Remove PPStream protocol and add iQIYI (#2403)

P2P video player PPStream was discontinued shortly after the purchase of PPS.tv by Baidu (iQIYI) on 2013 (see https://www.techinasia.com/report-baidu-acquires-video-rival-pps)
So we remove the old `NDPI_PROTOCOL_PPSTREAM` logic and add `NDPI_PROTOCOL_IQIYI` id to handle all the iQIYI traffic, which is basically video streaming traffic.

A video hosting service, called PPS.tv, is still offered by the same company: for the time being we classified both services with the same protocol id.

6 files changed, 83 insertions, 236 deletions

diff --git a/src/include/ndpi_private.h b/src/include/ndpi_private.h
index 42b31d7fe..935f58377 100644
--- a/src/include/ndpi_private.h
+++ b/src/include/ndpi_private.h
@@ -738,7 +738,6 @@ void init_ntp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int3
 void init_openvpn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_oracle_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_postgres_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
-void init_ppstream_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_pptp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_qq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_quake_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
@@ -918,6 +917,7 @@ void init_teso_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
 void init_ldp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_knxnet_ip_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_bfcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
+void init_iqiyi_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 
 #endif
 
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 39a091ddd..68b4d9f8e 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -82,7 +82,7 @@ typedef enum {
   NDPI_PROTOCOL_MAIL_IMAPS            = 51,
   NDPI_PROTOCOL_ICECAST               = 52,
   NDPI_PROTOCOL_CPHA                  = 53,
-  NDPI_PROTOCOL_PPSTREAM              = 54,
+  NDPI_PROTOCOL_IQIYI                 = 54,
   NDPI_PROTOCOL_ZATTOO                = 55,
   NDPI_PROTOCOL_YANDEX_MARKET         = 56,
   NDPI_PROTOCOL_YANDEX_DISK           = 57,
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 369cc76a4..ba8927c38 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -990,7 +990,11 @@ static ndpi_protocol_match host_match[] =
 
    { "pastebin.com",                             "Pastebin",         NDPI_PROTOCOL_PASTEBIN, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_DEFAULT_LEVEL },
 
-   { "pps.tv",                                   "PPStream",         NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "pps.tv",                                "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "iqiyi.com",                             "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "iqiyipic.com",                          "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "qy.net",                                "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "iq.com",                                "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
 
    { "hulustream.com",                                  "Hulu",            NDPI_PROTOCOL_HULU, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
    { "hulu.com",                                        "Hulu",            NDPI_PROTOCOL_HULU, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
@@ -999,11 +1003,6 @@ static ndpi_protocol_match host_match[] =
    { "huluad.com",                                      "Hulu",            NDPI_PROTOCOL_HULU, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
    { "huluim.com",                                      "Hulu",            NDPI_PROTOCOL_HULU, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
 
-   /*
-     VidTO streaming service
-   */
-   { "vidto.me",                                 "VidTO",            NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
-   { "vidto.se",                                           "VidTO",            NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
 
    { "snapcraft.io",                        "UbuntuONE",        NDPI_PROTOCOL_UBUNTUONE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
    { "ubuntu.com",                            "UbuntuONE",        NDPI_PROTOCOL_UBUNTUONE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
@@ -1208,13 +1207,6 @@ static ndpi_protocol_match host_match[] =
    { "abuse.ch",                         "Cybersec", NDPI_PROTOCOL_CYBERSECURITY, NDPI_PROTOCOL_CATEGORY_CYBERSECURITY, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_DEFAULT_LEVEL },
    { "dnsbl.", /* www.dnsbl.info */      "Cybersec", NDPI_PROTOCOL_CYBERSECURITY, NDPI_PROTOCOL_CATEGORY_CYBERSECURITY, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_DEFAULT_LEVEL },
 
-   { "iqiyi.com",                        "PPStream", NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
-   { "iqiyipic.com",                     "PPStream", NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
-   { "iq.com",                           "PPStream", NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
-   { "qy.net",                           "PPStream", NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
-   { "qiyipic.com",                      "PPStream", NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
-   { "ppstream.com",                     "PPStream", NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
-
    { "pluralsight.com",                                                     "Pluralsight", NDPI_PROTOCOL_PLURALSIGHT, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
    { "pluralsight2.imgix.net",                                              "Pluralsight", NDPI_PROTOCOL_PLURALSIGHT, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
    { "pluralsight.imgix.net",                                               "Pluralsight", NDPI_PROTOCOL_PLURALSIGHT, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index db3814015..5bd7597ac 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1220,10 +1220,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			  "WireGuard", NDPI_PROTOCOL_CATEGORY_VPN,
 			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 51820, 0, 0, 0, 0) /* UDP */);
-  ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_PPSTREAM,
-			  "PPStream", NDPI_PROTOCOL_CATEGORY_STREAMING,
-			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
-			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
   ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_XBOX,
 			  "Xbox", NDPI_PROTOCOL_CATEGORY_GAME,
 			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
@@ -2308,6 +2304,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			  "BFCP", NDPI_PROTOCOL_CATEGORY_VIDEO,
 			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+  ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_IQIYI,
+			  "iQIYI", NDPI_PROTOCOL_CATEGORY_STREAMING,
+			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
 
