diff options
79 files changed, 261 insertions, 73 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 256fd8f24..7485a9062 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -334,6 +334,7 @@ typedef enum { NDPI_PROTOCOL_PSIPHON = 303, NDPI_PROTOCOL_ULTRASURF = 304, NDPI_PROTOCOL_THREEMA = 305, + NDPI_PROTOCOL_ALICLOUD = 306, #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index 9336d08c0..1ac315cf5 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -232,6 +232,7 @@ void init_i3d_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int3 void init_riotgames_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ultrasurf_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_threema_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +void init_alicloud_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); /* ndpi_main.c */ extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port); diff --git a/src/lib/inc_generated/ndpi_asn_alibaba.c.inc b/src/lib/inc_generated/ndpi_asn_alibaba.c.inc new file mode 100644 index 000000000..3d8b3d532 --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_alibaba.c.inc @@ -0,0 +1,67 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_alibaba_protocol_list[] = { + { 0x08D17A00 /* 8.209.122.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x08D3E400 /* 8.211.228.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x08D42000 /* 8.212.32.0/23 */, 23, NDPI_PROTOCOL_ALIBABA }, + { 0x08D45D00 /* 8.212.93.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x08D46400 /* 8.212.100.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x08D4B800 /* 8.212.184.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x08D6A000 /* 8.214.160.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x08D84C00 /* 8.216.76.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x0E017000 /* 14.1.112.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x2EC75800 /* 46.199.88.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2F39C500 /* 47.57.197.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2F5AAC00 /* 47.90.172.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x2FEB1100 /* 47.235.17.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2FF59C00 /* 47.245.156.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x2FF65A00 /* 47.246.90.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2FF66400 /* 47.246.100.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2FF68200 /* 47.246.130.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2FF68600 /* 47.246.134.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2FF69C00 /* 47.246.156.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2FF6A300 /* 47.246.163.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x2FFA4000 /* 47.250.64.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x2FFB8000 /* 47.251.128.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x6737CA00 /* 103.55.202.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x67CE2800 /* 103.206.40.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0x80006B00 /* 128.0.107.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0x938BFC00 /* 147.139.252.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0xAA210000 /* 170.33.0.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0xAA210800 /* 170.33.8.0/21 */, 21, NDPI_PROTOCOL_ALIBABA }, + { 0xAA211000 /* 170.33.16.0/20 */, 20, NDPI_PROTOCOL_ALIBABA }, + { 0xAA212000 /* 170.33.32.0/20 */, 20, NDPI_PROTOCOL_ALIBABA }, + { 0xAA214000 /* 170.33.64.0/23 */, 23, NDPI_PROTOCOL_ALIBABA }, + { 0xAA214200 /* 170.33.66.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0xAA214400 /* 170.33.68.0/23 */, 23, NDPI_PROTOCOL_ALIBABA }, + { 0xAA214800 /* 170.33.72.0/21 */, 21, NDPI_PROTOCOL_ALIBABA }, + { 0xAA215000 /* 170.33.80.0/21 */, 21, NDPI_PROTOCOL_ALIBABA }, + { 0xAA215800 /* 170.33.88.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0xAA215C00 /* 170.33.92.0/23 */, 23, NDPI_PROTOCOL_ALIBABA }, + { 0xAA216000 /* 170.33.96.0/21 */, 21, NDPI_PROTOCOL_ALIBABA }, + { 0xAA216800 /* 170.33.104.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + { 0xC60B9000 /* 198.11.144.0/24 */, 24, NDPI_PROTOCOL_ALIBABA }, + { 0xCB6B3000 /* 203.107.48.0/22 */, 22, NDPI_PROTOCOL_ALIBABA }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index e98577406..afa01d8fd 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -86,6 +86,7 @@ #include "inc_generated/ndpi_asn_goto.c.inc" #include "inc_generated/ndpi_asn_riotgames.c.inc" #include "inc_generated/ndpi_asn_threema.c.inc" +#include "inc_generated/ndpi_asn_alibaba.c.inc" /* Third party libraries */ #include "third_party/include/ndpi_patricia.h" @@ -1949,6 +1950,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Threema", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_ALICLOUD, + "AliCloud", NDPI_PROTOCOL_CATEGORY_CLOUD, + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main.c" @@ -2593,6 +2598,7 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_goto_protocol_list); ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_riotgames_protocol_list); ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_threema_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_alibaba_protocol_list); } } @@ -4436,6 +4442,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* Threema */ init_threema_dissector(ndpi_str, &a, detection_bitmask); + /* AliCloud */ + init_alicloud_dissector(ndpi_str, &a, detection_bitmask); + #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main_init.c" #endif