:bulb: Add Apache JServ Protocol Dissector

8 files changed, 205 insertions, 40 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index f92e580c3..16d537624 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -179,10 +179,7 @@
 #define NDPI_PROTOCOL_YOUTUBE_UPLOAD        136 /* Upload files to youtube */
 #define NDPI_PROTOCOL_ICQ                   137
 #define NDPI_PROTOCOL_CHECKMK               138
-
-/* Free to use */
-#define NDPI_PROTOCOL_FREE_B                139
-
+#define NDPI_PROTOCOL_AJP                   139 /* Leonn Paiva <leonn.paiva@gmail.com>*/
 #define NDPI_PROTOCOL_APPLE                 140
 #define NDPI_PROTOCOL_WEBEX                 141
 #define NDPI_PROTOCOL_WHATSAPP              142
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 4e230a68d..189b35a8e 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -202,6 +202,7 @@ void ndpi_search_smpp(struct ndpi_detection_module_struct *ndpi_struct, struct n
 void ndpi_search_tinc(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_fix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_csgo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
+void ndpi_search_ajp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 /* --- INIT FUNCTIONS --- */
 void init_diameter_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_afp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
@@ -354,4 +355,5 @@ void init_csgo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
 void init_checkmk_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_apple_push_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_whatsapp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_ajp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 #endif /* __NDPI_PROTOCOLS_H__ */
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 7ad9757a4..14b2992a2 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -350,7 +350,6 @@ struct bt_announce {              // 192 bytes
 #endif
 
 #ifdef NDPI_PROTOCOL_TINC
-
 #define TINC_CACHE_MAX_SIZE 10
 
 PACK_ON struct tinc_cache_entry {
@@ -1133,7 +1132,7 @@ struct ndpi_flow_struct {
 #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI)
   u_int16_t kxun_counter, iqiyi_counter;
 #endif
-  
+
   /* internal structures to save functions calls */
   struct ndpi_packet_struct packet;
   struct ndpi_flow_struct *flow;
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index fd7df2c7f..28b425022 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -19,6 +19,7 @@ libndpi_la_include_HEADERS = ../include/ndpi_api.h          \
 libndpi_la_SOURCES = ndpi_content_match.c.inc \
 		     ndpi_main.c \
 		     protocols/afp.c \
+		     protocols/ajp.c \
 		     protocols/aimini.c \
 		     protocols/applejuice.c \
 		     protocols/apple_push.c \
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2b5ade95f..afabf820e 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -504,8 +504,8 @@ void ndpi_exclude_protocol(struct ndpi_detection_module_struct *ndpi_struct,
 
   if(protocol_id < NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) {
 #ifdef NDPI_ENABLE_DEBUG_MESSAGES
-	if ( ndpi_struct && 
-	     ndpi_struct->ndpi_log_level >= NDPI_LOG_DEBUG && 
+	if ( ndpi_struct &&
+	     ndpi_struct->ndpi_log_level >= NDPI_LOG_DEBUG &&
     	     ndpi_struct->ndpi_debug_printf != NULL) {
 
 		(*(ndpi_struct->ndpi_debug_printf))(protocol_id, ndpi_struct, NDPI_LOG_DEBUG,
@@ -751,11 +751,11 @@ static int init_hyperscan(struct ndpi_detection_module_struct *ndpi_mod) {
   unsigned int *ids;
   hs_compile_error_t *compile_err;
   struct hs *hs;
-  
+
   ndpi_mod->hyperscan = (void*)malloc(sizeof(struct hs));
   if(!ndpi_mod->hyperscan) return(-1);
   hs = (struct hs*)ndpi_mod->hyperscan;
-  
+
   for(i=0; host_match[i].string_to_match != NULL; i++) {
     if(host_match[i].pattern_to_match) {
       /*  printf("[DEBUG] %s\n", host_match[i].pattern_to_match); */
@@ -779,7 +779,7 @@ static int init_hyperscan(struct ndpi_detection_module_struct *ndpi_mod) {
       num_patterns++;
     }
   }
-  
+
   if(hs_compile_multi(expressions, NULL, ids,
 		      num_patterns, HS_MODE_BLOCK, NULL,
 		      &hs->database, &compile_err) != HS_SUCCESS) {
@@ -787,13 +787,13 @@ static int init_hyperscan(struct ndpi_detection_module_struct *ndpi_mod) {
     hs_free_compile_error(compile_err);
     return -1;
   }
-  
+
   if(hs_alloc_scratch(hs->database, &hs->scratch) != HS_SUCCESS) {
     NDPI_LOG_ERR(ndpi_mod, "Unable to allocate hyperscan scratch space\n");
     hs_free_database(hs->database);
     return -1;
   }
-  
+
   return 0;
 }
 
