diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2022-04-21 20:43:52 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-04-21 20:43:52 +0200 |
| commit | 42909673ced0b5431c233b47d40ca759c3415b2a (patch) | |
| tree | 3a3f18416f0b5f32a27447adb57074430cb5013a | |
| parent | ddc256b09ec89580ea1ba00d0fa69e022c45474c (diff) | |
Add some scripts to easily update some IPs lists (#1522)
Follow-up of 8b062295
Add a new protocol id for generic Tencent/Wechat flows
23 files changed, 878 insertions, 207 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index f1ff5b30b..f8f1ba919 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -313,6 +313,7 @@ typedef enum { NDPI_PROTOCOL_HSRP = 282, NDPI_PROTOCOL_CYBERSECURITY = 283, /* Cybersecurity companies */ NDPI_PROTOCOL_GOOGLE_CLOUD = 284, + NDPI_PROTOCOL_TENCENT = 285, #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" diff --git a/src/lib/inc_generated/ndpi_asn_bloomberg.c.inc b/src/lib/inc_generated/ndpi_asn_bloomberg.c.inc new file mode 100644 index 000000000..7ee6acb54 --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_bloomberg.c.inc @@ -0,0 +1,68 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_bloomberg_protocol_list[] = { + { 0x3F580300 /* 63.88.3.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x4173E200 /* 65.115.226.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BB1000 /* 69.187.16.0/21 */, 21, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BB1800 /* 69.187.24.0/22 */, 22, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BB1D00 /* 69.187.29.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BB1F00 /* 69.187.31.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BB2000 /* 69.187.32.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BB4900 /* 69.187.73.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BF5000 /* 69.191.80.0/21 */, 21, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BF8800 /* 69.191.136.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFB000 /* 69.191.176.0/21 */, 21, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFB800 /* 69.191.184.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFBA00 /* 69.191.186.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFBC00 /* 69.191.188.0/22 */, 22, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFC000 /* 69.191.192.0/22 */, 22, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFC600 /* 69.191.198.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFC800 /* 69.191.200.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFCA00 /* 69.191.202.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFCC00 /* 69.191.204.0/22 */, 22, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFD000 /* 69.191.208.0/22 */, 22, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFD400 /* 69.191.212.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFD600 /* 69.191.214.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFD800 /* 69.191.216.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFDA00 /* 69.191.218.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFDC00 /* 69.191.220.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFE200 /* 69.191.226.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFE500 /* 69.191.229.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFE600 /* 69.191.230.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFE900 /* 69.191.233.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFEA00 /* 69.191.234.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFED00 /* 69.191.237.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFEF00 /* 69.191.239.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0x45BFF000 /* 69.191.240.0/20 */, 20, NDPI_PROTOCOL_BLOOMBERG }, + { 0x67FBCC00 /* 103.251.204.0/22 */, 22, NDPI_PROTOCOL_BLOOMBERG }, + { 0xA02BFA00 /* 160.43.250.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + { 0xA02BFD00 /* 160.43.253.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0xB90A7400 /* 185.10.116.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + { 0xC7ACA900 /* 199.172.169.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0xCCB3F000 /* 204.179.240.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0xCDD87000 /* 205.216.112.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0xCE9C3500 /* 206.156.53.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, + { 0xD0163800 /* 208.22.56.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_citrix.c.inc b/src/lib/inc_generated/ndpi_asn_citrix.c.inc new file mode 100644 index 000000000..bfb5983bd --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_citrix.c.inc @@ -0,0 +1,89 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_citrix_protocol_list[] = { + { 0x17EFE300 /* 23.239.227.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x404A1100 /* 64.74.17.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x404A1200 /* 64.74.18.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x405F8000 /* 64.95.128.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x43D94000 /* 67.217.64.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x43D94300 /* 67.217.67.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x43D94400 /* 67.217.68.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + { 0x43D94800 /* 67.217.72.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x43D94B00 /* 67.217.75.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x43D94C00 /* 67.217.76.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x43D94E00 /* 67.217.78.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x43D95000 /* 67.217.80.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x43D95200 /* 67.217.82.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x43D95400 /* 67.217.84.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x43D95600 /* 67.217.86.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x43D95800 /* 67.217.88.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x43D95A00 /* 67.217.90.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x43D95C00 /* 67.217.92.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + { 0x44400000 /* 68.64.0.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x44400200 /* 68.64.2.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x44400600 /* 68.64.6.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x44400800 /* 68.64.8.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x44400A00 /* 68.64.10.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x44400C00 /* 68.64.12.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + { 0x44401000 /* 68.64.16.0/21 */, 21, NDPI_PROTOCOL_CITRIX }, + { 0x44401800 /* 68.64.24.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + { 0x44401C00 /* 68.64.28.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x44401E00 /* 68.64.30.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0x4E6C7400 /* 78.108.116.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + { 0x4E6C7800 /* 78.108.120.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x4E6C7E00 /* 78.108.126.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0x5FAC4600 /* 95.172.70.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xADC70000 /* 173.199.0.0/21 */, 21, NDPI_PROTOCOL_CITRIX }, + { 0xADC70A00 /* 173.199.10.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xADC70C00 /* 173.199.12.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xADC70F00 /* 173.199.15.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xADC71100 /* 173.199.17.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xADC71200 /* 173.199.18.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xADC71400 /* 173.199.20.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xADC71700 /* 173.199.23.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xADC71800 /* 173.199.24.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + { 0xADC71E00 /* 173.199.30.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xADC72000 /* 173.199.32.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xADC72800 /* 173.199.40.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xADC72A00 /* 173.199.42.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xADC72C00 /* 173.199.44.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + { 0xADC73000 /* 173.199.48.0/21 */, 21, NDPI_PROTOCOL_CITRIX }, + { 0xADC73C00 /* 173.199.60.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + { 0xBC422B00 /* 188.66.43.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xCAAD1900 /* 202.173.25.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xCEB76400 /* 206.183.100.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xD873D000 /* 216.115.208.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xD873D200 /* 216.115.210.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xD873D500 /* 216.115.213.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xD873D600 /* 216.115.214.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xD873D900 /* 216.115.217.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xD873DA00 /* 216.115.218.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xD873DD00 /* 216.115.221.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xD873DE00 /* 216.115.222.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xD8DB7200 /* 216.219.114.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xD8DB7400 /* 216.219.116.0/23 */, 23, NDPI_PROTOCOL_CITRIX }, + { 0xD8DB7700 /* 216.219.119.0/24 */, 24, NDPI_PROTOCOL_CITRIX }, + { 0xD8DB7800 /* 216.219.120.0/22 */, 22, NDPI_PROTOCOL_CITRIX }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_dropbox.c.inc b/src/lib/inc_generated/ndpi_asn_dropbox.c.inc new file mode 100644 index 000000000..27c7b6111 --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_dropbox.c.inc @@ -0,0 +1,33 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_dropbox_protocol_list[] = { + { 0x2D3A4000 /* 45.58.64.0/20 */, 20, NDPI_PROTOCOL_DROPBOX }, + { 0x40700D00 /* 64.112.13.0/24 */, 24, NDPI_PROTOCOL_DROPBOX }, + { 0x6CA0A000 /* 108.160.160.0/20 */, 20, NDPI_PROTOCOL_DROPBOX }, + { 0xA27D0000 /* 162.125.0.0/16 */, 16, NDPI_PROTOCOL_DROPBOX }, + { 0xB92D0800 /* 185.45.8.0/22 */, 22, NDPI_PROTOCOL_DROPBOX }, + { 0xB969A400 /* 185.105.164.0/24 */, 24, NDPI_PROTOCOL_DROPBOX }, + { 0xC0BDC800 /* 192.189.200.0/23 */, 23, NDPI_PROTOCOL_DROPBOX }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_facebook.c.inc b/src/lib/inc_generated/ndpi_asn_facebook.c.inc index d5719fcb3..2ed720342 100644 --- a/src/lib/inc_generated/ndpi_asn_facebook.c.inc +++ b/src/lib/inc_generated/ndpi_asn_facebook.c.inc @@ -53,13 +53,16 @@ static ndpi_network ndpi_protocol_facebook_protocol_list[] = { { 0x8186A000 /* 129.134.160.0/24 */, 24, NDPI_PROTOCOL_FACEBOOK }, { 0x8186A300 /* 129.134.163.0/24 */, 24, NDPI_PROTOCOL_FACEBOOK }, { 0x8186A400 /* 129.134.164.0/23 */, 23, NDPI_PROTOCOL_FACEBOOK }, + { 0x8186A900 /* 129.134.169.0/24 */, 24, NDPI_PROTOCOL_FACEBOOK }, { 0x8186AA00 /* 129.134.170.0/23 */, 23, NDPI_PROTOCOL_FACEBOOK }, { 0x9DF00000 /* 157.240.0.0/17 */, 17, NDPI_PROTOCOL_FACEBOOK }, { 0x9DF08000 /* 157.240.128.0/24 */, 24, NDPI_PROTOCOL_FACEBOOK }, - { 0x9DF09E00 /* 157.240.158.0/23 */, 23, NDPI_PROTOCOL_FACEBOOK }, + { 0x9DF09C00 /* 157.240.156.0/24 */, 24, NDPI_PROTOCOL_FACEBOOK }, + { 0x9DF09F00 /* 157.240.159.0/24 */, 24, NDPI_PROTOCOL_FACEBOOK }, { 0x9DF0AC00 /* 157.240.172.0/24 */, 24, NDPI_PROTOCOL_FACEBOOK }, { 0x9DF0AE00 /* 157.240.174.0/23 */, 23, NDPI_PROTOCOL_FACEBOOK }, - { 0x9DF0B000 /* 157.240.176.0/22 */, 22, NDPI_PROTOCOL_FACEBOOK }, + { 0x9DF0B000 /* 157.240.176.0/23 */, 23, NDPI_PROTOCOL_FACEBOOK }, + { 0x9DF0B300 /* 157.240.179.0/24 */, 24, NDPI_PROTOCOL_FACEBOOK }, { 0x9DF0B400 /* 157.240.180.0/23 */, 23, NDPI_PROTOCOL_FACEBOOK }, { 0x9DF0C000 /* 157.240.192.0/18 */, 18, NDPI_PROTOCOL_FACEBOOK }, { 0xA3728000 /* 163.114.128.0/20 */, 20, NDPI_PROTOCOL_FACEBOOK }, diff --git a/src/lib/inc_generated/ndpi_asn_github.c.inc b/src/lib/inc_generated/ndpi_asn_github.c.inc new file mode 100644 index 000000000..40d40210b --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_github.c.inc @@ -0,0 +1,29 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_github_protocol_list[] = { + { 0x8C527000 /* 140.82.112.0/20 */, 20, NDPI_PROTOCOL_GITHUB }, + { 0x8F374000 /* 143.55.64.0/20 */, 20, NDPI_PROTOCOL_GITHUB }, + { 0xC01EFC00 /* 192.30.252.0/22 */, 22, NDPI_PROTOCOL_GITHUB }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_hotspotshield.c.inc b/src/lib/inc_generated/ndpi_asn_hotspotshield.c.inc new file mode 100644 index 000000000..6d9e48a9d --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_hotspotshield.c.inc @@ -0,0 +1,26 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_hotspot_shield_protocol_list[] = { + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_opendns.c.inc b/src/lib/inc_generated/ndpi_asn_opendns.c.inc new file mode 100644 index 000000000..17d1da96b --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_opendns.c.inc @@ -0,0 +1,123 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_opendns_protocol_list[] = { + { 0x43D74000 /* 67.215.64.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x43D74200 /* 67.215.66.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D74400 /* 67.215.68.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x43D74600 /* 67.215.70.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D74900 /* 67.215.73.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D74B00 /* 67.215.75.