diff --git a/src/lib/protocols/alicloud.c b/src/lib/protocols/alicloud.c new file mode 100644 index 000000000..b8ce58d81 --- /dev/null +++ b/src/lib/protocols/alicloud.c @@ -0,0 +1,82 @@ +/* + * alicloud.c + * + * Copyright (C) 2022 - ntop.org + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + + +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_ALICLOUD + +#include "ndpi_api.h" + +static void ndpi_int_alicloud_add_connection(struct ndpi_detection_module_struct * const ndpi_struct, + struct ndpi_flow_struct * const flow) +{ + NDPI_LOG_INFO(ndpi_struct, "found alicloud\n"); + + ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id, NDPI_PROTOCOL_ALICLOUD, + NDPI_CONFIDENCE_DPI); +} + +void ndpi_search_alicloud(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + struct ndpi_packet_struct const * const packet = &ndpi_struct->packet; + + NDPI_LOG_DBG(ndpi_struct, "search alicloud\n"); + + if (packet->payload_packet_len < 8) + { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + + if (ntohl(get_u_int32_t(packet->payload, 0)) == 0xcefabeba) + { + u_int32_t pdu_len = ntohl(get_u_int32_t(packet->payload, 4)); + + if (packet->payload_packet_len == 8 && pdu_len > 0) + { + ndpi_int_alicloud_add_connection(ndpi_struct, flow); + return; + } else if (pdu_len == (u_int32_t)packet->payload_packet_len - 8) { + ndpi_int_alicloud_add_connection(ndpi_struct, flow); + return; + } + } + + if (flow->packet_counter > 3) + { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + } +} + +void init_alicloud_dissector(struct ndpi_detection_module_struct *ndpi_struct, + u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) +{ + ndpi_set_bitmask_protocol_detection("AliCloud", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_ALICLOUD, + ndpi_search_alicloud, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK + ); + + *id += 1; +} diff --git a/tests/pcap/alicloud.pcap b/tests/pcap/alicloud.pcap Binary files differnew file mode 100644 index 000000000..141d7153a --- /dev/null +++ b/tests/pcap/alicloud.pcap diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out index cf4b172a9..e5e3c3b70 100644 --- a/tests/result/1kxun.pcap.out +++ b/tests/result/1kxun.pcap.out @@ -6,7 +6,7 @@ Confidence Unknown : 14 (flows) Confidence Match by port : 5 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 177 (flows) -Num dissector calls: 5055 (25.66 diss/flow) +Num dissector calls: 5061 (25.69 diss/flow) Unknown 24 6428 14 DNS 2 378 1 diff --git a/tests/result/443-chrome.pcap.out b/tests/result/443-chrome.pcap.out index ed4d426db..d4e7d13c9 100644 --- a/tests/result/443-chrome.pcap.out +++ b/tests/result/443-chrome.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 120 (120.00 diss/flow) +Num dissector calls: 121 (121.00 diss/flow) TLS 1 1506 1 diff --git a/tests/result/443-opvn.pcap.out b/tests/result/443-opvn.pcap.out index 05f249a10..a8bffe84f 100644 --- a/tests/result/443-opvn.pcap.out +++ b/tests/result/443-opvn.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 134 (134.00 diss/flow) +Num dissector calls: 135 (135.00 diss/flow) OpenVPN 46 11573 1 diff --git a/tests/result/KakaoTalk_chat.pcap.out b/tests/result/KakaoTalk_chat.pcap.out index 6f65da7e5..82202b385 100644 --- a/tests/result/KakaoTalk_chat.pcap.out +++ b/tests/result/KakaoTalk_chat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 870 (22.89 diss/flow) +Num dissector calls: 878 (23.11 diss/flow) DNS 2 217 1 HTTP 1 56 1 diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out index cba4c407d..924b9ab62 100644 --- a/tests/result/KakaoTalk_talk.pcap.out +++ b/tests/result/KakaoTalk_talk.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 6 (1.20 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 5 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 983 (49.15 diss/flow) +Num dissector calls: 993 (49.65 diss/flow) HTTP 5 280 1 QQ 15 1727 1 diff --git a/tests/result/Oscar.pcap.out b/tests/result/Oscar.pcap.out index 7e9d436c6..a82f38290 100644 --- a/tests/result/Oscar.pcap.out +++ b/tests/result/Oscar.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 347 (347.00 diss/flow) +Num dissector calls: 351 (351.00 diss/flow) TLS 71 9386 1 diff --git a/tests/result/alexa-app.pcapng.out b/tests/result/alexa-app.pcapng.out index 600ef3505..fc9d85dc8 100644 --- a/tests/result/alexa-app.pcapng.out +++ b/tests/result/alexa-app.pcapng.out @@ -6,7 +6,7 @@ DPI Packets (other): 6 (1.00 pkts/flow) Confidence Match by port : 5 (flows) Confidence Match by IP : 9 (flows) Confidence DPI : 146 (flows) -Num dissector calls: 2328 (14.55 diss/flow) +Num dissector calls: 2329 (14.56 diss/flow) DNS 4 400 2 DHCP 3 1056 2 diff --git a/tests/result/alicloud.pcap.out b/tests/result/alicloud.pcap.out new file mode 100644 index 000000000..8fa037a52 --- /dev/null +++ b/tests/result/alicloud.pcap.out @@ -0,0 +1,23 @@ +Guessed flow protos: 0 + +DPI Packets (TCP): 60 (4.00 pkts/flow) +Confidence DPI : 15 (flows) +Num dissector calls: 1995 (133.00 diss/flow) + +AliCloud 225 22986 15 + + 1 TCP 192.168.2.100:45094 <-> 8.209.76.194:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][7 pkts/822 bytes <-> 8 pkts/832 bytes][Goodput ratio: 43/36][0.49 sec][bytes ratio: -0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/1 17/67 23/322 7/115][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 117/104 274/250 77/60][Plen Bins: 28,28,0,0,14,14,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 2 TCP 192.168.2.100:51774 <-> 