Add detection of Tailscale (#1857)

Extend the example of wireguard traffic

52 files changed, 83 insertions, 57 deletions

diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out
index 93c73d474..b24726f94 100644
--- a/tests/result/1kxun.pcap.out
+++ b/tests/result/1kxun.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	120	(1.21 pkts/flow)
 Confidence Unknown          : 14 (flows)
 Confidence Match by port    : 6 (flows)
 Confidence DPI              : 177 (flows)
-Num dissector calls: 4403 (22.35 diss/flow)
+Num dissector calls: 4417 (22.42 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/60/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/4in4tunnel.pcap.out b/tests/result/4in4tunnel.pcap.out
index 56e997af0..c695afc41 100644
--- a/tests/result/4in4tunnel.pcap.out
+++ b/tests/result/4in4tunnel.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (UDP):	5	(5.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
-Num dissector calls: 174 (174.00 diss/flow)
+Num dissector calls: 175 (175.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/6in6tunnel.pcap.out b/tests/result/6in6tunnel.pcap.out
index 082b97924..0986ec762 100644
--- a/tests/result/6in6tunnel.pcap.out
+++ b/tests/result/6in6tunnel.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (UDP):	2	(2.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
-Num dissector calls: 120 (120.00 diss/flow)
+Num dissector calls: 121 (121.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/EAQ.pcap.out b/tests/result/EAQ.pcap.out
index 878839eaf..bd8497a2d 100644
--- a/tests/result/EAQ.pcap.out
+++ b/tests/result/EAQ.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	12	(6.00 pkts/flow)
 DPI Packets (UDP):	116	(4.00 pkts/flow)
 Confidence DPI              : 31 (flows)
-Num dissector calls: 4242 (136.84 diss/flow)
+Num dissector calls: 4271 (137.77 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out
index 465bb893e..4abfaba63 100644
--- a/tests/result/anyconnect-vpn.pcap.out
+++ b/tests/result/anyconnect-vpn.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	10	(1.00 pkts/flow)
 Confidence Unknown          : 2 (flows)
 Confidence Match by port    : 6 (flows)
 Confidence DPI              : 61 (flows)
-Num dissector calls: 874 (12.67 diss/flow)
+Num dissector calls: 875 (12.68 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/27/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/collectd.pcap.out b/tests/result/collectd.pcap.out
index de4066def..f7ba4e961 100644
--- a/tests/result/collectd.pcap.out
+++ b/tests/result/collectd.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	3
 DPI Packets (UDP):	13	(1.62 pkts/flow)
 Confidence Match by port    : 3 (flows)
 Confidence DPI              : 5 (flows)
-Num dissector calls: 392 (49.00 diss/flow)
+Num dissector calls: 395 (49.38 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/dhcp-fuzz.pcapng.out b/tests/result/dhcp-fuzz.pcapng.out
index b528e0fd1..2411f59f0 100644
--- a/tests/result/dhcp-fuzz.pcapng.out
+++ b/tests/result/dhcp-fuzz.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (UDP):	1	(1.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
-Num dissector calls: 105 (105.00 diss/flow)
+Num dissector calls: 106 (106.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/discord.pcap.out b/tests/result/discord.pcap.out
index b401a2914..711175719 100644
--- a/tests/result/discord.pcap.out
+++ b/tests/result/discord.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	5	(5.00 pkts/flow)
 DPI Packets (UDP):	60	(1.82 pkts/flow)
 Confidence DPI              : 34 (flows)
-Num dissector calls: 3904 (114.82 diss/flow)
+Num dissector calls: 3931 (115.62 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/discord_mid_flow.pcap.out b/tests/result/discord_mid_flow.pcap.out
index 94cdcaa55..7294de9b5 100644
--- a/tests/result/discord_mid_flow.pcap.out
