Fix classification "by-port" (#1851)

Classification "by-port" should be the last possible effort, *after* having test all the LRU caches. Remove some dead code from `ndpi_detection_giveup()`: `flow->guessed_protocol_id` is never set to any od those voip protocols and at that point in this function we never have both a master *and* a application protocols. Coverage reports (both from unit tests and from fuzzing) confirms that was dead code.
author: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> 2023-01-17 08:26:42 +0100
committer: GitHub <noreply@github.com> 2023-01-17 08:26:42 +0100
commit: ebb9ebd2a0a1536cb8f9d9dc510f52f33ed78eab (patch)
tree: 6e3ee193e8e9e0e4ce1f2f9680ec252f1f46e8e2
parent: 1f7c57deff9debbda3d26be906e067dcf73ce1f9 (diff)
60 files changed, 92 insertions, 118 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 642ddb780..4618cb75f 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -5977,7 +5977,6 @@ static void ndpi_add_connection_as_zoom(struct ndpi_detection_module_struct *ndp
 ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_str, struct ndpi_flow_struct *flow,
 				    u_int8_t enable_guess, u_int8_t *protocol_was_guessed) {
   ndpi_protocol ret = NDPI_PROTOCOL_NULL;
-  u_int16_t guessed_protocol_id = NDPI_PROTOCOL_UNKNOWN;
 
   /* *** We can't access ndpi_str->packet from this function!! *** */
 
@@ -6011,41 +6010,14 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st
 
   if(flow->guessed_protocol_id == NDPI_PROTOCOL_STUN)
     goto check_stun_export;
-  else if((flow->guessed_protocol_id == NDPI_PROTOCOL_HANGOUT_DUO) ||
-          (flow->guessed_protocol_id == NDPI_PROTOCOL_FACEBOOK_VOIP) ||
-          (flow->guessed_protocol_id == NDPI_PROTOCOL_SIGNAL_VOIP) ||
-          (flow->guessed_protocol_id == NDPI_PROTOCOL_WHATSAPP_CALL)) {
-    *protocol_was_guessed = 1;
-    ndpi_set_detected_protocol(ndpi_str, flow, flow->guessed_protocol_id, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI_PARTIAL);
-  } else if(enable_guess) {
-
-    guessed_protocol_id = flow->guessed_protocol_id;
-
-    /* Ignore guessed protocol if they have been discarded */
-    if((guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN)
-       && (flow->l4_proto == IPPROTO_UDP) &&
-       NDPI_ISSET(&flow->excluded_protocol_bitmask, guessed_protocol_id) &&
-       is_udp_not_guessable_protocol(guessed_protocol_id))
-      flow->guessed_protocol_id = guessed_protocol_id = NDPI_PROTOCOL_UNKNOWN;
-
-    if(guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) {
-      *protocol_was_guessed = 1;
-      ndpi_set_detected_protocol(ndpi_str, flow, guessed_protocol_id, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_MATCH_BY_PORT);
-    } else if(flow->stun.num_binding_requests > 0 &&
-              flow->stun.num_processed_pkts > 0) {
+  else if(enable_guess) {
+    if(flow->stun.num_binding_requests > 0 &&
+       flow->stun.num_processed_pkts > 0) {
       *protocol_was_guessed = 1;
       ndpi_set_detected_protocol(ndpi_str, flow, NDPI_PROTOCOL_STUN, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI_PARTIAL);
     }
   }
 
-  if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && enable_guess) {
-    if(flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) {
-      *protocol_was_guessed = 1;
-      flow->detected_protocol_stack[1] = flow->guessed_protocol_id;
-      flow->confidence = NDPI_CONFIDENCE_MATCH_BY_PORT;
-    }
-  }
-
   if((flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) &&
      (flow->guessed_protocol_id == NDPI_PROTOCOL_STUN)) {
   check_stun_export:
@@ -6055,23 +6027,9 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st
 
   ret.master_protocol = flow->detected_protocol_stack[1], ret.app_protocol = flow->detected_protocol_stack[0];
 
-  if(ret.master_protocol == NDPI_PROTOCOL_STUN) {
-    if(ret.app_protocol == NDPI_PROTOCOL_FACEBOOK)
-      ret.app_protocol = NDPI_PROTOCOL_FACEBOOK_VOIP;
-    else if(ret.app_protocol == NDPI_PROTOCOL_GOOGLE) {
-      /*
-	As Google has recently introduced Duo,
-	we need to distinguish between it and hangout
-	thing that should be handled by the STUN dissector
