Refactoring the debugging output.

levels of debug output:
 0 - ERROR: Only for errors.
 1 - TRACE: Start of each packets and if found protocol.
 2 - DEBUG: Start of searching each protocol and excluding protocols.
 3 - DEBUG_EXTRA: For all other messages.

Added field ndpi_struct->debug_logging for enable debug output of each protocols.

Simple macros for debugging output are added:
NDPI_LOG_ERR(), NDPI_LOG_INFO(), NDPI_LOG_DBG(), NDPI_LOG_DBG2(),
NDPI_EXCLUDE_PROTO()

1 files changed, 65 insertions, 91 deletions

diff --git a/src/lib/protocols/irc.c b/src/lib/protocols/irc.c
index b2b73ac5f..2cadf0a32 100644
--- a/src/lib/protocols/irc.c
+++ b/src/lib/protocols/irc.c
@@ -23,9 +23,14 @@
  */
 
 
-#include "ndpi_protocols.h"
+#include "ndpi_protocol_ids.h"
 
 #ifdef NDPI_PROTOCOL_IRC
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_IRC
+
+#include "ndpi_api.h"
+
 #define NDPI_IRC_FIND_LESS(time_err,less) {int t1 = 0;	\
     u_int32_t timestamp = time_err[0];			\
     for(t1=0;t1 < NDPI_PROTOCOL_IRC_MAXPORT;t1++) {	\
@@ -65,7 +70,7 @@ static u_int8_t ndpi_check_for_NOTICE_or_PRIVMSG(struct ndpi_detection_module_st
   for (i = 0; i < packet->payload_packet_len - 7; i++) {
     if (packet->payload[i] == 'N' || packet->payload[i] == 'P') {
       if (memcmp(&packet->payload[i + 1], "OTICE ", 6) == 0 || memcmp(&packet->payload[i + 1], "RIVMSG ", 7) == 0) {
-	NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found NOTICE or PRIVMSG\n");
+	NDPI_LOG_DBG2(ndpi_struct, "found NOTICE or PRIVMSG\n");
 	return 1;
       }
     }
@@ -94,7 +99,7 @@ static u_int8_t ndpi_check_for_Nickname(struct ndpi_detection_module_struct *ndp
       if ((((packetl - (i + 1)) >= 4) && memcmp(&packet->payload[i + 1], "ick=", 4) == 0)
 	  || (((packetl - (i + 1)) >= 8) && (memcmp(&packet->payload[i + 1], "ickname=", 8) == 0))
 	  || (((packetl - (i + 1)) >= 8) && (memcmp(&packet->payload[i + 1], "ickName=", 8) == 0))) {
-	NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found HTTP IRC Nickname pattern\n");
+	NDPI_LOG_DBG2(ndpi_struct, "found HTTP IRC Nickname pattern\n");
 	return 1;
       }
     }
@@ -114,7 +119,7 @@ static u_int8_t ndpi_check_for_cmd(struct ndpi_detection_module_struct *ndpi_str
   for (i = 0; i < packet->payload_packet_len - 4; i++) {
     if (packet->payload[i] == 'c') {
       if (memcmp(&packet->payload[i + 1], "md=", 3) == 0) {
-	NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found HTTP IRC cmd pattern  \n");
+	NDPI_LOG_DBG2(ndpi_struct, "found HTTP IRC cmd pattern  \n");
 	return 1;
       }
     }
@@ -147,8 +152,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
   struct ndpi_packet_struct *packet = &flow->packet;
 	
 
-  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG,
-	   "called ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast\n");
+  NDPI_LOG_DBG(ndpi_struct, "start fast detect\n");
 
