SKYPE: remove detection over TCP

Skype detection over TCP has been completely disable since 659f75138 (3
years ago!).
Since that logic was too weak anyway, remove it.

83 files changed, 82 insertions, 118 deletions

diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index d3f6102b5..d3e7ca1ad 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -686,9 +686,6 @@ struct ndpi_flow_tcp_struct {
   /* NDPI_PROTOCOL_SOAP */
   u_int32_t soap_stage:1;
 
-  /* NDPI_PROTOCOL_SKYPE */
-  u_int8_t skype_packet_id;
-
   /* NDPI_PROTOCOL_LOTUS_NOTES */
   u_int8_t lotus_notes_packet_id;
 
diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c
index 6fece0e63..de2493711 100644
--- a/src/lib/protocols/skype.c
+++ b/src/lib/protocols/skype.c
@@ -148,39 +148,6 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
     
     NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
     return;
-    // TCP check
-  } else if((packet->tcp != NULL)
-	    /* As the TCP skype heuristic is weak, we need to make sure no other protocols overlap */
-	    && (flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN)
-	    && (flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN)) {
-    flow->l4.tcp.skype_packet_id++;
-
-    if(flow->l4.tcp.skype_packet_id < 3) {
-      ; /* Too early */
-    } else if((flow->l4.tcp.skype_packet_id == 3)
-	      /* We have seen the 3-way handshake */
-	      && flow->l4.tcp.seen_syn
-	      && flow->l4.tcp.seen_syn_ack
-	      && flow->l4.tcp.seen_ack) {
-      /* Disabled this logic as it's too weak and leads to false positives */
-#if 0
-      if((payload_len == 8) || (payload_len == 3) || (payload_len == 17)) {
-	// printf("[SKYPE] payload_len=%u\n", payload_len);
-	/* printf("[SKYPE] %u/%u\n", ntohs(packet->tcp->source), ntohs(packet->tcp->dest)); */
-	
-	NDPI_LOG_INFO(ndpi_struct, "found skype\n");
-	  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE_TEAMS_CALL, NDPI_PROTOCOL_SKYPE_TEAMS, NDPI_CONFIDENCE_DPI);
-      } else {
-	// printf("NO [SKYPE] payload_len=%u\n", payload_len);
-      }
-
-      /* printf("[SKYPE] [id: %u][len: %d]\n", flow->l4.tcp.skype_packet_id, payload_len);  */
-#endif
-    } else {
-      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-    }
-
-    return;
   }
 }
 
@@ -199,7 +166,7 @@ void init_skype_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in
   ndpi_set_bitmask_protocol_detection("Skype_Teams", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_SKYPE_TEAMS,
 				      ndpi_search_skype,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);
 
diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out
index 6e7f824bf..15b1a5136 100644
--- a/tests/result/1kxun.pcap.out
+++ b/tests/result/1kxun.pcap.out
@@ -6,7 +6,7 @@ Confidence Unknown          : 14 (flows)
 Confidence Match by port    : 5 (flows)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 177 (flows)
-Num dissector calls: 5084 (25.81 diss/flow)
+Num dissector calls: 5065 (25.71 diss/flow)
 
 Unknown	24	6428	14
 DNS	2	378	1
diff --git a/tests/result/443-chrome.pcap.out b/tests/result/443-chrome.pcap.out
index d4e7d13c9..ed4d426db 100644
--- a/tests/result/443-chrome.pcap.out
+++ b/tests/result/443-chrome.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	1	(1.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
-Num dissector calls: 121 (121.00 diss/flow)
+Num dissector calls: 120 (120.00 diss/flow)
 
 TLS	1	1506	1
 
diff --git a/tests/result/443-opvn.pcap.out b/tests/result/443-opvn.pcap.out
index a8bffe84f..05f249a10 100644
--- a/tests/result/443-opvn.pcap.out
+++ b/tests/result/443-opvn.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	6	(6.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 135 (135.00 diss/flow)
+Num dissector calls: 134 (134.00 diss/flow)
 
 OpenVPN	46	11573	1
 
diff --git a/tests/result/KakaoTalk_chat.pcap.out b/tests/result/KakaoTalk_chat.pcap.out
index 26f193fec..6f65da7e5 100644
--- a/tests/result/KakaoTalk_chat.pcap.out
+++ b/tests/result/KakaoTalk_chat.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	1	(1.00 pkts/flow)
 Confidence Match by port    : 4 (flows)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 33 (flows)
-Num dissector calls: 894 (23.53 diss/flow)
+Num dissector calls: 870 (22.89 diss/flow)
 
 DNS	2	217	1
 HTTP	1	56	1
diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out
index 00c6824c1..cba4c407d 100644
--- a/tests/result/KakaoTalk_talk.pcap.out
+++ b/tests/result/KakaoTalk_talk.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	6	(1.20 pkts/flow)
 Confidence Match by port    : 4 (flows)
 Confidence Match by IP      : 5 (flows)
 Confidence DPI              : 11 (flows)
-Num dissector calls: 999 (49.95 diss/flow)
+Num dissector calls: 983 (49.15 diss/flow)
 