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D74C00 /* 67.215.76.0/22 */, 22, NDPI_PROTOCOL_OPENDNS }, + { 0x43D75000 /* 67.215.80.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D75200 /* 67.215.82.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x43D75400 /* 67.215.84.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x43D75600 /* 67.215.86.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D75800 /* 67.215.88.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D75B00 /* 67.215.91.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D75C00 /* 67.215.92.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x43D75E00 /* 67.215.94.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92700000 /* 146.112.0.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, + { 0x92700B00 /* 146.112.11.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92700C00 /* 146.112.12.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92700E00 /* 146.112.14.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x92701000 /* 146.112.16.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x92701200 /* 146.112.18.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92701400 /* 146.112.20.0/22 */, 22, NDPI_PROTOCOL_OPENDNS }, + { 0x92701800 /* 146.112.24.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x92701A00 /* 146.112.26.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92701C00 /* 146.112.28.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x92701F00 /* 146.112.31.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92702100 /* 146.112.33.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92702200 /* 146.112.34.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x92702400 /* 146.112.36.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x92702600 /* 146.112.38.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92702800 /* 146.112.40.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, + { 0x92703000 /* 146.112.48.0/20 */, 20, NDPI_PROTOCOL_OPENDNS }, + { 0x92704000 /* 146.112.64.0/22 */, 22, NDPI_PROTOCOL_OPENDNS }, + { 0x92704800 /* 146.112.72.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x92704E00 /* 146.112.78.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x92705000 /* 146.112.80.0/20 */, 20, NDPI_PROTOCOL_OPENDNS }, + { 0x92706000 /* 146.112.96.0/20 */, 20, NDPI_PROTOCOL_OPENDNS }, + { 0x92707000 /* 146.112.112.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, + { 0x92708000 /* 146.112.128.0/19 */, 19, NDPI_PROTOCOL_OPENDNS }, + { 0x9270A000 /* 146.112.160.0/20 */, 20, NDPI_PROTOCOL_OPENDNS }, + { 0x9270B000 /* 146.112.176.0/22 */, 22, NDPI_PROTOCOL_OPENDNS }, + { 0x9270B800 /* 146.112.184.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9270BA00 /* 146.112.186.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9270BE00 /* 146.112.190.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9270C000 /* 146.112.192.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, + { 0x9270C800 /* 146.112.200.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9270CB00 /* 146.112.203.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9270CC00 /* 146.112.204.0/22 */, 22, NDPI_PROTOCOL_OPENDNS }, + { 0x9270D000 /* 146.112.208.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9270D200 /* 146.112.210.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9270D400 /* 146.112.212.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9270D600 /* 146.112.214.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9270D800 /* 146.112.216.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9270DB00 /* 146.112.219.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9270DD00 /* 146.112.221.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9270DE00 /* 146.112.222.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9270E000 /* 146.112.224.0/19 */, 19, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE0000 /* 155.190.0.0/22 */, 22, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE0800 /* 155.190.8.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE0F00 /* 155.190.15.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE1100 /* 155.190.17.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE1200 /* 155.190.18.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE1400 /* 155.190.20.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE1C00 /* 155.190.28.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE2100 /* 155.190.33.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE2200 /* 155.190.34.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE2400 /* 155.190.36.0/22 */, 22, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE2A00 /* 155.190.42.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE2C00 /* 155.190.44.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE2E00 /* 155.190.46.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE3000 /* 155.190.48.0/22 */, 22, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE3500 /* 155.190.53.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE3600 /* 155.190.54.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE4200 /* 155.190.66.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE4400 /* 155.190.68.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE4600 /* 155.190.70.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE5300 /* 155.190.83.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE7400 /* 155.190.116.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE8000 /* 155.190.128.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE8900 /* 155.190.137.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE8A00 /* 155.190.138.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBE8C00 /* 155.190.140.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBEA000 /* 155.190.160.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBEC000 /* 155.190.192.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBEC900 /* 155.190.201.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBECA00 /* 155.190.202.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBEF800 /* 155.190.248.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBEFA00 /* 155.190.250.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0x9BBEFE00 /* 155.190.254.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0xB93C5400 /* 185.60.84.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0xB93C5600 /* 185.60.86.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0xCCC2E800 /* 204.194.232.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0xCCC2EA00 /* 204.194.234.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0xCCC2ED00 /* 204.194.237.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, + { 0xCCC2EE00 /* 204.194.238.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, + { 0xD043D800 /* 208.67.216.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, + { 0xD0452000 /* 208.69.32.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_starcraft.c.inc b/src/lib/inc_generated/ndpi_asn_starcraft.c.inc new file mode 100644 index 000000000..a15e0fce5 --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_starcraft.c.inc @@ -0,0 +1,58 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_starcraft_protocol_list[] = { + { 0x052AA800 /* 5.42.168.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT }, + { 0x052AB000 /* 5.42.176.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT }, + { 0x18690000 /* 24.105.0.0/18 */, 18, NDPI_PROTOCOL_STARCRAFT }, + { 0x25F40000 /* 37.244.0.0/19 */, 19, NDPI_PROTOCOL_STARCRAFT }, + { 0x25F42000 /* 37.244.32.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT }, + { 0x25F43000 /* 37.244.48.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x25F43200 /* 37.244.50.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT }, + { 0x25F43400 /* 37.244.52.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, + { 0x25F43800 /* 37.244.56.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT }, + { 0x3B992800 /* 59.153.40.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x67C62000 /* 103.198.32.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x6E2DD000 /* 110.45.208.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT }, + { 0x75340600 /* 117.52.6.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT }, + { 0x75341A00 /* 117.52.26.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x75341C00 /* 117.52.28.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x75342100 /* 117.52.33.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT }, + { 0x75342200 /* 117.52.34.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x75342400 /* 117.52.36.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x79FE8900 /* 121.254.137.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT }, + { 0x79FECE00 /* 121.254.206.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x79FEDA00 /* 121.254.218.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT }, + { 0x89DD4000 /* 137.221.64.0/19 */, 19, NDPI_PROTOCOL_STARCRAFT }, + { 0x89DD6000 /* 137.221.96.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT }, + { 0x89DD6800 /* 137.221.104.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, + { 0x89DD6C00 /* 137.221.108.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + { 0x89DD6E00 /* 137.221.110.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT }, + { 0x9E73C000 /* 158.115.192.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT }, + { 0x9E73D800 /* 158.115.216.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT }, + { 0xB6A21F00 /* 182.162.31.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT }, + { 0xB93C7000 /* 185.60.112.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, + { 0xC64A2000 /* 198.74.32.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, + { 0xC64A2400 /* 198.74.36.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_steam.c.inc b/src/lib/inc_generated/ndpi_asn_steam.c.inc new file mode 100644 index 000000000..7429b72f5 --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_steam.c.inc @@ -0,0 +1,48 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_steam_protocol_list[] = { + { 0x670A7C00 /* 103.10.124.0/23 */, 23, NDPI_PROTOCOL_STEAM }, + { 0x671C3600 /* 103.28.54.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0x92429800 /* 146.66.152.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0x92429B00 /* 146.66.155.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0x99FE5600 /* 153.254.86.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0x9B85E000 /* 155.133.224.0/22 */, 22, NDPI_PROTOCOL_STEAM }, + { 0x9B85E600 /* 155.133.230.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0x9B85E800 /* 155.133.232.0/23 */, 23, NDPI_PROTOCOL_STEAM }, + { 0x9B85EA00 /* 155.133.234.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0x9B85EC00 /* 155.133.236.0/22 */, 22, NDPI_PROTOCOL_STEAM }, + { 0x9B85F000 /* 155.133.240.0/23 */, 23, NDPI_PROTOCOL_STEAM }, + { 0x9B85F500 /* 155.133.245.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0x9B85F600 /* 155.133.246.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0x9B85F800 /* 155.133.248.0/21 */, 21, NDPI_PROTOCOL_STEAM }, + { 0xA2FEC000 /* 162.254.192.0/21 */, 21, NDPI_PROTOCOL_STEAM }, + { 0xB919B600 /* 185.25.182.0/23 */, 23, NDPI_PROTOCOL_STEAM }, + { 0xBED92100 /* 190.217.33.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0xC0456000 /* 192.69.96.0/22 */, 22, NDPI_PROTOCOL_STEAM }, + { 0xCDB9C200 /* 205.185.194.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0xCDC40600 /* 205.196.6.0/24 */, 24, NDPI_PROTOCOL_STEAM }, + { 0xD040C800 /* 208.64.200.0/22 */, 22, NDPI_PROTOCOL_STEAM }, + { 0xD04EA400 /* 208.78.164.0/22 */, 22, NDPI_PROTOCOL_STEAM }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_tencent.c.inc b/src/lib/inc_generated/ndpi_asn_tencent.c.inc new file mode 100644 index 000000000..30988f267 --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_tencent.c.inc @@ -0,0 +1,209 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_tencent_protocol_list[] = { + { 0x010C0000 /* 1.12.0.0/14 */, 14, NDPI_PROTOCOL_TENCENT }, + { 0x01740000 /* 1.116.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x01C9B800 /* 1.201.184.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x01C9BC00 /* 1.201.188.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x2ABB8000 /* 42.187.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x2AC00000 /* 42.192.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x2AC28000 /* 42.194.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x2B800000 /* 43.128.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x2B820000 /* 43.130.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x2B830000 /* 43.131.0.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x2B838000 /* 43.131.128.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0x2B83C000 /* 43.131.192.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x2B840000 /* 43.132.0.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x2B844400 /* 43.132.68.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0x2B844600 /* 43.132.70.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x2B845400 /* 43.132.84.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x2B845E00 /* 43.132.94.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x2B846000 /* 43.132.96.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0x2B848000 /* 43.132.