removed imesh protocol (iMesh is no longer availlable)

8 files changed, 10 insertions, 330 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index ff0b1735e..75a015370 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -54,7 +54,6 @@
 #define NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC		110
 #define NDPI_PROTOCOL_HTTP_CONNECT				130
 #define NDPI_PROTOCOL_HTTP_PROXY				131
-#define NDPI_PROTOCOL_SOCKS					172 /* Tomasz Bujlow <tomasz@skatnet.dk> */
 
 
 #define NDPI_PROTOCOL_FTP_CONTROL				1 /* Tomasz Bujlow <tomasz@skatnet.dk> */
@@ -86,7 +85,7 @@
 #define NDPI_PROTOCOL_VMWARE					28
 #define NDPI_PROTOCOL_MAIL_SMTPS				29
 #define NDPI_PROTOCOL_FILETOPIA				        30
-#define NDPI_PROTOCOL_IMESH					31
+#define NDPI_PROTOCOL_UBNTAC2					31 /* Ubiquity UBNT AirControl 2 - Thomas Fjellstrom <thomas+ndpi@fjellstrom.ca> */
 #define NDPI_PROTOCOL_KONTIKI					32
 #define NDPI_PROTOCOL_OPENFT					33
 #define NDPI_PROTOCOL_FASTTRACK				        34
@@ -188,6 +187,8 @@
 #define NDPI_PROTOCOL_UBUNTUONE			  	        169 /* Remy Mudingay <mudingay@ill.fr> */
 #define NDPI_PROTOCOL_WHOIS_DAS				        170
 #define NDPI_PROTOCOL_COLLECTD				        171
+#define NDPI_PROTOCOL_SOCKS					172 /* Tomasz Bujlow <tomasz@skatnet.dk> */
+#define NDPI_PROTOCOL_MS_LYNC 			                173
 #define NDPI_PROTOCOL_RTMP					174 /* Tomasz Bujlow <tomasz@skatnet.dk> */
 #define NDPI_PROTOCOL_FTP_DATA				        175 /* Tomasz Bujlow <tomasz@skatnet.dk> */
 #define NDPI_PROTOCOL_ZMQ                                       177
@@ -201,8 +202,6 @@
 #define NDPI_PROTOCOL_STARCRAFT 			        211 /* Matteo Bracci <matteobracci1@gmail.com> */
 #define NDPI_PROTOCOL_TEREDO 			                212
 #define NDPI_PROTOCOL_HEP 			                213 /* Sipcapture.org QXIP BV */
-#define NDPI_PROTOCOL_UBNTAC2					214 /* Ubiquity UBNT AirControl 2 - Thomas Fjellstrom <thomas+ndpi@fjellstrom.ca> */
-#define NDPI_PROTOCOL_MS_LYNC 			                173
 
 
 
@@ -262,7 +261,7 @@
 #define NDPI_PROTOCOL_MQTT				208
 #define NDPI_PROTOCOL_RX 			        209
 #define NDPI_SERVICE_SINA                               210
-#define NDPI_SERVICE_HANGOUT                            215
+#define NDPI_SERVICE_HANGOUT                            214
 
 /* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
 #define NDPI_LAST_IMPLEMENTED_PROTOCOL			NDPI_SERVICE_HANGOUT
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 93ba4b643..5ce5dac09 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -80,7 +80,6 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
 void ndpi_search_rtsp_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_filetopia_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_vmware(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
-void ndpi_search_imesh_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_ssl_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_mms_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_icecast_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
@@ -232,7 +231,6 @@ void init_http_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
 void init_http_activesync_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_iax_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_icecast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
-void init_imesh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_ipp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_irc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_jabber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index b35479464..4d1bc1f39 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -59,7 +59,6 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
 		     protocols/http.c \
 		     protocols/iax.c \
 		     protocols/icecast.c \
-		     protocols/imesh.c \
 		     protocols/ipp.c \
 		     protocols/irc.c \
 		     protocols/jabber.c \
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 749a740b4..14e0ee387 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -843,11 +843,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
     			    no_master, "Filetopia",
     			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
     			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
-    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_IMESH,
-			    no_master,
-			    no_master, "iMESH",
-			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
-			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
     ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_KONTIKI,
 			    no_master,
 			    no_master, "Kontiki",
@@ -2274,9 +2269,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* VMWARE */
   init_vmware_dissector(ndpi_struct, &a, detection_bitmask);
 