-      */
-      ndpi_set_detected_protocol(ndpi_str, flow, NDPI_PROTOCOL_HANGOUT_DUO, NDPI_PROTOCOL_STUN, NDPI_CONFIDENCE_DPI_PARTIAL);
-      ret.app_protocol = NDPI_PROTOCOL_HANGOUT_DUO;
-    }
-  }
-
   if((ret.master_protocol == NDPI_PROTOCOL_UNKNOWN)
      && (ret.app_protocol == NDPI_PROTOCOL_UNKNOWN)) {
-    /* Last resort */
+    /* Check some caches */
     if(ndpi_search_into_bittorrent_cache(ndpi_str, flow,
 					 flow->c_address.v4, flow->c_port,
 					 flow->s_address.v4, flow->s_port)) {
@@ -6091,6 +6049,22 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st
     }
   }
 
+  /* Classification by-port is the last resort */
+  if(enable_guess && ret.app_protocol == NDPI_PROTOCOL_UNKNOWN) {
+
+    /* Ignore guessed protocol if they have been discarded */
+    if(flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN &&
+       flow->l4_proto == IPPROTO_UDP &&
+       NDPI_ISSET(&flow->excluded_protocol_bitmask, flow->guessed_protocol_id) &&
+       is_udp_not_guessable_protocol(flow->guessed_protocol_id))
+      flow->guessed_protocol_id = NDPI_PROTOCOL_UNKNOWN;
+
+    if(flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) {
+      ndpi_set_detected_protocol(ndpi_str, flow, flow->guessed_protocol_id, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_MATCH_BY_PORT);
+      ret.app_protocol = flow->detected_protocol_stack[0];
+    }
+  }
+
   if(ret.app_protocol != NDPI_PROTOCOL_UNKNOWN) {
     *protocol_was_guessed = 1;
     ndpi_fill_protocol_category(ndpi_str, flow, &ret);
diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out
index e04ef9a45..9d32be60f 100644
--- a/tests/result/1kxun.pcap.out
+++ b/tests/result/1kxun.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 6 (flows)
 Confidence DPI              : 177 (flows)
 Num dissector calls: 4395 (22.31 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/45/0 (insert/search/found)
+LRU cache bittorrent: 0/60/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/8/0 (insert/search/found)
diff --git a/tests/result/443-chrome.pcap.out b/tests/result/443-chrome.pcap.out
index 02479494d..a059c2c5e 100644
--- a/tests/result/443-chrome.pcap.out
+++ b/tests/result/443-chrome.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	1	(1.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Num dissector calls: 116 (116.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/KakaoTalk_chat.pcap.out b/tests/result/KakaoTalk_chat.pcap.out
index 4406ae624..9da1f2b7a 100644
--- a/tests/result/KakaoTalk_chat.pcap.out
+++ b/tests/result/KakaoTalk_chat.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 5 (flows)
 Confidence DPI              : 33 (flows)
 Num dissector calls: 599 (15.76 diss/flow)
 LRU cache ookla:      0/1/0 (insert/search/found)
-LRU cache bittorrent: 0/6/0 (insert/search/found)
+LRU cache bittorrent: 0/15/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/9/0 (insert/search/found)
diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out
index 0da95b68c..19d60cfc7 100644
--- a/tests/result/KakaoTalk_talk.pcap.out
+++ b/tests/result/KakaoTalk_talk.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 8 (flows)
 Confidence DPI              : 11 (flows)
 Num dissector calls: 818 (40.90 diss/flow)
 LRU cache ookla:      0/2/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/27/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   2/6/0 (insert/search/found)
diff --git a/tests/result/WebattackXSS.pcap.out b/tests/result/WebattackXSS.pcap.out
index 4d2cb78e9..235d6e273 100644
--- a/tests/result/WebattackXSS.pcap.out
+++ b/tests/result/WebattackXSS.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 639 (flows)
 Confidence DPI              : 22 (flows)
 Num dissector calls: 264 (0.40 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/1917/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/alexa-app.pcapng.out b/tests/result/alexa-app.pcapng.out
index b75734c0f..0c4e2fb40 100644
--- a/tests/result/alexa-app.pcapng.out
+++ b/tests/result/alexa-app.pcapng.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 14 (flows)