+++ b/tests/result/discord_mid_flow.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	3	(3.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 142 (142.00 diss/flow)
+Num dissector calls: 143 (143.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out b/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out
index a6101325e..e3f916b2f 100644
--- a/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out
+++ b/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	256	(1.04 pkts/flow)
 Confidence DPI              : 245 (flows)
-Num dissector calls: 20759 (84.73 diss/flow)
+Num dissector calls: 20770 (84.78 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/513/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/dnscrypt-v2.pcap.out b/tests/result/dnscrypt-v2.pcap.out
index 8545b48ad..07c420cdc 100644
--- a/tests/result/dnscrypt-v2.pcap.out
+++ b/tests/result/dnscrypt-v2.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	6	(2.00 pkts/flow)
 Confidence DPI              : 3 (flows)
-Num dissector calls: 363 (121.00 diss/flow)
+Num dissector calls: 366 (122.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/dnscrypt_skype_false_positive.pcapng.out b/tests/result/dnscrypt_skype_false_positive.pcapng.out
index 69bcbfb59..1b4b78b06 100644
--- a/tests/result/dnscrypt_skype_false_positive.pcapng.out
+++ b/tests/result/dnscrypt_skype_false_positive.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	2	(2.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 122 (122.00 diss/flow)
+Num dissector calls: 123 (123.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out
index 1a26bd179..982c0dc13 100644
--- a/tests/result/fuzz-2006-06-26-2594.pcap.out
+++ b/tests/result/fuzz-2006-06-26-2594.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	5	(1.00 pkts/flow)
 Confidence Unknown          : 30 (flows)
 Confidence Match by port    : 28 (flows)
 Confidence DPI              : 193 (flows)
-Num dissector calls: 5334 (21.25 diss/flow)
+Num dissector calls: 5367 (21.38 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/180/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/fuzz-2020-02-16-11740.pcap.out b/tests/result/fuzz-2020-02-16-11740.pcap.out
index f26de27e1..6add6e2c4 100644
--- a/tests/result/fuzz-2020-02-16-11740.pcap.out
+++ b/tests/result/fuzz-2020-02-16-11740.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (other):	7	(1.00 pkts/flow)
 Confidence Unknown          : 19 (flows)
 Confidence Match by port    : 3 (flows)
 Confidence DPI              : 55 (flows)
-Num dissector calls: 1741 (22.61 diss/flow)
+Num dissector calls: 1757 (22.82 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/66/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/gnutella.pcap.out b/tests/result/gnutella.pcap.out
index 6d23fdea1..65a1fe161 100644
--- a/tests/result/gnutella.pcap.out
+++ b/tests/result/gnutella.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	10	(1.00 pkts/flow)
 Confidence Unknown          : 592 (flows)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 167 (flows)
-Num dissector calls: 65634 (86.36 diss/flow)
+Num dissector calls: 66146 (87.03 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/1779/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/gtp_false_positive.pcapng.out b/tests/result/gtp_false_positive.pcapng.out
index 34b25037d..619dab8c5 100644
--- a/tests/result/gtp_false_positive.pcapng.out
+++ b/tests/result/gtp_false_positive.pcapng.out
@@ -3,7 +3,7 @@ Guessed flow protos:	3
 DPI Packets (UDP):	7	(2.33 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 2 (flows)
-Num dissector calls: 388 (129.33 diss/flow)
+Num dissector calls: 391 (130.33 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out
index 7e5ff435b..8165a5218 100644
--- a/tests/result/http_ipv6.pcap.out