-  /* IMESH */
-  init_imesh_dissector(ndpi_struct, &a, detection_bitmask);
-
   /* MMS */
   init_mms_dissector(ndpi_struct, &a, detection_bitmask);
 
diff --git a/src/lib/protocols/imesh.c b/src/lib/protocols/imesh.c
deleted file mode 100644
index e67019a43..000000000
--- a/src/lib/protocols/imesh.c
+++ /dev/null
@@ -1,308 +0,0 @@
-/*
- * imesh.c
- *
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
- * 
- */
-
-
-#include "ndpi_api.h"
-
-#ifdef NDPI_PROTOCOL_IMESH
-
-
-static void ndpi_int_imesh_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
-					  struct ndpi_flow_struct *flow/* , ndpi_protocol_type_t protocol_type */)
-{
-  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IMESH, NDPI_PROTOCOL_UNKNOWN);
-}
-
-
-void ndpi_search_imesh_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  struct ndpi_packet_struct *packet = &flow->packet;	
-
-  if (packet->udp != NULL) {
-
-    NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "UDP FOUND\n");
-
-    // this is the login packet
-    if (packet->payload_packet_len == 28 && (get_u_int32_t(packet->payload, 0)) == htonl(0x02000000) &&
-	get_u_int32_t(packet->payload, 24) == 0 &&
-	(packet->udp->dest == htons(1864) || packet->udp->source == htons(1864))) {
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh Login detected\n");
-      ndpi_int_imesh_add_connection(ndpi_struct, flow);
-      return;
-    }
-    if (packet->payload_packet_len == 36) {
-      if (get_u_int32_t(packet->payload, 0) == htonl(0x02000000) && packet->payload[4] != 0 &&
-	  packet->payload[5] == 0 && get_u_int16_t(packet->payload, 6) == htons(0x0083) &&
-	  get_u_int32_t(packet->payload, 24) == htonl(0x40000000) &&
-	  (packet->payload[packet->payload_packet_len - 1] == packet->payload[packet->payload_packet_len - 5] ||
-	   packet->payload[packet->payload_packet_len - 1] - 1 == packet->payload[packet->payload_packet_len - 5]
-	   || packet->payload[packet->payload_packet_len - 1] ==
-	   packet->payload[packet->payload_packet_len - 5] - 1)) {
-	NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
-	ndpi_int_imesh_add_connection(ndpi_struct, flow);
-	return;
-      }
-      if (get_u_int16_t(packet->payload, 0) == htons(0x0200) && get_u_int16_t(packet->payload, 2) != 0 &&
-	  get_u_int32_t(packet->payload, 4) == htonl(0x02000083) && get_u_int32_t(packet->payload, 24) == htonl(0x40000000) &&
-	  (packet->payload[packet->payload_packet_len - 1] == packet->payload[packet->payload_packet_len - 5] ||
-	   packet->payload[packet->payload_packet_len - 1] - 1 == packet->payload[packet->payload_packet_len - 5]
-	   || packet->payload[packet->payload_packet_len - 1] ==
-	   packet->payload[packet->payload_packet_len - 5] - 1)) {
-	NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
-	ndpi_int_imesh_add_connection(ndpi_struct, flow);
-	return;
-      }
-    }
-    if (packet->payload_packet_len == 24 && get_u_int16_t(packet->payload, 0) == htons(0x0200)
-	&& get_u_int16_t(packet->payload, 2) != 0 && get_u_int32_t(packet->payload, 4) == htonl(0x03000084) &&
-	(packet->payload[packet->payload_packet_len - 1] == packet->payload[packet->payload_packet_len - 5] ||
-	 packet->payload[packet->payload_packet_len - 1] - 1 == packet->payload[packet->payload_packet_len - 5] ||
-	 packet->payload[packet->payload_packet_len - 1] == packet->payload[packet->payload_packet_len - 5] - 1)) {
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
-      ndpi_int_imesh_add_connection(ndpi_struct, flow);
-      return;
-    }
-    if (packet->payload_packet_len == 32 && get_u_int32_t(packet->payload, 0) == htonl(0x02000000) &&
-	get_u_int16_t(packet->payload, 21) == 0 && get_u_int16_t(packet->payload, 26) == htons(0x0100)) {
-      if (get_u_int32_t(packet->payload, 4) == htonl(0x00000081) && packet->payload[11] == packet->payload[15] &&
-	  get_l16(packet->payload, 24) == htons(packet->udp->source)) {
-	/* packet->payload[28] = source address */
-	NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
-	ndpi_int_imesh_add_connection(ndpi_struct, flow);
-	return;
-      }
-      if (get_u_int32_t(packet->payload, 4) == htonl(0x01000082)) {
-	NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
-	ndpi_int_imesh_add_connection(ndpi_struct, flow);
-	return;
-      }
-    }
-    NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh UDP packetlen: %d\n",
-	     packet->payload_packet_len);
-
-  }
-
-  if (packet->tcp != NULL) {
-    if (packet->payload_packet_len == 64 && get_u_int32_t(packet->payload, 0) == htonl(0x40000000) &&
-	get_u_int32_t(packet->payload, 4) == 0 && get_u_int32_t(packet->payload, 8) == htonl(0x0000fcff) &&