   /* case 1: len 1460, len 1460, len 1176 several times in one direction, than len = 4, 4096, 8192 in the other direction */
   if (packet->payload_packet_len == 1460
@@ -174,7 +178,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 0x1000
 									|| ntohs(get_u_int16_t(packet->payload, 2)) ==
 									0x2000)) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1460,1460,1176,<-4096||8192");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1460,1460,1176,<-4096||8192");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -185,27 +189,27 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
 										1 + packet->packet_direction))) {
     flow->l4.tcp.irc_stage2 = 4;
     flow->l4.tcp.irc_direction = 1 + packet->packet_direction;
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "len = 1448 first\n");
+    NDPI_LOG_DBG2(ndpi_struct, "len = 1448 first\n");
     return 1;
   }
   if (packet->payload_packet_len == 1448 && flow->l4.tcp.irc_stage2 == 4
       && flow->l4.tcp.irc_direction == 1 + packet->packet_direction) {
     flow->l4.tcp.irc_stage2 = 5;
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "len = 1448 second \n");
+    NDPI_LOG_DBG2(ndpi_struct, "len = 1448 second \n");
     return 1;
   }
   if (packet->payload_packet_len == 1200 && flow->l4.tcp.irc_stage2 == 5
       && flow->l4.tcp.irc_direction == 1 + packet->packet_direction) {
     flow->l4.tcp.irc_stage2 = 6;
     flow->l4.tcp.irc_0x1000_full = 1;
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "len = 1200  \n");
+    NDPI_LOG_DBG2(ndpi_struct, "len = 1200  \n");
     return 1;
   }
   if (packet->payload_packet_len == 4 && (flow->l4.tcp.irc_stage2 == 6 || flow->l4.tcp.irc_0x1000_full == 1)
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 0x1000
 									|| ntohs(get_u_int16_t(packet->payload, 2)) ==
 									0x2000)) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1448,1448,1200,<-4096||8192");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1448,1448,1200,<-4096||8192");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -222,7 +226,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1380
 									|| ntohs(get_u_int16_t(packet->payload, 2)) ==
 									2760)) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1380,<-1380||2760");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1380,<-1380||2760");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -237,7 +241,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1200
 									|| ntohs(get_u_int16_t(packet->payload, 2)) ==
 									2400)) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1200,<-1200||2400");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1200,<-1200||2400");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -252,7 +256,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1024
 									|| ntohs(get_u_int16_t(packet->payload, 2)) ==
 									2048)) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1024,<-1024||2048");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1024,<-1024||2048");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -267,7 +271,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1248
 									|| ntohs(get_u_int16_t(packet->payload, 2)) ==
 									2496)) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1248,<-1248||2496");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1248,<-1248||2496");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -282,7 +286,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1448
 									|| ntohs(get_u_int16_t(packet->payload, 2)) ==
 									2896)) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1448,<-1448||2896");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1448,<-1448||2896");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -305,8 +309,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
   if (packet->payload_packet_len == 4
       && flow->l4.tcp.irc_stage2 == 14
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && ntohs(get_u_int16_t(packet->payload, 2)) == 8192) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-	     "IRC SSL detected: ->1448,1448,1448,1448,1448,952,<-8192");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1448,1448,1448,1448,1448,952,<-8192");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -339,8 +342,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
   if (packet->payload_packet_len == 4
       && flow->l4.tcp.irc_stage2 == 19
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && ntohs(get_u_int16_t(packet->payload, 2)) == 7168) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-	     "IRC SSL detected: ->1024,1448,1448,1200,1448,600,<-7168");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1024,1448,1448,1200,1448,600,<-7168");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
   }
@@ -353,7 +355,7 @@ u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_det
   if (packet->payload_packet_len == 4
       && flow->l4.tcp.irc_stage2 == 20
       && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && ntohs(get_u_int16_t(packet->payload, 2)) == 2404) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1024,1380 <-2404");
+    NDPI_LOG_INFO(ndpi_struct, "found IRC SSL: ->1024,1380 <-2404");
     ndpi_int_irc_add_connection(ndpi_struct, flow);
     return 1;
 
@@ -382,26 +384,26 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
   u_int16_t http_content_ptr_len = 0;
   u_int8_t space = 0;
 