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x2B850000 /* 43.133.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x2B860000 /* 43.134.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x2B870000 /* 43.135.0.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x2B878000 /* 43.135.128.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x2B87C000 /* 43.135.192.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0x2B880000 /* 43.136.0.0/13 */, 13, NDPI_PROTOCOL_TENCENT }, + { 0x2B900000 /* 43.144.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x2B984000 /* 43.152.64.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0x2B984200 /* 43.152.66.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x2B984400 /* 43.152.68.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x2B984800 /* 43.152.72.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0x2B985000 /* 43.152.80.0/20 */, 20, NDPI_PROTOCOL_TENCENT }, + { 0x2B98C000 /* 43.152.192.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x2B990000 /* 43.153.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x2B9A0000 /* 43.154.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x2B9C0000 /* 43.156.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x2B9E0000 /* 43.158.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x2B9F0000 /* 43.159.0.0/20 */, 20, NDPI_PROTOCOL_TENCENT }, + { 0x2B9F2000 /* 43.159.32.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0x2B9F8000 /* 43.159.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x2BF2FC00 /* 43.242.252.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x2BF7C400 /* 43.247.196.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x2D28C000 /* 45.40.192.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x2D714400 /* 45.113.68.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x2D927000 /* 45.146.112.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x31330000 /* 49.51.0.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0x31332000 /* 49.51.32.0/20 */, 20, NDPI_PROTOCOL_TENCENT }, + { 0x31333000 /* 49.51.48.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0x31333E00 /* 49.51.62.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x31334000 /* 49.51.64.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0x31336000 /* 49.51.96.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0x31336800 /* 49.51.104.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x31336C00 /* 49.51.108.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x31338000 /* 49.51.128.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x3133C000 /* 49.51.192.0/20 */, 20, NDPI_PROTOCOL_TENCENT }, + { 0x3133E000 /* 49.51.224.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x3133E400 /* 49.51.228.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x3133E800 /* 49.51.232.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0x3133F000 /* 49.51.240.0/20 */, 20, NDPI_PROTOCOL_TENCENT }, + { 0x31E80000 /* 49.232.0.0/14 */, 14, NDPI_PROTOCOL_TENCENT }, + { 0x3A574000 /* 58.87.64.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x3EEA0000 /* 62.234.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x51440000 /* 81.68.0.0/14 */, 14, NDPI_PROTOCOL_TENCENT }, + { 0x529C0000 /* 82.156.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x5EBF0000 /* 94.191.0.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x65200000 /* 101.32.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x65210000 /* 101.33.0.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x65210400 /* 101.33.4.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x65210A00 /* 101.33.10.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x65210E00 /* 101.33.14.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x65211100 /* 101.33.17.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0x65211200 /* 101.33.18.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x65211400 /* 101.33.20.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x65211A00 /* 101.33.26.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x65211E00 /* 101.33.30.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x65212000 /* 101.33.32.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0x65214000 /* 101.33.64.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x65218000 /* 101.33.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x65220000 /* 101.34.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x652A0000 /* 101.42.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x67071C00 /* 103.7.28.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x67267400 /* 103.38.116.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x6734D800 /* 103.52.216.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x67743200 /* 103.116.50.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x67EE1000 /* 103.238.16.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x6A340000 /* 106.52.0.0/14 */, 14, NDPI_PROTOCOL_TENCENT }, + { 0x6DF40000 /* 109.244.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x6E288000 /* 110.40.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x6E2A8000 /* 110.42.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x6FE50000 /* 111.229.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x6FE60000 /* 111.230.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x72750000 /* 114.117.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x72840000 /* 114.132.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x739F0000 /* 115.159.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x76180000 /* 118.24.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x76590000 /* 118.89.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x767E4000 /* 118.126.64.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x76C38000 /* 118.195.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x771BA000 /* 119.27.160.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0x771C0000 /* 119.28.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x772D0000 /* 119.45.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x775B0000 /* 119.91.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x78350000 /* 120.53.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x78583800 /* 120.88.56.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0x78E81400 /* 120.232.20.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x78F17F00 /* 120.241.127.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0x78F18000 /* 120.241.128.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0x78F18800 /* 120.241.136.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0x79040000 /* 121.4.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x79330000 /* 121.51.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x7A330000 /* 122.51.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x7A98C000 /* 122.152.192.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x7BCE0000 /* 123.206.0.0/15 */, 15, NDPI_PROTOCOL_TENCENT }, + { 0x7C9C0000 /* 124.156.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x7CDC0000 /* 124.220.0.0/14 */, 14, NDPI_PROTOCOL_TENCENT }, + { 0x806C0000 /* 128.108.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x811C0000 /* 129.28.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x81CC0000 /* 129.204.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x81D30000 /* 129.211.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x81E20000 /* 129.226.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x84E80000 /* 132.232.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x86AF0000 /* 134.175.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x8B9B0000 /* 139.155.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x8BBA0000 /* 139.186.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x8BC70000 /* 139.199.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x8C8F0000 /* 140.143.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x9238C000 /* 146.56.192.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0x94460000 /* 148.70.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x966D0000 /* 150.109.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x969E0000 /* 150.158.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x98880000 /* 152.136.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0x9A088000 /* 154.8.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0x9CF05800 /* 156.240.88.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0x9E4F0100 /* 158.79.1.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0x9F4B0000 /* 159.75.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0xA20E0000 /* 162.14.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0xA23E0000 /* 162.62.0.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0xA23E8000 /* 162.62.128.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0xA23EC000 /* 162.62.192.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0xA23EE000 /* 162.62.224.0/20 */, 20, NDPI_PROTOCOL_TENCENT }, + { 0xAA6A0000 /* 170.106.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0xAC51C000 /* 172.81.192.0/18 */, 18, NDPI_PROTOCOL_TENCENT }, + { 0xAF180000 /* 175.24.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0xAF1B0000 /* 175.27.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0xAFB20000 /* 175.178.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0xB6FE0000 /* 182.254.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0xBC838000 /* 188.131.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0xC0908000 /* 192.144.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0xC1700000 /* 193.112.0.0/16 */, 16, NDPI_PROTOCOL_TENCENT }, + { 0xCBC38000 /* 203.195.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0xCBCD8000 /* 203.205.128.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xCBCD8600 /* 203.205.134.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xCBCD8800 /* 203.205.136.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0xCBCD9000 /* 203.205.144.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0xCBCD9800 /* 203.205.152.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xCBCD9B00 /* 203.205.155.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xCBCD9C00 /* 203.205.156.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDBC00 /* 203.205.188.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDBF00 /* 203.205.191.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDC100 /* 203.205.193.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDC200 /* 203.205.194.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDC400 /* 203.205.196.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDDA00 /* 203.205.218.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDDC00 /* 203.205.220.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDE000 /* 203.205.224.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDE800 /* 203.205.232.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDF000 /* 203.205.240.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDF200 /* 203.205.242.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xCBCDF800 /* 203.205.248.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0xD249A000 /* 210.73.160.0/19 */, 19, NDPI_PROTOCOL_TENCENT }, + { 0xD2ABE800 /* 210.171.232.0/21 */, 21, NDPI_PROTOCOL_TENCENT }, + { 0xD2B44A00 /* 210.180.74.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xD3385C00 /* 211.56.92.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0xD3988000 /* 211.152.128.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0xD3988400 /* 211.152.132.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xD3988A00 /* 211.152.138.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xD3989000 /* 211.152.144.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0xD3989400 /* 211.152.148.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xD3989800 /* 211.152.152.0/22 */, 22, NDPI_PROTOCOL_TENCENT }, + { 0xD3989C00 /* 211.152.156.0/24 */, 24, NDPI_PROTOCOL_TENCENT }, + { 0xD3989E00 /* 211.152.158.0/23 */, 23, NDPI_PROTOCOL_TENCENT }, + { 0xD39F8000 /* 211.159.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0xD4400000 /* 212.64.0.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + { 0xD4818000 /* 212.129.128.0/17 */, 17, NDPI_PROTOCOL_TENCENT }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_twitch.c.inc b/src/lib/inc_generated/ndpi_asn_twitch.c.inc new file mode 100644 index 000000000..800b03073 --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_twitch.c.inc @@ -0,0 +1,35 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_twitch_protocol_list[] = { + { 0x17A00000 /* 23.160.0.0/24 */, 24, NDPI_PROTOCOL_TWITCH }, + { 0x2D718000 /* 45.113.128.0/22 */, 22, NDPI_PROTOCOL_TWITCH }, + { 0x34DFC000 /* 52.223.192.0/18 */, 18, NDPI_PROTOCOL_TWITCH }, + { 0x63B54000 /* 99.181.64.0/18 */, 18, NDPI_PROTOCOL_TWITCH }, + { 0x67353000 /* 103.53.48.0/23 */, 23, NDPI_PROTOCOL_TWITCH }, + { 0xB92ACC00 /* 185.42.204.0/22 */, 22, NDPI_PROTOCOL_TWITCH }, + { 0xC0104000 /* 192.16.64.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, + { 0xC06CEF00 /* 192.108.239.0/24 */, 24, NDPI_PROTOCOL_TWITCH }, + { 0xC709F800 /* 199.9.248.