out
index decde54ed..10aebf475 100644
--- a/tests/result/skype.pcap.out
+++ b/tests/result/skype.pcap.out
@@ -15,7 +15,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   1/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          213/197 (search/found)
+Automa host:          181/167 (search/found)
 Automa domain:        181/0 (search/found)
 Automa tls cert:      1/1 (search/found)
 Automa risk mask:     3/0 (search/found)
diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out
index 8fa014d3d..e1146bf0e 100644
--- a/tests/result/skype_no_unknown.pcap.out
+++ b/tests/result/skype_no_unknown.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   1/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          159/143 (search/found)
+Automa host:          135/121 (search/found)
 Automa domain:        130/0 (search/found)
 Automa tls cert:      1/1 (search/found)
 Automa risk mask:     4/0 (search/found)
diff --git a/tests/result/smtp-starttls.pcap.out b/tests/result/smtp-starttls.pcap.out
index b5f55902c..d7a29394e 100644
--- a/tests/result/smtp-starttls.pcap.out
+++ b/tests/result/smtp-starttls.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/1 (search/found)
+Automa host:          3/1 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      1/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/soap.pcap.out b/tests/result/soap.pcap.out
index ef34f41b8..baf4978e9 100644
--- a/tests/result/soap.pcap.out
+++ b/tests/result/soap.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/2 (search/found)
+Automa host:          1/1 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/softether.pcap.out b/tests/result/softether.pcap.out
index 0a92cc4d3..7212d1e7b 100644
--- a/tests/result/softether.pcap.out
+++ b/tests/result/softether.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/2 (search/found)
+Automa host:          1/1 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/sql_injection.pcap.out b/tests/result/sql_injection.pcap.out
index e971e89bb..09fdcb735 100644
--- a/tests/result/sql_injection.pcap.out
+++ b/tests/result/sql_injection.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/ssl-cert-name-mismatch.pcap.out b/tests/result/ssl-cert-name-mismatch.pcap.out
index f93322b18..adb1dfada 100644
--- a/tests/result/ssl-cert-name-mismatch.pcap.out
+++ b/tests/result/ssl-cert-name-mismatch.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          3/0 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out
index 9c64d7af2..c18766832 100644
--- a/tests/result/starcraft_battle.pcap.out
+++ b/tests/result/starcraft_battle.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          69/3 (search/found)
+Automa host:          41/2 (search/found)
 Automa domain:        41/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     4/0 (search/found)
diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out
index 227eb9250..d67105ecb 100644
--- a/tests/result/teams.pcap.out
+++ b/tests/result/teams.pcap.out
@@ -15,7 +15,7 @@ LRU cache stun:       6/40/18 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    24/13/9 (insert/search/found)
-Automa host:          117/85 (search/found)
+Automa host:          85/69 (search/found)
 Automa domain:        85/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     21/0 (search/found)
diff --git a/tests/result/telegram.pcap.out b/tests/result/telegram.pcap.out
index 265da3db0..a50b7a4ce 100644
--- a/tests/result/telegram.pcap.out
+++ b/tests/result/telegram.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          53/17 (search/found)
+Automa host:          41/13 (search/found)
 Automa domain:        39/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     4/0 (search/found)
diff --git a/tests/result/tk.pcap.out b/tests/result/tk.pcap.out
index 1176a09bf..f19c9b140 100644
--- a/tests/result/tk.pcap.out
+++ b/tests/result/tk.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          12/0 (search/found)
+Automa host:          6/0 (search/found)
 Automa domain:        6/6 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     3/0 (search/found)
diff --git a/tests/result/tls-rdn-extract.pcap.out b/tests/result/tls-rdn-extract.pcap.out
index 8d77cd6ad..1243b34b2 100644
--- a/tests/result/tls-rdn-extract.pcap.out
+++ b/tests/result/tls-rdn-extract.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          3/1 (search/found)
+Automa host:          2/1 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out
index 88a2c52af..a58410838 100644
--- a/tests/result/tls_certificate_too_long.pcap.out
+++ b/tests/result/tls_certificate_too_long.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          49/30 (search/found)
+Automa host:          39/22 (search/found)
 Automa domain:        39/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     11/0 (search/found)
diff --git a/tests/result/tls_esni_sni_both.pcap.out b/tests/result/tls_esni_sni_both.pcap.out
index 644009878..b2bc163f2 100644
--- a/tests/result/tls_esni_sni_both.pcap.out
+++ b/tests/result/tls_esni_sni_both.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/tls_long_cert.pcap.out b/tests/result/tls_long_cert.pcap.out
index 0d473c574..474cbe557 100644
--- a/tests/result/tls_long_cert.pcap.out
+++ b/tests/result/tls_long_cert.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          57/0 (search/found)
+Automa host:          56/0 (search/found)
 Automa domain:        56/0 (search/found)
 Automa tls cert:      1/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/tls_torrent.pcapng.out b/tests/result/tls_torrent.pcapng.out
index 32b015cd2..ec08af7fe 100644
--- a/tests/result/tls_torrent.pcapng.out
+++ b/tests/result/tls_torrent.pcapng.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          4/4 (search/found)
+Automa host:          3/3 (search/found)
 Automa domain:        3/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/tls_verylong_certificate.pcap.out b/tests/result/tls_verylong_certificate.pcap.out
index 4f99b8951..40fb8536c 100644
--- a/tests/result/tls_verylong_certificate.pcap.out
+++ b/tests/result/tls_verylong_certificate.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          3/0 (search/found)
+Automa host:          2/0 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      1/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/tor.pcap.out b/tests/result/tor.pcap.out
index 6827a5962..60255cc81 100644
--- a/tests/result/tor.pcap.out