 Confidence DPI              : 146 (flows)
 Num dissector calls: 473 (2.96 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/42/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/12/0 (insert/search/found)
diff --git a/tests/result/android.pcap.out b/tests/result/android.pcap.out
index 475fa0a7c..8bce5ad91 100644
--- a/tests/result/android.pcap.out
+++ b/tests/result/android.pcap.out
@@ -8,7 +8,7 @@ Confidence Match by port    : 2 (flows)
 Confidence DPI              : 60 (flows)
 Num dissector calls: 257 (4.08 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out
index 8433e85e6..dbd644cd0 100644
--- a/tests/result/anyconnect-vpn.pcap.out
+++ b/tests/result/anyconnect-vpn.pcap.out
@@ -8,7 +8,7 @@ Confidence Match by port    : 6 (flows)
 Confidence DPI              : 61 (flows)
 Num dissector calls: 877 (12.71 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/9/0 (insert/search/found)
+LRU cache bittorrent: 0/27/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/11/0 (insert/search/found)
diff --git a/tests/result/cloudflare-warp.pcap.out b/tests/result/cloudflare-warp.pcap.out
index 12075cb10..e26608f7a 100644
--- a/tests/result/cloudflare-warp.pcap.out
+++ b/tests/result/cloudflare-warp.pcap.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 2 (flows)
 Confidence DPI              : 5 (flows)
 Num dissector calls: 173 (21.62 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/collectd.pcap.out b/tests/result/collectd.pcap.out
index 33fa52f54..213135670 100644
--- a/tests/result/collectd.pcap.out
+++ b/tests/result/collectd.pcap.out
@@ -5,13 +5,13 @@ Confidence Match by port    : 3 (flows)
 Confidence DPI              : 5 (flows)
 Num dissector calls: 389 (48.62 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/3/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/3/0 (insert/search/found)
 Automa host:          0/0 (search/found)
 Automa domain:        0/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/dhcp-fuzz.pcapng.out b/tests/result/dhcp-fuzz.pcapng.out
index c00dffeb8..20cddf6a9 100644
--- a/tests/result/dhcp-fuzz.pcapng.out
+++ b/tests/result/dhcp-fuzz.pcapng.out
@@ -4,13 +4,13 @@ DPI Packets (UDP):	1	(1.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Num dissector calls: 104 (104.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/1/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/1/0 (insert/search/found)
 Automa host:          0/0 (search/found)
 Automa domain:        0/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/ethereum.pcap.out b/tests/result/ethereum.pcap.out
index 0f365da67..d882d4c32 100644
--- a/tests/result/ethereum.pcap.out
+++ b/tests/result/ethereum.pcap.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 3 (flows)
 Confidence DPI              : 71 (flows)
 Num dissector calls: 539 (7.28 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out
index 4a167174b..0a217d4b1 100644
--- a/tests/result/fuzz-2006-06-26-2594.pcap.out
+++ b/tests/result/fuzz-2006-06-26-2594.pcap.out
@@ -8,13 +8,13 @@ Confidence Match by port    : 28 (flows)
 Confidence DPI              : 193 (flows)
 Num dissector calls: 5305 (21.14 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/129/0 (insert/search/found)
+LRU cache bittorrent: 0/180/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/61/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/17/0 (insert/search/found)
+LRU cache stun_zoom:  0/30/0 (insert/search/found)
 Automa host:          254/0 (search/found)
 Automa domain:        247/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/fuzz-2006-09-29-28586.pcap.out b/tests/result/fuzz-2006-09-29-28586.pcap.out
index 73f2ed1a9..c44b3f6ef 100644
--- a/tests/result/fuzz-2006-09-29-28586.pcap.out
+++ b/tests/result/fuzz-2006-09-29-28586.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 26 (flows)
 Confidence DPI              : 11 (flows)
 Num dissector calls: 928 (23.20 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/9/0 (insert/search/found)
+LRU cache bittorrent: 0/87/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/fuzz-2020-02-16-11740.pcap.out b/tests/result/fuzz-2020-02-16-11740.pcap.out