 HTTP	5	280	1
 QQ	15	1727	1
diff --git a/tests/result/Oscar.pcap.out b/tests/result/Oscar.pcap.out
index a41b410ce..7e9d436c6 100644
--- a/tests/result/Oscar.pcap.out
+++ b/tests/result/Oscar.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	33	(33.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
-Num dissector calls: 365 (365.00 diss/flow)
+Num dissector calls: 347 (347.00 diss/flow)
 
 TLS	71	9386	1
 
diff --git a/tests/result/alexa-app.pcapng.out b/tests/result/alexa-app.pcapng.out
index fc9d85dc8..600ef3505 100644
--- a/tests/result/alexa-app.pcapng.out
+++ b/tests/result/alexa-app.pcapng.out
@@ -6,7 +6,7 @@ DPI Packets (other):	6	(1.00 pkts/flow)
 Confidence Match by port    : 5 (flows)
 Confidence Match by IP      : 9 (flows)
 Confidence DPI              : 146 (flows)
-Num dissector calls: 2329 (14.56 diss/flow)
+Num dissector calls: 2328 (14.55 diss/flow)
 
 DNS	4	400	2
 DHCP	3	1056	2
diff --git a/tests/result/amqp.pcap.out b/tests/result/amqp.pcap.out
index 13ab8aec4..d121004c3 100644
--- a/tests/result/amqp.pcap.out
+++ b/tests/result/amqp.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	9	(3.00 pkts/flow)
 Confidence DPI              : 3 (flows)
-Num dissector calls: 400 (133.33 diss/flow)
+Num dissector calls: 395 (131.67 diss/flow)
 
 AMQP	160	23514	3
 
diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out
index 355018a27..07a1d1ee5 100644
--- a/tests/result/anyconnect-vpn.pcap.out
+++ b/tests/result/anyconnect-vpn.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown          : 2 (flows)
 Confidence Match by port    : 5 (flows)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 61 (flows)
-Num dissector calls: 1176 (17.04 diss/flow)
+Num dissector calls: 1170 (16.96 diss/flow)
 
 Unknown	19	1054	2
 DNS	32	3655	16
diff --git a/tests/result/bittorrent.pcap.out b/tests/result/bittorrent.pcap.out
index 8d6b38304..6062d056a 100644
--- a/tests/result/bittorrent.pcap.out
+++ b/tests/result/bittorrent.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	24	(1.00 pkts/flow)
 Confidence DPI              : 24 (flows)
-Num dissector calls: 2114 (88.08 diss/flow)
+Num dissector calls: 2092 (87.17 diss/flow)
 
 BitTorrent	299	305728	24
 
diff --git a/tests/result/cloudflare-warp.pcap.out b/tests/result/cloudflare-warp.pcap.out
index fffdf6aeb..64b3ebc17 100644
--- a/tests/result/cloudflare-warp.pcap.out
+++ b/tests/result/cloudflare-warp.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	4
 DPI Packets (TCP):	41	(5.12 pkts/flow)
 Confidence Match by IP      : 3 (flows)
 Confidence DPI              : 5 (flows)
-Num dissector calls: 285 (35.62 diss/flow)
+Num dissector calls: 282 (35.25 diss/flow)
 
 Jabber	11	890	1
 Google	8	476	3
diff --git a/tests/result/dnp3.pcap.out b/tests/result/dnp3.pcap.out
index 5022498ae..d5da026aa 100644
--- a/tests/result/dnp3.pcap.out
+++ b/tests/result/dnp3.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	80	(10.00 pkts/flow)
 Confidence DPI              : 8 (flows)
-Num dissector calls: 352 (44.00 diss/flow)
+Num dissector calls: 351 (43.88 diss/flow)
 
 DNP3	543	38754	8
 
diff --git a/tests/result/emotet.pcap.out b/tests/result/emotet.pcap.out
index 06a71411f..cb1761c55 100644
--- a/tests/result/emotet.pcap.out
+++ b/tests/result/emotet.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	48	(8.00 pkts/flow)
 Confidence DPI              : 6 (flows)
-Num dissector calls: 281 (46.83 diss/flow)
+Num dissector calls: 279 (46.50 diss/flow)
 
 SMTP	626	438465	1
 HTTP	1601	1581542	3
diff --git a/tests/result/ftp-start-tls.pcap.out b/tests/result/ftp-start-tls.pcap.out
index ef8df8bc4..62ddaada8 100644
--- a/tests/result/ftp-start-tls.pcap.out
+++ b/tests/result/ftp-start-tls.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	10	(10.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 177 (177.00 diss/flow)
+Num dissector calls: 174 (174.00 diss/flow)
 
 FTP_CONTROL	51	7510	1
 
diff --git a/tests/result/ftp.pcap.out b/tests/result/ftp.pcap.out
index d1f432937..06b7fcf8f 100644
--- a/tests/result/ftp.pcap.out
+++ b/tests/result/ftp.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	1
 DPI Packets (TCP):	49	(16.33 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 691 (230.33 diss/flow)
+Num dissector calls: 683 (227.67 diss/flow)
 
 Unknown	1115	1122198	1
 FTP_CONTROL	68	5571	1
diff --git a/tests/result/ftp_failed.pcap.out b/tests/result/ftp_failed.pcap.out
index 3944a87a0..432f25dd0 100644
--- a/tests/result/ftp_failed.pcap.out
+++ b/tests/result/ftp_failed.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	8	(8.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 161 (161.00 diss/flow)
+Num dissector calls: 159 (159.00 diss/flow)
 