8.209.77.36:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][7 pkts/822 bytes <-> 8 pkts/832 bytes][Goodput ratio: 43/36][0.46 sec][bytes ratio: -0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 3/0 14/64 20/318 7/114][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 117/104 274/250 77/60][Plen Bins: 28,28,0,0,14,14,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 3 TCP 192.168.2.100:57322 <-> 8.209.107.122:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][7 pkts/822 bytes <-> 8 pkts/832 bytes][Goodput ratio: 43/36][0.33 sec][bytes ratio: -0.006 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/0 16/41 24/166 9/57][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 117/104 274/250 77/60][Plen Bins: 28,28,0,0,14,14,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 4 TCP 192.168.2.100:37160 <-> 8.209.107.125:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/1096 bytes <-> 7 pkts/538 bytes][Goodput ratio: 51/10][0.49 sec][bytes ratio: 0.341 (Upload)][IAT c2s/s2c min/avg/max/stddev: 18/1 69/77 237/237 76/84][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 137/77 274/122 89/19][Plen Bins: 33,16,0,0,16,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 TCP 192.168.2.100:55484 <-> 8.209.107.157:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/1096 bytes <-> 7 pkts/538 bytes][Goodput ratio: 51/10][0.41 sec][bytes ratio: 0.341 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/0 56/65 242/241 84/89][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 137/77 274/122 89/19][Plen Bins: 33,16,0,0,16,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 6 TCP 192.168.2.100:51682 <-> 8.209.73.197:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][7 pkts/822 bytes <-> 8 pkts/704 bytes][Goodput ratio: 43/24][0.96 sec][bytes ratio: 0.077 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 9/0 19/145 29/567 7/203][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 117/88 274/122 77/26][Plen Bins: 28,42,0,0,14,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 7 TCP 192.168.2.100:38094 <-> 8.209.104.159:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.61 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 92/99 469/416 169/159][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 8 TCP 192.168.2.100:39018 <-> 8.209.104.12:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.62 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/0 93/99 480/420 173/161][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 9 TCP 192.168.2.100:40154 <-> 8.209.104.159:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.77 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/0 119/130 632/573 230/222][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][PLAIN TEXT (TGD/Ym)][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 10 TCP 192.168.2.100:41056 <-> 8.209.73.197:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.78 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 15/0 120/130 633/575 229/223][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 11 TCP 192.168.2.100:42430 <-> 8.209.104.130:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.77 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 9/0 118/128 625/570 227/221][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 12 TCP 192.168.2.100:42600 <-> 8.209.105.125:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.77 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 5/1 118/129 627/569 228/220][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 13 TCP 192.168.2.100:44388 <-> 8.209.107.125:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.67 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 5/1 100/107 520/456 188/175][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 14 TCP 192.168.2.100:45078 <-> 8.209.105.125:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.60 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/0 90/96 468/413 169/159][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 15 TCP 192.168.2.100:52228 <-> 8.209.73.197:8999 [proto: 306/AliCloud][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/888 bytes <-> 7 pkts/582 bytes][Goodput ratio: 40/19][0.89 sec][bytes ratio: 0.208 (Upload)][IAT c2s/s2c min/avg/max/stddev: 6/1 138/152 628/568 223/214][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 111/83 274/122 74/25][Plen Bins: 33,33,0,0,16,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/amqp.pcap.out b/tests/result/amqp.pcap.out index d121004c3..725522d60 100644 --- a/tests/result/amqp.pcap.out +++ b/tests/result/amqp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (3.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 395 (131.67 diss/flow) +Num dissector calls: 398 (132.67 diss/flow) AMQP 160 23514 3 diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out index 13e20627a..e08b1c6df 100644 --- a/tests/result/anyconnect-vpn.pcap.out +++ b/tests/result/anyconnect-vpn.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 2 (flows) Confidence Match by port : 5 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 61 (flows) -Num dissector calls: 1161 (16.83 diss/flow) +Num dissector calls: 1165 (16.88 diss/flow) Unknown 19 1054 2 DNS 32 3655 16 diff --git a/tests/result/cloudflare-warp.pcap.out b/tests/result/cloudflare-warp.pcap.out index 64b3ebc17..fffdf6aeb 100644 --- a/tests/result/cloudflare-warp.pcap.out +++ b/tests/result/cloudflare-warp.