Added proprietary Agora Software Defined Real-time Network (SD-RTN) protocol dissector. (#1520)

Signed-off-by: lns <matzeton@googlemail.com>

6 files changed, 138 insertions, 4 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 918e567c7..f1ff5b30b 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -199,7 +199,7 @@ typedef enum {
   NDPI_PROTOCOL_CORBA                 = 168,
   NDPI_PROTOCOL_UBUNTUONE             = 169,
   NDPI_PROTOCOL_WHOIS_DAS             = 170,
-  NDPI_PROTOCOL_FREE_171              = 171, /* FREE */
+  NDPI_PROTOCOL_SD_RTN                = 171, /* Agora SD-RTN: https://www.agora.io/en */
   NDPI_PROTOCOL_SOCKS                 = 172,
   NDPI_PROTOCOL_NINTENDO              = 173,
   NDPI_PROTOCOL_RTMP                  = 174,
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index e225ba04a..4e9509cac 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -222,6 +222,7 @@ void init_avast_securedns_dissector(struct ndpi_detection_module_struct *ndpi_st
 void init_cassandra_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_ethernet_ip_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_toca_boca_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_sd_rtn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 
 /* ndpi_main.c */
 extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port);
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2bd3c0a5a..7cbc9b316 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1619,9 +1619,9 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			  "Whois-DAS", NDPI_PROTOCOL_CATEGORY_NETWORK,
 			  ndpi_build_default_ports(ports_a, 43, 4343, 0, 0, 0), /* TCP */
 			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0));    /* UDP */
-  ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_171,
-			  "FREE171", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS,
-			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),      /* TCP */
+  ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SD_RTN,
+			  "SD-RTN", NDPI_PROTOCOL_CATEGORY_MEDIA,
+			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),  /* TCP */
 			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
   ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SOCKS,
 			  "SOCKS", NDPI_PROTOCOL_CATEGORY_WEB,
@@ -4311,6 +4311,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
   /* TocaBoca */
   init_toca_boca_dissector(ndpi_str, &a, detection_bitmask);
 
+  /* SD-RTN Software Defined Real-time Network */
+  init_sd_rtn_dissector(ndpi_str, &a, detection_bitmask);
+
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_main_init.c"
 #endif
diff --git a/src/lib/protocols/sd_rtn.c b/src/lib/protocols/sd_rtn.c
new file mode 100644
index 000000000..1ddd6af06
--- /dev/null
+++ b/src/lib/protocols/sd_rtn.c
@@ -0,0 +1,97 @@
+/*
+ * sd_rtn.c
+ *
+ * Copyright (C) 2011-22 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SD_RTN
+
+#include "ndpi_api.h"
+
+static void ndpi_int_sd_rtn_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
+                                           struct ndpi_flow_struct * const flow)
+{
+  NDPI_LOG_INFO(ndpi_struct, "found Software Defined Real-time Network (SD-RTN)\n");
+  ndpi_set_detected_protocol(ndpi_struct, flow,
+                             NDPI_PROTOCOL_SD_RTN,
+                             NDPI_PROTOCOL_UNKNOWN,
+                             NDPI_CONFIDENCE_DPI);
+}
+
+static int ndpi_int_sd_rtn_dissect_sni(struct ndpi_flow_struct * const flow,
+                                       u_int8_t const * const payload,
+                                       u_int32_t payload_len)
+{
+  u_int32_t sni_len = ntohs(get_u_int16_t(payload, 16));
+
+  if (sni_len + 19 > payload_len)
+  {
+    return -1;
+  }
+
+  if (payload[18] != 0x00)
+  {
+    return -1;
+  }
+
+  ndpi_hostname_sni_set(flow, &payload[19], sni_len);
+
+  return 0;
+}
+
+void ndpi_search_sd_rtn(struct ndpi_detection_module_struct *ndpi_struct,
+                        struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct * const packet = &ndpi_struct->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "search Software Defined Real-time Network (SD-RTN)\n");
+
+  if (packet->udp != NULL)
+  {
+    if (packet->payload_packet_len >= 20
+        && packet->payload[6] == 0x21
+        && ntohl(get_u_int32_t(packet->payload, 12)) == 0x04534e49 /* "\x04SNI" */)
+    {
+      int ret = ndpi_int_sd_rtn_dissect_sni(flow, packet->payload,
+                                                  packet->payload_packet_len);
+
+      if (ret == 0)
+      {
+        ndpi_int_sd_rtn_add_connection(ndpi_struct, flow);