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/inc_generated/ndpi_asn_ubuntuone.c.inc b/src/lib/inc_generated/ndpi_asn_ubuntuone.c.inc new file mode 100644 index 000000000..a02a3278a --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_ubuntuone.c.inc @@ -0,0 +1,30 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_ubuntuone_protocol_list[] = { + { 0x5BBD5800 /* 91.189.88.0/21 */, 21, NDPI_PROTOCOL_UBUNTUONE }, + { 0xA2D52000 /* 162.213.32.0/22 */, 22, NDPI_PROTOCOL_UBUNTUONE }, + { 0xB97DBC00 /* 185.125.188.0/22 */, 22, NDPI_PROTOCOL_UBUNTUONE }, + { 0xC2A9FE00 /* 194.169.254.0/24 */, 24, NDPI_PROTOCOL_UBUNTUONE }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index ca52cc780..a2bd9a0d9 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -23,6 +23,7 @@ static ndpi_network host_protocol_list[] = { /* SoundCloud + TODO: are we able to autogenerate this list? */ { 0x22FB2FEE /* 34.251.47.238 */, 32, NDPI_PROTOCOL_SOUNDCLOUD }, { 0x23A06456 /* 35.160.100.86 */, 32, NDPI_PROTOCOL_SOUNDCLOUD }, @@ -493,35 +494,8 @@ static ndpi_network host_protocol_list[] = { { 0x9DF0F1C4 /* 157.240.241.196/32 */, 32, NDPI_PROTOCOL_INSTAGRAM }, /* - WeChat - origin AS132203, AS132591, AS45090 - */ - { 0xCBCD93AB /* 203.205.147.171/32 */, 32, NDPI_PROTOCOL_WECHAT }, - { 0xCBCD93AD /* 203.205.147.173/32 */, 32, NDPI_PROTOCOL_WECHAT }, - { 0xCBCD97A2 /* 203.205.151.162/32 */, 32, NDPI_PROTOCOL_WECHAT }, - { 0x67071E25 /* 103.7.30.37/32 */, 32, NDPI_PROTOCOL_WECHAT }, - { 0XCBCDB000 /* 203.205.176.0/20 */, 20, NDPI_PROTOCOL_WECHAT }, - { 0XCBCDC000 /* 203.205.192.0/18 */, 18, NDPI_PROTOCOL_WECHAT }, - - /* - OpenDNS, LLC - origin AS36692, AS30607 - */ - - { 0x26631400 /* 38.99.20.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, - { 0x3F504FC0 /* 63.80.79.192/26 */, 26, NDPI_PROTOCOL_OPENDNS }, - { 0x43D74000 /* 67.215.64.0/19 */, 19, NDPI_PROTOCOL_OPENDNS }, - { 0x92700000 /* 146.112.0.0/16 */, 16, NDPI_PROTOCOL_OPENDNS }, - { 0xB93C5400 /* 185.60.84.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, - { 0xB93C5500 /* 185.60.85.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, - { 0xB93C5600 /* 185.60.86.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, - { 0xB93C5700 /* 185.60.87.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, - { 0xCCC2E800 /* 204.194.232.0/21*/, 21, NDPI_PROTOCOL_OPENDNS }, - { 0xD043D800 /* 208.67.216.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, - { 0xD0452000 /* 208.69.32.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, - - /* OCS GO (Orange Cinéma Séries) + TODO: are we able to autogenerate this list? */ { 0xB2F8D000 /* 178.248.208.0 */, 21, NDPI_PROTOCOL_OCS }, @@ -710,16 +684,9 @@ static ndpi_network host_protocol_list[] = { #endif /* - Citrix GotoMeeting (AS16815, AS21866) - */ - - { 0xD873D000 /* 216.115.208.0 */, 20, NDPI_PROTOCOL_CITRIX }, - { 0xD8DB7000 /* 216.219.112.0 */, 20, NDPI_PROTOCOL_CITRIX }, - { 0xADC70000 /* 173.199.0.0 */, 18, NDPI_PROTOCOL_CITRIX }, - - /* Viber Media S.à r.l. https://whois.arin.net/rest/nets;q=AWS-VIBER-MEDIA?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2 + TODO: are we able to autogenerate this list? */ { 0x0DE61550 /* 13.230.21.80/28 */, 28, NDPI_PROTOCOL_VIBER }, @@ -740,139 +707,9 @@ static ndpi_network host_protocol_list[] = { { 0x36DBBFA0 /* 54.219.191.160/28 */, 28, NDPI_PROTOCOL_VIBER }, { 0x36E8FB90 /* 54.232.251.144/28 */, 28, NDPI_PROTOCOL_VIBER }, - /* - Dropbox, Inc. - origin AS19679 + /* AnyDesk + TODO: are we able to autogenerate this list? */ - - { 0x2D3A4000 /* 45.58.64.0/20 */, 20, NDPI_PROTOCOL_DROPBOX }, - { 0x6CA0A000 /* 108.160.160.0/20 */, 20, NDPI_PROTOCOL_DROPBOX }, - { 0xA27D0000 /* 162.125.0.0/16 */, 16, NDPI_PROTOCOL_DROPBOX }, - { 0xB92D0800 /* 185.45.8.0/22 */, 22, NDPI_PROTOCOL_DROPBOX }, - { 0xC72FD800 /* 199.47.216.0/22 */, 22, NDPI_PROTOCOL_DROPBOX }, - - /* - Blizzard Entertainment, Inc - origin AS57976 - */ - - { 0x052AA000 /* 5.42.160.0/19 */, 19, NDPI_PROTOCOL_STARCRAFT }, - { 0x0C81DE00 /* 12.129.222.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, - { 0x0C81E400 /* 12.129.228.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, - { 0x0C81EC00 /* 12.129.236.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, - { 0x0C81FE00 /* 12.129.254.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, - { 0x0C82F400 /* 12.130.244.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, - { 0x18690000 /* 24.105.0.0/18 */, 18, NDPI_PROTOCOL_STARCRAFT }, - { 0x25F40000 /* 37.244.0.0/18 */, 18, NDPI_PROTOCOL_STARCRAFT }, - { 0x3B992800 /* 59.153.40.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, - { 0x3E73F400 /* 62.115.244.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, - { 0x50EFD000 /* 80.239.208.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, - { 0x67047200 /* 103.4.114.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, - { 0x67C62000 /* 103.198.32.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, - { 0x89DD4000 /* 137.221.64.0/18 */, 18, NDPI_PROTOCOL_STARCRAFT }, - { 0xB93C7000 /* 185.60.112.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, - { 0xC30CF400 /* 195.12.244.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, - { 0xC76C2000 /* 199.108.32.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT }, - { 0xC76C3000 /* 199.108.48.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT }, - { 0xCA094200 /* 202.9.66.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, - - /* - Canonical Ltd (Ubuntu) - origin AS41231z - */ - - { 0x5BBD5800 /* 91.189.88.0/21 */, 21, NDPI_PROTOCOL_UBUNTUONE }, - { 0xA2D52000 /* 162.213.32.0/22 */, 22, NDPI_PROTOCOL_UBUNTUONE }, - { 0xB97DBC00 /* 185.125.188.0/22 */, 22, NDPI_PROTOCOL_UBUNTUONE }, - - /* - Twitch Interactive Inc. - origin AS46489 - */ - - { 0x17A00000 /* 23.160.0.0/24 */, 24, NDPI_PROTOCOL_TWITCH }, - { 0x2D718000 /* 45.113.128.0/22 */, 22, NDPI_PROTOCOL_TWITCH }, - { 0x34DFC000 /* 52.223.192.0/20 */, 20, NDPI_PROTOCOL_TWITCH }, - { 0x34DFD000 /* 52.223.208.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, - { 0x34DFD800 /* 52.223.216.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, - { 0x34DFE000 /* 52.223.224.0/20 */, 20, NDPI_PROTOCOL_TWITCH }, - { 0x34DFF000 /* 52.223.240.0/20 */, 20, NDPI_PROTOCOL_TWITCH }, - { 0x67353000 /* 103.53.48.0/22 */, 22, NDPI_PROTOCOL_TWITCH }, - { 0xB92ACC00 /* 185.42.204.0/22 */, 22, NDPI_PROTOCOL_TWITCH }, - { 0xC0104000 /* 192.16.64.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, - { 0xC06CEF00 /* 192.108.239.0/24*/, 24, NDPI_PROTOCOL_TWITCH }, - { 0xC709F800 /* 199.9.248.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, - - /* - AnchorFree, Inc. (Hotspot Shield) - origin AS26642 - */ - - { 0x2E102200 /* 46.16.34.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0x2E102300 /* 46.16.35.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0x32752D00 /* 50.117.45.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0x3F8DC600 /* 63.141.198.0/23 */, 23, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0x4A730100 /* 74.115.1.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0x4A730500 /* 74.115.5.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0x4A730600 /* 74.115.6.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0x55EDC500 /* 85.237.197.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0x55EDDE00 /* 85.237.222.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xC62F7300 /* 198.47.115.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xC6906800 /* 198.144.104.0/24*/, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xC7FFD700 /* 199.255.215.0/24*/, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xCC0E4A00 /* 204.14.74.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xCC0E4C00 /* 204.14.76.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xCC0E4D00 /* 204.14.77.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xCC0E4E00 /* 204.14.78.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xCDA42000 /* 205.164.32.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xD1498400 /* 209.73.132.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xD1499700 /* 209.73.151.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - { 0xD8AC8E00 /* 216.172.142.0/24*/, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, - - /* - GitHub, Inc. - origin AS36459 - */ - - { 0xC01EFC00 /* 192.30.252.0/22 */, 22, NDPI_PROTOCOL_GITHUB }, - - /* - Valve Corporation (Steam) - origin AS32590 - */ - - { 0x2D79B800 /* 45.121.184.0/22 */, 22, NDPI_PROTOCOL_STEAM }, - { 0x670A7C00 /* 103.10.124.0/23 */, 23, NDPI_PROTOCOL_STEAM }, - { 0x671C3600 /* 103.28.54.0/23 */, 23, NDPI_PROTOCOL_STEAM }, - { 0x8F899200 /* 143.137.146.0/24*/, 24, NDPI_PROTOCOL_STEAM }, - { 0x92429800 /* 146.66.152.0/21 */, 21, NDPI_PROTOCOL_STEAM }, - { 0x99FE5600 /* 153.254.86.0/24 */, 24, NDPI_PROTOCOL_STEAM }, - { 0x9B85E000 /* 155.133.224.0/19*/, 19, NDPI_PROTOCOL_STEAM }, - { 0xA2FEC000 /* 162.254.192.0/21*/, 21, NDPI_PROTOCOL_STEAM }, - { 0xB919B400 /* 185.25.180.0/22 */, 22, NDPI_PROTOCOL_STEAM }, - { 0xBED87900 /* 190.216.121.0/24*/, 24, NDPI_PROTOCOL_STEAM }, - { 0xBED92100 /* 190.217.33.0/24 */, 24, NDPI_PROTOCOL_STEAM }, - { 0xC0456000 /* 192.69.96.0/22 */, 22, NDPI_PROTOCOL_STEAM }, - { 0xCDB9C200 /* 205.185.194.0/24*/, 24, NDPI_PROTOCOL_STEAM }, - { 0xCDC40600 /* 205.196.6.0/24 */, 24, NDPI_PROTOCOL_STEAM }, - { 0xD040C800 /* 208.64.200.0/24 */, 24, NDPI_PROTOCOL_STEAM }, - { 0xD040C900 /* 208.64.201.0/22 */, 22, NDPI_PROTOCOL_STEAM }, - { 0xD04EA400 /* 208.78.164.0/22 */, 22, NDPI_PROTOCOL_STEAM }, - - /* Bloomberg */ - { 0xD086A100 /* 208.134.161.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, - { 0xCDB7F600 /* 205.183.246.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, - { 0xC769B000 /* 199.105.176.0/21 */, 21, NDPI_PROTOCOL_BLOOMBERG }, - { 0xC769B800 /* 199.105.184.0/23 */, 23, NDPI_PROTOCOL_BLOOMBERG }, - { 0x45B80000 /* 69.184.0.0/13 */, 13, NDPI_PROTOCOL_BLOOMBERG }, - { 0xA02B0000 /* 160.43.0.0/16 */, 24, NDPI_PROTOCOL_BLOOMBERG }, - { 0xCE9C3500 /* 206.156.53.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, - { 0xCDD87000 /* 205.216.112.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, - { 0xD0163800 /* 208.22.56.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, - { 0xD0163900 /* 208.22.57.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG }, - { 0x45BFC000 /* 69.191.192.0/18 */, 18, NDPI_PROTOCOL_BLOOMBERG }, - - /* AnyDesk */ { 0x3353EF8E /* 51.83.239.142/31 */, 31, NDPI_PROTOCOL_ANYDESK }, { 0x3353EF90 /* 51.83.239.144/31 */, 31, NDPI_PROTOCOL_ANYDESK }, { 0x3353EEC8 /* 51.83.238.200/29 */, 29, NDPI_PROTOCOL_ANYDESK }, diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 7cbc9b316..e1c3ee85e 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -70,6 +70,17 @@ #include "inc_generated/ndpi_asn_webex.c.inc" #include "inc_generated/ndpi_asn_teamviewer.c.inc" #include "inc_generated/ndpi_asn_facebook.c.inc" +#include "inc_generated/ndpi_asn_tencent.c.inc" +#include "inc_generated/ndpi_asn_opendns.c.inc" +#include "inc_generated/ndpi_asn_dropbox.c.inc" +#include "inc_generated/ndpi_asn_starcraft.c.inc" +#include "inc_generated/ndpi_asn_ubuntuone.c.inc" +#include "inc_generated/ndpi_asn_twitch.c.inc" +#include "inc_generated/ndpi_asn_hotspotshield.c.inc" +#include "inc_generated/ndpi_asn_github.c.inc" +#include "inc_generated/ndpi_asn_steam.c.inc" +#include "inc_generated/ndpi_asn_bloomberg.c.inc" +#include "inc_generated/ndpi_asn_citrix.c.inc" /* Third party libraries */ #include "third_party/include/ndpi_patricia.h" @@ -1847,6 +1858,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "GoogleCloud", NDPI_PROTOCOL_CATEGORY_CLOUD, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TENCENT, + "Tencent", NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main.c" @@ -2474,6 +2489,17 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_webex_protocol_list); ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_teamviewer_protocol_list); ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_facebook_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_tencent_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_opendns_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_dropbox_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_starcraft_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_ubuntuone_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_twitch_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_hotspot_shield_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_github_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_steam_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_bloomberg_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_citrix_protocol_list); } } diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out index 9d3546a06..dcd38408f 100644 --- a/tests/result/KakaoTalk_talk.pcap.out +++ b/tests/result/KakaoTalk_talk.pcap.out @@ -1,6 +1,6 @@ Guessed flow protos: 12 -DPI Packets (TCP): 89 (5.93 pkts/flow) +DPI Packets (TCP): 86 (5.73 pkts/flow) DPI Packets (UDP): 6 (1.20 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 7 (flows) @@ -29,7 +29,7 @@ JA3 Host Stats: 5 TCP 10.24.82.188:59954 <-> 173.252.88.128:443 [proto: 91.119/TLS.Facebook][Encrypted][Confidence: DPI][cat: SocialNetwork/6][15 pkts/2932 bytes <-> 14 pkts/1092 bytes][Goodput ratio: 71/27][1.96 sec][bytes ratio: 0.457 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 141/117 494/295 163/92][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 195/78 735/189 228/35][Risk: ** Obsolete TLS Version (1.1 or older) **** Possibly Malicious JA3 Fingerprint **][Risk Score: 150][TLSv1][JA3C: dff8a0aa1c904aaea76c5bf624e88333][JA3S: 