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 4 DPI Packets (TCP): 41 (5.12 pkts/flow) Confidence Match by IP : 3 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 282 (35.25 diss/flow) +Num dissector calls: 285 (35.62 diss/flow) Jabber 11 890 1 Google 8 476 3 diff --git a/tests/result/emotet.pcap.out b/tests/result/emotet.pcap.out index cb1761c55..06a71411f 100644 --- a/tests/result/emotet.pcap.out +++ b/tests/result/emotet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 48 (8.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 279 (46.50 diss/flow) +Num dissector calls: 281 (46.83 diss/flow) SMTP 626 438465 1 HTTP 1601 1581542 3 diff --git a/tests/result/ftp-start-tls.pcap.out b/tests/result/ftp-start-tls.pcap.out index 62ddaada8..43874bcc7 100644 --- a/tests/result/ftp-start-tls.pcap.out +++ b/tests/result/ftp-start-tls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 174 (174.00 diss/flow) +Num dissector calls: 176 (176.00 diss/flow) FTP_CONTROL 51 7510 1 diff --git a/tests/result/ftp.pcap.out b/tests/result/ftp.pcap.out index 06b7fcf8f..4b7d61d05 100644 --- a/tests/result/ftp.pcap.out +++ b/tests/result/ftp.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 49 (16.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 683 (227.67 diss/flow) +Num dissector calls: 690 (230.00 diss/flow) Unknown 1115 1122198 1 FTP_CONTROL 68 5571 1 diff --git a/tests/result/ftp_failed.pcap.out b/tests/result/ftp_failed.pcap.out index 432f25dd0..3944a87a0 100644 --- a/tests/result/ftp_failed.pcap.out +++ b/tests/result/ftp_failed.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 159 (159.00 diss/flow) +Num dissector calls: 161 (161.00 diss/flow) FTP_CONTROL 18 1700 1 diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out index c3b9362a7..574fb4a87 100644 --- a/tests/result/fuzz-2006-06-26-2594.pcap.out +++ b/tests/result/fuzz-2006-06-26-2594.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 30 (flows) Confidence Match by port : 28 (flows) Confidence DPI : 193 (flows) -Num dissector calls: 5287 (21.06 diss/flow) +Num dissector calls: 5303 (21.13 diss/flow) Unknown 30 3356 30 FTP_CONTROL 36 2569 12 diff --git a/tests/result/fuzz-2006-09-29-28586.pcap.out b/tests/result/fuzz-2006-09-29-28586.pcap.out index ff410a983..686de394a 100644 --- a/tests/result/fuzz-2006-09-29-28586.pcap.out +++ b/tests/result/fuzz-2006-09-29-28586.pcap.out @@ -6,7 +6,7 @@ Confidence Unknown : 3 (flows) Confidence Match by port : 23 (flows) Confidence Match by IP : 2 (flows) Confidence DPI : 12 (flows) -Num dissector calls: 1218 (30.45 diss/flow) +Num dissector calls: 1227 (30.67 diss/flow) Unknown 3 655 3 HTTP 116 27378 35 diff --git a/tests/result/fuzz-2021-10-13.pcap.out b/tests/result/fuzz-2021-10-13.pcap.out index cbeb7b3fc..1f22320cd 100644 --- a/tests/result/fuzz-2021-10-13.pcap.out +++ b/tests/result/fuzz-2021-10-13.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 118 (118.00 diss/flow) +Num dissector calls: 119 (119.00 diss/flow) Unknown 1 197 1 diff --git a/tests/result/google_ssl.pcap.out b/tests/result/google_ssl.pcap.out index b122786f4..478bd4763 100644 --- a/tests/result/google_ssl.pcap.out +++ b/tests/result/google_ssl.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 28 (28.00 pkts/flow) Confidence Match by IP : 1 (flows) -Num dissector calls: 249 (249.00 diss/flow) +Num dissector calls: 252 (252.00 diss/flow) Google 28 9108 1 diff --git a/tests/result/h323-overflow.pcap.out b/tests/result/h323-overflow.pcap.out index afabc16ae..b48860db5 100644 --- a/tests/result/h323-overflow.pcap.out +++ b/tests/result/h323-overflow.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 120 (120.00 diss/flow) +Num dissector calls: 121 (121.00 diss/flow) HTTP 1 58 1 diff --git a/tests/result/h323.pcap.out b/tests/result/h323.pcap.out index 00b1a5e59..59e0551a3 100644 --- a/tests/result/h323.pcap.out +++ b/tests/result/h323.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 122 (61.00 diss/flow) +Num dissector calls: 123 (61.50 diss/flow) H323 12 1825 2 diff --git a/tests/result/imap-starttls.pcap.out b/tests/result/imap-starttls.pcap.out index 663d1af6e..65dd10236 100644 --- a/tests/result/imap-starttls.pcap.out +++ b/tests/result/imap-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 190 (190.00 diss/flow) +Num dissector calls: 193 (193.00 diss/flow) IMAPS 32 7975 1 diff --git a/tests/result/imap.pcap.out b/tests/result/imap.pcap.out index 34b34a590..2cd1781ca 100644 --- a/tests/result/imap.pcap.out +++ b/tests/result/imap.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 211 (211.00 diss/flow) +Num dissector calls: 215 (215.00 diss/flow) IMAP 33 3774 1 diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out index 15a95d52b..c5ea01f7f 100644 --- a/tests/result/instagram.pcap.out +++ b/tests/result/instagram.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by port : 6 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 30 (flows) -Num dissector calls: 2053 (54.03 diss/flow) +Num dissector calls: 2069 (54.45 diss/flow) Unknown 1 66 1 HTTP 116 91784 6 diff --git a/tests/result/irc.pcap.out b/tests/result/irc.pcap.out index 3e5406d89..bb49ebbfe 100644 --- a/tests/result/irc.pcap.out +++ b/tests/result/irc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 166 (166.00 diss/flow) +Num dissector calls: 168 (168.00 diss/flow) IRC 29 8945 1 diff --git a/tests/result/jabber.pcap.out b/tests/result/jabber.pcap.out index 61362bc4e..bec49335e 100644 --- a/tests/result/jabber.pcap.out +++ b/tests/result/jabber.