 FTP_CONTROL	18	1700	1
 
diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out
index 530fd71e9..c3b9362a7 100644
--- a/tests/result/fuzz-2006-06-26-2594.pcap.out
+++ b/tests/result/fuzz-2006-06-26-2594.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	5	(1.00 pkts/flow)
 Confidence Unknown          : 30 (flows)
 Confidence Match by port    : 28 (flows)
 Confidence DPI              : 193 (flows)
-Num dissector calls: 5311 (21.16 diss/flow)
+Num dissector calls: 5287 (21.06 diss/flow)
 
 Unknown	30	3356	30
 FTP_CONTROL	36	2569	12
diff --git a/tests/result/fuzz-2006-09-29-28586.pcap.out b/tests/result/fuzz-2006-09-29-28586.pcap.out
index 162bb275f..ff410a983 100644
--- a/tests/result/fuzz-2006-09-29-28586.pcap.out
+++ b/tests/result/fuzz-2006-09-29-28586.pcap.out
@@ -6,7 +6,7 @@ Confidence Unknown          : 3 (flows)
 Confidence Match by port    : 23 (flows)
 Confidence Match by IP      : 2 (flows)
 Confidence DPI              : 12 (flows)
-Num dissector calls: 1229 (30.73 diss/flow)
+Num dissector calls: 1218 (30.45 diss/flow)
 
 Unknown	3	655	3
 HTTP	116	27378	35
diff --git a/tests/result/fuzz-2021-10-13.pcap.out b/tests/result/fuzz-2021-10-13.pcap.out
index 1f22320cd..cbeb7b3fc 100644
--- a/tests/result/fuzz-2021-10-13.pcap.out
+++ b/tests/result/fuzz-2021-10-13.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	1	(1.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
-Num dissector calls: 119 (119.00 diss/flow)
+Num dissector calls: 118 (118.00 diss/flow)
 
 Unknown	1	197	1
 
diff --git a/tests/result/genshin-impact.pcap.out b/tests/result/genshin-impact.pcap.out
index 9bf666902..15f96aacf 100644
--- a/tests/result/genshin-impact.pcap.out
+++ b/tests/result/genshin-impact.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	12	(4.00 pkts/flow)
 DPI Packets (UDP):	3	(1.00 pkts/flow)
 Confidence DPI              : 6 (flows)
-Num dissector calls: 556 (92.67 diss/flow)
+Num dissector calls: 553 (92.17 diss/flow)
 
 GenshinImpact	90	18405	6
 
diff --git a/tests/result/google_ssl.pcap.out b/tests/result/google_ssl.pcap.out
index 0dca16854..b122786f4 100644
--- a/tests/result/google_ssl.pcap.out
+++ b/tests/result/google_ssl.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	28	(28.00 pkts/flow)
 Confidence Match by IP      : 1 (flows)
-Num dissector calls: 261 (261.00 diss/flow)
+Num dissector calls: 249 (249.00 diss/flow)
 
 Google	28	9108	1
 
diff --git a/tests/result/h323-overflow.pcap.out b/tests/result/h323-overflow.pcap.out
index b48860db5..afabc16ae 100644
--- a/tests/result/h323-overflow.pcap.out
+++ b/tests/result/h323-overflow.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	1	(1.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
-Num dissector calls: 121 (121.00 diss/flow)
+Num dissector calls: 120 (120.00 diss/flow)
 
 HTTP	1	58	1
 
diff --git a/tests/result/h323.pcap.out b/tests/result/h323.pcap.out
index 59e0551a3..00b1a5e59 100644
--- a/tests/result/h323.pcap.out
+++ b/tests/result/h323.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	2	(2.00 pkts/flow)
 DPI Packets (UDP):	1	(1.00 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 123 (61.50 diss/flow)
+Num dissector calls: 122 (61.00 diss/flow)
 
 H323	12	1825	2
 
diff --git a/tests/result/hpvirtgrp.pcap.out b/tests/result/hpvirtgrp.pcap.out
index bb289b7ce..defd5f6c4 100644
--- a/tests/result/hpvirtgrp.pcap.out
+++ b/tests/result/hpvirtgrp.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	37	(4.11 pkts/flow)
 Confidence DPI              : 9 (flows)
-Num dissector calls: 1116 (124.00 diss/flow)
+Num dissector calls: 1107 (123.00 diss/flow)
 
 HP_VIRTGRP	135	12739	9
 
diff --git a/tests/result/imap-starttls.pcap.out b/tests/result/imap-starttls.pcap.out
index 65dd10236..663d1af6e 100644
--- a/tests/result/imap-starttls.pcap.out
+++ b/tests/result/imap-starttls.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	10	(10.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 193 (193.00 diss/flow)
+Num dissector calls: 190 (190.00 diss/flow)
 
 IMAPS	32	7975	1
 
diff --git a/tests/result/imap.pcap.out b/tests/result/imap.pcap.out
index 2cd1781ca..34b34a590 100644
--- a/tests/result/imap.pcap.out
+++ b/tests/result/imap.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	11	(11.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 215 (215.00 diss/flow)
+Num dissector calls: 211 (211.00 diss/flow)
 