index 59851d41f..c74e7c188 100644
--- a/tests/result/fuzz-2020-02-16-11740.pcap.out
+++ b/tests/result/fuzz-2020-02-16-11740.pcap.out
@@ -7,13 +7,13 @@ Confidence Match by port    : 3 (flows)
 Confidence DPI              : 55 (flows)
 Num dissector calls: 1725 (22.40 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/57/0 (insert/search/found)
+LRU cache bittorrent: 0/66/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/22/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/13/0 (insert/search/found)
+LRU cache stun_zoom:  0/16/0 (insert/search/found)
 Automa host:          0/0 (search/found)
 Automa domain:        0/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/gnutella.pcap.out b/tests/result/gnutella.pcap.out
index 94d25b2c7..fd6e7d6d1 100644
--- a/tests/result/gnutella.pcap.out
+++ b/tests/result/gnutella.pcap.out
@@ -8,13 +8,13 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 167 (flows)
 Num dissector calls: 65122 (85.69 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/1776/0 (insert/search/found)
+LRU cache bittorrent: 0/1779/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/2/0 (insert/search/found)
 LRU cache mining:     0/593/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/511/0 (insert/search/found)
+LRU cache stun_zoom:  0/512/0 (insert/search/found)
 Automa host:          15/0 (search/found)
 Automa domain:        13/0 (search/found)
 Automa tls cert:      1/0 (search/found)
diff --git a/tests/result/googledns_android10.pcap.out b/tests/result/googledns_android10.pcap.out
index 3c0d136b5..afc870a86 100644
--- a/tests/result/googledns_android10.pcap.out
+++ b/tests/result/googledns_android10.pcap.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 2 (flows)
 Confidence DPI              : 6 (flows)
 Num dissector calls: 16 (2.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/6/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/gtp_false_positive.pcapng.out b/tests/result/gtp_false_positive.pcapng.out
index 26a806c21..c42dc2e04 100644
--- a/tests/result/gtp_false_positive.pcapng.out
+++ b/tests/result/gtp_false_positive.pcapng.out
@@ -5,13 +5,13 @@ Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 2 (flows)
 Num dissector calls: 385 (128.33 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/3/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/1/0 (insert/search/found)
+LRU cache stun_zoom:  0/3/0 (insert/search/found)
 Automa host:          0/0 (search/found)
 Automa domain:        0/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/http_guessed_host_and_guessed.pcapng.out b/tests/result/http_guessed_host_and_guessed.pcapng.out
index da647d33f..6f455effe 100644
--- a/tests/result/http_guessed_host_and_guessed.pcapng.out
+++ b/tests/result/http_guessed_host_and_guessed.pcapng.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	1	(1.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Num dissector calls: 116 (116.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out
index d7a7c81e0..04ca82d22 100644
--- a/tests/result/http_ipv6.pcap.out
+++ b/tests/result/http_ipv6.pcap.out
@@ -6,13 +6,13 @@ Confidence Match by port    : 7 (flows)
 Confidence DPI              : 8 (flows)
 Num dissector calls: 142 (9.47 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/21/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/7/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/1/0 (insert/search/found)
 Automa host:          7/7 (search/found)
 Automa domain:        7/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out
index ad441bba8..ce576a5f8 100644
--- a/tests/result/instagram.pcap.out
+++ b/tests/result/instagram.pcap.out
@@ -8,7 +8,7 @@ Confidence Match by port    : 7 (flows)
 Confidence DPI              : 30 (flows)
 Num dissector calls: 1780 (46.84 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/15/0 (insert/search/found)
+LRU cache bittorrent: 0/24/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/iphone.pcap.out b/tests/result/iphone.pcap.out
index 0354a9eea..1a549df85 100644
--- a/tests/result/iphone.pcap.out
+++ b/tests/result/iphone.pcap.out