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -5569,10 +5569,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
   /* NON_TCP_UDP */
   init_non_tcp_udp_dissector(ndpi_str, &a);
 
-
-  /* PPSTREAM */
-  init_ppstream_dissector(ndpi_str, &a);
-
   /* IAX */
   init_iax_dissector(ndpi_str, &a);
 
@@ -6205,6 +6201,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
   /* Binary Floor Control Protocol */
   init_bfcp_dissector(ndpi_str, &a);
 
+  /* iQIYI */
+  init_iqiyi_dissector(ndpi_str, &a);
+
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_main_init.c"
 #endif
diff --git a/src/lib/protocols/iqiyi.c b/src/lib/protocols/iqiyi.c
new file mode 100644
index 000000000..28600a4fc
--- /dev/null
+++ b/src/lib/protocols/iqiyi.c
@@ -0,0 +1,69 @@
+/*
+ * iqiyi.c
+ *
+ * Copyright (C) 2024 - ntop.org
+ * Copyright (C) 2024 - V.G <v.gavrilov@securitycode.ru>
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ * 
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_IQIYI
+
+#include "ndpi_api.h"
+#include "ndpi_private.h"
+
+static void ndpi_int_iqiyi_add_connection(struct ndpi_detection_module_struct *ndpi_struct, 
+                                          struct ndpi_flow_struct *flow)
+{
+  NDPI_LOG_INFO(ndpi_struct, "found iQIYI\n");
+  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IQIYI,
+                             NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+}
+
+static void ndpi_search_iqiyi(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "search iQIYI\n");
+
+  if (packet->payload_packet_len > 120 && packet->payload_packet_len < 300) {
+    if (ndpi_memmem(packet->payload, packet->payload_packet_len, "PPStream", NDPI_STATICSTRING_LEN("PPStream"))) {
+      ndpi_int_iqiyi_add_connection(ndpi_struct, flow);
+      return;
+    }
+  }
+
+  /* Add more iQiyi signatures */
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void init_iqiyi_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+                                         u_int32_t *id)
+{
+  ndpi_set_bitmask_protocol_detection("iQIYI", ndpi_struct, *id,
+                                      NDPI_PROTOCOL_IQIYI,
+                                      ndpi_search_iqiyi,
+                                      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+                                      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+                                      ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
+}
diff --git a/src/lib/protocols/ppstream.c b/src/lib/protocols/ppstream.c
deleted file mode 100644
index 83f3648a9..000000000
--- a/src/lib/protocols/ppstream.c
+++ /dev/null
@@ -1,213 +0,0 @@
-/*
- * ppstream.c
- *
- * Copyright (C) 2016-22 - ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
- * 
- */
-
-#include "ndpi_protocol_ids.h"
-
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_PPSTREAM
-
-#include "ndpi_api.h"
-#include "ndpi_private.h"
-
-#define PPS_PORT 17788
-
-
-static void ndpi_int_ppstream_add_connection(struct ndpi_detection_module_struct
-					     *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
-  NDPI_LOG_INFO(ndpi_struct, "found PPStream over UDP\n");
-}
-
-
-static void ndpi_search_ppstream(struct ndpi_detection_module_struct
-				 *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  struct ndpi_packet_struct *packet = &ndpi_struct->packet;
-
-  NDPI_LOG_DBG(ndpi_struct, "search PPStream\n");
-  /**
-     PPS over TCP is detected inside HTTP dissector 
-  */
-	
-  /* check PPS over UDP */
-  if(packet->udp != NULL) {
-    /*** on port 17788 ***/
-    if(packet->payload_packet_len > 14 && ((ntohs(packet->udp->source) == PPS_PORT) || (ntohs(packet->udp->dest) == PPS_PORT))) {
-      if(((packet->payload_packet_len - 4 == get_l16(packet->payload, 0))
-	  || (packet->payload_packet_len == get_l16(packet->payload, 0))
-	  || (packet->payload_packet_len >= 6 && packet->payload_packet_len - 6 == get_l16(packet->payload, 0)))) {
-	/* check 43 and */
-	  if(packet->payload[2] == 0x43) {
-	    if(packet->payload[5] == 0xff &&
-	       packet->payload[6] == 0x00 &&
-	       packet->payload[7] == 0x01 &&
-	       packet->payload[8] == 0x00 &&
-	       packet->payload[9] == 0x00 &&
-	       packet->payload[10] == 0x00 &&
-	       packet->payload[11] == 0x00 &&
-	       packet->payload[12] == 0x00 &&
-	       packet->payload[13] == 0x00 &&