 IMAP	33	3774	1
 
diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out
index f298e47e1..15a95d52b 100644
--- a/tests/result/instagram.pcap.out
+++ b/tests/result/instagram.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 6 (flows)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 30 (flows)
-Num dissector calls: 2126 (55.95 diss/flow)
+Num dissector calls: 2053 (54.03 diss/flow)
 
 Unknown	1	66	1
 HTTP	116	91784	6
diff --git a/tests/result/irc.pcap.out b/tests/result/irc.pcap.out
index bb49ebbfe..3e5406d89 100644
--- a/tests/result/irc.pcap.out
+++ b/tests/result/irc.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	7	(7.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 168 (168.00 diss/flow)
+Num dissector calls: 166 (166.00 diss/flow)
 
 IRC	29	8945	1
 
diff --git a/tests/result/jabber.pcap.out b/tests/result/jabber.pcap.out
index 7139acbc1..61362bc4e 100644
--- a/tests/result/jabber.pcap.out
+++ b/tests/result/jabber.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	74	(6.17 pkts/flow)
 Confidence DPI              : 12 (flows)
-Num dissector calls: 1525 (127.08 diss/flow)
+Num dissector calls: 1505 (125.42 diss/flow)
 
 Jabber	358	61304	12
 
diff --git a/tests/result/kerberos.pcap.out b/tests/result/kerberos.pcap.out
index e5b7ab086..e61e77a58 100644
--- a/tests/result/kerberos.pcap.out
+++ b/tests/result/kerberos.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	77	(2.14 pkts/flow)
 Confidence Unknown          : 2 (flows)
 Confidence Match by port    : 23 (flows)
 Confidence DPI              : 11 (flows)
-Num dissector calls: 3865 (107.36 diss/flow)
+Num dissector calls: 3813 (105.92 diss/flow)
 
 Unknown	9	3031	2
 SMBv23	6	1914	3
diff --git a/tests/result/lisp_registration.pcap.out b/tests/result/lisp_registration.pcap.out
index 134ed6b69..ce6d3d7f0 100644
--- a/tests/result/lisp_registration.pcap.out
+++ b/tests/result/lisp_registration.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	8	(4.00 pkts/flow)
 DPI Packets (UDP):	2	(1.00 pkts/flow)
 Confidence DPI              : 4 (flows)
-Num dissector calls: 226 (56.50 diss/flow)
+Num dissector calls: 224 (56.00 diss/flow)
 
 LISP	30	5266	4
 
diff --git a/tests/result/log4j-webapp-exploit.pcap.out b/tests/result/log4j-webapp-exploit.pcap.out
index eaaf5d43f..dabd3d23e 100644
--- a/tests/result/log4j-webapp-exploit.pcap.out
+++ b/tests/result/log4j-webapp-exploit.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	2
 DPI Packets (TCP):	63	(9.00 pkts/flow)
 Confidence Unknown          : 2 (flows)
 Confidence DPI              : 5 (flows)
-Num dissector calls: 549 (78.43 diss/flow)
+Num dissector calls: 545 (77.86 diss/flow)
 
 Unknown	356	25081	2
 HTTP	34	6741	3
diff --git a/tests/result/memcached.cap.out b/tests/result/memcached.cap.out
index 3b61ed2ee..dada65e21 100644
--- a/tests/result/memcached.cap.out
+++ b/tests/result/memcached.cap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	6	(6.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 135 (135.00 diss/flow)
+Num dissector calls: 134 (134.00 diss/flow)
 
 Memcached	10	1711	1
 
diff --git a/tests/result/mongo_false_positive.pcapng.out b/tests/result/mongo_false_positive.pcapng.out
index ef39b014a..e755d0775 100644
--- a/tests/result/mongo_false_positive.pcapng.out
+++ b/tests/result/mongo_false_positive.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	26	(26.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
-Num dissector calls: 431 (431.00 diss/flow)
+Num dissector calls: 409 (409.00 diss/flow)
 
 TLS	26	12163	1
 
diff --git a/tests/result/mongodb.pcap.out b/tests/result/mongodb.pcap.out
index 217e7ae43..b0ead9009 100644
--- a/tests/result/mongodb.pcap.out
+++ b/tests/result/mongodb.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	27	(3.38 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 2 (flows)
 Confidence DPI              : 5 (flows)
-Num dissector calls: 217 (27.12 diss/flow)
+Num dissector calls: 216 (27.00 diss/flow)
 
 Unknown	3	230	1
 MongoDB	24	2510	7
diff --git a/tests/result/mssql_tds.pcap.out b/tests/result/mssql_tds.pcap.out
index 678fa52d9..001ce7935 100644
--- a/tests/result/mssql_tds.pcap.out
+++ b/tests/result/mssql_tds.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	1
 DPI Packets (TCP):	18	(1.50 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 11 (flows)
-Num dissector calls: 287 (23.92 diss/flow)
+Num dissector calls: 280 (23.33 diss/flow)
 
 MsSQL-TDS	38	16260	12
 
diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out
index b947d9d10..362220e23 100644
--- a/tests/result/nest_log_sink.pcap.out
+++ b/tests/result/nest_log_sink.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	128	(9.85 pkts/flow)
 DPI Packets (UDP):	2	(2.00 pkts/flow)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 13 (flows)
-Num dissector calls: 2104 (150.29 diss/flow)
+Num dissector calls: 2080 (148.57 diss/flow)
 
