+ NDPI_PROTOCOL_SYNCTHING = 313,

+void init_syncthing_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);

+ { "discovery.syncthing.net", "Syncthing", NDPI_PROTOCOL_SYNCTHING, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },

+

+ ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SYNCTHING,

+ "Syncthing", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT,

+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,

+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);

+ /* Syncthing */

+ init_syncthing_dissector(ndpi_str, &a, detection_bitmask);

+

+/*

+ * syncthing.c

+ *

+ * Copyright (C) 2022 - ntop.org

+ *

+ * nDPI is free software: you can redistribute it and/or modify

+ * it under the terms of the GNU Lesser General Public License as published by

+ * the Free Software Foundation, either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * nDPI is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

+ * GNU Lesser General Public License for more details.

+ *

+ * You should have received a copy of the GNU Lesser General Public License

+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.

+ *

+ */

+

+

+#include "ndpi_protocol_ids.h"

+

+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SYNCTHING

+

+#include "ndpi_api.h"

+

+static void ndpi_int_syncthing_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,

+ struct ndpi_flow_struct * const flow)

+{

+ NDPI_LOG_INFO(ndpi_struct, "found syncthing\n");

+ ndpi_set_detected_protocol(ndpi_struct, flow,

+ NDPI_PROTOCOL_SYNCTHING,

+ NDPI_PROTOCOL_UNKNOWN,

+ NDPI_CONFIDENCE_DPI);

+}

+

+void ndpi_search_syncthing(struct ndpi_detection_module_struct *ndpi_struct,

+ struct ndpi_flow_struct *flow)

+{

+ struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;

+

+ NDPI_LOG_DBG(ndpi_struct, "search syncthing\n");

+

+ if (packet->payload_packet_len <= 4)

+ {

+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);

+ return;

+ }

+

+ if (ntohl(get_u_int32_t(packet->payload, 0)) == 0x2EA7D90B /* Magic */)

+ {

+ ndpi_int_syncthing_add_connection(ndpi_struct, flow);

+ /* ToDo: Dissect Announce Message. Protocol buffer dissector required. */

+ return;

+ }

+

+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);

+ return;

+}

+

+void init_syncthing_dissector(struct ndpi_detection_module_struct *ndpi_struct,

+ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)

+{

+ ndpi_set_bitmask_protocol_detection("Syncthing", ndpi_struct, detection_bitmask, *id,

+ NDPI_PROTOCOL_SYNCTHING,

+ ndpi_search_syncthing,

+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,

+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,

+ ADD_TO_DETECTION_BITMASK

+ );

+

+ *id += 1;

+}

+Num dissector calls: 4744 (24.08 diss/flow)

+Num dissector calls: 173 (173.00 diss/flow)

+Num dissector calls: 119 (119.00 diss/flow)

+Num dissector calls: 4190 (135.16 diss/flow)

+Num dissector calls: 932 (13.51 diss/flow)

+Num dissector calls: 391 (48.88 diss/flow)

+Num dissector calls: 105 (105.00 diss/flow)

+Num dissector calls: 3961 (116.50 diss/flow)

+Num dissector calls: 21940 (89.55 diss/flow)

+Num dissector calls: 366 (122.00 diss/flow)

+Num dissector calls: 123 (123.00 diss/flow)

+Num dissector calls: 5477 (21.82 diss/flow)

+Num dissector calls: 1741 (22.61 diss/flow)

+Num dissector calls: 65865 (86.66 diss/flow)

+Num dissector calls: 387 (129.00 diss/flow)

+Num dissector calls: 140 (9.33 diss/flow)

+Num dissector calls: 281 (140.50 diss/flow)

+Num dissector calls: 1911 (50.29 diss/flow)

+Num dissector calls: 358 (7.02 diss/flow)

+Num dissector calls: 318 (39.75 diss/flow)

+Num dissector calls: 107 (35.67 diss/flow)

+Num dissector calls: 1287 (61.29 diss/flow)

+Num dissector calls: 397 (132.33 diss/flow)

+Num dissector calls: 6458 (60.36 diss/flow)

+Num dissector calls: 212 (21.20 diss/flow)

+Num dissector calls: 188 (94.00 diss/flow)

+Num dissector calls: 197 (197.00 diss/flow)