@@ -7,13 +7,13 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 50 (flows)
 Num dissector calls: 344 (6.75 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/1/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/1/0 (insert/search/found)
 Automa host:          62/53 (search/found)
 Automa domain:        62/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/kerberos.pcap.out b/tests/result/kerberos.pcap.out
index b969ba6b7..1945aaf7c 100644
--- a/tests/result/kerberos.pcap.out
+++ b/tests/result/kerberos.pcap.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 23 (flows)
 Confidence DPI              : 11 (flows)
 Num dissector calls: 3741 (103.92 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/6/0 (insert/search/found)
+LRU cache bittorrent: 0/75/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/malware.pcap.out b/tests/result/malware.pcap.out
index 8bd6bfc97..fa1fc41a7 100644
--- a/tests/result/malware.pcap.out
+++ b/tests/result/malware.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 4 (flows)
 Num dissector calls: 15 (3.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/2/0 (insert/search/found)
diff --git a/tests/result/mongodb.pcap.out b/tests/result/mongodb.pcap.out
index 3e47797f5..8ed419825 100644
--- a/tests/result/mongodb.pcap.out
+++ b/tests/result/mongodb.pcap.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 2 (flows)
 Confidence DPI              : 5 (flows)
 Num dissector calls: 102 (12.75 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/mssql_tds.pcap.out b/tests/result/mssql_tds.pcap.out
index dbb86e0f7..098986820 100644
--- a/tests/result/mssql_tds.pcap.out
+++ b/tests/result/mssql_tds.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 11 (flows)
 Num dissector calls: 280 (23.33 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out
index a9f00bb7f..c0df07973 100644
--- a/tests/result/nest_log_sink.pcap.out
+++ b/tests/result/nest_log_sink.pcap.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 13 (flows)
 Num dissector calls: 1765 (126.07 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/netbios.pcap.out b/tests/result/netbios.pcap.out
index 1ac20952f..8fd4474c0 100644
--- a/tests/result/netbios.pcap.out
+++ b/tests/result/netbios.pcap.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 14 (flows)
 Num dissector calls: 130 (8.67 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/netflix.pcap.out b/tests/result/netflix.pcap.out
index 311056d51..8e799ef97 100644
--- a/tests/result/netflix.pcap.out
+++ b/tests/result/netflix.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 60 (flows)
 Num dissector calls: 375 (6.15 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/nintendo.pcap.out b/tests/result/nintendo.pcap.out
index 30f14ae5f..e02ad96cd 100644
--- a/tests/result/nintendo.pcap.out
+++ b/tests/result/nintendo.pcap.out
@@ -8,7 +8,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 15 (flows)
 Num dissector calls: 1250 (59.52 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/15/0 (insert/search/found)
+LRU cache bittorrent: 0/18/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/pinterest.pcap.out b/tests/result/pinterest.pcap.out
index ad0c3e623..26f11374d 100644
--- a/tests/result/pinterest.pcap.out
+++ b/tests/result/pinterest.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 16 (flows)
 Confidence DPI              : 21 (flows)
 Num dissector calls: 21 (0.57 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/48/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/6/0 (insert/search/found)
diff --git a/tests/result/pps.pcap.out b/tests/result/pps.pcap.out
index 5aadbe26f..ace733243 100644
--- a/tests/result/pps.pcap.out
+++ b/tests/result/pps.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 2 (flows)
 Confidence DPI              : 76 (flows)
 Num dissector calls: 5710 (53.36 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/87/0 (insert/search/found)
+LRU cache bittorrent: 0/93/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/quic.pcap.out b/tests/result/quic.pcap.out
index 3502a3dd9..b043c9f3f 100644
--- a/tests/result/quic.pcap.out
