Improved detection of Ookla speedtest and openspeedtest.com

1 files changed, 10 insertions, 4 deletions

diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index c941fe145..8efaf1af4 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -348,10 +348,16 @@ static void ndpi_http_parse_subprotocol(struct ndpi_detection_module_struct *ndp
     char *double_col = strchr((char*)flow->host_server_name, ':');
 
     if(double_col) double_col[0] = '\0';
-
-    ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HTTP,
-				 (char *)flow->host_server_name,
-				 strlen((const char *)flow->host_server_name));
+    
+    if(ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HTTP,
+				    (char *)flow->host_server_name,
+				    strlen((const char *)flow->host_server_name)) == 0) {
+      if((strstr(flow->http.url, ":8080/downloading?n=0.") == 0)
+	 || (strstr(flow->http.url, ":8080/upload?n=0.") == 0)) {
+	/* This looks like Ookla speedtest */
+	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_HTTP);
+      }
+    }
   }
 }