@@ -802,7 +802,7 @@ static int init_hyperscan(struct ndpi_detection_module_struct *ndpi_mod) {
 static void destroy_hyperscan(struct ndpi_detection_module_struct *ndpi_mod) {
   if(ndpi_mod->hyperscan) {
     struct hs *hs = (struct hs*)ndpi_mod->hyperscan;
-    
+
     hs_free_scratch(hs->scratch);
     hs_free_database(hs->database);
   }
@@ -1793,18 +1793,18 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    no_master, "CSGO", NDPI_PROTOCOL_CATEGORY_GAME,
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AJP,
+          no_master,
+          no_master, "AJP", NDPI_PROTOCOL_CATEGORY_WEB,
+          ndpi_build_default_ports(ports_a, 8009, 0, 0, 0, 0) /* TCP */,
+          ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
 
     /* To remove */
     ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_A,
-			    no_master,
-			    no_master, "PlaceholderA", NDPI_PROTOCOL_CATEGORY_UNSPECIFIED,
-			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
-			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
-    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_B,
-			    no_master,
-			    no_master, "PlaceholderB", NDPI_PROTOCOL_CATEGORY_UNSPECIFIED,
-			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
-			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+          no_master,
+          no_master, "PlaceholderA", NDPI_PROTOCOL_CATEGORY_UNSPECIFIED,
+          ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+          ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
 
     /* calling function for host and content matched protocols */
     init_string_based_protocols(ndpi_mod);
@@ -1963,7 +1963,7 @@ void set_ndpi_flow_malloc(void* (*__ndpi_flow_malloc)(size_t size)) { _ndpi_flow
 void set_ndpi_free(void  (*__ndpi_free)(void *ptr))       { _ndpi_free = __ndpi_free; }
 void set_ndpi_flow_free(void  (*__ndpi_flow_free)(void *ptr))       { _ndpi_flow_free = __ndpi_flow_free; }
 
-void ndpi_debug_printf(unsigned int proto, struct ndpi_detection_module_struct *ndpi_str, 
+void ndpi_debug_printf(unsigned int proto, struct ndpi_detection_module_struct *ndpi_str,
 		ndpi_log_level_t log_level, const char *file_name, const char *func_name, int line_number,
 		const char * format, ...)
 {
@@ -1979,7 +1979,7 @@ void ndpi_debug_printf(unsigned int proto, struct ndpi_detection_module_struct *
   va_end(args);
 
   if (ndpi_str != NULL) {
-    printf("%s:%s:%-3u - [%s]: %s", 
+    printf("%s:%s:%-3u - [%s]: %s",
 	    file_name, func_name, line_number, ndpi_get_proto_name(ndpi_str, proto), str);
   } else {
     printf("Proto: %u, %s", proto, str);
@@ -1998,7 +1998,7 @@ void set_ndpi_debug_function(struct ndpi_detection_module_struct *ndpi_str, ndpi
 struct ndpi_detection_module_struct *ndpi_init_detection_module(void) {
   struct ndpi_detection_module_struct *ndpi_str = ndpi_malloc(sizeof(struct ndpi_detection_module_struct));
   int i;
-  
+
   if(ndpi_str == NULL) {
 #ifdef NDPI_ENABLE_DEBUG_MESSAGES
     NDPI_LOG_ERR(ndpi_str, "ndpi_init_detection_module initial malloc failed for ndpi_str\n");
@@ -2955,6 +2955,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* LISP */
   init_lisp_dissector(ndpi_struct, &a, detection_bitmask);
 
+  /* AJP */
+  init_ajp_dissector(ndpi_struct, &a, detection_bitmask);
+
   /* ----------------------------------------------------------------- */
 
   ndpi_struct->callback_buffer_size = a;
@@ -3607,7 +3610,7 @@ void ndpi_check_flow_func(struct ndpi_detection_module_struct *ndpi_struct,
 static u_int16_t ndpi_guess_host_protocol_id(struct ndpi_detection_module_struct *ndpi_struct,
 					     struct ndpi_flow_struct *flow) {
   u_int16_t ret = NDPI_PROTOCOL_UNKNOWN;
-  
+
   if(flow->packet.iph) {
     /* guess host protocol */
     ret = ndpi_network_ptree_match(ndpi_struct, (struct in_addr *)&flow->packet.iph->saddr);
@@ -3615,7 +3618,7 @@ static u_int16_t ndpi_guess_host_protocol_id(struct ndpi_detection_module_struct
     if(ret == NDPI_PROTOCOL_UNKNOWN)
       ret = ndpi_network_ptree_match(ndpi_struct, (struct in_addr *)&flow->packet.iph->daddr);
   }
-    
+
   return(ret);
 }
 