+Num dissector calls: 1428 (119.00 diss/flow)

+Num dissector calls: 607 (121.40 diss/flow)

+Num dissector calls: 106 (106.00 diss/flow)

+Num dissector calls: 209 (209.00 diss/flow)

+Num dissector calls: 122 (122.00 diss/flow)

+Num dissector calls: 371 (92.75 diss/flow)

+Num dissector calls: 1510 (29.04 diss/flow)

+Num dissector calls: 576 (144.00 diss/flow)

+Num dissector calls: 1894 (82.35 diss/flow)

+Guessed flow protos: 0

+

+DPI Packets (UDP): 4 (1.00 pkts/flow)

+Confidence DPI : 4 (flows)

+Num dissector calls: 412 (103.00 diss/flow)

+LRU cache ookla: 0/0/0 (insert/search/found)

+LRU cache bittorrent: 0/0/0 (insert/search/found)

+LRU cache zoom: 0/0/0 (insert/search/found)

+LRU cache stun: 0/0/0 (insert/search/found)

+LRU cache tls_cert: 0/0/0 (insert/search/found)

+LRU cache mining: 0/0/0 (insert/search/found)

+LRU cache msteams: 0/0/0 (insert/search/found)

+Automa host: 0/0 (search/found)

+Automa domain: 0/0 (search/found)

+Automa tls cert: 0/0 (search/found)

+Automa risk mask: 0/0 (search/found)

+Automa common alpns: 0/0 (search/found)

+Patricia risk mask: 0/0 (search/found)

+Patricia risk: 0/0 (search/found)

+Patricia protocols: 8/0 (search/found)

+

+Syncthing 34 15680 4

+

+ 1 UDP [fe80::6238:e0ff:fec5:35a0]:47077 -> [ff12::8384]:21027 [proto: 313/Syncthing][Encrypted][Confidence: DPI][cat: Download/7][15 pkts/7450 bytes -> 0 pkts/0 bytes][Goodput ratio: 88/0][419.99 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 29994/0 30000/0 30004/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 267/0 497/0 530/0 85/0][PLAIN TEXT (//192.168.2.100)][Plen Bins: 0,0,0,0,0,0,6,6,0,0,0,0,0,0,87,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

+ 2 UDP 192.168.2.100:54977 -> 192.168.2.255:21027 [proto: 313/Syncthing][Encrypted][Confidence: DPI][cat: Download/7][15 pkts/7150 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][0.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 29994/0 30000/0 30005/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 247/0 477/0 510/0 85/0][PLAIN TEXT (//192.168.2.100)][Plen Bins: 0,0,0,0,0,0,6,6,0,0,0,0,0,0,87,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

+ 3 UDP [fe80::6238:e0ff:fec5:35a0]:42370 -> [ff12::8384]:21027 [proto: 313/Syncthing][Encrypted][Confidence: DPI][cat: Download/7][2 pkts/560 bytes -> 0 pkts/0 bytes][Goodput ratio: 78/0][29.99 sec][PLAIN TEXT (//192.168.2.100)][Plen Bins: 0,0,0,0,0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

+ 4 UDP 192.168.2.100:33927 -> 192.168.2.255:21027 [proto: 313/Syncthing][Encrypted][Confidence: DPI][cat: Download/7][2 pkts/520 bytes -> 0 pkts/0 bytes][Goodput ratio: 84/0][0.01 sec][PLAIN TEXT (//192.168.2.100)][Plen Bins: 0,0,0,0,0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

+ 47 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 314/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

+ 109 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 314/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

+Num dissector calls: 606 (7.30 diss/flow)

+Num dissector calls: 148 (74.00 diss/flow)

+Num dissector calls: 1664 (34.67 diss/flow)

+Num dissector calls: 308 (44.00 diss/flow)

+Num dissector calls: 437 (20.81 diss/flow)

+Num dissector calls: 545 (18.79 diss/flow)

+Num dissector calls: 322 (5.65 diss/flow)

+Num dissector calls: 592 (13.45 diss/flow)

+Num dissector calls: 144 (144.00 diss/flow)

+Num dissector calls: 822 (24.91 diss/flow)

+Num dissector calls: 875 (175.00 diss/flow)