+++ b/tests/result/http_ipv6.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	77	(5.92 pkts/flow)
 DPI Packets (UDP):	4	(2.00 pkts/flow)
 Confidence Match by port    : 7 (flows)
 Confidence DPI              : 8 (flows)
-Num dissector calls: 143 (9.53 diss/flow)
+Num dissector calls: 144 (9.60 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/21/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/imo.pcap.out b/tests/result/imo.pcap.out
index 62fc55777..02c3a3c8b 100644
--- a/tests/result/imo.pcap.out
+++ b/tests/result/imo.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	7	(3.50 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 282 (141.00 diss/flow)
+Num dissector calls: 284 (142.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out
index 2969c38d7..4aaa6d9d0 100644
--- a/tests/result/instagram.pcap.out
+++ b/tests/result/instagram.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	1	(1.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 7 (flows)
 Confidence DPI              : 30 (flows)
-Num dissector calls: 1765 (46.45 diss/flow)
+Num dissector calls: 1766 (46.47 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/24/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/iphone.pcap.out b/tests/result/iphone.pcap.out
index 8fd37d6d8..e71f84516 100644
--- a/tests/result/iphone.pcap.out
+++ b/tests/result/iphone.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	55	(1.77 pkts/flow)
 DPI Packets (other):	5	(1.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 50 (flows)
-Num dissector calls: 345 (6.76 diss/flow)
+Num dissector calls: 346 (6.78 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/kontiki.pcap.out b/tests/result/kontiki.pcap.out
index e1201cdb9..e55ff956e 100644
--- a/tests/result/kontiki.pcap.out
+++ b/tests/result/kontiki.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (UDP):	6	(1.50 pkts/flow)
 DPI Packets (other):	4	(1.00 pkts/flow)
 Confidence Unknown          : 2 (flows)
 Confidence DPI              : 6 (flows)
-Num dissector calls: 314 (39.25 diss/flow)
+Num dissector calls: 316 (39.50 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/6/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/line.pcap.out b/tests/result/line.pcap.out
index 6f26d7ceb..4647685c5 100644
--- a/tests/result/line.pcap.out
+++ b/tests/result/line.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	13	(6.50 pkts/flow)
 DPI Packets (UDP):	40	(13.33 pkts/flow)
 Confidence DPI              : 5 (flows)
-Num dissector calls: 710 (142.00 diss/flow)
+Num dissector calls: 713 (142.60 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/linecall_falsepositve.pcap.out b/tests/result/linecall_falsepositve.pcap.out
index 9f3c5dcba..b32f6221a 100644
--- a/tests/result/linecall_falsepositve.pcap.out
+++ b/tests/result/linecall_falsepositve.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (UDP):	25	(25.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
-Num dissector calls: 296 (296.00 diss/flow)
+Num dissector calls: 297 (297.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/lru_ipv6_caches.pcapng.out b/tests/result/lru_ipv6_caches.pcapng.out
index 065c5cb0a..ae6d5b780 100644
--- a/tests/result/lru_ipv6_caches.pcapng.out
+++ b/tests/result/lru_ipv6_caches.pcapng.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	42	(4.67 pkts/flow)
 Confidence Unknown          : 4 (flows)
 Confidence DPI (cache)      : 2 (flows)
 Confidence DPI              : 6 (flows)
-Num dissector calls: 1216 (101.33 diss/flow)
+Num dissector calls: 1224 (102.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/nintendo.pcap.out b/tests/result/nintendo.pcap.out
index 36a8b3f8c..633e0d06e 100644
--- a/tests/result/nintendo.pcap.out
+++ b/tests/result/nintendo.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	2	(1.00 pkts/flow)