07dddc59e60135c7b479d39c3ae686af][Cipher: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA][Plen Bins: 30,23,0,0,15,0,7,0,7,0,0,0,0,0,0,0,0,0,0,0,0,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 6 UDP 10.24.82.188:10269 <-> 1.201.1.174:23047 [proto: 194/KakaoTalk_Voice][ClearText][Confidence: DPI][cat: VoIP/10][12 pkts/1692 bytes <-> 10 pkts/1420 bytes][Goodput ratio: 69/69][45.10 sec][bytes ratio: 0.087 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1062/3176 4203/4247 4716/5160 1131/719][Pkt Len c2s/s2c min/avg/max/stddev: 122/142 141/142 150/142 6/0][Plen Bins: 0,0,4,95,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 7 UDP 10.24.82.188:11321 <-> 1.201.1.174:23045 [proto: 194/KakaoTalk_Voice][ClearText][Confidence: DPI][cat: VoIP/10][11 pkts/1542 bytes <-> 11 pkts/1542 bytes][Goodput ratio: 69/69][43.84 sec][bytes ratio: 0.000 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1105/1052 4266/3766 4903/4991 1245/1144][Pkt Len c2s/s2c min/avg/max/stddev: 122/122 140/140 142/142 6/6][Plen Bins: 0,0,9,90,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 8 TCP 10.24.82.188:48489 <-> 203.205.147.215:80 [proto: 7.48/HTTP.QQ][ClearText][Confidence: DPI][cat: Download/7][8 pkts/1117 bytes <-> 7 pkts/610 bytes][Goodput ratio: 54/34][3.79 sec][Hostname/SNI: hkminorshort.weixin.qq.com][bytes ratio: 0.294 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/51 406/439 2019/1166 732/515][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 140/87 665/262 199/71][URL: http://hkminorshort.weixin.qq.com/cgi-bin/micromsg-bin/rtkvreport][StatusCode: 200][Req Content-Type: application/octet-stream][Content-Type: application/octet-stream][User-Agent: MicroMessenger Client][Risk: ** Binary Application Transfer **][Risk Score: 250][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 8 TCP 10.24.82.188:48489 <-> 203.205.147.215:80 [proto: 285.48/Tencent.QQ][ClearText][Confidence: DPI][cat: Chat/9][8 pkts/1117 bytes <-> 7 pkts/610 bytes][Goodput ratio: 54/34][3.79 sec][Hostname/SNI: hkminorshort.weixin.qq.com][bytes ratio: 0.294 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/51 406/439 2019/1166 732/515][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 140/87 665/262 199/71][Risk: ** Known Protocol on Non Standard Port **][Risk Score: 50][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 9 TCP 10.24.82.188:51021 <-> 103.246.57.251:8080 [proto: 131/HTTP_Proxy][ClearText][Confidence: Match by port][cat: Web/5][6 pkts/543 bytes <-> 5 pkts/945 bytes][Goodput ratio: 25/64][24.77 sec][bytes ratio: -0.270 (Download)][IAT c2s/s2c min/avg/max/stddev: 77/47 4920/8061 17431/17434 6679/7163][Pkt Len c2s/s2c min/avg/max/stddev: 68/68 90/189 130/504 24/164][Plen Bins: 16,51,0,16,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 10 TCP 139.150.0.125:443 <-> 10.24.82.188:46947 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][3 pkts/1044 bytes <-> 2 pkts/154 bytes][Goodput ratio: 84/27][51.90 sec][Plen Bins: 0,33,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 11 TCP 10.24.82.188:58916 <-> 54.255.185.236:5222 [proto: 265/AmazonAWS][Encrypted][Confidence: Match by IP][cat: Cloud/13][2 pkts/225 bytes <-> 2 pkts/171 bytes][Goodput ratio: 39/20][0.46 sec][PLAIN TEXT (xiaomi.com)][Plen Bins: 0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/quickplay.pcap.out b/tests/result/quickplay.pcap.out index 3454c4d1c..b5eab0bf5 100644 --- a/tests/result/quickplay.pcap.out +++ b/tests/result/quickplay.pcap.out @@ -1,6 +1,6 @@ Guessed flow protos: 10 -DPI Packets (TCP): 150 (7.14 pkts/flow) +DPI Packets (TCP): 147 (7.00 pkts/flow) Confidence DPI : 21 (flows) HTTP 133 96179 11 @@ -22,9 +22,9 @@ AmazonAWS 2 1469 1 11 TCP 10.54.169.250:56381 <-> 54.179.140.65:80 [proto: 7.265/HTTP.AmazonAWS][ClearText][Confidence: DPI][cat: Cloud/13][1 pkts/638 bytes <-> 1 pkts/831 bytes][Goodput ratio: 91/93][0.32 sec][Hostname/SNI: api.account.xiaomi.com][URL: api.account.xiaomi.com/pass/v2/safe/user/coreInfo?signature=u%2F73dEXBHbejev0ISNwnGyyfeTw%3D&userId=Mz5Xr5UXKuw83hxd6Yms2w%3D%3D][StatusCode: 200][Req Content-Type: application/x-www-form-urlencoded][User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.4.4; MI 3W MIUI/V6.4.2.0.KXDMICB)][PLAIN TEXT (GET /pass/v)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 12 TCP 10.54.169.250:54883 <-> 203.205.151.160:80 [proto: 7.48/HTTP.QQ][ClearText][Confidence: DPI][cat: Chat/9][2 pkts/1192 bytes <-> 1 pkts/145 bytes][Goodput ratio: 91/61][2.08 sec][Hostname/SNI: hkextshort.weixin.qq.com][URL: http://hkextshort.weixin.qq.com/cgi-bin/micromsg-bin/mmsnssync][StatusCode: 0][Req Content-Type: application/octet-stream][User-Agent: MicroMessenger Client][PLAIN TEXT (POST http)][Plen Bins: 0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 13 TCP 10.54.169.250:54885 <-> 203.205.151.160:80 [proto: 7.48/HTTP.QQ][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/461 bytes <-> 2 pkts/522 bytes][Goodput ratio: 88/78][2.81 sec][Hostname/SNI: hkextshort.weixin.qq.com][URL: http://hkextshort.weixin.qq.com/cgi-bin/micromsg-bin/getcontactlabellist][StatusCode: 200][Req Content-Type: application/octet-stream][User-Agent: MicroMessenger Client][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,66,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 14 TCP 10.54.169.250:35670 <-> 203.205.147.215:80 [proto: 7.48/HTTP.QQ][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/681 bytes <-> 1 pkts/262 bytes][Goodput ratio: 92/78][0.14 sec][Hostname/SNI: hkminorshort.weixin.qq.com][URL: http://hkminorshort.weixin.qq.com/cgi-bin/micromsg-bin/rtkvreport][StatusCode: 200][Req Content-Type: application/octet-stream][User-Agent: MicroMessenger Client][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 15 TCP 10.54.169.250:42762 <-> 203.205.129.101:80 [proto: 7.48/HTTP.QQ][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/616 bytes <-> 1 pkts/261 bytes][Goodput ratio: 91/78][0.37 sec][Hostname/SNI: hkextshort.weixin.qq.com][URL: http://hkextshort.weixin.qq.com/cgi-bin/micromsg-bin/androidgcmreg][StatusCode: 200][Req Content-Type: application/octet-stream][User-Agent: MicroMessenger Client][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 16 TCP 10.54.169.250:42761 <-> 203.205.129.101:80 [proto: 7.48/HTTP.QQ][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/380 bytes <-> 1 pkts/261 bytes][Goodput ratio: 85/78][0.34 sec][Hostname/SNI: hkextshort.weixin.qq.com][URL: http://hkextshort.weixin.qq.com/cgi-bin/micromsg-bin/mmbatchemojidownload][StatusCode: 200][Req Content-Type: application/octet-stream][User-Agent: MicroMessenger Client][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 14 TCP 10.54.169.250:35670 <-> 203.205.147.215:80 [proto: 285.48/Tencent.QQ][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/681 bytes <-> 1 pkts/262 bytes][Goodput ratio: 92/78][0.14 sec][Hostname/SNI: hkminorshort.weixin.qq.com][Risk: ** Known Protocol on Non Standard Port **][Risk Score: 50][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 15 TCP 10.54.169.250:42762 <-> 203.205.129.101:80 [proto: 285.48/Tencent.QQ][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/616 bytes <-> 1 pkts/261 bytes][Goodput ratio: 91/78][0.37 sec][Hostname/SNI: hkextshort.weixin.qq.com][Risk: ** Known Protocol on Non Standard Port **][Risk Score: 50][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 16 TCP 10.54.169.250:42761 <-> 203.205.129.101:80 [proto: 285.48/Tencent.QQ][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/380 bytes <-> 1 pkts/261 bytes][Goodput ratio: 85/78][0.34 sec][Hostname/SNI: hkextshort.weixin.qq.com][Risk: ** Known Protocol on Non Standard Port **][Risk Score: 50][PLAIN TEXT (POST http)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 17 TCP 10.54.169.250:52285 <-> 173.252.74.22:80 [proto: 7.119/HTTP.Facebook][ClearText][Confidence: DPI][cat: SocialNetwork/6][1 pkts/243 bytes <-> 1 pkts/339 bytes][Goodput ratio: 77/83][0.46 sec][Hostname/SNI: www.facebook.com][URL: www.facebook.com/mobile/status.php][StatusCode: 204][User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.4.4; MI 3W MIUI/V6.4.2.0.KXDMICB)][PLAIN TEXT (GET /mobile/status.php HTTP/1.1)][Plen Bins: 0,0,0,0,0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 18 TCP 10.54.169.250:52288 <-> 173.252.74.22:80 [proto: 7.119/HTTP.Facebook][ClearText][Confidence: DPI][cat: SocialNetwork/6][1 pkts/243 bytes <-> 1 pkts/339 bytes][Goodput ratio: 77/83][0.46 sec][Hostname/SNI: www.facebook.com][URL: www.facebook.com/mobile/status.php][StatusCode: 204][User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.4.4; MI 3W MIUI/V6.4.2.0.KXDMICB)][PLAIN TEXT (GET /mobile/status.php HTTP/1.1)][Plen Bins: 0,0,0,0,0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 19 TCP 10.54.169.250:44793 <-> 31.13.68.49:80 [proto: 7.119/HTTP.Facebook][ClearText][Confidence: DPI][cat: SocialNetwork/6][1 pkts/237 bytes <-> 1 pkts/339 bytes][Goodput ratio: 76/83][0.34 sec][Hostname/SNI: www.facebook.com][URL: www.facebook.com/mobile/status.php][StatusCode: 204][User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.4.2; GT-I9505 Build/KOT49H)][PLAIN TEXT (GET /mobile/status.php HTTP/1.1)][Plen Bins: 0,0,0,0,0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out index e2fb02d8c..a04852ad3 100644 --- a/tests/result/starcraft_battle.pcap.out +++ b/tests/result/starcraft_battle.pcap.out @@ -3,8 +3,8 @@ Guessed flow protos: 24 DPI Packets (TCP): 182 (4.79 pkts/flow) DPI Packets (UDP): 36 (2.77 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) -Confidence Match by port : 14 (flows) -Confidence Match by IP : 8 (flows) +Confidence Match by port : 16 (flows) +Confidence Match by IP : 6 (flows) Confidence DPI : 30 (flows) DNS 26 2848 7 @@ -36,7 +36,7 @@ Starcraft 236 51494 6 17 TCP 192.168.1.100:3524 <-> 80.239.186.26:80 [proto: 7/HTTP][ClearText][Confidence: DPI][cat: Web/5][6 pkts/481 bytes <-> 4 pkts/733 bytes][Goodput ratio: 30/68][0.31 sec][Hostname/SNI: nydus.battle.net][bytes ratio: -0.208 (Download)][IAT c2s/s2c min/avg/max/stddev: 9/0 63/32 113/65 34/32][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 80/183 199/553 53/213][URL: nydus.battle.net/S2/enGB/client/feed/homepage?build=enGB&targetRegion=EU][StatusCode: 302][Content-Type: text/html][User-Agent: Battle.net Web Client][PLAIN TEXT (GET /S2/enGB/client/feed/homepa)][Plen Bins: 0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 18 TCP 192.168.1.100:3523 <-> 80.239.186.26:80 [proto: 7/HTTP][ClearText][Confidence: DPI][cat: Web/5][6 pkts/483 bytes <-> 4 pkts/725 bytes][Goodput ratio: 30/68][0.31 sec][Hostname/SNI: nydus.battle.net][bytes ratio: -0.200 (Download)][IAT c2s/s2c min/avg/max/stddev: 9/0 61/32 111/65 33/32][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 80/181 201/545 54/210][URL: nydus.battle.net/S2/enGB/client/feed/live-event?build=enGB&targetRegion=EU][StatusCode: 302][Content-Type: text/html][User-Agent: Battle.net Web Client][PLAIN TEXT (GET /S2/enGB/client/feed/live)][Plen Bins: 0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 19 TCP 192.168.1.100:3519 <-> 80.239.186.21:80 [proto: 7/HTTP][ClearText][Confidence: DPI][cat: Web/5][5 pkts/482 bytes <-> 4 pkts/497 bytes][Goodput ratio: 41/53][0.17 sec][Hostname/SNI: eu.launcher.battle.net][bytes ratio: -0.015 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 43/29 58/58 25/29][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 96/124 254/317 79/111][URL: eu.launcher.battle.net/service/s2/alert/en-gb][StatusCode: 200][Content-Type: text/plain][User-Agent: Battle.net Web Client][PLAIN TEXT (GET /service/s2/alert/en)][Plen Bins: 0,0,0,0,0,0,50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 20 TCP 192.168.1.100:3427 <-> 80.239.208.193:1119 [proto: 213/Starcraft][ClearText][Confidence: Match by IP][cat: Game/8][6 pkts/376 bytes <-> 7 pkts/526 bytes][Goodput ratio: 14/22][10.56 sec][bytes ratio: -0.166 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 2624/2614 6381/6342 2711/2730][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 63/75 74/155 9/33][Plen Bins: 80,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 20 TCP 192.168.1.100:3427 <-> 80.239.208.193:1119 [proto: 213/Starcraft][ClearText][Confidence: Match by port][cat: Game/8][6 pkts/376 bytes <-> 7 pkts/526 bytes][Goodput ratio: 14/22][10.56 sec][bytes ratio: -0.166 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 2624/2614 6381/6342 2711/2730][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 63/75 74/155 9/33][Plen Bins: 80,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 21 TCP 192.168.1.100:3512 <-> 12.129.222.54:80 [proto: 7.76/HTTP.WorldOfWarcraft][ClearText][Confidence: DPI][cat: Game/8][5 pkts/367 bytes <-> 4 pkts/513 bytes][Goodput ratio: 23/53][0.60 sec][Hostname/SNI: us.scan.worldofwarcraft.com][bytes ratio: -0.166 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 9/0 148/102 198/203 80/102][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 73/128 139/327 33/115][URL: us.scan.worldofwarcraft.com/update/Launcher.txt][StatusCode: 200][Content-Type: text/plain][PLAIN TEXT (GET /update/Launcher.txt HTTP/1)][Plen Bins: 0,0,50,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 22 UDP 192.168.1.100:55468 <-> 192.168.1.254:53 [proto: 5/DNS][ClearText][Confidence: DPI][cat: Network/14][2 pkts/168 bytes <-> 2 pkts/388 bytes][Goodput ratio: 50/78][0.09 sec][Hostname/SNI: bnetcmsus-a.akamaihd.net][2.228.46.112][PLAIN