 DNS	15	1612	1
 NestLogSink	676	112058	12
diff --git a/tests/result/netbios.pcap.out b/tests/result/netbios.pcap.out
index 5d31a930b..47f3dda1f 100644
--- a/tests/result/netbios.pcap.out
+++ b/tests/result/netbios.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	2	(2.00 pkts/flow)
 DPI Packets (UDP):	14	(1.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 14 (flows)
-Num dissector calls: 136 (9.07 diss/flow)
+Num dissector calls: 135 (9.00 diss/flow)
 
 NetBIOS	258	24196	13
 SMBv1	2	486	2
diff --git a/tests/result/nntp.pcap.out b/tests/result/nntp.pcap.out
index 43a7e1a1d..c291024f6 100644
--- a/tests/result/nntp.pcap.out
+++ b/tests/result/nntp.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	6	(6.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 141 (141.00 diss/flow)
+Num dissector calls: 140 (140.00 diss/flow)
 
 Usenet	32	7037	1
 
diff --git a/tests/result/ookla.pcap.out b/tests/result/ookla.pcap.out
index 6c33fdd4c..954712ba4 100644
--- a/tests/result/ookla.pcap.out
+++ b/tests/result/ookla.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	16	(8.00 pkts/flow)
 Confidence DPI (cache)      : 1 (flows)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 139 (69.50 diss/flow)
+Num dissector calls: 138 (69.00 diss/flow)
 
 Ookla	5086	4689745	2
 
diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out
index a8eb736cc..64bf79daf 100644
--- a/tests/result/openvpn.pcap.out
+++ b/tests/result/openvpn.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	6	(6.00 pkts/flow)
 DPI Packets (UDP):	5	(2.50 pkts/flow)
 Confidence DPI              : 3 (flows)
-Num dissector calls: 395 (131.67 diss/flow)
+Num dissector calls: 394 (131.33 diss/flow)
 
 OpenVPN	298	57111	3
 
diff --git a/tests/result/oracle12.pcapng.out b/tests/result/oracle12.pcapng.out
index db76f0737..0515abd92 100644
--- a/tests/result/oracle12.pcapng.out
+++ b/tests/result/oracle12.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	20	(20.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
-Num dissector calls: 311 (311.00 diss/flow)
+Num dissector calls: 300 (300.00 diss/flow)
 
 Oracle	20	2518	1
 
diff --git a/tests/result/pgsql.pcap.out b/tests/result/pgsql.pcap.out
index 2a19914b7..fed63c64d 100644
--- a/tests/result/pgsql.pcap.out
+++ b/tests/result/pgsql.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	12	(6.00 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 270 (135.00 diss/flow)
+Num dissector calls: 268 (134.00 diss/flow)
 
 PostgreSQL	39	4709	2
 
diff --git a/tests/result/pop3.pcap.out b/tests/result/pop3.pcap.out
index 8171df058..e132e8cca 100644
--- a/tests/result/pop3.pcap.out
+++ b/tests/result/pop3.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	10	(10.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 191 (191.00 diss/flow)
+Num dissector calls: 188 (188.00 diss/flow)
 
 POP3	31	3915	1
 
diff --git a/tests/result/reasm_crash_anon.pcapng.out b/tests/result/reasm_crash_anon.pcapng.out
index 0d0673956..199625e6b 100644
--- a/tests/result/reasm_crash_anon.pcapng.out
+++ b/tests/result/reasm_crash_anon.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	33	(33.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
-Num dissector calls: 337 (337.00 diss/flow)
+Num dissector calls: 334 (334.00 diss/flow)
 
 Unknown	200	20067	1
 
diff --git a/tests/result/reasm_segv_anon.pcapng.out b/tests/result/reasm_segv_anon.pcapng.out
index 81a29b683..6172fc642 100644
--- a/tests/result/reasm_segv_anon.pcapng.out
+++ b/tests/result/reasm_segv_anon.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	33	(33.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
-Num dissector calls: 336 (336.00 diss/flow)
+Num dissector calls: 315 (315.00 diss/flow)
 
 HTTP	82	77940	1
 
diff --git a/tests/result/rsh.pcap.out b/tests/result/rsh.pcap.out
index f319d3470..82846e6ea 100644
--- a/tests/result/rsh.pcap.out
+++ b/tests/result/rsh.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	12	(6.00 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 324 (162.00 diss/flow)
+Num dissector calls: 320 (160.00 diss/flow)
 
 RSH	24	1721	2
 
diff --git a/tests/result/rsync.pcap.out b/tests/result/rsync.pcap.out
index 0153b6e26..a61d7c1e5 100644
--- a/tests/result/rsync.pcap.out
+++ b/tests/result/rsync.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	9	(9.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 183 (183.00 diss/flow)
+Num dissector calls: 180 (180.00 diss/flow)
 
 RSYNC	30	2493	1
 
diff --git a/tests/result/rtmp.pcap.out b/tests/result/rtmp.pcap.out
index d34e8e54c..c7be2ae83 100644
--- a/tests/result/rtmp.pcap.out
+++ b/tests/result/rtmp.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	8	(8.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 165 (165.00 diss/flow)
+Num dissector calls: 163 (163.00 diss/flow)
 