-  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "irc : search irc\n");
+  NDPI_LOG_DBG(ndpi_struct, "search irc\n");
   if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter > 70) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "exclude irc, packet_counter > 70\n");
+    NDPI_LOG_DBG(ndpi_struct, "exclude irc, packet_counter > 70\n");
     NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IRC);
     return;
   }
   if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter > 30 &&
       flow->l4.tcp.irc_stage2 == 0) {
-    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "packet_counter > 30, exclude irc.\n");
+    NDPI_LOG_DBG(ndpi_struct, "exclude irc, packet_counter > 30\n");
     NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IRC);
     return;
   }
   if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_IRC) {
     if (src != NULL && ((u_int32_t)
 			(packet->tick_timestamp - src->irc_ts) < ndpi_struct->irc_timeout)) {
-      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "irc : save src connection packet detected\n");
+      NDPI_LOG_DBG2(ndpi_struct, "irc : save src connection packet detected\n");
       src->irc_ts = packet->tick_timestamp;
     } else if (dst != NULL && ((u_int32_t)
 			       (packet->tick_timestamp - dst->irc_ts) < ndpi_struct->irc_timeout)) {
-      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "irc : save dst connection packet detected\n");
+      NDPI_LOG_DBG2(ndpi_struct, "irc : save dst connection packet detected\n");
       dst->irc_ts = packet->tick_timestamp;
     }
   }
@@ -423,8 +425,7 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
       for (counter = 0; counter < dst->irc_number_of_port; counter++) {
 	if (dst->irc_port[counter] == sport || dst->irc_port[counter] == dport) {
 	  dst->last_time_port_used[counter] = packet->tick_timestamp;
-	  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-		   "dest port matched with the DCC port and the flow is marked as IRC");
+	  NDPI_LOG_INFO(ndpi_struct, "found IRC: dest port matched with the DCC port");
 	  ndpi_int_irc_add_connection(ndpi_struct, flow);
 	  return;
 	}
@@ -434,9 +435,8 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
       for (counter = 0; counter < src->irc_number_of_port; counter++) {
 	if (src->irc_port[counter] == sport || src->irc_port[counter] == dport) {
 	  src->last_time_port_used[counter] = packet->tick_timestamp;
+	  NDPI_LOG_INFO(ndpi_struct, "found  IRC: Source port matched with the DCC port");
 	  ndpi_int_irc_add_connection(ndpi_struct, flow);
-	  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-		   "Source port matched with the DCC port and the flow is marked as IRC");
 	  return;
 	}
       }
@@ -465,8 +465,8 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	    || (memcmp(&packet->payload[c1], "irc.discostars.de1", 18)
 		== 0)
 	    || (memcmp(&packet->payload[c1], "irc.rizon.net", 13) == 0)) {
-	  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-		   "IRC SSL detected with :- irc.hackthissite.org0 | irc.gamepad.ca1 | dungeon.axenet.org0 "
+	  NDPI_LOG_INFO(ndpi_struct,
+		   "found IRC SSL: - irc.hackthissite.org0 | irc.gamepad.ca1 | dungeon.axenet.org0 "
 		   "| dazed.nuggethaus.net | irc.indymedia.org | irc.discostars.de1 ");
 	  ndpi_int_irc_add_connection(ndpi_struct, flow);
 	  break;
@@ -496,14 +496,14 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	  if (packet->line[i].ptr[0] == ':') {
 	    flow->l4.tcp.irc_3a_counter++;
 	    if (flow->l4.tcp.irc_3a_counter == 7) {	/* ':' == 0x3a */
-	      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "0x3a. seven times. found irc.");
+	      NDPI_LOG_INFO(ndpi_struct, "found irc. 0x3a. seven times.");
 	      ndpi_int_irc_add_connection(ndpi_struct, flow);
 	      goto detected_irc;
 	    }
 	  }
 	}
 	if (flow->l4.tcp.irc_3a_counter == 7) {	/* ':' == 0x3a */
-	  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "0x3a. seven times. found irc.");
+	  NDPI_LOG_INFO(ndpi_struct, "found irc. 0x3a. seven times.");