+        return;
+      }
+    }
+  }
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void init_sd_rtn_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+                           u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("SD-RTN", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_SD_RTN,
+				      ndpi_search_sd_rtn,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
+}
+
diff --git a/tests/pcap/agora-sd-rtn.pcap b/tests/pcap/agora-sd-rtn.pcap
new file mode 100644
index 000000000..c23ce6a6f
--- /dev/null
+++ b/tests/pcap/agora-sd-rtn.pcap
diff --git a/tests/result/agora-sd-rtn.pcap.out b/tests/result/agora-sd-rtn.pcap.out
new file mode 100644
index 000000000..71ad38511
--- /dev/null
+++ b/tests/result/agora-sd-rtn.pcap.out
@@ -0,0 +1,33 @@
+Guessed flow protos:	0
+
+DPI Packets (UDP):	26	(1.00 pkts/flow)
+Confidence DPI              : 26 (flows)
+
+SD-RTN	403	112365	26
+
+	1	UDP 192.168.2.100:55322 <-> 104.166.161.75:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][24 pkts/5221 bytes <-> 6 pkts/3204 bytes][Goodput ratio: 81/92][730.23 sec][Hostname/SNI: 104-166-161-75.edge.agora.io][bytes ratio: 0.239 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 34770/0 730075/0 155475/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 218/534 986/534 191/0][PLAIN TEXT (75.edge.agora.ioPDMD)][Plen Bins: 20,0,0,20,3,0,10,20,0,0,0,0,0,3,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	2	UDP 192.168.2.100:46798 <-> 23.248.186.179:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][11 pkts/2008 bytes <-> 4 pkts/5044 bytes][Goodput ratio: 77/97][< 1 sec][Hostname/SNI: 23-248-186-179.edge.agora.io][bytes ratio: -0.431 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 13/0 92/0 29/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/1261 183/1261 367/1261 98/0][PLAIN TEXT (179.edge.agora.ioPDMD)][Plen Bins: 20,0,0,13,13,0,0,20,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,26,0,0,0,0,0,0,0,0,0]
+	3	UDP 192.168.2.100:47805 -> 199.190.44.135:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][18 pkts/4968 bytes -> 0 pkts/0 bytes][Goodput ratio: 85/0][904.29 sec][Hostname/SNI: 199-190-44-135.edge.agora.io][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 58186/0 927866/0 224551/0][Pkt Len c2s/s2c min/avg/max/stddev: 276/0 276/0 276/0 0/0][PLAIN TEXT (135.edge.agora.ioPDMD)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	4	UDP 192.168.2.100:47805 <-> 202.226.25.166:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/3312 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 85/92][2.97 sec][Hostname/SNI: 202-226-25-166.edge.agora.io][bytes ratio: 0.348 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 143/0 876/0 273/0][Pkt Len c2s/s2c min/avg/max/stddev: 276/534 276/534 276/534 0/0][PLAIN TEXT (166.edge.agora.ioPDMD)][Plen Bins: 0,0,0,0,0,0,0,80,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	5	UDP 192.168.2.100:44131 <-> 104.166.161.75:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/3044 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 83/92][0.12 sec][Hostname/SNI: 104-166-161-75.edge.agora.io][bytes ratio: 0.310 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 12/0 121/0 36/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 254/534 986/534 237/0][PLAIN TEXT (75.edge.agora.ioPDMD)][Plen Bins: 20,0,0,6,6,0,20,20,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	6	UDP 192.168.2.100:55094 <-> 128.1.193.223:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][3 pkts/825 bytes <-> 7 pkts/3762 bytes][Goodput ratio: 85/92][< 1 sec][Hostname/SNI: 128-1-193-223.edge.agora.io][bytes ratio: -0.640 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/167 0/478 0/1440 0/521][Pkt Len c2s/s2c min/avg/max/stddev: 275/534 275/537 275/540 0/3][PLAIN TEXT (223.edge.agora.ioPDMD)][Plen Bins: 0,0,0,0,0,0,0,30,0,0,0,0,0,0,0,70,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	7	UDP 192.168.2.100:40393 <-> 23.248.186.179:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2760 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 82/92][0.05 sec][Hostname/SNI: 23-248-186-179.edge.agora.io][bytes ratio: 0.265 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/0 48/0 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 230/534 860/534 206/0][PLAIN TEXT (179.edge.agora.ioPDMD)][Plen Bins: 20,0,0,13,13,6,0,20,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	8	UDP 192.168.2.100:47805 -> 103.104.168.244:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][15 pkts/4155 bytes -> 0 pkts/0 bytes][Goodput ratio: 85/0][3.03 sec][Hostname/SNI: 