 Confidence Unknown          : 5 (flows)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 15 (flows)
-Num dissector calls: 1255 (59.76 diss/flow)
+Num dissector calls: 1260 (60.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/18/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out
index ccb63d7ee..8bf6de812 100644
--- a/tests/result/openvpn.pcap.out
+++ b/tests/result/openvpn.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	6	(6.00 pkts/flow)
 DPI Packets (UDP):	5	(2.50 pkts/flow)
 Confidence DPI              : 3 (flows)
-Num dissector calls: 384 (128.00 diss/flow)
+Num dissector calls: 386 (128.67 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/pps.pcap.out b/tests/result/pps.pcap.out
index 62f0e180d..7d4f1b4cc 100644
--- a/tests/result/pps.pcap.out
+++ b/tests/result/pps.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	196	(4.45 pkts/flow)
 Confidence Unknown          : 29 (flows)
 Confidence Match by port    : 2 (flows)
 Confidence DPI              : 76 (flows)
-Num dissector calls: 5739 (53.64 diss/flow)
+Num dissector calls: 5768 (53.91 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/93/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/quic.pcap.out b/tests/result/quic.pcap.out
index d7bd438c5..778d8116c 100644
--- a/tests/result/quic.pcap.out
+++ b/tests/result/quic.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	1
 DPI Packets (UDP):	12	(1.20 pkts/flow)
 Confidence Match by port    : 1 (flows)
 Confidence DPI              : 9 (flows)
-Num dissector calls: 209 (20.90 diss/flow)
+Num dissector calls: 210 (21.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/quic_0RTT.pcap.out b/tests/result/quic_0RTT.pcap.out
index 51f147760..6f3c38158 100644
--- a/tests/result/quic_0RTT.pcap.out
+++ b/tests/result/quic_0RTT.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	4	(2.00 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 184 (92.00 diss/flow)
+Num dissector calls: 185 (92.50 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/radius_false_positive.pcapng.out b/tests/result/radius_false_positive.pcapng.out
index 7b05fa646..6794ecc50 100644
--- a/tests/result/radius_false_positive.pcapng.out
+++ b/tests/result/radius_false_positive.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	1
 
 DPI Packets (UDP):	10	(10.00 pkts/flow)
 Confidence Match by port    : 1 (flows)
-Num dissector calls: 199 (199.00 diss/flow)
+Num dissector calls: 200 (200.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/raknet.pcap.out b/tests/result/raknet.pcap.out
index 4d7ad1fe7..4287aa2d0 100644
--- a/tests/result/raknet.pcap.out
+++ b/tests/result/raknet.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	24	(2.00 pkts/flow)
 Confidence DPI              : 12 (flows)
-Num dissector calls: 1398 (116.50 diss/flow)
+Num dissector calls: 1404 (117.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/rx.pcap.out b/tests/result/rx.pcap.out
index e623c3e32..0c2981cc7 100644
--- a/tests/result/rx.pcap.out
+++ b/tests/result/rx.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	10	(2.00 pkts/flow)
 Confidence DPI              : 5 (flows)
-Num dissector calls: 602 (120.40 diss/flow)
+Num dissector calls: 607 (121.40 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/sflow.pcap.out b/tests/result/sflow.pcap.out
index 0733ed674..3b0bb2a78 100644
--- a/tests/result/sflow.pcap.out
+++ b/tests/result/sflow.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	2	(2.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 106 (106.00 diss/flow)
+Num dissector calls: 107 (107.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/sip_hello.pcapng.out b/tests/result/sip_hello.pcapng.out
index d9a6ddbca..cd2c048db 100644
--- a/tests/result/sip_hello.pcapng.out
+++ b/tests/result/sip_hello.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	9	(9.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 209 (209.00 diss/flow)