TEXT (bnetcmsus)][Plen Bins: 0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 23 UDP 173.194.40.22:443 <-> 192.168.1.100:53568 [proto: 126/Google][Encrypted][Confidence: Match by IP][cat: Web/5][3 pkts/243 bytes <-> 3 pkts/232 bytes][Goodput ratio: 48/45][28.94 sec][bytes ratio: 0.023 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 13855/13940 14457/14457 15059/14974 602/517][Pkt Len c2s/s2c min/avg/max/stddev: 77/66 81/77 83/83 3/8][Plen Bins: 16,83,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] @@ -63,7 +63,7 @@ Starcraft 236 51494 6 44 TCP 192.168.1.100:3052 <-> 216.58.212.110:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][1 pkts/55 bytes <-> 1 pkts/66 bytes][Goodput ratio: 2/0][0.04 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 45 IGMP 192.168.1.107:0 -> 224.0.0.22:0 [proto: 82/IGMP][ClearText][Confidence: DPI][cat: Network/14][2 pkts/120 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.18 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 46 UDP 192.168.1.100:53146 <-> 5.42.180.154:1119 [proto: 213/Starcraft][ClearText][Confidence: Match by IP][cat: Game/8][1 pkts/44 bytes <-> 1 pkts/60 bytes][Goodput ratio: 4/3][0.05 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 47 UDP 192.168.1.100:53146 <-> 62.115.246.51:1119 [proto: 213/Starcraft][ClearText][Confidence: Match by IP][cat: Game/8][1 pkts/44 bytes <-> 1 pkts/60 bytes][Goodput ratio: 4/3][0.06 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 47 UDP 192.168.1.100:53146 <-> 62.115.246.51:1119 [proto: 213/Starcraft][ClearText][Confidence: Match by port][cat: Game/8][1 pkts/44 bytes <-> 1 pkts/60 bytes][Goodput ratio: 4/3][0.06 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 48 UDP 192.168.1.100:6113 <-> 213.248.127.166:1119 [proto: 213/Starcraft][ClearText][Confidence: Match by port][cat: Game/8][1 pkts/43 bytes <-> 1 pkts/60 bytes][Goodput ratio: 2/11][0.05 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 49 UDP 192.168.1.100:6113 <-> 213.248.127.212:1119 [proto: 213/Starcraft][ClearText][Confidence: Match by port][cat: Game/8][1 pkts/43 bytes <-> 1 pkts/60 bytes][Goodput ratio: 2/11][0.05 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 50 TCP 192.168.1.100:3534 -> 2.228.46.112:80 [proto: 7/HTTP][ClearText][Confidence: Match by port][cat: Web/5][1 pkts/66 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/synscan.pcap.out b/tests/result/synscan.pcap.out index 6559c7206..27bfa7d9e 100644 --- a/tests/result/synscan.pcap.out +++ b/tests/result/synscan.pcap.out @@ -104,7 +104,7 @@ iSCSI 2 116 2 43 TCP 172.16.0.8:36050 -> 64.13.134.52:2605 [proto: 13/BGP][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 44 TCP 172.16.0.8:36050 -> 64.13.134.52:3000 [proto: 26/ntop][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 45 TCP 172.16.0.8:36050 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][ClearText][Confidence: Match by port][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 46 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 285/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 46 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 286/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 47 TCP 172.16.0.8:36050 -> 64.13.134.52:3306 [proto: 20/MySQL][ClearText][Confidence: Match by port][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 48 TCP 172.16.0.8:36050 -> 64.13.134.52:3389 [proto: 88/RDP][ClearText][Confidence: Match by port][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing Session **][Risk Score: 10][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 49 TCP 172.16.0.8:36050 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] @@ -165,7 +165,7 @@ iSCSI 2 116 2 104 TCP 172.16.0.8:36051 -> 64.13.134.52:2605 [proto: 13/BGP][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 105 TCP 172.16.0.8:36051 -> 64.13.134.52:3000 [proto: 26/ntop][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 106 TCP 172.16.0.8:36051 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][ClearText][Confidence: Match by port][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 107 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 285/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 107 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 286/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 108 TCP 172.16.0.8:36051 -> 64.13.134.52:3306 [proto: 20/MySQL][ClearText][Confidence: Match by port][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 109 TCP 172.16.0.8:36051 -> 64.13.134.52:3389 [proto: 88/RDP][ClearText][Confidence: Match by port][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing Session **][Risk Score: 10][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 110 TCP 172.16.0.8:36051 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out index c6f0c8960..b64fa0858 100644 --- a/tests/result/tls_certificate_too_long.pcap.out +++ b/tests/result/tls_certificate_too_long.pcap.out @@ -4,8 +4,7 @@ DPI Packets (TCP): 220 (13.75 pkts/flow) DPI Packets (UDP): 33 (1.94 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 1 (flows) -Confidence Match by port : 1 (flows) -Confidence Match by IP : 4 (flows) +Confidence Match by IP : 5 (flows) Confidence DPI : 29 (flows) Unknown 13 5582 1 @@ -13,9 +12,9 @@ MDNS 5 983 3 NTP 8 720 4 Outlook 126 53776 2 IGMP 2 92 2 -TLS 4 283 1 Google 26 2980 4 Apple 2 273 1 +Github 4 283 1 Microsoft 121 47561 14 Azure 4 414 2 GoogleCloud 4 330 1 @@ -46,7 +45,7 @@ JA3 Host Stats: 19 UDP 192.168.1.121:58161 <-> 8.8.8.8:53 [proto: 5.212/DNS.Microsoft][ClearText][Confidence: DPI][cat: Cloud/13][1 pkts/77 bytes <-> 1 pkts/244 bytes][Goodput ratio: 45/82][0.03 sec][Hostname/SNI: www.microsoft.com][2.22.33.235][PLAIN TEXT (microsoft)][Plen Bins: 0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 20 UDP [fe80::1059:a858:f9e7:cf94]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][ClearText][Confidence: DPI][cat: Network/14][2 pkts/320 bytes -> 0 pkts/0 bytes][Goodput ratio: 61/0][1.02 sec][Hostname/SNI: _companion-link._tcp.local][_companion-link._tcp.local][PLAIN TEXT (companion)][Plen Bins: 0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 21 UDP 192.168.1.121:65492 <-> 8.8.8.8:53 [proto: 5.276/DNS.Azure][ClearText][Confidence: DPI][cat: Cloud/13][1 pkts/115 bytes <-> 1 pkts/191 bytes][Goodput ratio: 63/78][0.07 sec][Hostname/SNI: wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com][::][PLAIN TEXT (northeurope)][Plen Bins: 0,0,50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 22 TCP 192.168.1.121:53905 <-> 140.82.113.26:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][2 pkts/120 bytes <-> 2 pkts/163 bytes][Goodput ratio: 0/19][0.11 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 22 TCP 192.168.1.121:53905 <-> 140.82.113.26:443 [proto: 91.203/TLS.Github][Encrypted][Confidence: Match by IP][cat: Collaborative/15][2 pkts/120 bytes <-> 2 pkts/163 bytes][Goodput ratio: 0/19][0.11 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 23 UDP 192.168.1.121:53884 <-> 8.8.8.8:53 [proto: 5.212/DNS.Microsoft][ClearText][Confidence: DPI][cat: Cloud/13][1 pkts/78 bytes <-> 1 pkts/203 bytes][Goodput ratio: 46/79][0.02 sec][Hostname/SNI: wdcp.microsoft.com][40.113.10.47][PLAIN TEXT (microsoft)][Plen Bins: 0,50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 24 UDP 192.168.1.139:5353 -> 224.0.0.251:5353 [proto: 8/MDNS][ClearText][Confidence: DPI][cat: Network/14][2 pkts/280 bytes -> 0 pkts/0 bytes][Goodput ratio: 70/0][1.02 sec][Hostname/SNI: _companion-link._tcp.local][_companion-link._tcp.local][PLAIN TEXT (companion)][Plen Bins: 0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 25 UDP 192.168.1.121:65213 <-> 8.8.8.8:53 [proto: 5.140/DNS.Apple][ClearText][Confidence: DPI][cat: Web/5][1 pkts/80 bytes <-> 1 pkts/193 bytes][Goodput ratio: 47/78][0.01 sec][Hostname/SNI: time-macos.apple.com][17.253.54.251][PLAIN TEXT (aaplimg)][Plen Bins: 0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out index 8cae9033a..a6ae4a771 100644 --- a/tests/result/tls_invalid_reads.pcap.out +++ b/tests/result/tls_invalid_reads.pcap.out @@ -3,7 +3,8 @@ Guessed flow protos: 3 DPI Packets (TCP): 11 (3.67 pkts/flow) Confidence DPI : 3 (flows) -TLS 8 1891 2 +TLS 7 1827 1 +Citrix 1 64 1 Crashlytics 3 560 1 JA3 Host Stats: @@ -13,4 +14,4 @@ JA3 Host Stats: 1 TCP 192.168.10.101:3967 <-> 206.33.61.113:443 [proto: 91/TLS][Encrypted][Confidence: DPI][cat: Web/5][4 pkts/330 bytes <-> 3 pkts/1497 bytes][Goodput ratio: 31/89][0.08 sec][bytes ratio: -0.639 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/38 25/19 58/38 24/19][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 82/499 156/905 43/346][Risk: ** Obsolete TLS Version (1.1 or older) **][Risk Score: 100][TLSv1][JA3S: 53611273a714cb4789c8222932efd5a7 (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5][Plen Bins: 0,0,0,33,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 TCP 10.191.139.17:58552 <-> 54.221.224.45:443 [VLAN: 2][proto: GTP:91.275/TLS.Crashlytics][Encrypted][Confidence: DPI][cat: DataTransfer/4][2 pkts/442 bytes <-> 1 pkts/118 bytes][Goodput ratio: 41/0][0.23 sec][Hostname/SNI: e.crashlytics.com][ALPN: ][Risk: ** TLS Suspicious Extension **][Risk Score: 100][TLSv1.2][JA3C: 9d5430e6dfce44459702b74d790df353][Firefox][PLAIN TEXT (e.crashlytics.com)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 3 TCP 74.80.160.99:3258 -> 67.217.77.28:443 [proto: 91/TLS][Encrypted][Confidence: DPI][cat: Web/5][1 pkts/64 bytes -> 0 pkts/0 bytes][Goodput ratio: 15/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 3 TCP 74.80.160.99:3258 -> 67.217.77.28:443 [proto: 91.132/TLS.Citrix][Encrypted][Confidence: DPI][cat: Network/14][1 pkts/64 bytes -> 0 pkts/0 bytes][Goodput ratio: 15/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out index 424283013..80c178d6d 100644 --- a/tests/result/wechat.pcap.out +++ b/tests/result/wechat.pcap.out @@ -3,8 +3,8 @@ Guessed flow protos: 47 DPI Packets (TCP): 531 (9.00 pkts/flow) DPI Packets (UDP): 124 (3.35 pkts/flow) DPI Packets (other): 7 (1.00 pkts/flow) -Confidence Match by port : 11 (flows) -Confidence Match by IP : 20 (flows) +Confidence Match by port : 20 (flows) +Confidence Match by IP : 11 (flows) Confidence DPI : 72 (flows) DNS 13 1075 8 @@ -16,19 +16,20 @@ SMBv1 3 751 1 DHCP 1 342 1 QQ 26 9402 2 IGMP 24 1280 4 -TLS 21 1209 3 +TLS 234 83531 12 ICMPV6 4 328 3 Google 110 24574 13 LLMNR 12 944 6 -WeChat 1247 606081 46 +WeChat 989 520787 32 GoogleDocs 15 5114 2 +Tencent 45 2972 5 JA3 Host Stats: IP Address # JA3C 1 192.168.1.103 3 - 1 TCP 203.205.151.162:443 <-> 192.168.1.103:54058 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][88 pkts/15114 bytes <-> 91 pkts/61842 bytes][Goodput ratio: 62/90][553.47 sec][bytes ratio: -0.607 (Download)][IAT c2s/s2c min/avg/max/stddev: 5/11 6995/5837 150373/150695 18892/18424][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 172/680 264/1254 99/594][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0] + 1 TCP 203.205.151.162:443 <-> 192.168.1.103:54058 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][88 pkts/15114 bytes <-> 91 pkts/61842 bytes][Goodput ratio: 62/90][553.47 sec][bytes ratio: -0.607 (Download)][IAT c2s/s2c min/avg/max/stddev: 5/11 6995/5837 150373/150695 18892/18424][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 172/680 264/1254 99/594][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0] 2 TCP 192.168.1.103:54101 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: DPI][cat: Chat/9][46 pkts/12575 bytes <-> 40 pkts/53424 bytes][Goodput ratio: 76/95][15.73 sec][Hostname/SNI: web.wechat.com][ALPN: h2;http/1.1][bytes ratio: -0.619 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 403/151 10035/951 1616/288][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 273/1336 1306/4350 407/922][Risk: ** Possibly Malicious JA3 Fingerprint **][Risk Score: 50][TLSv1.2][JA3C: e330bca99c8a5256ae126a55c4c725c5][ServerNames: webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com][JA3S: 699a80bdb17efe157c861f92c5bf5d1d][Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3][Subject: C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com][Certificate SHA-1: 4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1][Validity: 2015-09-21 00:00:00 - 2018-09-20 23:59:59][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,2,0,2,0,2,4,2,0,0,0,4,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,4,0,2,0,0,0,2,0,54,0,0,10] 3 TCP 192.168.1.103:54103 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: DPI][cat: Chat/9][50 pkts/23958 bytes <-> 46 pkts/39684 bytes][Goodput ratio: 86/92][23.11 sec][Hostname/SNI: web.wechat.com][ALPN: h2;http/1.1][bytes ratio: -0.247 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 538/312 9999/7018 1833/1162][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 479/863 1306/4059 492/922][Risk: ** Possibly Malicious JA3 Fingerprint **][Risk Score: 50][TLSv1.2][JA3C: e330bca99c8a5256ae126a55c4c725c5][ServerNames: webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com][JA3S: 699a80bdb17efe157c861f92c5bf5d1d][Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3][Subject: C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com][Certificate SHA-1: 4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1][Validity: 2015-09-21 00:00:00 - 2018-09-20 