+++ b/tests/result/tor.pcap.out
@@ -12,7 +12,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          15/0 (search/found)
+Automa host:          8/0 (search/found)
 Automa domain:        7/0 (search/found)
 Automa tls cert:      4/0 (search/found)
 Automa risk mask:     6/0 (search/found)
diff --git a/tests/result/trickbot.pcap.out b/tests/result/trickbot.pcap.out
index 4964a1396..61ebaa93c 100644
--- a/tests/result/trickbot.pcap.out
+++ b/tests/result/trickbot.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/tumblr.pcap.out b/tests/result/tumblr.pcap.out
index 4862a6e75..aaed20756 100644
--- a/tests/result/tumblr.pcap.out
+++ b/tests/result/tumblr.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          13/5 (search/found)
+Automa host:          9/5 (search/found)
 Automa domain:        9/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/tunnelbear.pcap.out b/tests/result/tunnelbear.pcap.out
index bb5662969..a1001e99c 100644
--- a/tests/result/tunnelbear.pcap.out
+++ b/tests/result/tunnelbear.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          29/17 (search/found)
+Automa host:          26/17 (search/found)
 Automa domain:        26/0 (search/found)
 Automa tls cert:      2/0 (search/found)
 Automa risk mask:     3/0 (search/found)
diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out
index 5f4ead1aa..ea850623c 100644
--- a/tests/result/viber.pcap.out
+++ b/tests/result/viber.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          48/14 (search/found)
+Automa host:          31/10 (search/found)
 Automa domain:        31/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/wa_voice.pcap.out b/tests/result/wa_voice.pcap.out
index 3d3194736..e8b2c8b92 100644
--- a/tests/result/wa_voice.pcap.out
+++ b/tests/result/wa_voice.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       2/16/12 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          24/14 (search/found)
+Automa host:          20/10 (search/found)
 Automa domain:        20/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/waze.pcap.out b/tests/result/waze.pcap.out
index cf18da005..490282528 100644
--- a/tests/result/waze.pcap.out
+++ b/tests/result/waze.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          21/19 (search/found)
+Automa host:          20/19 (search/found)
 Automa domain:        20/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/webex.pcap.out b/tests/result/webex.pcap.out
index fe67c4206..9d1cead9b 100644
--- a/tests/result/webex.pcap.out
+++ b/tests/result/webex.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          47/30 (search/found)
+Automa host:          44/30 (search/found)
 Automa domain:        44/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     5/0 (search/found)
diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out
index a92345235..36d190ce9 100644
--- a/tests/result/wechat.pcap.out
+++ b/tests/result/wechat.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          118/63 (search/found)
+Automa host:          96/51 (search/found)
 Automa domain:        94/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     29/0 (search/found)
diff --git a/tests/result/weibo.pcap.out b/tests/result/weibo.pcap.out
index f24fbdd66..f95ccb417 100644
--- a/tests/result/weibo.pcap.out
+++ b/tests/result/weibo.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          57/43 (search/found)
+Automa host:          32/25 (search/found)
 Automa domain:        32/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     2/0 (search/found)
diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out
index c2e21e9e6..517952f8f 100644
--- a/tests/result/whatsapp_login_call.pcap.out
+++ b/tests/result/whatsapp_login_call.pcap.out
@@ -14,7 +14,7 @@ LRU cache stun:       4/42/36 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          17/9 (search/found)
+Automa host:          15/7 (search/found)
 Automa domain:        15/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     3/0 (search/found)
diff --git a/tests/result/whatsapp_login_chat.pcap.out b/tests/result/whatsapp_login_chat.pcap.out
index bac1c9b54..4eaa234b1 100644
--- a/tests/result/whatsapp_login_chat.pcap.out
+++ b/tests/result/whatsapp_login_chat.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          5/3 (search/found)
+Automa host:          4/2 (search/found)
 Automa domain:        4/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/windowsupdate_over_http.pcap.out b/tests/result/windowsupdate_over_http.pcap.out
index 4e6a411c7..bd3491343 100644
--- a/tests/result/windowsupdate_over_http.pcap.out
+++ b/tests/result/windowsupdate_over_http.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/wow.pcap.out b/tests/result/wow.pcap.out
index 94dfa5255..f03ac56d5 100644
--- a/tests/result/wow.pcap.out
+++ b/tests/result/wow.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          3/3 (search/found)
+Automa host:          2/2 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/xiaomi.pcap.out b/tests/result/xiaomi.pcap.out
index 1d30af761..bfa7dc8f1 100644
--- a/tests/result/xiaomi.pcap.out
+++ b/tests/result/xiaomi.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/xss.pcap.out b/tests/result/xss.pcap.out
index a0b479d6f..322de9a3b 100644
--- a/tests/result/xss.pcap.out
+++ b/tests/result/xss.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          2/0 (search/found)
+Automa host:          1/0 (search/found)
 Automa domain:        1/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
diff --git a/tests/result/zattoo.pcap.out b/tests/result/zattoo.pcap.out
index 8d7e03d3b..5cc8c5695 100644
--- a/tests/result/zattoo.pcap.out
+++ b/tests/result/zattoo.pcap.out
@@ -10,7 +10,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          3/3 (search/found)
+Automa host:          2/2 (search/found)
 Automa domain:        2/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     1/0 (search/found)
diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out
index 061cb3e29..7c1ce7536 100644
--- a/tests/result/zoom.pcap.out
+++ b/tests/result/zoom.pcap.out
@@ -13,7 +13,7 @@ LRU cache stun:       2/6/4 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/0/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-Automa host:          33/25 (search/found)
+Automa host:          25/20 (search/found)
 Automa domain:        24/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     7/0 (search/found)