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 74 (6.17 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1505 (125.42 diss/flow) +Num dissector calls: 1523 (126.92 diss/flow) Jabber 358 61304 12 diff --git a/tests/result/kerberos.pcap.out b/tests/result/kerberos.pcap.out index e61e77a58..5e2af9216 100644 --- a/tests/result/kerberos.pcap.out +++ b/tests/result/kerberos.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (2.14 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 23 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 3813 (105.92 diss/flow) +Num dissector calls: 3866 (107.39 diss/flow) Unknown 9 3031 2 SMBv23 6 1914 3 diff --git a/tests/result/log4j-webapp-exploit.pcap.out b/tests/result/log4j-webapp-exploit.pcap.out index dabd3d23e..652b6b9f5 100644 --- a/tests/result/log4j-webapp-exploit.pcap.out +++ b/tests/result/log4j-webapp-exploit.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 63 (9.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 545 (77.86 diss/flow) +Num dissector calls: 546 (78.00 diss/flow) Unknown 356 25081 2 HTTP 34 6741 3 diff --git a/tests/result/memcached.cap.out b/tests/result/memcached.cap.out index dada65e21..3b61ed2ee 100644 --- a/tests/result/memcached.cap.out +++ b/tests/result/memcached.cap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 134 (134.00 diss/flow) +Num dissector calls: 135 (135.00 diss/flow) Memcached 10 1711 1 diff --git a/tests/result/mongo_false_positive.pcapng.out b/tests/result/mongo_false_positive.pcapng.out index e755d0775..7b369de91 100644 --- a/tests/result/mongo_false_positive.pcapng.out +++ b/tests/result/mongo_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (26.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 409 (409.00 diss/flow) +Num dissector calls: 413 (413.00 diss/flow) TLS 26 12163 1 diff --git a/tests/result/mssql_tds.pcap.out b/tests/result/mssql_tds.pcap.out index 001ce7935..f70e038f2 100644 --- a/tests/result/mssql_tds.pcap.out +++ b/tests/result/mssql_tds.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 18 (1.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 280 (23.33 diss/flow) +Num dissector calls: 284 (23.67 diss/flow) MsSQL-TDS 38 16260 12 diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out index 362220e23..9cfc5cdce 100644 --- a/tests/result/nest_log_sink.pcap.out +++ b/tests/result/nest_log_sink.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 128 (9.85 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 2080 (148.57 diss/flow) +Num dissector calls: 2103 (150.21 diss/flow) DNS 15 1612 1 NestLogSink 676 112058 12 diff --git a/tests/result/netbios.pcap.out b/tests/result/netbios.pcap.out index 47f3dda1f..5d31a930b 100644 --- a/tests/result/netbios.pcap.out +++ b/tests/result/netbios.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 14 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 14 (flows) -Num dissector calls: 135 (9.00 diss/flow) +Num dissector calls: 136 (9.07 diss/flow) NetBIOS 258 24196 13 SMBv1 2 486 2 diff --git a/tests/result/nntp.pcap.out b/tests/result/nntp.pcap.out index c291024f6..43a7e1a1d 100644 --- a/tests/result/nntp.pcap.out +++ b/tests/result/nntp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 140 (140.00 diss/flow) +Num dissector calls: 141 (141.00 diss/flow) Usenet 32 7037 1 diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out index a45145c58..a53f7eb78 100644 --- a/tests/result/openvpn.pcap.out +++ b/tests/result/openvpn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) DPI Packets (UDP): 5 (2.50 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 391 (130.33 diss/flow) +Num dissector calls: 392 (130.67 diss/flow) OpenVPN 298 57111 3 diff --git a/tests/result/oracle12.pcapng.out b/tests/result/oracle12.pcapng.out index 0515abd92..50adb743b 100644 --- a/tests/result/oracle12.pcapng.out +++ b/tests/result/oracle12.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 20 (20.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 300 (300.00 diss/flow) +Num dissector calls: 304 (304.00 diss/flow) Oracle 20 2518 1 diff --git a/tests/result/pgsql.pcap.out b/tests/result/pgsql.pcap.out index fed63c64d..2a19914b7 100644 --- a/tests/result/pgsql.pcap.out +++ b/tests/result/pgsql.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 268 (134.00 diss/flow) +Num dissector calls: 270 (135.00 diss/flow) PostgreSQL 39 4709 2 diff --git a/tests/result/pop3.pcap.out b/tests/result/pop3.pcap.out index e132e8cca..8171df058 100644 --- a/tests/result/pop3.pcap.out +++ b/tests/result/pop3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 188 (188.00 diss/flow) +Num dissector calls: 191 (191.00 diss/flow) POP3 31 3915 1 diff --git a/tests/result/punycode-idn.pcap.out b/tests/result/punycode-idn.pcap.out index e7dc4475f..2be36d0bd 100644 --- a/tests/result/punycode-idn.pcap.out +++ b/tests/result/punycode-idn.pcap.out @@ -6,9 +6,9 @@ Confidence DPI : 3 (flows) Num dissector calls: 31 (10.33 diss/flow) DNS 2 162 1 -HTTP 12 1597 1 Spotify 2 197 1 +Alibaba 12 1597 1 - 1 TCP 192.168.2.140:56011 <-> 170.33.9.230:80 [proto: 7/HTTP][ClearText][Confidence: DPI][cat: Web/5][7 pkts/568 bytes <-> 5 pkts/1029 bytes][Goodput ratio: 29/69][0.57 sec][Hostname/SNI: www.love.xn--55qx5d][bytes ratio: -0.289 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 77/122 222/352 90/163][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 81/206 137/765 36/280][URL: www.love.xn--55qx5d/][StatusCode: 403][Content-Type: text/html][User-Agent: curl/7.77.0][Risk: ** IDN Domain Name **** Error Code **][Risk Score: 20][Risk Info: www.love.xn--55qx5d / HTTP Error Code 403][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 TCP 192.168.2.140:56011 <-> 170.33.9.230:80 [proto: 7.274/HTTP.Alibaba][ClearText][Confidence: DPI][cat: Web/5][7 pkts/568 bytes <-> 5 pkts/1029 bytes][Goodput ratio: 29/69][0.57 sec][Hostname/SNI: www.love.xn--55qx5d][bytes ratio: -0.289 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 77/122 222/352 90/163][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 81/206 137/765 36/280][URL: www.love.xn--55qx5d/][StatusCode: 403][Content-Type: text/html][User-Agent: curl/7.77.0][Risk: ** IDN Domain Name **** Error Code **][Risk Score: 20][Risk Info: www.love.xn--55qx5d / HTTP Error Code 403][PLAIN TEXT (GET / HTTP/1.1)][Plen Bins: 0,0,66,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 2 UDP 192.168.2.140:45520 <-> 192.168.2.1:53 [proto: 5.156/DNS.Spotify][ClearText][Confidence: DPI][cat: Music/25][1 pkts/69 bytes <-> 1 pkts/128 bytes][Goodput ratio: 39/67][0.02 sec][Hostname/SNI: i.scdn.co][146.75.62.248][PLAIN TEXT (scdnco)][Plen Bins: 50,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 3 UDP 192.168.2.140:60156 <-> 192.168.2.1:53 [proto: 5/DNS][ClearText][Confidence: DPI][cat: Network/14][1 pkts/81 bytes <-> 1 pkts/81 bytes][Goodput ratio: 48/48][0.00 sec][Hostname/SNI: www.xn--mnich-kva.com][::][Risk: ** IDN Domain Name **** Error Code **][Risk Score: 20][Risk Info: www.xn--mnich-kva.com / DNS Error Code 3][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/reasm_crash_anon.pcapng.out b/tests/result/reasm_crash_anon.pcapng.out index 199625e6b..fec1939c0 100644 --- a/tests/result/reasm_crash_anon.pcapng.out +++ b/tests/result/reasm_crash_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 334 (334.00 diss/flow) +Num dissector calls: 338 (338.00 diss/flow) Unknown 200 20067 1 diff --git a/tests/result/reasm_segv_anon.pcapng.out b/tests/result/reasm_segv_anon.pcapng.out index 6172fc642..0a2c207e4 100644 --- a/tests/result/reasm_segv_anon.pcapng.out +++ b/tests/result/reasm_segv_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 315 (315.00 diss/flow) +Num dissector calls: 317 (317.00 diss/flow) HTTP 82 77940 1 diff --git a/tests/result/rsh.pcap.out b/tests/result/rsh.pcap.out index 82846e6ea..d47bce8a4 100644 --- a/tests/result/rsh.pcap.out +++ b/tests/result/rsh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 320 (160.00 diss/flow) +Num dissector calls: 322 (161.00 diss/flow) RSH 24 1721 2 diff --git a/tests/result/rsync.pcap.out b/tests/result/rsync.pcap.out index a61d7c1e5..0153b6e26 100644 --- a/tests/result/rsync.pcap.out +++ b/tests/result/rsync.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 180 (180.00 diss/flow) +Num dissector calls: 183 (183.00 diss/flow) RSYNC 30 2493 1 diff --git a/tests/result/rtmp.pcap.out b/tests/result/rtmp.pcap.out index c7be2ae83..d34e8e54c 100644 --- a/tests/result/rtmp.pcap.out +++ b/tests/result/rtmp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 163 (163.00 diss/flow) +Num dissector calls: 165 (165.00 diss/flow) RTMP 26 8368 1 diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out index eae5ec38f..b933d21c2 100644 --- a/tests/result/skype.pcap.out +++ b/tests/result/skype.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 61 (flows) Confidence Match by port : 27 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 204 (flows) -Num dissector calls: 31667 (108.08 diss/flow) +Num dissector calls: 31948 (109.04 diss/flow) Unknown 1575 272476 61 DNS 2 267 1 diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out index 7f8e32dce..705fd30fd 100644 --- a/tests/result/skype_no_unknown.pcap.out +++ b/tests/result/skype_no_unknown.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 45 (flows) Confidence Match by port : 22 (flows) Confidence DPI : 200 (flows) -Num dissector calls: 25954 (97.21 diss/flow) +Num dissector calls: 26144 (97.92 diss/flow) Unknown 850 152468 45 DNS 2 267 1 diff --git a/tests/result/smb_frags.pcap.out b/tests/result/smb_frags.pcap.out index 5b6407a94..09aab382e 100644 --- a/tests/result/smb_frags.pcap.out +++ b/tests/result/smb_frags.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 157 (157.00 diss/flow) +Num dissector calls: 159 (159.00 diss/flow) SMBv1 8 2763 1 diff --git a/tests/result/smbv1.pcap.out b/tests/result/smbv1.pcap.out index 2715e0b1e..682276185 100644 --- a/tests/result/smbv1.pcap.out +++ b/tests/result/smbv1.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 151 (151.00 diss/flow) +Num dissector calls: 153 (153.00 diss/flow) SMBv1 7 1197 1 diff --git a/tests/result/smtp.pcap.out b/tests/result/smtp.pcap.out index 733482609..5bbe595e7 100644 --- a/tests/result/smtp.pcap.out +++ b/tests/result/smtp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 204 (204.00 diss/flow) +Num dissector calls: 208 (208.00 diss/flow) SMTP 95 23157 1 diff --git a/tests/result/soap.pcap.out b/tests/result/soap.pcap.out index 271a72fd5..8a4d9d1d6 100644 --- a/tests/result/soap.pcap.out +++ b/tests/result/soap.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (3.67 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 360 (120.00 diss/flow) +Num dissector calls: 364 (121.33 diss/flow) Microsoft 1 1506 1 SOAP 19 9442 2 diff --git a/tests/result/socks-http-example.pcap.out b/tests/result/socks-http-example.pcap.out index 0b77c787d..62bfccf7a 100644 --- a/tests/result/socks-http-example.pcap.out +++ b/tests/result/socks-http-example.