+Num dissector calls: 210 (210.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/3/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/skype_udp.pcap.out b/tests/result/skype_udp.pcap.out
index 62c0c6639..b0cee6db8 100644
--- a/tests/result/skype_udp.pcap.out
+++ b/tests/result/skype_udp.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	2	(2.00 pkts/flow)
 Confidence DPI              : 1 (flows)
-Num dissector calls: 121 (121.00 diss/flow)
+Num dissector calls: 122 (122.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/softether.pcap.out b/tests/result/softether.pcap.out
index b7bee6d0c..2562aee3a 100644
--- a/tests/result/softether.pcap.out
+++ b/tests/result/softether.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	1
 DPI Packets (TCP):	4	(4.00 pkts/flow)
 DPI Packets (UDP):	31	(10.33 pkts/flow)
 Confidence DPI              : 4 (flows)
-Num dissector calls: 361 (90.25 diss/flow)
+Num dissector calls: 363 (90.75 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out
index 88694d67c..d5a6959db 100644
--- a/tests/result/starcraft_battle.pcap.out
+++ b/tests/result/starcraft_battle.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other):	1	(1.00 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 12 (flows)
 Confidence DPI              : 39 (flows)
-Num dissector calls: 1411 (27.13 diss/flow)
+Num dissector calls: 1416 (27.23 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/39/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/stun.pcap.out b/tests/result/stun.pcap.out
index e17edf2ff..8645eee3f 100644
--- a/tests/result/stun.pcap.out
+++ b/tests/result/stun.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	4	(4.00 pkts/flow)
 DPI Packets (UDP):	13	(4.33 pkts/flow)
 Confidence DPI              : 4 (flows)
-Num dissector calls: 569 (142.25 diss/flow)
+Num dissector calls: 572 (143.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/stun_signal.pcapng.out b/tests/result/stun_signal.pcapng.out
index bbcb077b5..924263777 100644
--- a/tests/result/stun_signal.pcapng.out
+++ b/tests/result/stun_signal.pcapng.out
@@ -4,7 +4,7 @@ DPI Packets (UDP):	72	(3.43 pkts/flow)
 DPI Packets (other):	2	(1.00 pkts/flow)
 Confidence DPI (partial)    : 1 (flows)
 Confidence DPI              : 22 (flows)
-Num dissector calls: 2270 (98.70 diss/flow)
+Num dissector calls: 2285 (99.35 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/24/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/tailscale.pcap.out b/tests/result/tailscale.pcap.out
new file mode 100644
index 000000000..642abf292
--- /dev/null
+++ b/tests/result/tailscale.pcap.out
@@ -0,0 +1,25 @@
+Guessed flow protos:	0
+
+DPI Packets (UDP):	1	(1.00 pkts/flow)
+Confidence DPI              : 1 (flows)
+Num dissector calls: 1 (1.00 diss/flow)
+LRU cache ookla:      0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache zoom:       0/0/0 (insert/search/found)
+LRU cache stun:       0/0/0 (insert/search/found)
+LRU cache tls_cert:   0/0/0 (insert/search/found)
+LRU cache mining:     0/0/0 (insert/search/found)
+LRU cache msteams:    0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/0/0 (insert/search/found)
+Automa host:          0/0 (search/found)
+Automa domain:        0/0 (search/found)
+Automa tls cert:      0/0 (search/found)
+Automa risk mask:     0/0 (search/found)
+Automa common alpns:  0/0 (search/found)
+Patricia risk mask:   2/0 (search/found)
+Patricia risk:        0/0 (search/found)
+Patricia protocols:   1/1 (search/found)
+
+Tailscale	107	16516	1
+
+	1	UDP 192.168.88.3:41641 <-> 18.196.71.179:41641 [proto: 24/Tailscale][IP: 265/AmazonAWS][Encrypted][Confidence: DPI][cat: VPN/2][51 pkts/7842 bytes <-> 56 pkts/8674 bytes][Goodput ratio: 73/73][31.88 sec][bytes ratio: -0.050 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 28/0 586/517 2000/1880 588/502][Pkt Len c2s/s2c min/avg/max/stddev: 134/134 154/155 170/170 15/16][Plen Bins: 0,0,29,27,42,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out