103-104-168-244.edge.agora.io][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 233/0 1497/0 442/0][Pkt Len c2s/s2c min/avg/max/stddev: 277/0 277/0 277/0 0/0][PLAIN TEXT (244.edge.agora.ioPDMD)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	9	UDP 192.168.2.100:47805 -> 23.248.186.180:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][15 pkts/4140 bytes -> 0 pkts/0 bytes][Goodput ratio: 85/0][3.33 sec][Hostname/SNI: 23-248-186-180.edge.agora.io][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 256/0 1768/0 510/0][Pkt Len c2s/s2c min/avg/max/stddev: 276/0 276/0 276/0 0/0][PLAIN TEXT (180.edge.agora.ioPDMD)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	10	UDP 192.168.2.100:47805 <-> 128.1.193.223:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2518 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 80/92][0.26 sec][Hostname/SNI: 128-1-193-223.edge.agora.io][bytes ratio: 0.222 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 26/0 241/0 72/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 210/534 367/534 103/0][PLAIN TEXT (223.edge.agora.ioPDMD)][Plen Bins: 20,0,0,6,6,0,0,40,0,0,6,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	11	UDP 192.168.2.100:47453 <-> 23.248.186.179:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2396 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 79/92][< 1 sec][Hostname/SNI: 23-248-186-179.edge.agora.io][bytes ratio: 0.199 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 20/0 153/0 46/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 200/534 276/534 92/0][PLAIN TEXT (179.edge.agora.ioPDMD)][Plen Bins: 20,0,0,0,13,6,0,40,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	12	UDP 192.168.2.100:40393 <-> 104.166.161.75:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2328 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 78/92][0.05 sec][Hostname/SNI: 104-166-161-75.edge.agora.io][bytes ratio: 0.185 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/0 48/0 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 194/534 276/534 84/0][PLAIN TEXT (75.edge.agora.ioPDMD)][Plen Bins: 20,0,0,0,0,40,0,20,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	13	UDP 192.168.2.100:47805 <-> 23.248.186.179:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2318 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 78/92][0.06 sec][Hostname/SNI: 23-248-186-179.edge.agora.io][bytes ratio: 0.183 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/0 56/0 17/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 193/534 276/534 83/0][PLAIN TEXT (179.edge.agora.ioPDMD)][Plen Bins: 20,0,0,0,0,40,0,20,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	14	UDP 192.168.2.100:47805 <-> 128.1.193.224:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2316 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 78/92][0.20 sec][Hostname/SNI: 128-1-193-224.edge.agora.io][bytes ratio: 0.182 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 20/0 200/0 60/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 193/534 275/534 83/0][PLAIN TEXT (224.edge.agora.ioPDMD)][Plen Bins: 20,0,0,0,0,40,0,20,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	15	UDP 192.168.2.100:44131 <-> 128.1.77.66:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2300 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 78/92][0.06 sec][Hostname/SNI: 128-1-77-66.edge.agora.io][bytes ratio: 0.179 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/0 55/0 16/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 192/534 434/534 109/0][PLAIN TEXT (66.edge.agora.ioPDMD)][Plen Bins: 20,0,0,20,0,13,0,20,0,0,0,0,6,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	16	UDP 192.168.2.100:55322 <-> 193.118.52.182:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2273 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 78/92][0.04 sec][Hostname/SNI: 193-118-52-182.edge.agora.io][bytes ratio: 0.173 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/0 41/0 12/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 189/534 534/534 130/0][PLAIN TEXT (182.edge.agora.ioPDMD)][Plen Bins: 20,0,0,33,0,0,0,20,0,0,0,0,0,0,0,26,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	17	UDP 192.168.2.100:35778 <-> 23.248.186.179:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2197 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 77/92][0.05 sec][Hostname/SNI: 23-248-186-179.edge.agora.io][bytes ratio: 0.157 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/0 49/0 15/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 183/534 367/534 96/0][PLAIN TEXT (179.edge.agora.ioPDMD)][Plen Bins: 