-	get_u_int32_t(packet->payload, 12) == htonl(0x04800100) && get_u_int32_t(packet->payload, 45) == htonl(0xff020000) &&
-	get_u_int16_t(packet->payload, 49) == htons(0x001a)) {
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "found imesh.\n");
-      ndpi_int_imesh_add_connection(ndpi_struct, flow);
-      return;
-    }
-    if (packet->payload_packet_len == 95 && get_u_int32_t(packet->payload, 0) == htonl(0x5f000000) &&
-	get_u_int16_t(packet->payload, 4) == 0 && get_u_int16_t(packet->payload, 7) == htons(0x0004) &&
-	get_u_int32_t(packet->payload, 20) == 0 && get_u_int32_t(packet->payload, 28) == htonl(0xc8000400) &&
-	packet->payload[9] == 0x80 && get_u_int32_t(packet->payload, 10) == get_u_int32_t(packet->payload, 24)) {
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "found imesh.\n");
-      ndpi_int_imesh_add_connection(ndpi_struct, flow);
-      return;
-    }
-    if (packet->payload_packet_len == 28 && get_u_int32_t(packet->payload, 0) == htonl(0x1c000000) &&
-	get_u_int16_t(packet->payload, 10) == htons(0xfcff) && get_u_int32_t(packet->payload, 12) == htonl(0x07801800) &&
-	(get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == htons(0x1900) ||
-	 get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == htons(0x1a00))) {
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "found imesh.\n");
-      ndpi_int_imesh_add_connection(ndpi_struct, flow);
-      return;
-    }
-
-    NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "TCP FOUND :: Payload %u\n",
-	     packet->payload_packet_len);
-
-    if (packet->actual_payload_len == 0) {
-      return;
-    }
-    if ((packet->actual_payload_len == 8 || packet->payload_packet_len == 10)	/* PATTERN:: 04 00 00 00 00 00 00 00 [00 00] */
-	&&get_u_int32_t(packet->payload, 0) == htonl(0x04000000)
-	&& get_u_int32_t(packet->payload, 4) == 0) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 10	/* PATTERN:: ?? ?? 04|00 00 64|00 00 */
-	       && (packet->payload[2] == 0x04 || packet->payload[2] == 0x00)
-	       && packet->payload[3] == 0x00 && (packet->payload[4] == 0x00 || packet->payload[4] == 0x64)
-	       && packet->payload[5] == 0x00
-	       && (packet->payload[2] != packet->payload[4]) /* We do not want that the packet is ?? ?? 00 00 00 00 */
-	       ) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 2 && packet->payload[0] == 0x06 && packet->payload[1] == 0x00) {
-      flow->l4.tcp.imesh_stage++;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 10	/* PATTERN:: 06 00 04|00 00 01|00 00 01|00 00 ?? 00 */
-	       && packet->payload[0] == 0x06
-	       && packet->payload[1] == 0x00 && (packet->payload[2] == 0x04 || packet->payload[2] == 0x00)
-	       && packet->payload[3] == 0x00 && (packet->payload[4] == 0x00 || packet->payload[4] == 0x01)
-	       && packet->payload[5] == 0x00 && (packet->payload[6] == 0x01 || packet->payload[6] == 0x00)
-	       && packet->payload[7] == 0x00 && packet->payload[9] == 0x00
-	       && (packet->payload[2] || packet->payload[4] || packet->payload[6]) /* We do not want that the packet is all 06 00 00 ... */
-	       ) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 24 && packet->payload[0] == 0x06	// PATTERN :: 06 00 12 00 00 00 34 00 00
-	       && packet->payload[1] == 0x00
-	       && packet->payload[2] == 0x12
-	       && packet->payload[3] == 0x00
-	       && packet->payload[4] == 0x00
-	       && packet->payload[5] == 0x00
-	       && packet->payload[6] == 0x34 && packet->payload[7] == 0x00 && packet->payload[8] == 0x00) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 8	/* PATTERN:: 06|00 00 02 00 00 00 33 00 */
-	       && (packet->payload[0] == 0x06 || packet->payload[0] == 0x00)
-	       && packet->payload[1] == 0x00
-	       && packet->payload[2] == 0x02
-	       && packet->payload[3] == 0x00
-	       && packet->payload[4] == 0x00
-	       && packet->payload[5] == 0x00 && packet->payload[6] == 0x33 && packet->payload[7] == 0x00) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->payload_packet_len == 6	/* PATTERN:: 02 00 00 00 33 00 */
-	       && packet->payload[0] == 0x02
-	       && packet->payload[1] == 0x00
-	       && packet->payload[2] == 0x00
-	       && packet->payload[3] == 0x00 && packet->payload[4] == 0x33 && packet->payload[5] == 0x00) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 12 && packet->payload[0] == 0x06	// PATTERN : 06 00 06 00 00 00 64 00
-	       && packet->payload[1] == 0x00
-	       && packet->payload[2] == 0x06
-	       && packet->payload[3] == 0x00
-	       && packet->payload[4] == 0x00
-	       && packet->payload[5] == 0x00 && packet->payload[6] == 0x64 && packet->payload[7] == 0x00) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 10	/* PATTERN:: 06 00 04|01 00 00 00 01|00 00 ?? 00 */