 	  ndpi_int_irc_add_connection(ndpi_struct, flow);
 	  goto detected_irc;
 	}
@@ -518,19 +518,19 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	  || (memcmp(packet->payload, "NOTICE ", 7) == 0)
 	  || (memcmp(packet->payload, "PRIVMSG ", 8) == 0)
 	  || (memcmp(packet->payload, "VERSION ", 8) == 0)) {
-	NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
+	NDPI_LOG_DBG2(ndpi_struct,
 		 "USER, NICK, PASS, NOTICE, PRIVMSG one time");
 	if (flow->l4.tcp.irc_stage == 2) {
-	  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "found irc");
+	  NDPI_LOG_INFO(ndpi_struct, "found irc");
 	  ndpi_int_irc_add_connection(ndpi_struct, flow);
 	  flow->l4.tcp.irc_stage = 3;
 	}
 	if (flow->l4.tcp.irc_stage == 1) {
-	  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "second time, stage=2");
+	  NDPI_LOG_DBG2(ndpi_struct, "second time, stage=2");
 	  flow->l4.tcp.irc_stage = 2;
 	}
 	if (flow->l4.tcp.irc_stage == 0) {
-	  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "first time, stage=1");
+	  NDPI_LOG_DBG2(ndpi_struct, "first time, stage=1");
 	  flow->l4.tcp.irc_stage = 1;
 	}
 	/* irc packets can have either windows line breaks (0d0a) or unix line breaks (0a) */
@@ -538,13 +538,11 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	    && packet->payload[packet->payload_packet_len - 1] == 0x0a) {
 	  ndpi_parse_packet_line_info(ndpi_struct, flow);
 	  if (packet->parsed_lines > 1) {
-	    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-		     "packet contains more than one line");
+	    NDPI_LOG_DBG2(ndpi_struct, "packet contains more than one line");
 	    for (c = 1; c < packet->parsed_lines; c++) {
 	      if (packet->line[c].len > 4 && (memcmp(packet->line[c].ptr, "NICK ", 5) == 0
 					      || memcmp(packet->line[c].ptr, "USER ", 5) == 0)) {
-		NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct,
-			 NDPI_LOG_TRACE, "two icq signal words in the same packet");
+		NDPI_LOG_INFO(ndpi_struct, "found IRC: two icq signal words in the same packet");
 		ndpi_int_irc_add_connection(ndpi_struct, flow);
 		flow->l4.tcp.irc_stage = 3;
 		return;
@@ -555,14 +553,12 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	} else if (packet->payload[packet->payload_packet_len - 1] == 0x0a) {
 	  ndpi_parse_packet_line_info_any(ndpi_struct, flow);
 	  if (packet->parsed_lines > 1) {
-	    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-		     "packet contains more than one line");
+	    NDPI_LOG_DBG2(ndpi_struct, "packet contains more than one line");
 	    for (c = 1; c < packet->parsed_lines; c++) {
 	      if (packet->line[c].len > 4 && (memcmp(packet->line[c].ptr, "NICK ", 5) == 0
 						   || memcmp(packet->line[c].ptr, "USER ",
 							     5) == 0)) {
-		NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-			 "two icq signal words in the same packet");
+		NDPI_LOG_INFO(ndpi_struct, "found IRC: two icq signal words in the same packet");
 		ndpi_int_irc_add_connection(ndpi_struct, flow);
 		flow->l4.tcp.irc_stage = 3;
 		return;
@@ -594,7 +590,7 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 		&& (ndpi_check_for_IRC_traces(packet->http_url_name.ptr, packet->http_url_name.len)))
 	    || ((packet->referer_line.ptr)
 		&& (ndpi_check_for_IRC_traces(packet->referer_line.ptr, packet->referer_line.len)))) {
-	  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
+	  NDPI_LOG_DBG2(ndpi_struct,
 		   "IRC detected from the Http URL/ Referer header ");
 	  flow->l4.tcp.irc_stage = 1;
 	  // HTTP POST Request body is not in the same packet.
@@ -613,22 +609,21 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	|| (((packet->payload_packet_len - http_content_ptr_len) > 5)
 	    && (memcmp(packet->payload + http_content_ptr_len, "item=", 5) == 0)
 	    && (ndpi_check_for_cmd(ndpi_struct, flow) != 0))) {
-      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC Nickname, cmd,  one time");
+      NDPI_LOG_INFO(ndpi_struct, "found IRC: Nickname, cmd,  one time");
       ndpi_int_irc_add_connection(ndpi_struct, flow);
       return;
     }
   }
 
  detected_irc:
-  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "detected_irc:");
+  NDPI_LOG_DBG2(ndpi_struct, "detected_irc:");
 
   if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_IRC) {
     /* maybe this can be deleted at the end */
 
     if (packet->payload[packet->payload_packet_len - 2] != 0x0d
 	&& packet->payload[packet->payload_packet_len - 1] == 0x0a) {
-      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG,
-	       "ndpi_parse_packet_line_info_any(ndpi_struct, flow);");
+      NDPI_LOG_DBG2(ndpi_struct, "ndpi_parse_packet_line_info_any(ndpi_struct, flow);");
       ndpi_parse_packet_line_info_any(ndpi_struct, flow);
     } else if (packet->payload[packet->payload_packet_len - 2] == 0x0d) {
       ndpi_parse_packet_line_info(ndpi_struct, flow);
@@ -637,27 +632,27 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
     }
     for (i = 0; i < packet->parsed_lines; i++) {
       if (packet->line[i].len > 6 && memcmp(packet->line[i].ptr, "NOTICE ", 7) == 0) {
-	NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "NOTICE");
+	NDPI_LOG_DBG2(ndpi_struct, "NOTICE");
 	for (j = 7; j < packet->line[i].len - 8; j++) {
 	  if (packet->line[i].ptr[j] == ':') {
 	    if (memcmp(&packet->line[i].ptr[j + 1], "DCC SEND ", 9) == 0
 		|| memcmp(&packet->line[i].ptr[j + 1], "DCC CHAT ", 9) == 0) {
-	      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
+	      NDPI_LOG_INFO(ndpi_struct,
 		       "found NOTICE and DCC CHAT or DCC SEND.");
 	    }
 	  }
 	}
       }
       if (packet->payload_packet_len > 0 && packet->payload[0] == 0x3a /* 0x3a = ':' */ ) {
-	NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "3a");
+	NDPI_LOG_DBG2(ndpi_struct, "3a");
 	for (j = 1; j < packet->line[i].len - 9; j++) {
 	  if (packet->line[i].ptr[j] == ' ') {
 	    j++;
 	    if (packet->line[i].ptr[j] == 'P') {
-	      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "P");
+	      NDPI_LOG_DBG2(ndpi_struct, "P");
 	      j++;
 	      if (memcmp(&packet->line[i].ptr[j], "RIVMSG ", 7) == 0)
-		NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "RIVMSG");
+		NDPI_LOG_DBG2(ndpi_struct, "RIVMSG");
 	      h = j + 7;
 	      goto read_privmsg;
 	    }
@@ -665,25 +660,24 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 	}
       }
       if (packet->line[i].len > 7 && (memcmp(packet->line[i].ptr, "PRIVMSG ", 8) == 0)) {
-	NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "PRIVMSG	");
+	NDPI_LOG_DBG2(ndpi_struct, "PRIVMSG	");
 	h = 7;
       read_privmsg:
 	for (j = h; j < packet->line[i].len - 9; j++) {
 	  if (packet->line[i].ptr[j] == ':') {
 	    if (memcmp(&packet->line[i].ptr[j + 1], "xdcc ", 5) == 0) {
-	      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "xdcc should match.");
+	      NDPI_LOG_DBG2(ndpi_struct, "xdcc should match.");
 	    }
 	    j += 2;
 	    if (memcmp(&packet->line[i].ptr[j], "DCC ", 4) == 0) {
 	      j += 4;
-	      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "found DCC.");
+	      NDPI_LOG_DBG2(ndpi_struct, "found DCC.");
 	      if (memcmp(&packet->line[i].ptr[j], "SEND ", 5) == 0
 		  || (memcmp(&packet->line[i].ptr[j], "CHAT", 4) == 0)
 		  || (memcmp(&packet->line[i].ptr[j], "chat", 4) == 0)
 		  || (memcmp(&packet->line[i].ptr[j], "sslchat", 7) == 0)
 		  || (memcmp(&packet->line[i].ptr[j], "TSEND", 5) == 0)) {
-		NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-			 "found CHAT,chat,sslchat,TSEND.");
+		NDPI_LOG_DBG2(ndpi_struct, "found CHAT,chat,sslchat,TSEND.");
 		j += 4;
 