index 95c7a17d5..5d6a66e50 100644
--- a/tests/result/teams.pcap.out
+++ b/tests/result/teams.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 1 (flows)
 Confidence DPI (partial)    : 1 (flows)
 Confidence DPI              : 80 (flows)
-Num dissector calls: 591 (7.12 diss/flow)
+Num dissector calls: 592 (7.13 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/9/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/teamspeak3.pcap.out b/tests/result/teamspeak3.pcap.out
index d658fb01d..67f823de4 100644
--- a/tests/result/teamspeak3.pcap.out
+++ b/tests/result/teamspeak3.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	4	(2.00 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 195 (97.50 diss/flow)
+Num dissector calls: 196 (98.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/teamviewer.pcap.out b/tests/result/teamviewer.pcap.out
index 999da0e1b..4d0e4cc00 100644
--- a/tests/result/teamviewer.pcap.out
+++ b/tests/result/teamviewer.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	0
 DPI Packets (TCP):	4	(4.00 pkts/flow)
 DPI Packets (UDP):	4	(4.00 pkts/flow)
 Confidence DPI              : 2 (flows)
-Num dissector calls: 149 (74.50 diss/flow)
+Num dissector calls: 150 (75.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/telegram.pcap.out b/tests/result/telegram.pcap.out
index 9b814ab1a..b90238b78 100644
--- a/tests/result/telegram.pcap.out
+++ b/tests/result/telegram.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	5
 DPI Packets (UDP):	93	(1.94 pkts/flow)
 Confidence Unknown          : 2 (flows)
 Confidence DPI              : 46 (flows)
-Num dissector calls: 1578 (32.88 diss/flow)
+Num dissector calls: 1580 (32.92 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/6/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/tftp.pcap.out b/tests/result/tftp.pcap.out
index 6597ed37a..a535f5b8e 100644
--- a/tests/result/tftp.pcap.out
+++ b/tests/result/tftp.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos:	0
 
 DPI Packets (UDP):	13	(1.86 pkts/flow)
 Confidence DPI              : 7 (flows)
-Num dissector calls: 307 (43.86 diss/flow)
+Num dissector calls: 309 (44.14 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/toca-boca.pcap.out b/tests/result/toca-boca.pcap.out
index 22e25061e..77b26de8e 100644
--- a/tests/result/toca-boca.pcap.out
+++ b/tests/result/toca-boca.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos:	4
 DPI Packets (UDP):	21	(1.00 pkts/flow)
 Confidence Match by port    : 4 (flows)
 Confidence DPI              : 17 (flows)
-Num dissector calls: 437 (20.81 diss/flow)
+Num dissector calls: 441 (21.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out
index 3672b716c..d25a59045 100644
--- a/tests/result/viber.pcap.out
+++ b/tests/result/viber.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	27	(1.93 pkts/flow)
 DPI Packets (other):	2	(1.00 pkts/flow)
 Confidence Match by port    : 4 (flows)
 Confidence DPI              : 25 (flows)
-Num dissector calls: 515 (17.76 diss/flow)
+Num dissector calls: 516 (17.79 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/webex.pcap.out b/tests/result/webex.pcap.out
index 752238b05..a812afe4d 100644
--- a/tests/result/webex.pcap.out
+++ b/tests/result/webex.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP):	17	(8.50 pkts/flow)
 Confidence Unknown          : 1 (flows)
 Confidence Match by port    : 3 (flows)
 Confidence DPI              : 53 (flows)
-Num dissector calls: 316 (5.54 diss/flow)
+Num dissector calls: 317 (5.56 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/weibo.pcap.out b/tests/result/weibo.pcap.out
index d1db68ee7..ac85c617e 100644
--- a/tests/result/weibo.pcap.out