23:59:59][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,1,0,1,0,6,6,3,1,0,0,6,0,0,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,3,0,8,0,10,0,0,0,0,0,29,0,0,5] 4 TCP 192.168.1.103:54113 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: DPI][cat: Chat/9][38 pkts/8933 bytes <-> 35 pkts/35112 bytes][Goodput ratio: 72/93][27.77 sec][Hostname/SNI: web.wechat.com][ALPN: h2;http/1.1][bytes ratio: -0.594 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 559/54 8107/380 1792/116][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 235/1003 1306/1494 368/649][Risk: ** Possibly Malicious JA3 Fingerprint **][Risk Score: 50][TLSv1.2][JA3C: e330bca99c8a5256ae126a55c4c725c5][ServerNames: webpush1.wechat.com,webpush.wechat.com,login.web.wechat.com,webpush.web.wechat.com,webpush2.wechat.com,webpush.web2.wechat.com,file.web2.wechat.com,web1.wechat.com,file.web.wechat.com,loginpoll.wechat.com,web2.wechat.com,login.wechat.com,login.web2.wechat.com,res.wechat.com,web.wechat.com][JA3S: 699a80bdb17efe157c861f92c5bf5d1d][Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust SSL CA - G3][Subject: C=HK, ST=HongKong, L=Wan Chai, O=Tencent Mobility Limited, CN=web.wechat.com][Certificate SHA-1: 4F:3B:6A:87:0C:D2:34:09:C9:53:9F:6F:EE:7D:7B:9B:E9:D6:EF:C1][Validity: 2015-09-21 00:00:00 - 2018-09-20 23:59:59][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,5,0,2,0,0,2,2,2,0,0,2,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,2,0,0,2,0,5,0,2,0,0,0,63,0,0,0] @@ -62,18 +63,18 @@ JA3 Host Stats: 32 UDP [fe80::7a92:9cff:fe0f:a88e]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][ClearText][Confidence: DPI][cat: Network/14][44 pkts/4488 bytes -> 0 pkts/0 bytes][Goodput ratio: 39/0][3914.88 sec][Hostname/SNI: _googlecast._tcp.local][_googlecast._tcp.local][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 6684/0 41917/0 11732/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/0 102/0 102/0 0/0][PLAIN TEXT (googlecast)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 33 UDP 192.168.1.103:35601 <-> 172.217.23.67:443 [proto: 188.126/QUIC.Google][Encrypted][Confidence: DPI][cat: Web/5][5 pkts/2035 bytes <-> 5 pkts/1937 bytes][Goodput ratio: 90/89][0.12 sec][Hostname/SNI: ssl.gstatic.com][bytes ratio: 0.025 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/17 24/16 53/47 24/19][Pkt Len c2s/s2c min/avg/max/stddev: 80/72 407/387 1392/1392 508/512][User-Agent: Chrome/57.0.2987.133 Linux x86_64][PLAIN TEXT (ssl.gstatic.com)][Plen Bins: 30,30,0,0,0,0,0,0,10,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,0,0,0,0,0] 34 UDP 192.168.1.103:5353 -> 224.0.0.251:5353 [proto: 8/MDNS][ClearText][Confidence: DPI][cat: Network/14][44 pkts/3608 bytes -> 0 pkts/0 bytes][Goodput ratio: 49/0][3914.88 sec][Hostname/SNI: _googlecast._tcp.local][_googlecast._tcp.local][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 6684/0 41917/0 11732/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 82/0 82/0 0/0][PLAIN TEXT (googlecast)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 35 TCP 192.168.1.103:54183 -> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][2 pkts/2508 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][17.47 sec][PLAIN TEXT (G@aRkU)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0] + 35 TCP 192.168.1.103:54183 -> 203.205.151.162:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][2 pkts/2508 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][17.47 sec][PLAIN TEXT (G@aRkU)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0] 36 UDP [fe80::91f9:3df3:7436:6cd6]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][ClearText][Confidence: DPI][cat: Network/14][14 pkts/1428 bytes -> 0 pkts/0 bytes][Goodput ratio: 39/0][123.08 sec][Hostname/SNI: _googlecast._tcp.local][_googlecast._tcp.local][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 4608/0 45060/0 12222/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/0 102/0 102/0 0/0][PLAIN TEXT (googlecast)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 37 TCP 192.168.1.103:36017 <-> 64.233.167.188:5228 [proto: 126/Google][Encrypted][Confidence: Match by IP][cat: Web/5][10 pkts/660 bytes <-> 10 pkts/660 bytes][Goodput ratio: 0/0][540.78 sec][bytes ratio: 0.000 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 45051/45051 61959/61957 180207/180208 44694/44695][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 66/66 66/66 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 38 UDP 192.168.1.100:5353 -> 224.0.0.251:5353 [proto: 8/MDNS][ClearText][Confidence: DPI][cat: Network/14][14 pkts/1148 bytes -> 0 pkts/0 bytes][Goodput ratio: 49/0][123.08 sec][Hostname/SNI: _googlecast._tcp.local][_googlecast._tcp.local][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 4608/0 45058/0 12221/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 82/0 82/0 0/0][PLAIN TEXT (googlecast)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 39 TCP 192.168.1.103:58039 <-> 203.205.147.171:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][13 pkts/866 bytes <-> 4 pkts/280 bytes][Goodput ratio: 0/0][140.92 sec][bytes ratio: 0.511 (Upload)][IAT c2s/s2c min/avg/max/stddev: 272/45308 12755/45308 45020/45308 13611/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 67/70 74/74 2/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 39 TCP 192.168.1.103:58039 <-> 203.205.147.171:443 [proto: 91.285/TLS.Tencent][Encrypted][Confidence: Match by IP][cat: SocialNetwork/6][13 pkts/866 bytes <-> 4 pkts/280 bytes][Goodput ratio: 0/0][140.92 sec][bytes ratio: 0.511 (Upload)][IAT c2s/s2c min/avg/max/stddev: 272/45308 12755/45308 45020/45308 13611/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 67/70 74/74 2/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 40 TCP 192.168.1.103:58143 -> 216.58.205.131:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][3 pkts/1078 bytes -> 0 pkts/0 bytes][Goodput ratio: 82/0][92.69 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 41 TCP 203.205.151.162:443 <-> 192.168.1.103:54084 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][3 pkts/802 bytes <-> 3 pkts/198 bytes][Goodput ratio: 75/0][16.21 sec][bytes ratio: 0.604 (Upload)][IAT c2s/s2c min/avg/max/stddev: 6562/9679 8102/9679 9642/9679 1540/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 267/66 670/66 285/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 41 TCP 203.205.151.162:443 <-> 192.168.1.103:54084 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][3 pkts/802 bytes <-> 3 pkts/198 bytes][Goodput ratio: 75/0][16.21 sec][bytes ratio: 0.604 (Upload)][IAT c2s/s2c min/avg/max/stddev: 6562/9679 8102/9679 9642/9679 1540/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 267/66 670/66 285/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 42 UDP 192.168.1.100:137 -> 192.168.1.255:137 [proto: 10/NetBIOS][ClearText][Confidence: DPI][cat: System/18][9 pkts/828 bytes -> 0 pkts/0 bytes][Goodput ratio: 54/0][1.44 sec][Hostname/SNI: lbjamwptxz][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 179/0 816/0 313/0][Pkt Len c2s/s2c min/avg/max/stddev: 92/0 92/0 92/0 0/0][PLAIN TEXT ( EMECEKEBENFHFAFEFIFKCACACACACA)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 43 IGMP 192.168.1.100:0 -> 224.0.0.22:0 [proto: 82/IGMP][ClearText][Confidence: DPI][cat: Network/14][15 pkts/810 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3769.99 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 409/0 289920/0 3384346/0 895904/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 54/0 54/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 44 UDP 192.168.1.100:138 -> 192.168.1.255:138 [proto: 10.16/NetBIOS.SMBv1][ClearText][Confidence: DPI][cat: System/18][3 pkts/751 bytes -> 0 pkts/0 bytes][Goodput ratio: 83/0][3600.00 sec][Hostname/SNI: giovanni-pc][Risk: ** Unsafe Protocol **][Risk Score: 10][PLAIN TEXT ( EHEJEPFGEBEOEOEJ)][Plen Bins: 0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 45 TCP 192.168.1.103:54112 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][5 pkts/338 bytes <-> 4 pkts/280 bytes][Goodput ratio: 0/0][22.72 sec][bytes ratio: 0.094 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 351/910 5597/910 20327/910 8509/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/70 74/74 3/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 46 TCP 192.168.1.103:54114 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][5 pkts/338 bytes <-> 4 pkts/280 bytes][Goodput ratio: 0/0][55.41 sec][bytes ratio: 0.094 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 312/33511 13774/33511 33196/33511 13762/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/70 74/74 3/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 45 TCP 192.168.1.103:54112 <-> 203.205.151.162:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][5 pkts/338 bytes <-> 4 pkts/280 bytes][Goodput ratio: 0/0][22.72 sec][bytes ratio: 0.094 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 351/910 5597/910 20327/910 8509/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/70 74/74 3/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 46 TCP 192.168.1.103:54114 <-> 203.205.151.162:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][5 pkts/338 bytes <-> 4 pkts/280 bytes][Goodput ratio: 0/0][55.41 sec][bytes ratio: 0.094 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 312/33511 13774/33511 33196/33511 13762/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/70 74/74 3/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 47 UDP 192.168.1.103:19041 <-> 192.168.1.254:53 [proto: 5.48/DNS.QQ][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/73 bytes <-> 1 pkts/537 bytes][Goodput ratio: 42/92][0.03 sec][Hostname/SNI: res.wx.qq.com][203.205.158.34][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 48 TCP 192.168.1.103:34981 -> 95.101.34.33:80 [proto: 7/HTTP][ClearText][Confidence: Match by port][cat: Web/5][9 pkts/594 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][100.37 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 259/0 12546/0 83360/0 26898/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 66/0 66/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 49 TCP 192.168.1.103:34996 -> 95.101.34.33:80 [proto: 7/HTTP][ClearText][Confidence: Match by port][cat: Web/5][9 pkts/594 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][100.98 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 252/0 12622/0 82310/0 26534/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 66/0 66/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] @@ -82,18 +83,18 @@ JA3 Host Stats: 52 TCP 192.168.1.103:39207 -> 95.101.34.34:80 [proto: 7/HTTP][ClearText][Confidence: Match by port][cat: Web/5][9 pkts/594 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][104.22 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 239/0 13028/0 84664/0 27320/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 66/0 66/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 53 TCP 192.168.1.103:39231 -> 95.101.34.34:80 [proto: 7/HTTP][ClearText][Confidence: Match by port][cat: Web/5][9 pkts/594 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][99.19 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 255/0 12398/0 82310/0 26558/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 66/0 66/0 0/0][PLAIN TEXT (PLTbOhOof)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 54 TCP 192.168.1.103:53220 <-> 172.217.23.78:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][4 pkts/264 bytes <-> 4 pkts/319 bytes][Goodput ratio: 0/17][14.77 sec][bytes ratio: -0.094 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/39 4910/7364 14730/14688 6944/7324][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 66/80 66/121 0/24][PLAIN TEXT (lMRov.)