@@ -3638,7 +3641,7 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st
 	 && (flow->packet.l4_protocol == IPPROTO_TCP)
 	 && (flow->l4.tcp.ssl_stage > 1))
 	flow->guessed_protocol_id = NDPI_PROTOCOL_SSL_NO_CERT;
-       
+
       guessed_protocol_id = flow->guessed_protocol_id,
 	guessed_host_protocol_id = flow->guessed_host_protocol_id;
 
@@ -3817,20 +3820,20 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
     /* guess protocol */
     flow->guessed_protocol_id = (int16_t) ndpi_guess_protocol_id(ndpi_struct, protocol, sport, dport, &user_defined_proto);
     flow->guessed_host_protocol_id = ndpi_guess_host_protocol_id(ndpi_struct, flow);
-    
+
     if(flow->guessed_protocol_id >= (NDPI_MAX_SUPPORTED_PROTOCOLS-1)) {
       /* This is a custom protocol and it has priority over everything else */
       ret.master_protocol = NDPI_PROTOCOL_UNKNOWN, ret.app_protocol = flow->guessed_host_protocol_id;
       return(ret);
     }
 
-    if(user_defined_proto && flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) {      
+    if(user_defined_proto && flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) {
       if(flow->packet.iph) {
 	if(flow->guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN) {
 	  /* ret.master_protocol = flow->guessed_protocol_id , ret.app_protocol = flow->guessed_host_protocol_id; /\* ****** *\/ */
 	  ret = ndpi_detection_giveup(ndpi_struct, flow);
 	}
-	
+
 	return(ret);
       }
     } else {
@@ -3849,7 +3852,7 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
     ndpi_check_flow_func(ndpi_struct, flow, &ndpi_selection_packet);
     return(ret);
   }
-  
+
   ndpi_check_flow_func(ndpi_struct, flow, &ndpi_selection_packet);
 