 RTMP	26	8368	1
 
diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out
index 648edeced..a982d27a8 100644
--- a/tests/result/skype.pcap.out
+++ b/tests/result/skype.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown          : 61 (flows)
 Confidence Match by port    : 27 (flows)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 204 (flows)
-Num dissector calls: 32126 (109.65 diss/flow)
+Num dissector calls: 31676 (108.11 diss/flow)
 
 Unknown	1575	272476	61
 DNS	2	267	1
diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out
index 430e08735..7028a1190 100644
--- a/tests/result/skype_no_unknown.pcap.out
+++ b/tests/result/skype_no_unknown.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	5	(1.00 pkts/flow)
 Confidence Unknown          : 45 (flows)
 Confidence Match by port    : 22 (flows)
 Confidence DPI              : 200 (flows)
-Num dissector calls: 26274 (98.40 diss/flow)
+Num dissector calls: 25957 (97.22 diss/flow)
 
 Unknown	850	152468	45
 DNS	2	267	1
diff --git a/tests/result/smb_frags.pcap.out b/tests/result/smb_frags.pcap.out
index 09aab382e..5b6407a94 100644
--- a/tests/result/smb_frags.pcap.out
+++ b/tests/result/smb_frags.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	5	(5.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 159 (159.00 diss/flow)
+Num dissector calls: 157 (157.00 diss/flow)
 
 SMBv1	8	2763	1
 
diff --git a/tests/result/smbv1.pcap.out b/tests/result/smbv1.pcap.out
index 682276185..2715e0b1e 100644
--- a/tests/result/smbv1.pcap.out
+++ b/tests/result/smbv1.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	3	(3.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 153 (153.00 diss/flow)
+Num dissector calls: 151 (151.00 diss/flow)
 
 SMBv1	7	1197	1
 
diff --git a/tests/result/smtp.pcap.out b/tests/result/smtp.pcap.out
index 5bbe595e7..733482609 100644
--- a/tests/result/smtp.pcap.out
+++ b/tests/result/smtp.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	11	(11.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 208 (208.00 diss/flow)
+Num dissector calls: 204 (204.00 diss/flow)
 
 SMTP	95	23157	1
 
diff --git a/tests/result/soap.pcap.out b/tests/result/soap.pcap.out
index b3b914695..271a72fd5 100644
--- a/tests/result/soap.pcap.out
+++ b/tests/result/soap.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	11	(3.67 pkts/flow)
 Confidence DPI              : 3 (flows)
-Num dissector calls: 366 (122.00 diss/flow)
+Num dissector calls: 360 (120.00 diss/flow)
 
 Microsoft	1	1506	1
 SOAP	19	9442	2
diff --git a/tests/result/socks-http-example.pcap.out b/tests/result/socks-http-example.pcap.out
index dcadc21e8..0b77c787d 100644
--- a/tests/result/socks-http-example.pcap.out
+++ b/tests/result/socks-http-example.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	1
 DPI Packets (TCP):	29	(9.67 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 520 (173.33 diss/flow)
+Num dissector calls: 511 (170.33 diss/flow)
 
 SOCKS	46	8383	3
 
diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out
index 7e996c351..3ccd735df 100644
--- a/tests/result/starcraft_battle.pcap.out
+++ b/tests/result/starcraft_battle.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	1	(1.00 pkts/flow)
 Confidence Match by port    : 8 (flows)
 Confidence Match by IP      : 5 (flows)
 Confidence DPI              : 39 (flows)
-Num dissector calls: 1873 (36.02 diss/flow)
+Num dissector calls: 1866 (35.88 diss/flow)
 
 DNS	26	2848	7
 HTTP	450	294880	19
diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out
index b29ff3448..860a57b90 100644
--- a/tests/result/teams.pcap.out
+++ b/tests/result/teams.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown          : 1 (flows)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI (partial)    : 1 (flows)
 Confidence DPI              : 80 (flows)
-Num dissector calls: 1166 (14.05 diss/flow)
+Num dissector calls: 1164 (14.02 diss/flow)
 
 Unknown	4	456	1
 DNS	10	1357	5
diff --git a/tests/result/telnet.pcap.out b/tests/result/telnet.pcap.out
index 03dab2978..abb6ca76c 100644
--- a/tests/result/telnet.pcap.out
+++ b/tests/result/telnet.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	33	(33.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 163 (163.00 diss/flow)
+Num dissector calls: 161 (161.00 diss/flow)
 
 Telnet	87	7418	1
 
diff --git a/tests/result/threema.pcap.out b/tests/result/threema.pcap.out
index 3063bb027..ac997d5e2 100644
--- a/tests/result/threema.pcap.out
+++ b/tests/result/threema.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	2
 DPI Packets (TCP):	66	(11.00 pkts/flow)
 Confidence Match by IP      : 2 (flows)
 Confidence DPI              : 4 (flows)
-Num dissector calls: 1334 (222.33 diss/flow)
+Num dissector calls: 1306 (217.67 diss/flow)
 