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 29 (9.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 511 (170.33 diss/flow) +Num dissector calls: 514 (171.33 diss/flow) SOCKS 46 8383 3 diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out index 8a368c2c3..ee8e0fb6d 100644 --- a/tests/result/starcraft_battle.pcap.out +++ b/tests/result/starcraft_battle.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 8 (flows) Confidence Match by IP : 5 (flows) Confidence DPI : 39 (flows) -Num dissector calls: 1857 (35.71 diss/flow) +Num dissector calls: 1863 (35.83 diss/flow) DNS 26 2848 7 HTTP 450 294880 19 diff --git a/tests/result/synscan.pcap.out b/tests/result/synscan.pcap.out index c6b391182..6c6a077c2 100644 --- a/tests/result/synscan.pcap.out +++ b/tests/result/synscan.pcap.out @@ -104,7 +104,7 @@ iSCSI 2 116 2 43 TCP 172.16.0.8:36050 -> 64.13.134.52:2605 [proto: 13/BGP][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 44 TCP 172.16.0.8:36050 -> 64.13.134.52:3000 [proto: 26/ntop][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 45 TCP 172.16.0.8:36050 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][ClearText][Confidence: Match by port][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 46 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 306/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 46 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 307/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 47 TCP 172.16.0.8:36050 -> 64.13.134.52:3306 [proto: 20/MySQL][ClearText][Confidence: Match by port][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 48 TCP 172.16.0.8:36050 -> 64.13.134.52:3389 [proto: 88/RDP][ClearText][Confidence: Match by port][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 49 TCP 172.16.0.8:36050 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] @@ -165,7 +165,7 @@ iSCSI 2 116 2 104 TCP 172.16.0.8:36051 -> 64.13.134.52:2605 [proto: 13/BGP][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 105 TCP 172.16.0.8:36051 -> 64.13.134.52:3000 [proto: 26/ntop][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 106 TCP 172.16.0.8:36051 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][ClearText][Confidence: Match by port][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 107 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 306/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 107 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 307/iSCSI][ClearText][Confidence: Match by port][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 108 TCP 172.16.0.8:36051 -> 64.13.134.52:3306 [proto: 20/MySQL][ClearText][Confidence: Match by port][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 109 TCP 172.16.0.8:36051 -> 64.13.134.52:3389 [proto: 88/RDP][ClearText][Confidence: Match by port][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 110 TCP 172.16.0.8:36051 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][ClearText][Confidence: Match by port][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out index 7f733e28e..1956bac58 100644 --- a/tests/result/teams.pcap.out +++ b/tests/result/teams.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by IP : 1 (flows) Confidence DPI (partial) : 1 (flows) Confidence DPI : 80 (flows) -Num dissector calls: 1140 (13.73 diss/flow) +Num dissector calls: 1142 (13.76 diss/flow) Unknown 4 456 1 DNS 10 1357 5 diff --git a/tests/result/telnet.pcap.out b/tests/result/telnet.pcap.out index abb6ca76c..03dab2978 100644 --- a/tests/result/telnet.pcap.out +++ b/tests/result/telnet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 161 (161.00 diss/flow) +Num dissector calls: 163 (163.00 diss/flow) Telnet 87 7418 1 diff --git a/tests/result/threema.pcap.out b/tests/result/threema.pcap.out index ac997d5e2..c7236de50 100644 --- a/tests/result/threema.pcap.out +++ b/tests/result/threema.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 66 (11.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 1306 (217.67 diss/flow) +Num dissector calls: 1330 (221.67 diss/flow) Threema 83 11578 6 diff --git a/tests/result/tinc.pcap.out b/tests/result/tinc.pcap.out index 3487b0738..698ef2848 100644 --- a/tests/result/tinc.pcap.out +++ b/tests/result/tinc.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 19 (9.50 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI (cache) : 2 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 551 (137.75 diss/flow) +Num dissector calls: 555 (138.75 diss/flow) TINC 317 352291 4 diff --git a/tests/result/tls-appdata.pcap.out b/tests/result/tls-appdata.pcap.out index 9d080407c..c64ac8014 100644 --- a/tests/result/tls-appdata.pcap.out +++ b/tests/result/tls-appdata.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 20 (10.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 122 (61.00 diss/flow) +Num dissector calls: 123 (61.50 diss/flow) Facebook 6 789 1 Twitch 114 119156 1 diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out index a18802683..d14680137 100644 --- a/tests/result/tls_certificate_too_long.pcap.out +++ b/tests/result/tls_certificate_too_long.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 746 (21.31 diss/flow) +Num dissector calls: 752 (21.49 diss/flow) Unknown 13 5582 1 MDNS 5 983 3 diff --git a/tests/result/tls_false_positives.pcapng.out b/tests/result/tls_false_positives.pcapng.out index 918bd1cde..ff2734ca3 100644 --- a/tests/result/tls_false_positives.pcapng.out +++ b/tests/result/tls_false_positives.