+++ b/tests/result/quic.pcap.out
@@ -11,7 +11,7 @@ LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/1/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/1/0 (insert/search/found)
 Automa host:          8/8 (search/found)
 Automa domain:        8/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/radius_false_positive.pcapng.out b/tests/result/radius_false_positive.pcapng.out
index c1602413c..cce006ad0 100644
--- a/tests/result/radius_false_positive.pcapng.out
+++ b/tests/result/radius_false_positive.pcapng.out
@@ -4,13 +4,13 @@ DPI Packets (UDP):	10	(10.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Num dissector calls: 198 (198.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/1/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/1/0 (insert/search/found)
 Automa host:          0/0 (search/found)
 Automa domain:        0/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/reddit.pcap.out b/tests/result/reddit.pcap.out
index f14d644c6..fede8e986 100644
--- a/tests/result/reddit.pcap.out
+++ b/tests/result/reddit.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 59 (flows)
 Num dissector calls: 59 (0.98 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/14/0 (insert/search/found)
diff --git a/tests/result/sites.pcapng.out b/tests/result/sites.pcapng.out
index 7b955fd5b..d31167431 100644
--- a/tests/result/sites.pcapng.out
+++ b/tests/result/sites.pcapng.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 4 (flows)
 Confidence DPI              : 43 (flows)
 Num dissector calls: 54 (1.15 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/8/0 (insert/search/found)
diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out
index e06726df2..042799cf6 100644
--- a/tests/result/skype.pcap.out
+++ b/tests/result/skype.pcap.out
@@ -8,7 +8,7 @@ Confidence Match by port    : 28 (flows)
 Confidence DPI              : 206 (flows)
 Num dissector calls: 27117 (92.55 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/213/0 (insert/search/found)
+LRU cache bittorrent: 0/261/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   1/2/0 (insert/search/found)
diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out
index 95ab1487f..044f32aa2 100644
--- a/tests/result/skype_no_unknown.pcap.out
+++ b/tests/result/skype_no_unknown.pcap.out
@@ -8,7 +8,7 @@ Confidence Match by port    : 22 (flows)
 Confidence DPI              : 201 (flows)
 Num dissector calls: 22551 (84.46 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/156/0 (insert/search/found)
+LRU cache bittorrent: 0/198/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   1/2/0 (insert/search/found)
diff --git a/tests/result/soap.pcap.out b/tests/result/soap.pcap.out
index 3f8904ca6..2236f2ce1 100644
--- a/tests/result/soap.pcap.out
+++ b/tests/result/soap.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 2 (flows)
 Num dissector calls: 360 (120.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/socks-http-example.pcap.out b/tests/result/socks-http-example.pcap.out
index c2c92aa6b..d574898b3 100644
--- a/tests/result/socks-http-example.pcap.out
+++ b/tests/result/socks-http-example.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 2 (flows)
 Num dissector calls: 455 (151.67 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out
index a126c2340..a347acef9 100644
--- a/tests/result/starcraft_battle.pcap.out
+++ b/tests/result/starcraft_battle.pcap.out
@@ -8,13 +8,13 @@ Confidence Match by port    : 12 (flows)
 Confidence DPI              : 39 (flows)
 Num dissector calls: 1410 (27.12 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/6/0 (insert/search/found)
+LRU cache bittorrent: 0/39/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/14/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/5/0 (insert/search/found)
 Automa host:          41/2 (search/found)
 Automa domain:        41/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/synscan.pcap.out b/tests/result/synscan.pcap.out
index 025a89b4e..622a6069b 100644
--- a/tests/result/synscan.pcap.out
+++ b/tests/result/synscan.pcap.out
@@ -5,7 +5,7 @@ Confidence Unknown          : 1862 (flows)