 Threema	83	11578	6
 
diff --git a/tests/result/tinc.pcap.out b/tests/result/tinc.pcap.out
index 972426f23..3487b0738 100644
--- a/tests/result/tinc.pcap.out
+++ b/tests/result/tinc.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	19	(9.50 pkts/flow)
 DPI Packets (UDP):	2	(1.00 pkts/flow)
 Confidence DPI (cache)      : 2 (flows)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 557 (139.25 diss/flow)
+Num dissector calls: 551 (137.75 diss/flow)
 
 TINC	317	352291	4
 
diff --git a/tests/result/tls-appdata.pcap.out b/tests/result/tls-appdata.pcap.out
index c64ac8014..9d080407c 100644
--- a/tests/result/tls-appdata.pcap.out
+++ b/tests/result/tls-appdata.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	20	(10.00 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 123 (61.50 diss/flow)
+Num dissector calls: 122 (61.00 diss/flow)
 
 Facebook	6	789	1
 Twitch	114	119156	1
diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out
index 8c4385eaa..a18802683 100644
--- a/tests/result/tls_certificate_too_long.pcap.out
+++ b/tests/result/tls_certificate_too_long.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	2	(1.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 33 (flows)
-Num dissector calls: 751 (21.46 diss/flow)
+Num dissector calls: 746 (21.31 diss/flow)
 
 Unknown	13	5582	1
 MDNS	5	983	3
diff --git a/tests/result/tls_false_positives.pcapng.out b/tests/result/tls_false_positives.pcapng.out
index fd047dade..918bd1cde 100644
--- a/tests/result/tls_false_positives.pcapng.out
+++ b/tests/result/tls_false_positives.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	30	(30.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
-Num dissector calls: 408 (408.00 diss/flow)
+Num dissector calls: 405 (405.00 diss/flow)
 
 Unknown	30	37313	1
 
diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out
index 837c43721..bd59afb19 100644
--- a/tests/result/tls_invalid_reads.pcap.out
+++ b/tests/result/tls_invalid_reads.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	2
 DPI Packets (TCP):	10	(3.33 pkts/flow)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 143 (47.67 diss/flow)
+Num dissector calls: 142 (47.33 diss/flow)
 
 TLS	7	1827	1
 Crashlytics	3	560	1
diff --git a/tests/result/ultrasurf.pcap.out b/tests/result/ultrasurf.pcap.out
index 6fe3c1363..03c16fc59 100644
--- a/tests/result/ultrasurf.pcap.out
+++ b/tests/result/ultrasurf.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	13	(4.33 pkts/flow)
 Confidence DPI              : 3 (flows)
-Num dissector calls: 154 (51.33 diss/flow)
+Num dissector calls: 153 (51.00 diss/flow)
 
 TLS	5171	5127023	2
 UltraSurf	2971	2991918	1
diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out
index d0dd5055c..4323817a0 100644
--- a/tests/result/viber.pcap.out
+++ b/tests/result/viber.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	27	(1.93 pkts/flow)
 DPI Packets (other):	2	(1.00 pkts/flow)
 Confidence Match by IP      : 4 (flows)
 Confidence DPI              : 25 (flows)
-Num dissector calls: 719 (24.79 diss/flow)
+Num dissector calls: 701 (24.17 diss/flow)
 
 DNS	8	1267	4
 MDNS	4	412	1
diff --git a/tests/result/vnc.pcap.out b/tests/result/vnc.pcap.out
index 593745647..62ac1b20b 100644
--- a/tests/result/vnc.pcap.out
+++ b/tests/result/vnc.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	10	(5.00 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 280 (140.00 diss/flow)
+Num dissector calls: 278 (139.00 diss/flow)
 
 VNC	4551	329158	2
 
diff --git a/tests/result/wa_video.pcap.out b/tests/result/wa_video.pcap.out
index 405ee3006..13bc2593a 100644
--- a/tests/result/wa_video.pcap.out
+++ b/tests/result/wa_video.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	33	(33.00 pkts/flow)
 DPI Packets (UDP):	13	(1.00 pkts/flow)
 Confidence Match by IP      : 1 (flows)
 Confidence DPI              : 13 (flows)
-Num dissector calls: 546 (39.00 diss/flow)
+Num dissector calls: 526 (37.57 diss/flow)
 
 SSDP	8	1377	3
 DHCP	2	684	1
diff --git a/tests/result/wa_voice.pcap.out b/tests/result/wa_voice.pcap.out
index b9d6f7ebb..3ab896e1b 100644
--- a/tests/result/wa_voice.pcap.out
+++ b/tests/result/wa_voice.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	33	(1.57 pkts/flow)
 DPI Packets (other):	1	(1.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence DPI              : 27 (flows)
-Num dissector calls: 497 (17.75 diss/flow)
+Num dissector calls: 496 (17.71 diss/flow)
 
 Unknown	2	120	1
 MDNS	10	1188	2
diff --git a/tests/result/waze.pcap.out b/tests/result/waze.pcap.out
index 74f86de6d..264b0e84d 100644
--- a/tests/result/waze.pcap.out
+++ b/tests/result/waze.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	1	(1.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 9 (flows)
 Confidence DPI              : 23 (flows)
-Num dissector calls: 887 (26.88 diss/flow)
+Num dissector calls: 883 (26.76 diss/flow)
 