-	       && packet->payload[0] == 0x06
-	       && packet->payload[1] == 0x00 && (packet->payload[2] == 0x04 || packet->payload[2] == 0x01)
-	       && packet->payload[3] == 0x00
-	       && packet->payload[4] == 0x00
-	       && packet->payload[5] == 0x00 && (packet->payload[6] == 0x01 || packet->payload[6] == 0x00)
-	       && packet->payload[7] == 0x00
-	       /* && packet->payload[8]==0x00 */
-	       && packet->payload[9] == 0x00) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if ((packet->actual_payload_len == 64 || packet->actual_payload_len == 52	/* PATTERN:: [len] 00 00 00 00 */
-		|| packet->actual_payload_len == 95)
-	       && get_u_int16_t(packet->payload, 0) == (packet->actual_payload_len)
-	       && packet->payload[1] == 0x00 && packet->payload[2] == 0x00
-	       && packet->payload[3] == 0x00 && packet->payload[4] == 0x00) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 6 && packet->payload[0] == 0x06	// PATTERN : 06 00 04|6c 00|01 00 00
-	       && packet->payload[1] == 0x00 && (packet->payload[2] == 0x04 || packet->payload[2] == 0x6c)
-	       && (packet->payload[3] == 0x00 || packet->payload[3] == 0x01)
-	       && packet->payload[4] == 0x00 && packet->payload[5] == 0x00) {
-
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 6	/* PATTERN:: [len] ?? ee 00 00 00 */
-	       && get_u_int16_t(packet->payload, 0) == (packet->actual_payload_len)
-	       && packet->payload[2] == 0xee
-	       && packet->payload[3] == 0x00 && packet->payload[4] == 0x00 && packet->payload[5] == 0x00) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    } else if (packet->actual_payload_len == 10	/* PATTERN:: 06 00 00 00 00 00 00 00 */
-	       && packet->payload[0] == 0x06
-	       && packet->payload[1] == 0x00
-	       && packet->payload[2] == 0x00
-	       && packet->payload[3] == 0x00
-	       && packet->payload[4] == 0x00
-	       && packet->payload[5] == 0x00 && packet->payload[6] == 0x00 && packet->payload[7] == 0x00) {
-      flow->l4.tcp.imesh_stage += 2;
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
-	       "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
-    }
-
-
-    /* http login */
-    if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("POST /registration") &&
-	memcmp(packet->payload, "POST /registration", NDPI_STATICSTRING_LEN("POST /registration")) == 0) {
-      ndpi_parse_packet_line_info(ndpi_struct, flow);
-      if (packet->parsed_lines > 6 &&
-	  packet->host_line.ptr != NULL &&
-	  packet->host_line.len == NDPI_STATICSTRING_LEN("login.bearshare.com") &&
-	  packet->line[1].ptr != NULL &&
-	  packet->line[1].len == NDPI_STATICSTRING_LEN("Authorization: Basic Og==") &&
-	  packet->line[4].ptr != NULL &&
-	  packet->line[4].len == NDPI_STATICSTRING_LEN("Accept-Encoding: identity") &&
-	  memcmp(packet->line[1].ptr, "Authorization: Basic Og==",
-		 NDPI_STATICSTRING_LEN("Authorization: Basic Og==")) == 0 &&
-	  memcmp(packet->host_line.ptr, "login.bearshare.com",
-		 NDPI_STATICSTRING_LEN("login.bearshare.com")) == 0 &&
-	  memcmp(packet->line[4].ptr, "Accept-Encoding: identity",
-		 NDPI_STATICSTRING_LEN("Accept-Encoding: identity")) == 0) {
-	NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh Login detected\n");
-	ndpi_int_imesh_add_connection(ndpi_struct, flow);
-	return;
-      }
-    }
-    /*give one packet tolerance for detection */
-    if((flow->l4.tcp.imesh_stage >= 4) 
-       && (flow->l4.tcp.seen_syn && flow->l4.tcp.seen_syn_ack && flow->l4.tcp.seen_ack) /* We have seen the 3-way handshake */)
-      {
-      NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "found imesh.\n");
-      ndpi_int_imesh_add_connection(ndpi_struct, flow);
-      return;
-    }
-  }
-
-  if ((flow->packet_counter < 5) || packet->actual_payload_len == 0) {
-    return;
-  }
-  //imesh_not_found_end:
-  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IMESH);
-  NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh excluded at stage %d\n",
-	   packet->tcp != NULL ? flow->l4.tcp.imesh_stage : 0);
-
-}
-
-
-void init_imesh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
-  ndpi_set_bitmask_protocol_detection("iMESH", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_IMESH,
-				      ndpi_search_imesh_tcp_udp,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD,
-				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
-				      ADD_TO_DETECTION_BITMASK);
-
-  *id += 1;
-}
-
-#endif
diff --git a/tests/result/hangout.pcap.out b/tests/result/hangout.pcap.out
index 481ddfe3c..817d11220 100644
--- a/tests/result/hangout.pcap.out
+++ b/tests/result/hangout.pcap.out
@@ -1,3 +1,3 @@
 GoogleHangout	19	2774	1
 