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 30 (30.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 405 (405.00 diss/flow) +Num dissector calls: 409 (409.00 diss/flow) Unknown 30 37313 1 diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out index bd59afb19..837c43721 100644 --- a/tests/result/tls_invalid_reads.pcap.out +++ b/tests/result/tls_invalid_reads.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 10 (3.33 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 142 (47.33 diss/flow) +Num dissector calls: 143 (47.67 diss/flow) TLS 7 1827 1 Crashlytics 3 560 1 diff --git a/tests/result/tls_missing_ch_frag.pcap.out b/tests/result/tls_missing_ch_frag.pcap.out index f6d4181e8..b350a2d18 100644 --- a/tests/result/tls_missing_ch_frag.pcap.out +++ b/tests/result/tls_missing_ch_frag.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 125 (125.00 diss/flow) +Num dissector calls: 126 (126.00 diss/flow) TLS 14 10082 1 diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out index dfd64287f..51e4ab2e1 100644 --- a/tests/result/viber.pcap.out +++ b/tests/result/viber.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (1.93 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by IP : 4 (flows) Confidence DPI : 25 (flows) -Num dissector calls: 699 (24.10 diss/flow) +Num dissector calls: 703 (24.24 diss/flow) DNS 8 1267 4 MDNS 4 412 1 diff --git a/tests/result/vnc.pcap.out b/tests/result/vnc.pcap.out index 62ac1b20b..593745647 100644 --- a/tests/result/vnc.pcap.out +++ b/tests/result/vnc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 278 (139.00 diss/flow) +Num dissector calls: 280 (140.00 diss/flow) VNC 4551 329158 2 diff --git a/tests/result/wa_video.pcap.out b/tests/result/wa_video.pcap.out index 13bc2593a..83aae9e27 100644 --- a/tests/result/wa_video.pcap.out +++ b/tests/result/wa_video.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 33 (33.00 pkts/flow) DPI Packets (UDP): 13 (1.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 526 (37.57 diss/flow) +Num dissector calls: 530 (37.86 diss/flow) SSDP 8 1377 3 DHCP 2 684 1 diff --git a/tests/result/waze.pcap.out b/tests/result/waze.pcap.out index 264b0e84d..f47f1a8c4 100644 --- a/tests/result/waze.pcap.out +++ b/tests/result/waze.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 9 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 883 (26.76 diss/flow) +Num dissector calls: 885 (26.82 diss/flow) Unknown 10 786 1 HTTP 65 64777 8 diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out index 86fc020e5..15b2e5c9f 100644 --- a/tests/result/wechat.pcap.out +++ b/tests/result/wechat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Match by port : 17 (flows) Confidence Match by IP : 8 (flows) Confidence DPI : 78 (flows) -Num dissector calls: 1530 (14.85 diss/flow) +Num dissector calls: 1531 (14.86 diss/flow) DNS 13 1075 8 HTTP 70 4620 8 diff --git a/tests/result/whatsapp.pcap.out b/tests/result/whatsapp.pcap.out index d9aa7729e..3910b36f3 100644 --- a/tests/result/whatsapp.pcap.out +++ b/tests/result/whatsapp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 344 (4.00 pkts/flow) Confidence DPI : 86 (flows) -Num dissector calls: 12986 (151.00 diss/flow) +Num dissector calls: 13072 (152.00 diss/flow) WhatsApp 679 96293 86 diff --git a/tests/result/whatsapp_login_chat.pcap.out b/tests/result/whatsapp_login_chat.pcap.out index 9902a1dbe..7d0187c55 100644 --- a/tests/result/whatsapp_login_chat.pcap.out +++ b/tests/result/whatsapp_login_chat.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 25 (8.33 pkts/flow) DPI Packets (UDP): 7 (1.17 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 314 (34.89 diss/flow) +Num dissector calls: 315 (35.00 diss/flow) MDNS 2 202 2 DHCP 6 2052 1 diff --git a/tests/result/whois.pcapng.out b/tests/result/whois.pcapng.out index 15c65fc98..7050cd29a 100644 --- a/tests/result/whois.pcapng.out +++ b/tests/result/whois.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 16 (5.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 212 (70.67 diss/flow) +Num dissector calls: 215 (71.67 diss/flow) TLS 7 2046 1 Whois-DAS 16 4294 2 diff --git a/tests/result/z3950.pcapng.out b/tests/result/z3950.pcapng.out index 166034355..40b158e4b 100644 --- a/tests/result/z3950.pcapng.out +++ b/tests/result/z3950.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 485 (242.50 diss/flow) +Num dissector calls: 493 (246.50 diss/flow) Z3950 31 6308 2 diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out index 4937c15a6..b38968a2f 100644 --- a/tests/result/zoom.pcap.out +++ b/tests/result/zoom.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 25 (1.47 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 31 (flows) -Num dissector calls: 936 (28.36 diss/flow) +Num dissector calls: 941 (28.52 diss/flow) DNS 2 205 1 MDNS 1 87 1 diff --git a/utils/asn_update.sh b/utils/asn_update.sh index f03196a0a..8e7aa7cea 100755 --- a/utils/asn_update.sh +++ b/utils/asn_update.sh @@ -139,6 +139,11 @@ DEST=../src/lib/inc_generated/ndpi_asn_threema.c.inc create_list NDPI_PROTOCOL_THREEMA $DEST "AS29691" echo "(3) Threema IPs are available in $DEST" +echo "(1) Downloading AliBaba..." +DEST=../src/lib/inc_generated/ndpi_asn_alibaba.c.inc +create_list NDPI_PROTOCOL_ALIBABA $DEST "AS134963" +echo "(3) AliBaba IPs are available in $DEST" + if [ ${TOTAL_ASN} -eq ${FAILED_ASN} ]; then printf '%s: %s\n' "${0}" "All download(s) failed, ./get_routes_by_asn.sh broken?" exit 1 |