 Unknown	10	786	1
 HTTP	65	64777	8
diff --git a/tests/result/websocket.pcap.out b/tests/result/websocket.pcap.out
index c6009276f..54fb3d712 100644
--- a/tests/result/websocket.pcap.out
+++ b/tests/result/websocket.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	1	(1.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 108 (108.00 diss/flow)
+Num dissector calls: 107 (107.00 diss/flow)
 
 WebSocket	5	441	1
 
diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out
index 15b2e5c9f..86fc020e5 100644
--- a/tests/result/wechat.pcap.out
+++ b/tests/result/wechat.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	7	(1.00 pkts/flow)
 Confidence Match by port    : 17 (flows)
 Confidence Match by IP      : 8 (flows)
 Confidence DPI              : 78 (flows)
-Num dissector calls: 1531 (14.86 diss/flow)
+Num dissector calls: 1530 (14.85 diss/flow)
 
 DNS	13	1075	8
 HTTP	70	4620	8
diff --git a/tests/result/whatsapp.pcap.out b/tests/result/whatsapp.pcap.out
index adef2b112..d9aa7729e 100644
--- a/tests/result/whatsapp.pcap.out
+++ b/tests/result/whatsapp.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (TCP):	344	(4.00 pkts/flow)
 Confidence DPI              : 86 (flows)
-Num dissector calls: 13158 (153.00 diss/flow)
+Num dissector calls: 12986 (151.00 diss/flow)
 
 WhatsApp	679	96293	86
 
diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out
index 632cece10..c2535abd5 100644
--- a/tests/result/whatsapp_login_call.pcap.out
+++ b/tests/result/whatsapp_login_call.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	1	(1.00 pkts/flow)
 Confidence Match by port    : 4 (flows)
 Confidence Match by IP      : 16 (flows)
 Confidence DPI              : 37 (flows)
-Num dissector calls: 690 (12.11 diss/flow)
+Num dissector calls: 689 (12.09 diss/flow)
 
 HTTP	11	726	3
 MDNS	8	952	4
diff --git a/tests/result/whatsapp_login_chat.pcap.out b/tests/result/whatsapp_login_chat.pcap.out
index ad80872b4..9902a1dbe 100644
--- a/tests/result/whatsapp_login_chat.pcap.out
+++ b/tests/result/whatsapp_login_chat.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	2
 DPI Packets (TCP):	25	(8.33 pkts/flow)
 DPI Packets (UDP):	7	(1.17 pkts/flow)
 Confidence DPI              : 9 (flows)
-Num dissector calls: 316 (35.11 diss/flow)
+Num dissector calls: 314 (34.89 diss/flow)
 
 MDNS	2	202	2
 DHCP	6	2052	1
diff --git a/tests/result/whatsapp_voice_and_message.pcap.out b/tests/result/whatsapp_voice_and_message.pcap.out
index ea8787fd4..edba4522f 100644
--- a/tests/result/whatsapp_voice_and_message.pcap.out
+++ b/tests/result/whatsapp_voice_and_message.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	20	(4.00 pkts/flow)
 DPI Packets (UDP):	8	(1.00 pkts/flow)
 Confidence DPI              : 13 (flows)
-Num dissector calls: 553 (42.54 diss/flow)
+Num dissector calls: 548 (42.15 diss/flow)
 
 WhatsAppCall	44	5916	8
 WhatsApp	217	22139	5
diff --git a/tests/result/whois.pcapng.out b/tests/result/whois.pcapng.out
index 7050cd29a..15c65fc98 100644
--- a/tests/result/whois.pcapng.out
+++ b/tests/result/whois.pcapng.out
@@ -3,7 +3,7 @@ Guessed flow protos:	1
 DPI Packets (TCP):	16	(5.33 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 215 (71.67 diss/flow)
+Num dissector calls: 212 (70.67 diss/flow)
 
 TLS	7	2046	1
 Whois-DAS	16	4294	2
diff --git a/tests/result/xiaomi.pcap.out b/tests/result/xiaomi.pcap.out
index 73bbb1682..64015011c 100644
--- a/tests/result/xiaomi.pcap.out
+++ b/tests/result/xiaomi.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (TCP):	19	(2.71 pkts/flow)
 Confidence DPI              : 7 (flows)
-Num dissector calls: 767 (109.57 diss/flow)
+Num dissector calls: 761 (108.71 diss/flow)
 
 Xiaomi	52	11467	7
 
diff --git a/tests/result/z3950.pcapng.out b/tests/result/z3950.pcapng.out
index 3e2e6aedf..166034355 100644
--- a/tests/result/z3950.pcapng.out
+++ b/tests/result/z3950.pcapng.out
@@ -3,7 +3,7 @@ Guessed flow protos:	1
 DPI Packets (TCP):	26	(13.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 497 (248.50 diss/flow)
+Num dissector calls: 485 (242.50 diss/flow)
 
 Z3950	31	6308	2
 
diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out
index b9873da96..13948015b 100644
--- a/tests/result/zoom.pcap.out
+++ b/tests/result/zoom.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	25	(1.47 pkts/flow)
 DPI Packets (other):	2	(1.00 pkts/flow)
 Confidence Match by IP      : 2 (flows)
 Confidence DPI              : 31 (flows)
-Num dissector calls: 942 (28.55 diss/flow)
+Num dissector calls: 937 (28.39 diss/flow)
 
 DNS	2	205	1
 MDNS	1	87	1