-	1	UDP 10.89.61.13:56406 <-> 74.125.134.127:19305 [proto: 215/GoogleHangout][19 pkts/2774 bytes]
+	1	UDP 10.89.61.13:56406 <-> 74.125.134.127:19305 [proto: 214/GoogleHangout][19 pkts/2774 bytes]
diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out
index 9f495c49c..3e2c6fe60 100644
--- a/tests/result/http_ipv6.pcap.out
+++ b/tests/result/http_ipv6.pcap.out
@@ -5,10 +5,10 @@ QUIC	3	502	1
 ntop	80	36401	4
 
 	1	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:33062 <-> [2a00:1450:400b:c02::9a]:443 [proto: 91/SSL][2 pkts/172 bytes]
-	2	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37486 [proto: 91.217/SSL.ntop][19 pkts/7014 bytes][SSL client: www.ntop.org]
-	3	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37488 [proto: 91.217/SSL.ntop][17 pkts/6842 bytes][SSL client: www.ntop.org]
-	4	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37494 [proto: 91.217/SSL.ntop][18 pkts/6928 bytes][SSL client: www.ntop.org]
-	5	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37506 [proto: 91.217/SSL.ntop][26 pkts/15617 bytes][SSL client: www.ntop.org]
+	2	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37486 [proto: 91.216/SSL.ntop][19 pkts/7014 bytes][SSL client: www.ntop.org]
+	3	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37488 [proto: 91.216/SSL.ntop][17 pkts/6842 bytes][SSL client: www.ntop.org]
+	4	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37494 [proto: 91.216/SSL.ntop][18 pkts/6928 bytes][SSL client: www.ntop.org]
+	5	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37506 [proto: 91.216/SSL.ntop][26 pkts/15617 bytes][SSL client: www.ntop.org]
 	6	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4006:804::200e]:40526 [proto: 91/SSL][2 pkts/172 bytes]
 	7	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4001:803::1017]:41776 [proto: 91/SSL][14 pkts/2213 bytes]
 	8	TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a02:26f0:ad:197::236]:53132 [proto: 91.119/SSL.Facebook][12 pkts/5187 bytes][SSL client: s-static.ak.facebook.com]
diff --git a/tests/result/mpeg.pcap.out b/tests/result/mpeg.pcap.out
index 12b3d1ad5..a2c210473 100644
--- a/tests/result/mpeg.pcap.out
+++ b/tests/result/mpeg.pcap.out
@@ -1,3 +1,3 @@
 ntop	19	10643	1
 
-	1	TCP 46.101.157.119:80 <-> 192.168.80.160:55804 [proto: 7.217/HTTP.ntop][19 pkts/10643 bytes][Host: luca.ntop.org]
+	1	TCP 46.101.157.119:80 <-> 192.168.80.160:55804 [proto: 7.216/HTTP.ntop][19 pkts/10643 bytes][Host: luca.ntop.org]