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 55 TCP 192.168.1.103:54093 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][5 pkts/338 bytes <-> 3 pkts/214 bytes][Goodput ratio: 0/0][11.84 sec][bytes ratio: 0.225 (Upload)][IAT c2s/s2c min/avg/max/stddev: 325/0 2960/0 9935/0 4045/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/71 74/74 3/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 56 TCP 192.168.1.103:58037 <-> 203.205.147.171:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][5 pkts/338 bytes <-> 3 pkts/214 bytes][Goodput ratio: 0/0][11.56 sec][bytes ratio: 0.225 (Upload)][IAT c2s/s2c min/avg/max/stddev: 267/0 2890/0 9679/0 3944/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/71 74/74 3/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 55 TCP 192.168.1.103:54093 <-> 203.205.151.162:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][5 pkts/338 bytes <-> 3 pkts/214 bytes][Goodput ratio: 0/0][11.84 sec][bytes ratio: 0.225 (Upload)][IAT c2s/s2c min/avg/max/stddev: 325/0 2960/0 9935/0 4045/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/71 74/74 3/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 56 TCP 192.168.1.103:58037 <-> 203.205.147.171:443 [proto: 91.285/TLS.Tencent][Encrypted][Confidence: Match by IP][cat: SocialNetwork/6][5 pkts/338 bytes <-> 3 pkts/214 bytes][Goodput ratio: 0/0][11.56 sec][bytes ratio: 0.225 (Upload)][IAT c2s/s2c min/avg/max/stddev: 267/0 2890/0 9679/0 3944/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68/71 74/74 3/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 57 TCP 192.168.1.103:39195 -> 95.101.34.34:80 [proto: 7/HTTP][ClearText][Confidence: Match by port][cat: Web/5][8 pkts/528 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][90.80 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 232/0 12972/0 83248/0 28714/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 66/0 66/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 58 TCP 192.168.1.103:52020 -> 95.101.180.179:80 [proto: 7/HTTP][ClearText][Confidence: Match by port][cat: Web/5][8 pkts/528 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][94.52 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 267/0 13502/0 85920/0 29594/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 66/0 66/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 59 TCP 192.168.1.103:43851 <-> 203.205.158.34:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][5 pkts/290 bytes <-> 4 pkts/234 bytes][Goodput ratio: 0/0][47.04 sec][bytes ratio: 0.107 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 301/1307 11760/23331 45054/45355 19226/22024][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 58/58 74/66 8/5][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 59 TCP 192.168.1.103:43851 <-> 203.205.158.34:443 [proto: 91.285/TLS.Tencent][Encrypted][Confidence: Match by IP][cat: SocialNetwork/6][5 pkts/290 bytes <-> 4 pkts/234 bytes][Goodput ratio: 0/0][47.04 sec][bytes ratio: 0.107 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 301/1307 11760/23331 45054/45355 19226/22024][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 58/58 74/66 8/5][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 60 TCP 192.168.1.103:47627 <-> 216.58.205.78:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][3 pkts/198 bytes <-> 4 pkts/319 bytes][Goodput ratio: 0/17][14.77 sec][bytes ratio: -0.234 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/40 7363/7364 14726/14687 7363/7324][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 66/80 66/121 0/24][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 61 TCP 192.168.1.103:40740 <-> 203.205.151.211:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][4 pkts/216 bytes <-> 4 pkts/253 bytes][Goodput ratio: 0/12][20.65 sec][bytes ratio: -0.079 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 39/652 6763/10145 19992/19638 9355/9493][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 54/63 54/85 0/13][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 62 UDP 192.168.1.103:60356 <-> 192.168.1.254:53 [proto: 5.197/DNS.WeChat][ClearText][Confidence: DPI][cat: Chat/9][1 pkts/74 bytes <-> 1 pkts/391 bytes][Goodput ratio: 43/89][0.28 sec][Hostname/SNI: web.wechat.com][203.205.147.171][PLAIN TEXT (wechat)][Plen Bins: 0,50,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 63 TCP 192.168.1.103:49787 <-> 216.58.205.142:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][3 pkts/198 bytes <-> 3 pkts/198 bytes][Goodput ratio: 0/0][90.15 sec][bytes ratio: 0.000 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 45055/45054 45056/45055 45056/45056 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 66/66 66/66 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 64 TCP 192.168.1.103:58226 -> 203.205.147.171:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][6 pkts/396 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][92.42 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 607/0 18483/0 85584/0 33566/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 66/0 66/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 64 TCP 192.168.1.103:58226 -> 203.205.147.171:443 [proto: 91.285/TLS.Tencent][Encrypted][Confidence: Match by IP][cat: SocialNetwork/6][6 pkts/396 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][92.42 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 607/0 18483/0 85584/0 33566/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/0 66/0 66/0 0/0][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 65 UDP 192.168.1.103:53734 <-> 192.168.1.254:53 [proto: 5.126/DNS.Google][ClearText][Confidence: DPI][cat: Web/5][1 pkts/94 bytes <-> 1 pkts/272 bytes][Goodput ratio: 55/84][0.04 sec][Hostname/SNI: safebrowsing.googleusercontent.com][172.217.22.14][PLAIN TEXT (safebrowsing)][Plen Bins: 0,50,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 66 TCP 192.168.1.103:58043 <-> 203.205.147.171:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][3 pkts/206 bytes <-> 2 pkts/148 bytes][Goodput ratio: 0/0][1.65 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 66 TCP 192.168.1.103:58043 <-> 203.205.147.171:443 [proto: 91.285/TLS.Tencent][Encrypted][Confidence: Match by IP][cat: SocialNetwork/6][3 pkts/206 bytes <-> 2 pkts/148 bytes][Goodput ratio: 0/0][1.65 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 67 UDP 0.0.0.0:68 -> 255.255.255.255:67 [proto: 18/DHCP][ClearText][Confidence: DPI][cat: Network/14][1 pkts/342 bytes -> 0 pkts/0 bytes][Goodput ratio: 87/0][< 1 sec][Hostname/SNI: iphonedimonica][DHCP Fingerprint: 1,121,3,6,15,119,252][PLAIN TEXT (iPhonediMonica)][Plen Bins: 0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 68 UDP 192.168.1.103:46078 <-> 192.168.1.254:53 [proto: 5.126/DNS.Google][ClearText][Confidence: DPI][cat: Web/5][1 pkts/75 bytes <-> 1 pkts/234 bytes][Goodput ratio: 43/82][0.04 sec][Hostname/SNI: ssl.gstatic.com][172.217.23.67][PLAIN TEXT (gstatic)][Plen Bins: 0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 69 UDP 192.168.1.103:60562 <-> 192.168.1.254:53 [proto: 5.126/DNS.Google][ClearText][Confidence: DPI][cat: Web/5][1 pkts/75 bytes <-> 1 pkts/234 bytes][Goodput ratio: 43/82][0.03 sec][Hostname/SNI: ssl.gstatic.com][172.217.23.67][PLAIN TEXT (gstatic)][Plen Bins: 0,50,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] @@ -101,7 +102,7 @@ JA3 Host Stats: 71 IGMP 192.168.1.103:0 -> 224.0.0.22:0 [proto: 82/IGMP][ClearText][Confidence: DPI][cat: Network/14][4 pkts/216 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3756.16 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 72 TCP 192.168.1.103:40741 <-> 203.205.151.211:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][2 pkts/108 bytes <-> 2 pkts/108 bytes][Goodput ratio: 0/0][0.36 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 73 IGMP 192.168.1.254:0 -> 224.0.0.1:0 [proto: 82/IGMP][ClearText][Confidence: DPI][cat: Network/14][4 pkts/200 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3763.44 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 74 TCP 192.168.1.103:54085 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][2 pkts/132 bytes <-> 1 pkts/66 bytes][Goodput ratio: 0/0][0.33 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 74 TCP 192.168.1.103:54085 <-> 203.205.151.162:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][2 pkts/132 bytes <-> 1 pkts/66 bytes][Goodput ratio: 0/0][0.33 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 75 UDP [fe80::91f9:3df3:7436:6cd6]:50440 -> [ff02::1:3]:5355 [proto: 154/LLMNR][ClearText][Confidence: DPI][cat: Network/14][2 pkts/180 bytes -> 0 pkts/0 bytes][Goodput ratio: 31/0][0.01 sec][Hostname/SNI: lbjamwptxz][PLAIN TEXT (lbjamwptx)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 76 UDP [fe80::91f9:3df3:7436:6cd6]:49195 -> [ff02::1:3]:5355 [proto: 154/LLMNR][ClearText][Confidence: DPI][cat: Network/14][2 pkts/176 bytes -> 0 pkts/0 bytes][Goodput ratio: 29/0][0.01 sec][Hostname/SNI: cansaqcq][PLAIN TEXT (cansaqcq)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 77 UDP [fe80::91f9:3df3:7436:6cd6]:50577 -> [ff02::1:3]:5355 [proto: 154/LLMNR][ClearText][Confidence: DPI][cat: Network/14][2 pkts/176 bytes -> 0 pkts/0 bytes][Goodput ratio: 29/0][0.01 sec][Hostname/SNI: mcztmpkc][PLAIN TEXT (mcztmpkc)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] @@ -115,9 +116,9 @@ JA3 Host Stats: 85 UDP 192.168.1.100:54124 -> 224.0.0.252:5355 [proto: 154/LLMNR][ClearText][Confidence: DPI][cat: Network/14][2 pkts/140 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][0.01 sec][Hostname/SNI: lbjamwptxz][PLAIN TEXT (lbjamwptx)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 86 UDP 192.168.1.100:49832 -> 224.0.0.252:5355 [proto: 154/LLMNR][ClearText][Confidence: DPI][cat: Network/14][2 pkts/136 bytes -> 0 pkts/0 bytes][Goodput ratio: 38/0][0.01 sec][Hostname/SNI: cansaqcq][PLAIN TEXT (cansaqcq)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 87 UDP 192.168.1.100:57401 -> 224.0.0.252:5355 [proto: 154/LLMNR][ClearText][Confidence: DPI][cat: Network/14][2 pkts/136 bytes -> 0 pkts/0 bytes][Goodput ratio: 38/0][0.01 sec][Hostname/SNI: mcztmpkc][PLAIN TEXT (mcztmpkc)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 88 TCP 192.168.1.103:54106 -> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][2 pkts/132 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][35.46 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 89 TCP 192.168.1.103:54109 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][1 pkts/66 bytes <-> 1 pkts/66 bytes][Goodput ratio: 0/0][0.35 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 90 TCP 192.168.1.103:54110 <-> 203.205.151.162:443 [proto: 91.197/TLS.WeChat][Encrypted][Confidence: Match by IP][cat: Chat/9][1 pkts/66 bytes <-> 1 pkts/66 bytes][Goodput ratio: 0/0][0.31 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 88 TCP 192.168.1.103:54106 -> 203.205.151.162:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][2 pkts/132 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][35.46 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 89 TCP 192.168.1.103:54109 <-> 203.205.151.162:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][1 pkts/66 bytes <-> 1 pkts/66 bytes][Goodput ratio: 0/0][0.35 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 90 TCP 192.168.1.103:54110 <-> 203.205.151.162:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][1 pkts/66 bytes <-> 1 pkts/66 bytes][Goodput ratio: 0/0][0.31 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 91 TCP 192.168.1.103:54205 -> 64.233.167.188:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/132 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][135.44 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 92 ICMPV6 [fe80::842:a3f3:a286:6c5b]:0 -> [ff02::2]:0 [proto: 102/ICMPV6][ClearText][Confidence: DPI][cat: Network/14][2 pkts/132 bytes -> 0 pkts/0 bytes][Goodput ratio: 6/0][1.43 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 93 ICMPV6 [fe80::842:a3f3:a286:6c5b]:0 -> [ff02::16]:0 [proto: 102/ICMPV6][ClearText][Confidence: DPI][cat: Network/14][1 pkts/110 bytes -> 0 pkts/0 bytes][Goodput ratio: 36/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/utils/asn_update.sh b/utils/asn_update.sh index c104adc9b..e79c3da86 100755 --- a/utils/asn_update.sh +++ b/utils/asn_update.sh @@ -58,3 +58,58 @@ echo "(1) Downloading Webex routes..." DEST=../src/lib/inc_generated/ndpi_asn_webex.c.inc create_list NDPI_PROTOCOL_WEBEX $DEST "AS6577" "AS399937" "AS16472" "AS13445" echo "(3) Webex IPs are available in $DEST" + +echo "(1) Downloading Tencent routes..." +DEST=../src/lib/inc_generated/ndpi_asn_tencent.c.inc +create_list NDPI_PROTOCOL_TENCENT $DEST "AS45090" "AS137876" "AS133478" "AS132591" "AS132203" +echo "(3) Tencent IPs are available in $DEST" + +echo "(1) Downloading OpenDNS routes..." +DEST=../src/lib/inc_generated/ndpi_asn_opendns.c.inc +create_list NDPI_PROTOCOL_OPENDNS $DEST "AS36692" "AS30607" +echo "(3) OpenDNS IPs are available in $DEST" + +echo "(1) Downloading Dropbox routes..." +DEST=../src/lib/inc_generated/ndpi_asn_dropbox.c.inc +create_list NDPI_PROTOCOL_DROPBOX $DEST "AS62190" "AS54372" "AS393874" "AS203719" "AS200499" "AS19679" +echo "(3) Dropbox IPs are available in $DEST" + +echo "(1) Downloading Starcraft routes..." #Starcraft or a more generic Blizzard stuff? +DEST=../src/lib/inc_generated/ndpi_asn_starcraft.c.inc +create_list NDPI_PROTOCOL_STARCRAFT $DEST "AS57976" "AS32163" +echo "(3) Starcraft IPs are available in $DEST" + +echo "(1) Downloading UbuntuOne routes..." #Canonical +DEST=../src/lib/inc_generated/ndpi_asn_ubuntuone.c.inc +create_list NDPI_PROTOCOL_UBUNTUONE $DEST "AS41231" "AS11210" +echo "(3) UbuntuOne IPs are available in $DEST" + +echo "(1) Downloading Twitch routes..." +DEST=../src/lib/inc_generated/ndpi_asn_twitch.c.inc +create_list NDPI_PROTOCOL_TWITCH $DEST "AS46489" "AS397153" +echo "(3) Twitch IPs are available in $DEST" + +echo "(1) Downloading Hotspot Shield routes..." #AnchorFree +DEST=../src/lib/inc_generated/ndpi_asn_hotspotshield.c.inc +create_list NDPI_PROTOCOL_HOTSPOT_SHIELD $DEST "AS26642" +echo "(3) Hotspot Shield IPs are available in $DEST" + +echo "(1) Downloading GitHub routes..." +DEST=../src/lib/inc_generated/ndpi_asn_github.c.inc +create_list NDPI_PROTOCOL_GITHUB $DEST "AS36459" +echo "(3) GitHub IPs are available in $DEST" + +echo "(1) Downloading Steam routes..." #Valve +DEST=../src/lib/inc_generated/ndpi_asn_steam.c.inc +create_list NDPI_PROTOCOL_STEAM $DEST "AS32590" +echo "(3) Steam IPs are available in $DEST" + +echo "(1) Downloading Bloomberg routes..." +DEST=../src/lib/inc_generated/ndpi_asn_bloomberg.c.inc +create_list NDPI_PROTOCOL_BLOOMBERG $DEST "AS8188" "AS58850" "AS33220" "AS33181" "AS199559" "AS17063" "AS13908" "AS10361" +echo "(3) Bloomberg IPs are available in $DEST" + +echo "(1) Downloading Citrix routes..." #Citrix or a more generic LogMeIn stuff? +DEST=../src/lib/inc_generated/ndpi_asn_citrix.c.inc +create_list NDPI_PROTOCOL_CITRIX $DEST "AS395424" "AS21866" "AS213380" "AS20104" "AS16815" +echo "(3) Citrix IPs are available in $DEST" |