20,0,0,20,13,0,0,20,0,0,6,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	18	UDP 192.168.2.100:35778 <-> 104.166.161.75:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2197 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 77/92][0.05 sec][Hostname/SNI: 104-166-161-75.edge.agora.io][bytes ratio: 0.157 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/0 42/0 13/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 183/534 367/534 96/0][PLAIN TEXT (75.edge.agora.ioPDMD)][Plen Bins: 20,0,0,20,13,0,0,20,0,0,6,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	19	UDP 192.168.2.100:55322 <-> 23.248.186.179:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2190 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 77/92][0.05 sec][Hostname/SNI: 23-248-186-179.edge.agora.io][bytes ratio: 0.155 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/0 44/0 13/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 182/534 496/534 123/0][PLAIN TEXT (179.edge.agora.ioPDMD)][Plen Bins: 20,0,0,33,0,0,0,20,0,0,0,0,0,0,6,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	20	UDP 192.168.2.100:44131 <-> 23.248.186.179:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2171 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 77/92][0.05 sec][Hostname/SNI: 23-248-186-179.edge.agora.io][bytes ratio: 0.151 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/0 46/0 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 181/534 477/534 119/0][PLAIN TEXT (179.edge.agora.ioPDMD)][Plen Bins: 20,0,0,33,0,0,0,20,0,0,0,0,0,6,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	21	UDP 192.168.2.100:55322 <-> 128.1.193.223:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2163 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 77/92][0.19 sec][Hostname/SNI: 128-1-193-223.edge.agora.io][bytes ratio: 0.149 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 18/0 183/0 55/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 180/534 472/534 118/0][PLAIN TEXT (223.edge.agora.ioPDMD)][Plen Bins: 20,0,0,33,0,0,0,20,0,0,0,0,0,6,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	22	UDP 192.168.2.100:55322 <-> 23.248.186.180:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2145 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 76/92][0.05 sec][Hostname/SNI: 23-248-186-180.edge.agora.io][bytes ratio: 0.145 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/0 44/0 13/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 179/534 451/534 114/0][PLAIN TEXT (180.edge.agora.ioPDMD)][Plen Bins: 20,0,0,33,0,0,0,20,0,0,0,0,6,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	23	UDP 192.168.2.100:55322 <-> 128.1.233.218:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][11 pkts/2068 bytes <-> 4 pkts/1676 bytes][Goodput ratio: 78/90][0.08 sec][Hostname/SNI: 128-1-233-218.edge.agora.io][bytes ratio: 0.105 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/0 46/0 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/74 188/419 275/534 86/199][PLAIN TEXT (218.edge.agora.ioPDMD)][Plen Bins: 20,6,0,0,6,26,0,20,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	24	UDP 192.168.2.100:55322 <-> 128.1.193.224:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][12 pkts/2131 bytes <-> 3 pkts/1602 bytes][Goodput ratio: 76/92][0.19 sec][Hostname/SNI: 128-1-193-224.edge.agora.io][bytes ratio: 0.142 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 19/0 184/0 55/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/534 178/534 440/534 112/0][PLAIN TEXT (224.edge.agora.ioPDMD)][Plen Bins: 20,0,0,33,0,0,0,20,0,0,0,0,6,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	25	UDP 192.168.2.100:44131 <-> 23.248.186.180:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][11 pkts/2024 bytes <-> 4 pkts/1676 bytes][Goodput ratio: 77/90][0.07 sec][Hostname/SNI: 23-248-186-180.edge.agora.io][bytes ratio: 0.094 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 5/0 44/0 14/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/74 184/419 276/534 87/199][PLAIN TEXT (180.edge.agora.ioPDMD)][Plen Bins: 20,6,0,6,0,26,0,20,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	26	UDP 192.168.2.100:44131 <-> 104.166.161.19:8130 [proto: 171/SD-RTN][ClearText][Confidence: DPI][cat: Media/1][10 pkts/1851 bytes <-> 5 pkts/1750 bytes][Goodput ratio: 77/88][0.09 sec][Hostname/SNI: 104-166-161-19.edge.agora.io][bytes ratio: 0.028 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/0 54/0 18/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/74 185/350 276/534 90/225][PLAIN TEXT (19.edge.agora.ioPDMD)][Plen Bins: 20,13,0,0,6,20,0,20,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]