+++ b/tests/result/weibo.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	100	(3.33 pkts/flow)
 DPI Packets (UDP):	44	(3.14 pkts/flow)
 Confidence Match by port    : 21 (flows)
 Confidence DPI              : 23 (flows)
-Num dissector calls: 564 (12.82 diss/flow)
+Num dissector calls: 566 (12.86 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/63/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
diff --git a/tests/result/wireguard.pcap.out b/tests/result/wireguard.pcap.out
index c596fa9a4..d0f6b275d 100644
--- a/tests/result/wireguard.pcap.out
+++ b/tests/result/wireguard.pcap.out
@@ -1,8 +1,8 @@
 Guessed flow protos:	0
 
-DPI Packets (UDP):	4	(4.00 pkts/flow)
-Confidence DPI              : 1 (flows)
-Num dissector calls: 145 (145.00 diss/flow)
+DPI Packets (UDP):	6	(3.00 pkts/flow)
+Confidence DPI              : 2 (flows)
+Num dissector calls: 253 (126.50 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
@@ -16,10 +16,11 @@ Automa domain:        0/0 (search/found)
 Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
-Patricia risk mask:   2/0 (search/found)
+Patricia risk mask:   4/0 (search/found)
 Patricia risk:        0/0 (search/found)
-Patricia protocols:   2/0 (search/found)
+Patricia protocols:   4/0 (search/found)
 
-WireGuard	2399	734182	1
+WireGuard	52	12740	2
 
-	1	UDP 139.162.192.157:51820 <-> 192.168.0.14:36116 [proto: 206/WireGuard][IP: 0/Unknown][Encrypted][Confidence: DPI][cat: VPN/2][1362 pkts/518526 bytes <-> 1037 pkts/215656 bytes][Goodput ratio: 89/80][381.21 sec][bytes ratio: 0.413 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 269/314 10882/13538 1111/1204][Pkt Len c2s/s2c min/avg/max/stddev: 74/74 381/208 1404/1404 362/135][Plen Bins: 0,0,0,35,43,5,2,0,6,2,1,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0]
+	1	UDP 139.162.192.157:51820 <-> 192.168.0.14:36116 [proto: 206/WireGuard][IP: 0/Unknown][Encrypted][Confidence: DPI][cat: VPN/2][18 pkts/5428 bytes <-> 12 pkts/2568 bytes][Goodput ratio: 86/80][9.40 sec][bytes ratio: 0.358 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 414/661 5525/5525 1367/1721][Pkt Len c2s/s2c min/avg/max/stddev: 138/138 302/214 842/314 223/80][Plen Bins: 0,0,0,41,23,0,0,0,16,3,3,0,0,0,0,0,3,0,0,3,3,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	2	UDP 10.9.0.1:43462 <-> 10.9.0.2:51820 [proto: 206/WireGuard][IP: 0/Unknown][Encrypted][Confidence: DPI][cat: VPN/2][12 pkts/3100 bytes <-> 10 pkts/1644 bytes][Goodput ratio: 84/74][140.28 sec][bytes ratio: 0.307 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1369/17528 10176/138081 3139/45567][Pkt Len c2s/s2c min/avg/max/stddev: 74/122 258/164 1494/330 375/58][Plen Bins: 0,9,22,18,41,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0]
diff --git a/tests/result/zoom2.pcap.out b/tests/result/zoom2.pcap.out
index 8605931b6..4828e7cff 100644
--- a/tests/result/zoom2.pcap.out
+++ b/tests/result/zoom2.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP):	8	(8.00 pkts/flow)
 DPI Packets (UDP):	15	(5.00 pkts/flow)
 DPI Packets (other):	1	(1.00 pkts/flow)
 Confidence DPI              : 5 (flows)
-Num dissector calls: 479 (95.80 diss/flow)
+Num dissector calls: 482 (96.40 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       1/0/0 (insert/search/found)
diff --git a/tests/result/zoom_p2p.pcapng.out b/tests/result/zoom_p2p.pcapng.out
index bc3e0ecb6..5e8bd3906 100644
--- a/tests/result/zoom_p2p.pcapng.out
+++ b/tests/result/zoom_p2p.pcapng.out
@@ -4,7 +4,7 @@ DPI Packets (UDP):	88	(8.80 pkts/flow)
 DPI Packets (other):	2	(1.00 pkts/flow)
 Confidence DPI (partial cache): 4 (flows)
 Confidence DPI              : 8 (flows)
-Num dissector calls: 1083 (90.25 diss/flow)
+Num dissector calls: 1087 (90.58 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/12/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)