   a = flow->packet.detected_protocol_stack[0];
@@ -4780,7 +4783,7 @@ int ndpi_is_custom_category(ndpi_protocol_category_t category) {
   case NDPI_PROTOCOL_CATEGORY_CUSTOM_5:
     return(1);
     break;
-    
+
   default:
     return(0);
     break;
@@ -4798,23 +4801,23 @@ void ndpi_category_set_name(struct ndpi_detection_module_struct *ndpi_mod,
   case NDPI_PROTOCOL_CATEGORY_CUSTOM_1:
     snprintf(ndpi_mod->custom_category_labels[0], CUSTOM_CATEGORY_LABEL_LEN, "%s", name);
     break;
-    
+
   case NDPI_PROTOCOL_CATEGORY_CUSTOM_2:
     snprintf(ndpi_mod->custom_category_labels[1], CUSTOM_CATEGORY_LABEL_LEN, "%s", name);
     break;
-    
+
   case NDPI_PROTOCOL_CATEGORY_CUSTOM_3:
     snprintf(ndpi_mod->custom_category_labels[2], CUSTOM_CATEGORY_LABEL_LEN, "%s", name);
     break;
-    
+
   case NDPI_PROTOCOL_CATEGORY_CUSTOM_4:
     snprintf(ndpi_mod->custom_category_labels[3], CUSTOM_CATEGORY_LABEL_LEN, "%s", name);
     break;
-    
+
   case NDPI_PROTOCOL_CATEGORY_CUSTOM_5:
     snprintf(ndpi_mod->custom_category_labels[4], CUSTOM_CATEGORY_LABEL_LEN, "%s", name);
     break;
-    
+
   default:
     break;
   }
@@ -5119,7 +5122,7 @@ static int ndpi_automa_match_string_subprotocol(struct ndpi_detection_module_str
 						u_int8_t is_host_match) {
   int rv = NDPI_PROTOCOL_UNKNOWN;
   struct hs *hs = (struct hs*)ndpi_struct->hyperscan;
-  
+
   if(hs_scan(hs->database, string_to_match,
 	     string_to_match_len, 0, hs->scratch,
 	     hyperscanEventHandler, &rv) != HS_SUCCESS)
diff --git a/src/lib/protocols/ajp.c b/src/lib/protocols/ajp.c
new file mode 100644
index 000000000..ed7bb83f7
--- /dev/null
+++ b/src/lib/protocols/ajp.c
@@ -0,0 +1,153 @@
+/*
+ * ajp.c
+ *
+ * Copyright (C) 2018 by Leonn Paiva <leonn.paiva@gmail.com>
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#ifdef NDPI_PROTOCOL_AJP
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_AJP
+
+#include "ndpi_api.h"
+
+enum ajp_direction {
+  AJP_SERVER_TO_CONTAINER = 0x1234,
+  AJP_CONTAINER_TO_SERVER = 0x4142
+};
+
+enum ajp_packet_type {
+  AJP_UNKNOWN = 0,
+
+   /* packet types */
+  AJP_FORWARD_REQUEST = 2,
+  AJP_SEND_BODY_CHUNK = 3,
+  AJP_SEND_HEADERS = 4,
+  AJP_END_RESPONSE = 5,
+  AJP_GET_BODY_CHUNK = 6,
+  AJP_SHUTDOWN = 7,
+  AJP_PING = 8,
+  AJP_CPONG = 9,
+  AJP_CPING = 10,
+  AJP_BODY = 11
+};
+
+struct ajp_header {
+  uint16_t magic;
+  uint16_t len;
+  uint8_t code;
+};
+
+static void set_ajp_detected(struct ndpi_detection_module_struct *ndpi_struct,
+           struct ndpi_flow_struct *flow) {
+
+  if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
+    ndpi_search_tcp_or_udp(ndpi_struct, flow);
+
+    /* If no custom protocol has been detected */
+    /* if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) */
+      ndpi_int_reset_protocol(flow);
+      ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id, NDPI_PROTOCOL_AJP);
+  }
+}
+
+
+/*************************************************************************************************/
+
+static void ndpi_check_ajp(struct ndpi_detection_module_struct *ndpi_struct,
+  struct ndpi_flow_struct *flow)
+{
+  struct ajp_header ajp_hdr;
+
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  if (packet->payload_packet_len < 5 /* ajp_header size*/) {
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    return;
+  }
+
+  ajp_hdr = *((struct ajp_header *) (packet->payload));
+  ajp_hdr.magic = ntohs(ajp_hdr.magic);
+  ajp_hdr.len = ntohs(ajp_hdr.len);
+
+  if (ajp_hdr.len > 0 && ajp_hdr.magic == AJP_SERVER_TO_CONTAINER) {
+    if (ajp_hdr.code == AJP_FORWARD_REQUEST || ajp_hdr.code == AJP_SHUTDOWN
+        || ajp_hdr.code == AJP_PING || ajp_hdr.code == AJP_CPING) {
+
+      set_ajp_detected(ndpi_struct, flow);
+
+    } else {
+      NDPI_LOG_DBG(ndpi_struct, "Invalid AJP request type");
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    }
+  } else if (ajp_hdr.len > 0 && ajp_hdr.magic == AJP_CONTAINER_TO_SERVER) {
+    if (ajp_hdr.code == AJP_SEND_BODY_CHUNK || ajp_hdr.code == AJP_SEND_HEADERS
+        || ajp_hdr.code == AJP_END_RESPONSE || ajp_hdr.code == AJP_GET_BODY_CHUNK
+        || ajp_hdr.code == AJP_CPONG) {
+
+      set_ajp_detected(ndpi_struct, flow);
+
+    } else {
+      NDPI_LOG_DBG(ndpi_struct, "Invalid AJP response type");
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    }
+  } else {
+    NDPI_LOG_DBG(ndpi_struct,"Invalid AJP packet\n");
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+  }
+}
+
+void ndpi_search_ajp(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  // Break after 20 packets.
+  if(flow->packet_counter > 20) {
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    return;
+  }
+
+  if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
+    return;
+  }
+
+  NDPI_LOG_DBG(ndpi_struct, "search AJP\n");
+  ndpi_check_ajp(ndpi_struct, flow);
+
+  return;
+}
+
+/* ********************************* */
+
+
+void init_ajp_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+  u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("AJP", ndpi_struct, detection_bitmask,
+    *id, NDPI_PROTOCOL_AJP, ndpi_search_ajp,
+    NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD,
+    SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+    ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
+}
+
+#endif
diff --git a/tests/pcap/ajp.pcap b/tests/pcap/ajp.pcap
new file mode 100644
index 000000000..97228402c
--- /dev/null
+++ b/tests/pcap/ajp.pcap
diff --git a/tests/result/ajp.pcap.out b/tests/result/ajp.pcap.out
new file mode 100644
index 000000000..76fff67df
--- /dev/null
+++ b/tests/result/ajp.pcap.out
@@ -0,0 +1,10 @@
+Unknown	6	2200	2
+AJP	26	4446	2
+
+	1	TCP 172.29.9.146:38856 <-> 172.29.9.147:8009 [VLAN: 7][proto: 139/AJP][7 pkts/1554 bytes <-> 6 pkts/669 bytes]
+	2	TCP 172.29.9.146:38856 <-> 172.29.9.147:8010 [VLAN: 7][proto: 139/AJP][7 pkts/1554 bytes <-> 6 pkts/669 bytes]
+
+
+Undetected flows:
+	1	80 93.88.129.0:0 -> 0.7.8.0:0 [proto: 0/Unknown][4 pkts/2012 bytes -> 0 pkts/0 bytes]
+	2	80 142.243.129.0:0 -> 0.7.8.0:0 [proto: 0/Unknown][2 pkts/188 bytes -> 0 pkts/0 bytes]