 Confidence Match by port    : 132 (flows)
 Num dissector calls: 0 (0.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/5586/0 (insert/search/found)
+LRU cache bittorrent: 0/5976/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out
index 1737e5685..95c7a17d5 100644
--- a/tests/result/teams.pcap.out
+++ b/tests/result/teams.pcap.out
@@ -9,7 +9,7 @@ Confidence DPI (partial)    : 1 (flows)
 Confidence DPI              : 80 (flows)
 Num dissector calls: 591 (7.12 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/6/0 (insert/search/found)
+LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       6/42/18 (insert/search/found)
 LRU cache tls_cert:   0/8/0 (insert/search/found)
diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out
index 0388f5b2a..03025f5d4 100644
--- a/tests/result/tls_certificate_too_long.pcap.out
+++ b/tests/result/tls_certificate_too_long.pcap.out
@@ -8,7 +8,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 33 (flows)
 Num dissector calls: 569 (16.26 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/6/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out
index 9f0427ab0..95097f6be 100644
--- a/tests/result/tls_invalid_reads.pcap.out
+++ b/tests/result/tls_invalid_reads.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 2 (flows)
 Num dissector calls: 118 (39.33 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/2/0 (insert/search/found)
diff --git a/tests/result/toca-boca.pcap.out b/tests/result/toca-boca.pcap.out
index 1472f0181..c4f6b2767 100644
--- a/tests/result/toca-boca.pcap.out
+++ b/tests/result/toca-boca.pcap.out
@@ -5,13 +5,13 @@ Confidence Match by port    : 4 (flows)
 Confidence DPI              : 17 (flows)
 Num dissector calls: 433 (20.62 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/4/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/4/0 (insert/search/found)
 Automa host:          0/0 (search/found)
 Automa domain:        0/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/tor.pcap.out b/tests/result/tor.pcap.out
index 3d3e1f81c..a013ef688 100644
--- a/tests/result/tor.pcap.out
+++ b/tests/result/tor.pcap.out
@@ -6,7 +6,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 10 (flows)
 Num dissector calls: 48 (4.36 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/8/0 (insert/search/found)
diff --git a/tests/result/tumblr.pcap.out b/tests/result/tumblr.pcap.out
index bf977a8f4..af45508df 100644
--- a/tests/result/tumblr.pcap.out
+++ b/tests/result/tumblr.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 28 (flows)
 Confidence DPI              : 19 (flows)
 Num dissector calls: 19 (0.40 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/84/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/8/0 (insert/search/found)
diff --git a/tests/result/tunnelbear.pcap.out b/tests/result/tunnelbear.pcap.out
index 4b13a6b5b..08f531541 100644
--- a/tests/result/tunnelbear.pcap.out
+++ b/tests/result/tunnelbear.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 20 (flows)
 Num dissector calls: 22 (1.05 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/6/0 (insert/search/found)
diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out
index 90344d491..4ebcf9592 100644
--- a/tests/result/viber.pcap.out
+++ b/tests/result/viber.pcap.out
@@ -7,13 +7,13 @@ Confidence Match by port    : 4 (flows)
 Confidence DPI              : 25 (flows)
 Num dissector calls: 518 (17.86 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/6/0 (insert/search/found)
+LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/6/0 (insert/search/found)
 LRU cache mining:     0/4/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/1/0 (insert/search/found)
 Automa host:          31/13 (search/found)
 Automa domain:        31/0 (search/found)
 Automa tls cert:      2/0 (search/found)
diff --git a/tests/result/waze.pcap.out b/tests/result/waze.pcap.out
index f18979a47..b8511bf46 100644
--- a/tests/result/waze.pcap.out
+++ b/tests/result/waze.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 9 (flows)
 Confidence DPI              : 23 (flows)