-	       packet->payload[14] == 0x00) {
-
-	    ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-	    return;
-	    }       
-	  }
-	  /* check 44 */
-	  else if(packet->payload[2] == 0x44 && packet->payload_packet_len > 20) {
-	    /** b1 71 **/
-	    if(packet->payload[3] == 0xb1 && packet->payload[4] == 0x71) {
-	      if(packet->payload[13] == 0x00 &&
-		 packet->payload[14] == 0x00 &&
-		 packet->payload[15] == 0x01 &&
-		 packet->payload[16] == 0x00) {
-		/* 02 03 04 05 */
-		if(packet->payload[17] == 0x02 ||
-		   packet->payload[17] == 0x03 ||
-		   packet->payload[17] == 0x04 ||
-		   packet->payload[17] == 0x05) {
-		  if(packet->payload[18] == 0x00 &&
-		     packet->payload[19] == 0x00 &&
-		     packet->payload[20] == 0x00) {
-
-		    ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-		    return;
-		  }
-		}
-		/* ff */
-		else if(packet->payload[17] == 0xff) {
-		  if(packet->payload[18] == 0xff &&
-		     packet->payload[19] == 0xff &&
-		     packet->payload[20] == 0xff) {
-
-		    ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-		    return;
-		  }
-		}
-	      }
-	    }
-	    /** 73 17 **/
-	    else if(packet->payload[3] == 0x73 && packet->payload[4] == 0x17) {
-	      if(packet->payload[5] == 0x00 &&
-		 packet->payload[6] == 0x00 &&
-		 packet->payload[7] == 0x00 &&
-		 packet->payload[8] == 0x00 &&
-		 packet->payload[14] == 0x00 &&
-		 packet->payload[15] == 0x00 &&
-		 packet->payload[16] == 0x00 &&
-		 packet->payload[17] == 0x00 &&
-		 packet->payload[18] == 0x00 &&
-		 packet->payload[19] == 0x00 &&
-		 packet->payload[20] == 0x00) {
-
-		ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-		return;
-	      }
-	    }
-	    /** 74 71 **/
-	    else if(packet->payload[3] == 0x74 && packet->payload[4] == 0x71 && packet->payload_packet_len == 113) {
-	      /* check "PPStream" string in hex */
-	      if(packet->payload[94] == 0x50 &&
-		 packet->payload[95] == 0x50 &&
-		 packet->payload[96] == 0x53 &&
-		 packet->payload[97] == 0x74 &&
-		 packet->payload[98] == 0x72 &&
-		 packet->payload[99] == 0x65 &&
-		 packet->payload[100] == 0x61 &&
-		 packet->payload[101] == 0x6d) {
-
-		ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-		return;
-	      }
-	    }
-	  }
-	  /** check 55 (1) **/
-	  else if(packet->payload_packet_len > 20 &&
-		  packet->payload[2] == 0x55 && (packet->payload[13] == 0x1b &&
-						 packet->payload[14] == 0xa0 &&
-						 packet->payload[15] == 0x00 &&
-						 packet->payload[16] == 0x00 &&
-						 packet->payload[17] == 0x00 &&
-						 packet->payload[18] == 0x00 &&
-						 packet->payload[19] == 0x00 &&
-						 packet->payload[20] == 0x00 )) {
-
-	    ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-	    return;
-	  }
-	  /** check 55 (2) **/
-	  else if(packet->payload_packet_len > 20 &&
-		  packet->payload[2] == 0x55 && packet->payload[1] == 0x00 &&
-		  (packet->payload[5] == 0x00 &&
-		   packet->payload[6] == 0x00 &&
-		   packet->payload[7] == 0x00 &&
-		   packet->payload[8] == 0x00 &&
-		   packet->payload[14] == 0x00 &&
-		   packet->payload[15] == 0x00 &&
-		   packet->payload[16] == 0x00 &&
-		   packet->payload[17] == 0x00 &&
-		   packet->payload[18] == 0x00 &&
-		   packet->payload[19] == 0x00 &&
-		   packet->payload[20] == 0x00 )) {
-
-	    ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-	    return;
-	  }
-      }
-      /* No port detection */
-      if(packet->payload_packet_len > 17) {
-	/* 80 */
-	if(packet->payload[1] == 0x80 || packet->payload[1] == 0x84 ) {
-	  if(packet->payload[3] == packet->payload[4]) {
-
-	    ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-	    return;
-	  }
-	}
-	/* 53 */
-	else if(packet->payload[1] == 0x53 && packet->payload[3] == 0x00 &&
-		(packet->payload[0] == 0x08 || packet->payload[0] == 0x0c)) {
-
-	  ndpi_int_ppstream_add_connection(ndpi_struct, flow);
-	  return;
-	}
-      }
-    }
-
-    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-  }
-}
-
-
-void init_ppstream_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id)
-{
-  ndpi_set_bitmask_protocol_detection("PPStream", ndpi_struct, *id,
-				      NDPI_PROTOCOL_PPSTREAM,
-				      ndpi_search_ppstream,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
-				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
-				      ADD_TO_DETECTION_BITMASK);
-  
-  *id += 1;
-}
-