 		while (packet->line[i].len > j &&
@@ -696,35 +690,29 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 
 		  if (packet->line[i].ptr[j] == ' ') {
 		    space++;
-		    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "space %u.", space);
+		    NDPI_LOG_DBG2(ndpi_struct, "space %u.", space);
 		  }
 		  if (space == 3) {
 		    j++;
-		    NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "read port.");
+		    NDPI_LOG_DBG2(ndpi_struct, "read port.");
 		    if (src != NULL) {
 		      k = j;
 		      port =
 			ntohs_ndpi_bytestream_to_number
 			(&packet->line[i].ptr[j], packet->payload_packet_len - j, &j);
-		      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "port %u.",
+		      NDPI_LOG_DBG2(ndpi_struct, "port %u.",
 			       port);
 		      j = k;
 		      // hier jetzt überlegen, wie die ports abgespeichert werden sollen
 		      if (src->irc_number_of_port < NDPI_PROTOCOL_IRC_MAXPORT)
-			NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE,
-				 "src->irc_number_of_port < NDPI_PROTOCOL_IRC_MAXPORT.");
+			NDPI_LOG_DBG2(ndpi_struct, "src->irc_number_of_port < NDPI_PROTOCOL_IRC_MAXPORT.");
 		      if (src->irc_number_of_port < NDPI_PROTOCOL_IRC_MAXPORT && port != 0) {
 			if (!ndpi_is_duplicate(src, port)) {
 			  src->irc_port[src->irc_number_of_port]
 			    = port;
 			  src->irc_number_of_port++;
-			  NDPI_LOG
-			    (NDPI_PROTOCOL_IRC,
-			     ndpi_struct,
-			     NDPI_LOG_DEBUG, "found port=%d",
+			  NDPI_LOG_DBG2(ndpi_struct, "found port=%d jjeeeeeeeeeeeeeeeeeeeeeeeee",
 			     ntohs(get_u_int16_t(src->irc_port, 0)));
-			  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG,
-				   "jjeeeeeeeeeeeeeeeeeeeeeeeee");
 			}
 			src->irc_ts = packet->tick_timestamp;
 		      } else if (port != 0 && src->irc_number_of_port == NDPI_PROTOCOL_IRC_MAXPORT) {
@@ -732,11 +720,7 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 			  less = 0;
 			  NDPI_IRC_FIND_LESS(src->last_time_port_used, less);
 			  src->irc_port[less] = port;
-			  NDPI_LOG
-			    (NDPI_PROTOCOL_IRC,
-			     ndpi_struct,
-			     NDPI_LOG_DEBUG, "found port=%d",
-			     ntohs(get_u_int16_t(src->irc_port, 0)));
+			  NDPI_LOG_DBG2(ndpi_struct, "found port=%d", ntohs(get_u_int16_t(src->irc_port, 0)));
 			}
 			src->irc_ts = packet->tick_timestamp;
 		      }
@@ -747,8 +731,7 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 		    if (dst != NULL) {
 		      port = ntohs_ndpi_bytestream_to_number
 			(&packet->line[i].ptr[j], packet->payload_packet_len - j, &j);
-		      NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "port %u.",
-			       port);
+		      NDPI_LOG_DBG2(ndpi_struct, "port %u.", port);
 		      // hier das gleiche wie oben.
 		      /* hier werden NDPI_PROTOCOL_IRC_MAXPORT ports pro irc flows mitgespeichert. könnte man denn nicht ein-
 		       * fach an die dst oder src einen flag setzten, dass dieser port für eine bestimmte
@@ -759,13 +742,8 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 			  dst->irc_port[dst->irc_number_of_port]
 			    = port;
 			  dst->irc_number_of_port++;
-			  NDPI_LOG
-			    (NDPI_PROTOCOL_IRC,
-			     ndpi_struct,
-			     NDPI_LOG_DEBUG, "found port=%d",
-			     ntohs(get_u_int16_t(dst->irc_port, 0)));
-			  NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG,
-				   "juuuuuuuuuuuuuuuu");
+			  NDPI_LOG_DBG2(ndpi_struct, "found port=%d", ntohs(get_u_int16_t(dst->irc_port, 0)));
+			  NDPI_LOG_DBG2(ndpi_struct, "juuuuuuuuuuuuuuuu");
 			}
 			dst->irc_ts = packet->tick_timestamp;
 		      } else if (port != 0 && dst->irc_number_of_port == NDPI_PROTOCOL_IRC_MAXPORT) {
@@ -774,11 +752,7 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
 			  NDPI_IRC_FIND_LESS(dst->last_time_port_used, less);
 			  dst->irc_port[less] = port;
 
-			  NDPI_LOG
-			    (NDPI_PROTOCOL_IRC,
-			     ndpi_struct,
-			     NDPI_LOG_DEBUG, "found port=%d",
-			     ntohs(get_u_int16_t(dst->irc_port, 0)));
+			  NDPI_LOG_DBG2(ndpi_struct, "found port=%d", ntohs(get_u_int16_t(dst->irc_port, 0)));
 			}
 			dst->irc_ts = packet->tick_timestamp;
 		      }