 Num dissector calls: 338 (10.24 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/30/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/26/0 (insert/search/found)
diff --git a/tests/result/webex.pcap.out b/tests/result/webex.pcap.out
index 9afa58673..526db6027 100644
--- a/tests/result/webex.pcap.out
+++ b/tests/result/webex.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 3 (flows)
 Confidence DPI              : 53 (flows)
 Num dissector calls: 315 (5.53 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/75/0 (insert/search/found)
diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out
index 72a3f14fe..a817a7f52 100644
--- a/tests/result/wechat.pcap.out
+++ b/tests/result/wechat.pcap.out
@@ -8,7 +8,7 @@ Confidence Match by port    : 24 (flows)
 Confidence DPI              : 78 (flows)
 Num dissector calls: 309 (3.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache bittorrent: 0/75/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/weibo.pcap.out b/tests/result/weibo.pcap.out
index 2a06f36b0..cab8e87ad 100644
--- a/tests/result/weibo.pcap.out
+++ b/tests/result/weibo.pcap.out
@@ -6,13 +6,13 @@ Confidence Match by port    : 21 (flows)
 Confidence DPI              : 23 (flows)
 Num dissector calls: 562 (12.77 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/6/0 (insert/search/found)
+LRU cache bittorrent: 0/63/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
 LRU cache mining:     0/21/0 (insert/search/found)
 LRU cache msteams:    0/0/0 (insert/search/found)
-LRU cache stun_zoom:  0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/2/0 (insert/search/found)
 Automa host:          32/25 (search/found)
 Automa domain:        32/0 (search/found)
 Automa tls cert:      0/0 (search/found)
diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out
index 9e600f4b9..58c966afe 100644
--- a/tests/result/whatsapp_login_call.pcap.out
+++ b/tests/result/whatsapp_login_call.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 20 (flows)
 Confidence DPI              : 37 (flows)
 Num dissector calls: 302 (5.30 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/60/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       4/44/36 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/whois.pcapng.out b/tests/result/whois.pcapng.out
index 9f335454e..0e14a6bda 100644
--- a/tests/result/whois.pcapng.out
+++ b/tests/result/whois.pcapng.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 2 (flows)
 Num dissector calls: 177 (59.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/2/0 (insert/search/found)
diff --git a/tests/result/xss.pcap.out b/tests/result/xss.pcap.out
index 88049ff18..b814c11af 100644
--- a/tests/result/xss.pcap.out
+++ b/tests/result/xss.pcap.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 1 (flows)
 Num dissector calls: 12 (6.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/z3950.pcapng.out b/tests/result/z3950.pcapng.out
index b1b67fd69..473a4c8f5 100644
--- a/tests/result/z3950.pcapng.out
+++ b/tests/result/z3950.pcapng.out
@@ -5,7 +5,7 @@ Confidence Match by port    : 1 (flows)
 Confidence DPI              : 1 (flows)
 Num dissector calls: 453 (226.50 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
 LRU cache tls_cert:   0/0/0 (insert/search/found)
diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out
index cfed69c91..b3d8f7490 100644
--- a/tests/result/zoom.pcap.out
+++ b/tests/result/zoom.pcap.out
@@ -7,7 +7,7 @@ Confidence Match by port    : 2 (flows)
 Confidence DPI              : 31 (flows)
 Num dissector calls: 653 (19.79 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
-LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/6/0 (insert/search/found)
 LRU cache zoom:       7/0/0 (insert/search/found)
 LRU cache stun:       2/8/4 (insert/search/found)
 LRU cache tls_cert:   0/2/0 (insert/search/found)
author	Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>	2023-01-17 08:26:42 +0100
committer	GitHub <noreply@github.com>	2023-01-17 08:26:42 +0100
commit	ebb9ebd2a0a1536cb8f9d9dc510f52f33ed78eab (patch)
tree	6e3ee193e8e9e0e4ce1f2f9680ec252f1f46e8e2
parent	1f7c57deff9debbda3d26be906e067dcf73ce1f9 (diff)