diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2022-11-22 18:00:02 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-11-22 18:00:02 +0100 |
| commit | afb5c3e6bad82ebd265ab12254ac7c6e067a791b (patch) | |
| tree | ac21af18baab7e786d495fd03818590576b8f413 /tests/result/quic.pcap.out | |
| parent | 6e6f1e448967f38d15c2b83264e34f310806d555 (diff) | |
Fix classification "by-port" of QUIC flows (#1785)
nDPI is able to properly classify QUIC flows only if it elaborates the
very first packets of the flow.
The protocol list in `is_udp_guessable_protocol()` is basically a list
of protocols which can be detected from *any* packets in the flow.
Rename such function to `is_udp_not_guessable_protocol()`: the name is
still quite cryptic, but at least not plainly wrong
Diffstat (limited to 'tests/result/quic.pcap.out')
| -rw-r--r-- | tests/result/quic.pcap.out | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/tests/result/quic.pcap.out b/tests/result/quic.pcap.out index a848dc3ad..7a392afbc 100644 --- a/tests/result/quic.pcap.out +++ b/tests/result/quic.pcap.out @@ -1,7 +1,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 12 (1.20 pkts/flow) -Confidence Unknown : 1 (flows) +Confidence Match by port : 1 (flows) Confidence DPI : 9 (flows) Num dissector calls: 216 (21.60 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) @@ -20,11 +20,10 @@ Patricia risk mask: 20/0 (search/found) Patricia risk: 0/0 (search/found) Patricia protocols: 11/9 (search/found) -Unknown 3 364 1 GMail 413 254874 1 YouTube 85 76193 5 Google 11 10063 2 -QUIC 6 7072 1 +QUIC 9 7436 2 1 UDP 192.168.1.109:57833 <-> 216.58.212.101:443 [proto: 188.122/QUIC.GMail][IP: 126/Google][Encrypted][Confidence: DPI][cat: Email/3][161 pkts/23930 bytes <-> 252 pkts/230944 bytes][Goodput ratio: 72/95][37.93 sec][Hostname/SNI: mail.google.com][bytes ratio: -0.812 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 303/161 21144/21225 1960/1485][Pkt Len c2s/s2c min/avg/max/stddev: 67/61 149/916 1392/1392 207/581][User-Agent: beta Chrome/43.0.2357.45][PLAIN TEXT (mail.google.com)][Plen Bins: 4,37,1,5,3,0,3,0,0,0,0,1,0,0,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,40,0,0,0,0,0] 2 UDP 192.168.1.109:35236 <-> 216.58.210.206:443 [proto: 188.124/QUIC.YouTube][IP: 126/Google][Encrypted][Confidence: DPI][cat: Media/1][25 pkts/5276 bytes <-> 44 pkts/53157 bytes][Goodput ratio: 80/97][1.00 sec][Hostname/SNI: www.youtube.com][bytes ratio: -0.819 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 52/26 803/828 183/134][Pkt Len c2s/s2c min/avg/max/stddev: 79/61 211/1208 1392/1392 358/430][User-Agent: Chrome/50.0.2661.102 Linux x86_64][PLAIN TEXT (www.youtube.com)][Plen Bins: 1,35,1,0,0,0,0,0,0,0,2,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,1,0,0,0,0,0,0,57,0,0,0,0,0] @@ -35,7 +34,4 @@ QUIC 6 7072 1 7 UDP 192.168.1.105:45669 <-> 172.217.16.4:443 [proto: 188.126/QUIC.Google][IP: 126/Google][Encrypted][Confidence: DPI][cat: Web/5][3 pkts/1550 bytes <-> 2 pkts/2784 bytes][Goodput ratio: 92/97][0.16 sec][Hostname/SNI: www.google.com][User-Agent: Chrome/49.0.2623.87 Linux x86_64][PLAIN TEXT (www.google.comO)][Plen Bins: 0,40,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,60,0,0,0,0,0] 8 UDP 192.168.1.105:48445 <-> 216.58.214.110:443 [proto: 188.124/QUIC.YouTube][IP: 126/Google][Encrypted][Confidence: DPI][cat: Media/1][2 pkts/1471 bytes <-> 1 pkts/1392 bytes][Goodput ratio: 94/97][0.10 sec][Hostname/SNI: i.ytimg.com][User-Agent: Chrome/49.0.2623.87 Linux x86_64][PLAIN TEXT (i.ytimg.com)][Plen Bins: 0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,66,0,0,0,0,0] 9 UDP 192.168.1.105:53817 <-> 216.58.210.225:443 [proto: 188.124/QUIC.YouTube][IP: 126/Google][Encrypted][Confidence: DPI][cat: Media/1][1 pkts/1392 bytes <-> 1 pkts/1392 bytes][Goodput ratio: 97/97][0.08 sec][Hostname/SNI: yt3.ggpht.com][User-Agent: Chrome/49.0.2623.87 Linux x86_64][PLAIN TEXT (yt3.ggpht.com)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0] - - -Undetected flows: - 1 UDP 192.168.1.105:40461 <-> 172.217.16.3:443 [proto: 0/Unknown][IP: 126/Google][ClearText][Confidence: Unknown][2 pkts/241 bytes <-> 1 pkts/123 bytes][Goodput ratio: 65/65][0.09 sec][Plen Bins: 0,33,33,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 10 UDP 192.168.1.105:40461 <-> 172.217.16.3:443 [proto: 188/QUIC][IP: 126/Google][Encrypted][Confidence: Match by port][cat: Web/5][2 pkts/241 bytes <-> 1 pkts/123 bytes][Goodput ratio: 65/65][0.09 sec][Plen Bins: 0,33,33,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |