diff options
197 files changed, 265 insertions, 227 deletions
diff --git a/src/lib/protocols/jabber.c b/src/lib/protocols/jabber.c index 89dd3c8db..389d33625 100644 --- a/src/lib/protocols/jabber.c +++ b/src/lib/protocols/jabber.c @@ -65,20 +65,56 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &ndpi_struct->packet; + u_int16_t const max_packets = 4; + size_t i; + static uint8_t const valid_patterns[] = { 0x25, 0x26, 0x30 }; NDPI_LOG_DBG(ndpi_struct, "search JABBER\n"); - if (flow->packet_counter > 5) { - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + if (packet->payload_packet_len >= 3 && + packet->payload[1] == 0x00 && packet->payload[2] == packet->payload_packet_len) + { + /* Old style Jabber/XMPP SSL. */ + if (flow->packet_counter > max_packets - 1) + { + ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); + } + for (i = 0; i < NDPI_ARRAY_LENGTH(valid_patterns); ++i) + { + if (packet->payload[0] == valid_patterns[i]) + { + return; + } + } + } + + /* search for jabber here */ + /* this part is working asymmetrically */ + if (packet->payload_packet_len >= NDPI_STATICSTRING_LEN("<presence ") && + memcmp(packet->payload, "<presence ", NDPI_STATICSTRING_LEN("<presence ")) == 0 && + ndpi_strnstr((const char *)&packet->payload[0], + "xmlns='http://jabber.org/protocol/caps'", packet->payload_packet_len) != NULL) + { + ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); return; } - - if (packet->tcp != 0 && packet->payload_packet_len == 0) { + + if (packet->payload_packet_len >= NDPI_STATICSTRING_LEN("<iq type='") && + memcmp(packet->payload, "<iq type='", NDPI_STATICSTRING_LEN("<iq type='")) == 0 && + ndpi_strnstr((const char *)&packet->payload[0], + "xmlns='http://jabber.org/protocol/commands'", packet->payload_packet_len) != NULL) + { + ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); + return; + } + + if (packet->payload_packet_len == NDPI_STATICSTRING_LEN("</stream:stream>") && + memcmp(packet->payload, "</stream:stream>", NDPI_STATICSTRING_LEN("</stream:stream>")) == 0) + { + ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); return; } - /* search for jabber here */ - /* this part is working asymmetrically */ if ((packet->payload_packet_len > 13 && memcmp(packet->payload, "<?xml version=", 14) == 0) || (packet->payload_packet_len >= NDPI_STATICSTRING_LEN("<stream:stream ") && memcmp(packet->payload, "<stream:stream ", NDPI_STATICSTRING_LEN("<stream:stream ")) == 0)) { @@ -95,16 +131,11 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st return; } } - - if (flow->packet_counter < 3) { - NDPI_LOG_DBG2(ndpi_struct, "packet_counter: %u\n", flow->packet_counter); + + if (flow->packet_counter > max_packets) { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); return; } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - - ndpi_exclude_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TRUPHONE, - __FILE__,__FUNCTION__,__LINE__); } @@ -113,7 +144,7 @@ void init_jabber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_i ndpi_set_bitmask_protocol_detection("Jabber", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_JABBER, ndpi_search_jabber_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); diff --git a/tests/pcap/jabber.pcap b/tests/pcap/jabber.pcap Binary files differindex 9d2e94452..def78d3e1 100644 --- a/tests/pcap/jabber.pcap +++ b/tests/pcap/jabber.pcap diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out index b59278927..6e7f824bf 100644 --- a/tests/result/1kxun.pcap.out +++ b/tests/result/1kxun.pcap.out @@ -6,7 +6,7 @@ Confidence Unknown : 14 (flows) Confidence Match by port : 5 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 177 (flows) -Num dissector calls: 5172 (26.25 diss/flow) +Num dissector calls: 5084 (25.81 diss/flow) Unknown 24 6428 14 DNS 2 378 1 diff --git a/tests/result/443-curl.pcap.out b/tests/result/443-curl.pcap.out index db264640d..a38f274f6 100644 --- a/tests/result/443-curl.pcap.out +++ b/tests/result/443-curl.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) ntop 109 73982 1 diff --git a/tests/result/443-firefox.pcap.out b/tests/result/443-firefox.pcap.out index dc8d2c6d2..8cc96a945 100644 --- a/tests/result/443-firefox.pcap.out +++ b/tests/result/443-firefox.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) ntop 667 458067 1 diff --git a/tests/result/443-git.pcap.out b/tests/result/443-git.pcap.out index dc12d8fdd..be0013599 100644 --- a/tests/result/443-git.pcap.out +++ b/tests/result/443-git.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Github 70 37189 1 diff --git a/tests/result/443-opvn.pcap.out b/tests/result/443-opvn.pcap.out index 2920e3b3d..a8bffe84f 100644 --- a/tests/result/443-opvn.pcap.out +++ b/tests/result/443-opvn.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 139 (139.00 diss/flow) +Num dissector calls: 135 (135.00 diss/flow) OpenVPN 46 11573 1 diff --git a/tests/result/443-safari.pcap.out b/tests/result/443-safari.pcap.out index de9f8520f..86f296621 100644 --- a/tests/result/443-safari.pcap.out +++ b/tests/result/443-safari.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) ntop 41 19929 1 diff --git a/tests/result/4in4tunnel.pcap.out b/tests/result/4in4tunnel.pcap.out index 55db50eaf..32e7fb8e0 100644 --- a/tests/result/4in4tunnel.pcap.out +++ b/tests/result/4in4tunnel.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 5 (5.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 169 (169.00 diss/flow) +Num dissector calls: 171 (171.00 diss/flow) Unknown 5 850 1 diff --git a/tests/result/4in6tunnel.pcap.out b/tests/result/4in6tunnel.pcap.out index 8ec4f6314..08f1f609d 100644 --- a/tests/result/4in6tunnel.pcap.out +++ b/tests/result/4in6tunnel.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 13 (13.00 diss/flow) +Num dissector calls: 11 (11.00 diss/flow) Microsoft 4 2188 1 diff --git a/tests/result/6in4tunnel.pcap.out b/tests/result/6in4tunnel.pcap.out index 83d0aa9c2..5c3f5c298 100644 --- a/tests/result/6in4tunnel.pcap.out +++ b/tests/result/6in4tunnel.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 27 (5.40 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) DPI Packets (other): 3 (1.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 67 (6.70 diss/flow) +Num dissector calls: 58 (5.80 diss/flow) HTTP 10 1792 1 IMAPS 4 516 2 diff --git a/tests/result/BGP_Cisco_hdlc_slarp.pcap.out b/tests/result/BGP_Cisco_hdlc_slarp.pcap.out index 2b2865dcc..cdfc3f56a 100644 --- a/tests/result/BGP_Cisco_hdlc_slarp.pcap.out +++ b/tests/result/BGP_Cisco_hdlc_slarp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) BGP 14 969 1 diff --git a/tests/result/EAQ.pcap.out b/tests/result/EAQ.pcap.out index c0e5c6932..5a778bb5b 100644 --- a/tests/result/EAQ.pcap.out +++ b/tests/result/EAQ.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) DPI Packets (UDP): 116 (4.00 pkts/flow) Confidence DPI : 31 (flows) -Num dissector calls: 4108 (132.52 diss/flow) +Num dissector calls: 4102 (132.32 diss/flow) Google 23 11743 2 EAQ 174 10092 29 diff --git a/tests/result/IEC104.pcap.out b/tests/result/IEC104.pcap.out index fac53756c..2c12494ad 100644 --- a/tests/result/IEC104.pcap.out +++ b/tests/result/IEC104.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 16 (8.00 diss/flow) +Num dissector calls: 14 (7.00 diss/flow) IEC60870 15 1431 2 diff --git a/tests/result/KakaoTalk_chat.pcap.out b/tests/result/KakaoTalk_chat.pcap.out index 6907d0b9b..26f193fec 100644 --- a/tests/result/KakaoTalk_chat.pcap.out +++ b/tests/result/KakaoTalk_chat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 949 (24.97 diss/flow) +Num dissector calls: 894 (23.53 diss/flow) DNS 2 217 1 HTTP 1 56 1 diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out index 853c6b13b..00c6824c1 100644 --- a/tests/result/KakaoTalk_talk.pcap.out +++ b/tests/result/KakaoTalk_talk.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 6 (1.20 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 5 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 1027 (51.35 diss/flow) +Num dissector calls: 999 (49.95 diss/flow) HTTP 5 280 1 QQ 15 1727 1 diff --git a/tests/result/Oscar.pcap.out b/tests/result/Oscar.pcap.out index 654c69ba9..7593d578a 100644 --- a/tests/result/Oscar.pcap.out +++ b/tests/result/Oscar.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 71 (71.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 367 (367.00 diss/flow) +Num dissector calls: 365 (365.00 diss/flow) TLS 71 9386 1 diff --git a/tests/result/WebattackSQLinj.pcap.out b/tests/result/WebattackSQLinj.pcap.out index bde47e2d0..3414f7742 100644 --- a/tests/result/WebattackSQLinj.pcap.out +++ b/tests/result/WebattackSQLinj.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 54 (6.00 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 288 (32.00 diss/flow) +Num dissector calls: 261 (29.00 diss/flow) HTTP 94 30008 9 diff --git a/tests/result/WebattackXSS.pcap.out b/tests/result/WebattackXSS.pcap.out index 3120cddee..4840014f8 100644 --- a/tests/result/WebattackXSS.pcap.out +++ b/tests/result/WebattackXSS.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 639 DPI Packets (TCP): 3972 (6.01 pkts/flow) Confidence Match by port : 639 (flows) Confidence DPI : 22 (flows) -Num dissector calls: 21182 (32.05 diss/flow) +Num dissector calls: 17276 (26.14 diss/flow) HTTP 9374 4721148 661 diff --git a/tests/result/aimini-http.pcap.out b/tests/result/aimini-http.pcap.out index 3129503e6..f4f6aed31 100644 --- a/tests/result/aimini-http.pcap.out +++ b/tests/result/aimini-http.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (9.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 164 (41.00 diss/flow) +Num dissector calls: 148 (37.00 diss/flow) Aimini 133 86722 4 diff --git a/tests/result/ajp.pcap.out b/tests/result/ajp.pcap.out index 4513f7f40..e8fa2ea1b 100644 --- a/tests/result/ajp.pcap.out +++ b/tests/result/ajp.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 8 (4.00 pkts/flow) DPI Packets (other): 6 (3.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 36 (9.00 diss/flow) +Num dissector calls: 30 (7.50 diss/flow) Unknown 6 2200 2 AJP 26 4446 2 diff --git a/tests/result/alexa-app.pcapng.out b/tests/result/alexa-app.pcapng.out index af520b480..fc9d85dc8 100644 --- a/tests/result/alexa-app.pcapng.out +++ b/tests/result/alexa-app.pcapng.out @@ -6,7 +6,7 @@ DPI Packets (other): 6 (1.00 pkts/flow) Confidence Match by port : 5 (flows) Confidence Match by IP : 9 (flows) Confidence DPI : 146 (flows) -Num dissector calls: 2719 (16.99 diss/flow) +Num dissector calls: 2329 (14.56 diss/flow) DNS 4 400 2 DHCP 3 1056 2 diff --git a/tests/result/amqp.pcap.out b/tests/result/amqp.pcap.out index a0013433f..13ab8aec4 100644 --- a/tests/result/amqp.pcap.out +++ b/tests/result/amqp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (3.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 401 (133.67 diss/flow) +Num dissector calls: 400 (133.33 diss/flow) AMQP 160 23514 3 diff --git a/tests/result/android.pcap.out b/tests/result/android.pcap.out index 153931e68..beaf7ffe0 100644 --- a/tests/result/android.pcap.out +++ b/tests/result/android.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 52 (1.68 pkts/flow) DPI Packets (other): 4 (1.00 pkts/flow) Confidence Match by IP : 3 (flows) Confidence DPI : 60 (flows) -Num dissector calls: 668 (10.60 diss/flow) +Num dissector calls: 600 (9.52 diss/flow) DNS 4 390 2 MDNS 2 174 2 diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out index 3355c4780..d5c6c41ba 100644 --- a/tests/result/anyconnect-vpn.pcap.out +++ b/tests/result/anyconnect-vpn.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 2 (flows) Confidence Match by port : 5 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 61 (flows) -Num dissector calls: 1226 (17.77 diss/flow) +Num dissector calls: 1176 (17.04 diss/flow) Unknown 19 1054 2 DNS 32 3655 16 diff --git a/tests/result/anydesk-2.pcap.out b/tests/result/anydesk-2.pcap.out index 3ff3683dc..4d9b88a10 100644 --- a/tests/result/anydesk-2.pcap.out +++ b/tests/result/anydesk-2.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 13 (6.50 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 42 (10.50 diss/flow) +Num dissector calls: 36 (9.00 diss/flow) AnyDesk 2083 346113 4 diff --git a/tests/result/anydesk.pcap.out b/tests/result/anydesk.pcap.out index b1c0e3fa8..5c167e2da 100644 --- a/tests/result/anydesk.pcap.out +++ b/tests/result/anydesk.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 21 (10.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 23 (11.50 diss/flow) +Num dissector calls: 20 (10.00 diss/flow) AnyDesk 6963 2795460 2 diff --git a/tests/result/bot.pcap.out b/tests/result/bot.pcap.out index 514f8d5be..3479fe143 100644 --- a/tests/result/bot.pcap.out +++ b/tests/result/bot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) Azure 402 431124 1 diff --git a/tests/result/cachefly.pcapng.out b/tests/result/cachefly.pcapng.out index 5d921ba0d..a1d8613d5 100644 --- a/tests/result/cachefly.pcapng.out +++ b/tests/result/cachefly.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 8 (8.00 diss/flow) +Num dissector calls: 7 (7.00 diss/flow) Cachefly 6 6163 1 diff --git a/tests/result/cassandra.pcap.out b/tests/result/cassandra.pcap.out index 2627bb21c..c6a679059 100644 --- a/tests/result/cassandra.pcap.out +++ b/tests/result/cassandra.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 36 (18.00 diss/flow) +Num dissector calls: 30 (15.00 diss/flow) Cassandra 286 126016 2 diff --git a/tests/result/check_mk_new.pcap.out b/tests/result/check_mk_new.pcap.out index 966551a9d..12feec0f2 100644 --- a/tests/result/check_mk_new.pcap.out +++ b/tests/result/check_mk_new.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) CHECKMK 98 20242 1 diff --git a/tests/result/chrome.pcap.out b/tests/result/chrome.pcap.out index e8e62e628..5c6bd80ca 100644 --- a/tests/result/chrome.pcap.out +++ b/tests/result/chrome.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (6.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 108 (18.00 diss/flow) +Num dissector calls: 90 (15.00 diss/flow) TLS 5633 4985157 6 diff --git a/tests/result/citrix.pcap.out b/tests/result/citrix.pcap.out index 5da530a5b..7f02a3e74 100644 --- a/tests/result/citrix.pcap.out +++ b/tests/result/citrix.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Citrix 100 11332 1 diff --git a/tests/result/cloudflare-warp.pcap.out b/tests/result/cloudflare-warp.pcap.out index 75fe88b77..fffdf6aeb 100644 --- a/tests/result/cloudflare-warp.pcap.out +++ b/tests/result/cloudflare-warp.pcap.out @@ -1,12 +1,11 @@ -Guessed flow protos: 5 +Guessed flow protos: 4 -DPI Packets (TCP): 42 (5.25 pkts/flow) -Confidence Unknown : 1 (flows) +DPI Packets (TCP): 41 (5.12 pkts/flow) Confidence Match by IP : 3 (flows) -Confidence DPI : 4 (flows) -Num dissector calls: 328 (41.00 diss/flow) +Confidence DPI : 5 (flows) +Num dissector calls: 285 (35.62 diss/flow) -Unknown 11 890 1 +Jabber 11 890 1 Google 8 476 3 Messenger 17 2369 1 GoogleServices 5 492 1 @@ -20,11 +19,8 @@ JA3 Host Stats: 1 TCP 10.8.0.1:45606 <-> 104.18.47.234:443 [proto: 91.300/TLS.CloudflareWarp][Encrypted][Confidence: DPI][cat: VPN/2][6 pkts/924 bytes <-> 5 pkts/3107 bytes][Goodput ratio: 63/91][0.16 sec][Hostname/SNI: api.cloudflareclient.com][ALPN: http/1.1][bytes ratio: -0.542 (Download)][IAT c2s/s2c min/avg/max/stddev: 1/2 31/50 75/75 36/34][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 154/621 355/2891 111/1135][TLSv1.2][JA3C: 6f5e62edfa5933b1332ddf8b9fb3ef9d][ServerNames: cloudflareclient.com,*.cloudflareclient.com][JA3S: 9ebc57def2efb523f25c77af13aa6d48][Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3][Subject: C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=cloudflareclient.com][Certificate SHA-1: E6:54:3B:82:07:1E:29:C4:57:8C:B4:9E:64:38:11:38:9B:FC:66:98][Safari][Validity: 2022-05-19 00:00:00 - 2023-05-19 23:59:59][Cipher: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,0,25,0,0,25,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25] 2 TCP 10.8.0.1:45610 <-> 104.18.47.234:443 [proto: 91.300/TLS.CloudflareWarp][Encrypted][Confidence: DPI][cat: VPN/2][6 pkts/623 bytes <-> 5 pkts/3108 bytes][Goodput ratio: 45/91][0.15 sec][Hostname/SNI: api.cloudflareclient.com][ALPN: http/1.1][bytes ratio: -0.666 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/50 29/48 143/93 57/38][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 104/622 240/2854 69/1116][TLSv1.2][JA3C: 6f5e62edfa5933b1332ddf8b9fb3ef9d][ServerNames: cloudflareclient.com,*.cloudflareclient.com][JA3S: 9ebc57def2efb523f25c77af13aa6d48][Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3][Subject: C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=cloudflareclient.com][Certificate SHA-1: E6:54:3B:82:07:1E:29:C4:57:8C:B4:9E:64:38:11:38:9B:FC:66:98][Safari][Validity: 2022-05-19 00:00:00 - 2023-05-19 23:59:59][Cipher: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,25,25,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25] 3 TCP 10.8.0.1:40214 <-> 157.240.16.32:443 [proto: 91.157/TLS.Messenger][Encrypted][Confidence: DPI][cat: Chat/9][9 pkts/1498 bytes <-> 8 pkts/871 bytes][Goodput ratio: 66/50][0.90 sec][Hostname/SNI: mqtt-mini.facebook.com][bytes ratio: 0.265 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/6 113/132 238/257 88/85][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 166/109 576/290 191/89][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.3][JA3C: 159db30fc8fac7fb58bcaeee8785a687][JA3S: fcb2d4d0991292272fcb1e464eedfd43][Cipher: TLS_AES_128_GCM_SHA256][Plen Bins: 28,14,0,0,0,14,0,14,0,0,0,0,14,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 4 TCP 10.8.0.1:51296 <-> 142.250.183.163:443 [proto: 91.239/TLS.GoogleServices][Encrypted][Confidence: DPI][cat: Web/5][3 pkts/384 bytes <-> 2 pkts/108 bytes][Goodput ratio: 52/0][0.00 sec][Hostname/SNI: crashlyticsreports-pa.googleapis.com][ALPN: http/1.1][TLSv1.2][JA3C: d8c87b9bfde38897979e41242626c2f3][Safari][Plen Bins: 0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 5 TCP 10.158.134.93:40454 <-> 216.58.196.68:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/120 bytes <-> 2 pkts/108 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 6 TCP 10.8.0.1:43600 <-> 172.217.194.188:5228 [proto: 126/Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/128 bytes <-> 1 pkts/54 bytes][Goodput ratio: 0/0][0.00 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 7 TCP 10.158.134.93:55512 -> 142.251.42.106:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][1 pkts/66 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - - -Undetected flows: - 1 TCP 10.8.0.1:42344 <-> 159.138.85.48:5223 [proto: 0/Unknown][ClearText][Confidence: Unknown][6 pkts/567 bytes <-> 5 pkts/323 bytes][Goodput ratio: 39/16][0.37 sec][bytes ratio: 0.274 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/50 56/79 122/101 56/20][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 94/65 208/91 56/15][Plen Bins: 25,25,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 4 TCP 10.8.0.1:42344 <-> 159.138.85.48:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][6 pkts/567 bytes <-> 5 pkts/323 bytes][Goodput ratio: 39/16][0.37 sec][bytes ratio: 0.274 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/50 56/79 122/101 56/20][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 94/65 208/91 56/15][Plen Bins: 25,25,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 TCP 10.8.0.1:51296 <-> 142.250.183.163:443 [proto: 91.239/TLS.GoogleServices][Encrypted][Confidence: DPI][cat: Web/5][3 pkts/384 bytes <-> 2 pkts/108 bytes][Goodput ratio: 52/0][0.00 sec][Hostname/SNI: crashlyticsreports-pa.googleapis.com][ALPN: http/1.1][TLSv1.2][JA3C: d8c87b9bfde38897979e41242626c2f3][Safari][Plen Bins: 0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 6 TCP 10.158.134.93:40454 <-> 216.58.196.68:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/120 bytes <-> 2 pkts/108 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 7 TCP 10.8.0.1:43600 <-> 172.217.194.188:5228 [proto: 126/Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/128 bytes <-> 1 pkts/54 bytes][Goodput ratio: 0/0][0.00 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 8 TCP 10.158.134.93:55512 -> 142.251.42.106:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][1 pkts/66 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/coap_mqtt.pcap.out b/tests/result/coap_mqtt.pcap.out index 4e8c0314c..ace83cad9 100644 --- a/tests/result/coap_mqtt.pcap.out +++ b/tests/result/coap_mqtt.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (1.75 pkts/flow) DPI Packets (UDP): 12 (1.00 pkts/flow) Confidence DPI : 16 (flows) -Num dissector calls: 364 (22.75 diss/flow) +Num dissector calls: 361 (22.56 diss/flow) COAP 19 1614 8 Dropbox 800 80676 4 diff --git a/tests/result/collectd.pcap.out b/tests/result/collectd.pcap.out index f0e526673..27b4ce8cf 100644 --- a/tests/result/collectd.pcap.out +++ b/tests/result/collectd.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 13 (1.62 pkts/flow) Confidence Match by port : 3 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 376 (47.00 diss/flow) +Num dissector calls: 378 (47.25 diss/flow) collectd 81 109386 8 diff --git a/tests/result/corba.pcap.out b/tests/result/corba.pcap.out index 465bd8c38..73ea64b1c 100644 --- a/tests/result/corba.pcap.out +++ b/tests/result/corba.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 273 (91.00 diss/flow) +Num dissector calls: 264 (88.00 diss/flow) Corba 22 3681 3 diff --git a/tests/result/dazn.pcapng.out b/tests/result/dazn.pcapng.out index 2cda8609b..ddf8fb043 100644 --- a/tests/result/dazn.pcapng.out +++ b/tests/result/dazn.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 39 (13.00 diss/flow) +Num dissector calls: 33 (11.00 diss/flow) Dazn 12 6675 3 diff --git a/tests/result/discord.pcap.out b/tests/result/discord.pcap.out index b371ad7ce..3c01e6653 100644 --- a/tests/result/discord.pcap.out +++ b/tests/result/discord.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 13 (13.00 diss/flow) +Num dissector calls: 11 (11.00 diss/flow) Discord 7 3708 1 diff --git a/tests/result/dnp3.pcap.out b/tests/result/dnp3.pcap.out index 7c33c704a..5022498ae 100644 --- a/tests/result/dnp3.pcap.out +++ b/tests/result/dnp3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 80 (10.00 pkts/flow) Confidence DPI : 8 (flows) -Num dissector calls: 408 (51.00 diss/flow) +Num dissector calls: 352 (44.00 diss/flow) DNP3 543 38754 8 diff --git a/tests/result/dns_doh.pcap.out b/tests/result/dns_doh.pcap.out index f8a59533c..eb8a008e5 100644 --- a/tests/result/dns_doh.pcap.out +++ b/tests/result/dns_doh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) DoH_DoT 142 20362 1 diff --git a/tests/result/dns_dot.pcap.out b/tests/result/dns_dot.pcap.out index 9033ba782..12f211a7e 100644 --- a/tests/result/dns_dot.pcap.out +++ b/tests/result/dns_dot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 20 (20.00 diss/flow) +Num dissector calls: 17 (17.00 diss/flow) DoH_DoT 24 5869 1 diff --git a/tests/result/dns_fragmented.pcap.out b/tests/result/dns_fragmented.pcap.out index b0e344079..61790c607 100644 --- a/tests/result/dns_fragmented.pcap.out +++ b/tests/result/dns_fragmented.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 12 (6.00 pkts/flow) DPI Packets (UDP): 39 (2.05 pkts/flow) Confidence DPI : 21 (flows) -Num dissector calls: 51 (2.43 diss/flow) +Num dissector calls: 45 (2.14 diss/flow) DNS 53 16888 18 Google 6 4807 3 diff --git a/tests/result/drda_db2.pcap.out b/tests/result/drda_db2.pcap.out index 88cfbbf7e..c6660f3e1 100644 --- a/tests/result/drda_db2.pcap.out +++ b/tests/result/drda_db2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 103 (103.00 diss/flow) +Num dissector calls: 100 (100.00 diss/flow) DRDA 38 6691 1 diff --git a/tests/result/emotet.pcap.out b/tests/result/emotet.pcap.out index 44f8f3167..06a71411f 100644 --- a/tests/result/emotet.pcap.out +++ b/tests/result/emotet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 48 (8.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 300 (50.00 diss/flow) +Num dissector calls: 281 (46.83 diss/flow) SMTP 626 438465 1 HTTP 1601 1581542 3 diff --git a/tests/result/ethereum.pcap.out b/tests/result/ethereum.pcap.out index 0db358b57..897de8459 100644 --- a/tests/result/ethereum.pcap.out +++ b/tests/result/ethereum.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 18 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence Match by IP : 2 (flows) Confidence DPI : 71 (flows) -Num dissector calls: 1515 (20.47 diss/flow) +Num dissector calls: 1353 (18.28 diss/flow) Mining 1997 215877 72 AmazonAWS 1 78 1 diff --git a/tests/result/exe_download.pcap.out b/tests/result/exe_download.pcap.out index 059e5720d..9fb6e10be 100644 --- a/tests/result/exe_download.pcap.out +++ b/tests/result/exe_download.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 703 717463 1 diff --git a/tests/result/exe_download_as_png.pcap.out b/tests/result/exe_download_as_png.pcap.out index 5c474e5fc..d175c0c1e 100644 --- a/tests/result/exe_download_as_png.pcap.out +++ b/tests/result/exe_download_as_png.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 534 529449 1 diff --git a/tests/result/facebook.pcap.out b/tests/result/facebook.pcap.out index b364ecb13..d2b670da2 100644 --- a/tests/result/facebook.pcap.out +++ b/tests/result/facebook.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 16 (8.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 36 (18.00 diss/flow) +Num dissector calls: 30 (15.00 diss/flow) Facebook 60 30511 2 diff --git a/tests/result/firefox.pcap.out b/tests/result/firefox.pcap.out index 1abaa0fed..72941a642 100644 --- a/tests/result/firefox.pcap.out +++ b/tests/result/firefox.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (6.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 108 (18.00 diss/flow) +Num dissector calls: 90 (15.00 diss/flow) TLS 5441 4952732 6 diff --git a/tests/result/fix2.pcap.out b/tests/result/fix2.pcap.out index 63ec519f0..fd7102646 100644 --- a/tests/result/fix2.pcap.out +++ b/tests/result/fix2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 212 (106.00 diss/flow) +Num dissector calls: 206 (103.00 diss/flow) FIX 3046 246540 2 diff --git a/tests/result/forticlient.pcap.out b/tests/result/forticlient.pcap.out index c2275d3b6..6b94d82a7 100644 --- a/tests/result/forticlient.pcap.out +++ b/tests/result/forticlient.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 35 (7.00 pkts/flow) Confidence DPI (cache) : 4 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 100 (20.00 diss/flow) +Num dissector calls: 85 (17.00 diss/flow) FortiClient 2000 430931 5 diff --git a/tests/result/ftp-start-tls.pcap.out b/tests/result/ftp-start-tls.pcap.out index 7f2486b6f..ef8df8bc4 100644 --- a/tests/result/ftp-start-tls.pcap.out +++ b/tests/result/ftp-start-tls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 181 (181.00 diss/flow) +Num dissector calls: 177 (177.00 diss/flow) FTP_CONTROL 51 7510 1 diff --git a/tests/result/ftp.pcap.out b/tests/result/ftp.pcap.out index 57cdff806..f83c57f2f 100644 --- a/tests/result/ftp.pcap.out +++ b/tests/result/ftp.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 97 (32.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 701 (233.67 diss/flow) +Num dissector calls: 691 (230.33 diss/flow) Unknown 1115 1122198 1 FTP_CONTROL 68 5571 1 diff --git a/tests/result/ftp_failed.pcap.out b/tests/result/ftp_failed.pcap.out index 8c52a2454..3944a87a0 100644 --- a/tests/result/ftp_failed.pcap.out +++ b/tests/result/ftp_failed.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 166 (166.00 diss/flow) +Num dissector calls: 161 (161.00 diss/flow) FTP_CONTROL 18 1700 1 diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out index 134c969f3..530fd71e9 100644 --- a/tests/result/fuzz-2006-06-26-2594.pcap.out +++ b/tests/result/fuzz-2006-06-26-2594.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 30 (flows) Confidence Match by port : 28 (flows) Confidence DPI : 193 (flows) -Num dissector calls: 5319 (21.19 diss/flow) +Num dissector calls: 5311 (21.16 diss/flow) Unknown 30 3356 30 FTP_CONTROL 36 2569 12 diff --git a/tests/result/fuzz-2006-09-29-28586.pcap.out b/tests/result/fuzz-2006-09-29-28586.pcap.out index 7ee7eec2e..162bb275f 100644 --- a/tests/result/fuzz-2006-09-29-28586.pcap.out +++ b/tests/result/fuzz-2006-09-29-28586.pcap.out @@ -6,7 +6,7 @@ Confidence Unknown : 3 (flows) Confidence Match by port : 23 (flows) Confidence Match by IP : 2 (flows) Confidence DPI : 12 (flows) -Num dissector calls: 1274 (31.85 diss/flow) +Num dissector calls: 1229 (30.73 diss/flow) Unknown 3 655 3 HTTP 116 27378 35 diff --git a/tests/result/genshin-impact.pcap.out b/tests/result/genshin-impact.pcap.out index e33e550b8..9bf666902 100644 --- a/tests/result/genshin-impact.pcap.out +++ b/tests/result/genshin-impact.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 565 (94.17 diss/flow) +Num dissector calls: 556 (92.67 diss/flow) GenshinImpact 90 18405 6 diff --git a/tests/result/git.pcap.out b/tests/result/git.pcap.out index 07187d19c..479f556cb 100644 --- a/tests/result/git.pcap.out +++ b/tests/result/git.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Git 90 74005 1 diff --git a/tests/result/gnutella.pcap.out b/tests/result/gnutella.pcap.out index 14e624d64..31e305a35 100644 --- a/tests/result/gnutella.pcap.out +++ b/tests/result/gnutella.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 595 (flows) Confidence Match by port : 1 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 163 (flows) -Num dissector calls: 64871 (85.36 diss/flow) +Num dissector calls: 64728 (85.17 diss/flow) Unknown 1423 119577 595 MDNS 18 1632 2 diff --git a/tests/result/google_ssl.pcap.out b/tests/result/google_ssl.pcap.out index 0612f182c..0dca16854 100644 --- a/tests/result/google_ssl.pcap.out +++ b/tests/result/google_ssl.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 28 (28.00 pkts/flow) Confidence Match by IP : 1 (flows) -Num dissector calls: 268 (268.00 diss/flow) +Num dissector calls: 261 (261.00 diss/flow) Google 28 9108 1 diff --git a/tests/result/googledns_android10.pcap.out b/tests/result/googledns_android10.pcap.out index 9b0f6a433..80c091efc 100644 --- a/tests/result/googledns_android10.pcap.out +++ b/tests/result/googledns_android10.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 42 (6.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 6 (flows) -Num dissector calls: 145 (18.12 diss/flow) +Num dissector calls: 122 (15.25 diss/flow) ICMP 4 392 1 Google 8 504 2 diff --git a/tests/result/gtp_false_positive.pcapng.out b/tests/result/gtp_false_positive.pcapng.out index 671adee97..96fd44a2d 100644 --- a/tests/result/gtp_false_positive.pcapng.out +++ b/tests/result/gtp_false_positive.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 7 (2.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) -Num dissector calls: 371 (123.67 diss/flow) +Num dissector calls: 373 (124.33 diss/flow) Unknown 5 428 1 GTP 2 424 2 diff --git a/tests/result/hpvirtgrp.pcap.out b/tests/result/hpvirtgrp.pcap.out index de31113dd..bb289b7ce 100644 --- a/tests/result/hpvirtgrp.pcap.out +++ b/tests/result/hpvirtgrp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 37 (4.11 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 1143 (127.00 diss/flow) +Num dissector calls: 1116 (124.00 diss/flow) HP_VIRTGRP 135 12739 9 diff --git a/tests/result/http-crash-content-disposition.pcap.out b/tests/result/http-crash-content-disposition.pcap.out index 65edad719..afd31f6fe 100644 --- a/tests/result/http-crash-content-disposition.pcap.out +++ b/tests/result/http-crash-content-disposition.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) AmazonAWS 9 3328 1 diff --git a/tests/result/http-lines-split.pcap.out b/tests/result/http-lines-split.pcap.out index dcd4da415..7554868b8 100644 --- a/tests/result/http-lines-split.pcap.out +++ b/tests/result/http-lines-split.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 14 2503 1 diff --git a/tests/result/http-manipulated.pcap.out b/tests/result/http-manipulated.pcap.out index 801cb5e50..835b9ccf3 100644 --- a/tests/result/http-manipulated.pcap.out +++ b/tests/result/http-manipulated.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 64 (32.00 diss/flow) +Num dissector calls: 58 (29.00 diss/flow) HTTP 328 959347 2 diff --git a/tests/result/http_auth.pcap.out b/tests/result/http_auth.pcap.out index a264630b2..a19d2405a 100644 --- a/tests/result/http_auth.pcap.out +++ b/tests/result/http_auth.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 33 20574 1 diff --git a/tests/result/http_connect.pcap.out b/tests/result/http_connect.pcap.out index c1130c4b4..d4fb2debe 100644 --- a/tests/result/http_connect.pcap.out +++ b/tests/result/http_connect.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 37 (12.33 diss/flow) +Num dissector calls: 31 (10.33 diss/flow) DNS 2 178 1 TLS 58 36496 1 diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out index e05b3ed55..a90b1a160 100644 --- a/tests/result/http_ipv6.pcap.out +++ b/tests/result/http_ipv6.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 8 (flows) -Num dissector calls: 264 (17.60 diss/flow) +Num dissector calls: 234 (15.60 diss/flow) Unknown 3 502 1 ntop 80 36401 4 diff --git a/tests/result/iec60780-5-104.pcap.out b/tests/result/iec60780-5-104.pcap.out index d036befeb..f68628337 100644 --- a/tests/result/iec60780-5-104.pcap.out +++ b/tests/result/iec60780-5-104.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 24 (4.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 108 (18.00 diss/flow) +Num dissector calls: 90 (15.00 diss/flow) IEC60870 147 9033 6 diff --git a/tests/result/imap-starttls.pcap.out b/tests/result/imap-starttls.pcap.out index 100f28744..65dd10236 100644 --- a/tests/result/imap-starttls.pcap.out +++ b/tests/result/imap-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 198 (198.00 diss/flow) +Num dissector calls: 193 (193.00 diss/flow) IMAPS 32 7975 1 diff --git a/tests/result/imap.pcap.out b/tests/result/imap.pcap.out index 27bf7ba31..2cd1781ca 100644 --- a/tests/result/imap.pcap.out +++ b/tests/result/imap.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 218 (218.00 diss/flow) +Num dissector calls: 215 (215.00 diss/flow) IMAP 33 3774 1 diff --git a/tests/result/imaps.pcap.out b/tests/result/imaps.pcap.out index 989991de4..003572281 100644 --- a/tests/result/imaps.pcap.out +++ b/tests/result/imaps.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 20 (20.00 diss/flow) +Num dissector calls: 17 (17.00 diss/flow) ntop 20 5196 1 diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out index 71c738e71..100ab28eb 100644 --- a/tests/result/instagram.pcap.out +++ b/tests/result/instagram.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by port : 6 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 30 (flows) -Num dissector calls: 2166 (57.00 diss/flow) +Num dissector calls: 2126 (55.95 diss/flow) Unknown 1 66 1 HTTP 116 91784 6 diff --git a/tests/result/iphone.pcap.out b/tests/result/iphone.pcap.out index 754e51322..4edd7738c 100644 --- a/tests/result/iphone.pcap.out +++ b/tests/result/iphone.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 55 (1.77 pkts/flow) DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 50 (flows) -Num dissector calls: 608 (11.92 diss/flow) +Num dissector calls: 563 (11.04 diss/flow) Unknown 2 120 1 MDNS 17 7012 5 diff --git a/tests/result/ipp.pcap.out b/tests/result/ipp.pcap.out index c82cecde4..85a64b9c5 100644 --- a/tests/result/ipp.pcap.out +++ b/tests/result/ipp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 21 (7.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 108 (36.00 diss/flow) +Num dissector calls: 99 (33.00 diss/flow) IPP 277 248554 3 diff --git a/tests/result/irc.pcap.out b/tests/result/irc.pcap.out index 84fb273f1..bb49ebbfe 100644 --- a/tests/result/irc.pcap.out +++ b/tests/result/irc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 172 (172.00 diss/flow) +Num dissector calls: 168 (168.00 diss/flow) IRC 29 8945 1 diff --git a/tests/result/ja3_lots_of_cipher_suites.pcap.out b/tests/result/ja3_lots_of_cipher_suites.pcap.out index 5cacdb0f3..69ed2a11a 100644 --- a/tests/result/ja3_lots_of_cipher_suites.pcap.out +++ b/tests/result/ja3_lots_of_cipher_suites.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) TLS 11 5132 1 diff --git a/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out b/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out index a09964eb1..484917416 100644 --- a/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out +++ b/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) TLS 27 6966 1 diff --git a/tests/result/jabber.pcap.out b/tests/result/jabber.pcap.out index a2b5d9f58..7139acbc1 100644 --- a/tests/result/jabber.pcap.out +++ b/tests/result/jabber.pcap.out @@ -1,9 +1,20 @@ Guessed flow protos: 0 -DPI Packets (TCP): 6 (6.00 pkts/flow) -Confidence DPI : 1 (flows) -Num dissector calls: 142 (142.00 diss/flow) +DPI Packets (TCP): 74 (6.17 pkts/flow) +Confidence DPI : 12 (flows) +Num dissector calls: 1525 (127.08 diss/flow) -Jabber 13 901 1 +Jabber 358 61304 12 - 1 TCP 192.168.58.1:53460 <-> 192.168.58.153:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][7 pkts/565 bytes <-> 6 pkts/336 bytes][Goodput ratio: 28/0][0.07 sec][bytes ratio: 0.254 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/14 13/7 48/14 18/7][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 81/56 173/66 38/4][PLAIN TEXT (xml version)][Plen Bins: 66,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 TCP 172.16.0.62:57094 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][44 pkts/5701 bytes <-> 42 pkts/13807 bytes][Goodput ratio: 49/80][2.17 sec][bytes ratio: -0.416 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 36/39 611/611 109/111][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 130/329 559/1514 104/415][PLAIN TEXT (xml version)][Plen Bins: 2,4,2,24,9,13,4,6,9,0,2,2,2,0,0,4,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0] + 2 TCP 172.16.0.62:57122 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][44 pkts/5701 bytes <-> 42 pkts/13806 bytes][Goodput ratio: 49/80][2.16 sec][bytes ratio: -0.415 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 36/39 521/520 99/101][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 130/329 677/1514 116/415][PLAIN TEXT (xml version)][Plen Bins: 2,4,2,22,9,15,4,7,9,0,2,2,2,0,0,2,0,0,0,2,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0] + 3 TCP 172.16.0.62:57149 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][21 pkts/2752 bytes <-> 17 pkts/3414 bytes][Goodput ratio: 50/67][656.22 sec][bytes ratio: -0.107 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 35858/700 600484/4996 141164/1575][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 131/201 305/529 77/137][PLAIN TEXT (presence to)][Plen Bins: 0,18,0,22,18,9,18,4,0,0,0,0,4,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 4 TCP 172.16.0.62:57129 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][16 pkts/2866 bytes <-> 9 pkts/2273 bytes][Goodput ratio: 63/74][423.43 sec][bytes ratio: 0.115 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/2 23604/41249 136091/136094 40743/50152][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 179/253 769/481 173/115][PLAIN TEXT (iq type)][Plen Bins: 0,0,6,18,18,6,12,18,6,0,0,0,6,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 TCP 172.16.0.62:57147 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][16 pkts/1698 bytes <-> 12 pkts/1584 bytes][Goodput ratio: 38/49][0.42 sec][bytes ratio: 0.035 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 32/52 333/333 89/108][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 106/132 404/351 90/93][PLAIN TEXT (xml version)][Plen Bins: 30,0,0,10,10,30,0,0,10,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 6 TCP 192.168.2.100:58388 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][9 pkts/809 bytes <-> 6 pkts/455 bytes][Goodput ratio: 37/26][300.65 sec][bytes ratio: 0.280 (Upload)][IAT c2s/s2c min/avg/max/stddev: 13/1 30058/52574 209840/209871 73396/90816][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/76 221/91 51/13][Plen Bins: 12,63,12,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 7 TCP 192.168.2.100:34070 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][9 pkts/808 bytes <-> 6 pkts/455 bytes][Goodput ratio: 37/26][279.71 sec][bytes ratio: 0.279 (Upload)][IAT c2s/s2c min/avg/max/stddev: 26/0 39051/68333 273088/273176 95545/118266][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/76 221/91 51/12][Plen Bins: 12,63,12,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 8 TCP 192.168.2.100:41420 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][8 pkts/791 bytes <-> 7 pkts/471 bytes][Goodput ratio: 43/15][35.65 sec][bytes ratio: 0.254 (Upload)][IAT c2s/s2c min/avg/max/stddev: 31/0 5924/67 35140/231 13066/91][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 99/67 221/91 53/11][Plen Bins: 28,28,28,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 9 TCP 192.168.2.100:34218 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][9 pkts/808 bytes <-> 6 pkts/453 bytes][Goodput ratio: 37/26][306.20 sec][bytes ratio: 0.282 (Upload)][IAT c2s/s2c min/avg/max/stddev: 23/1 42924/75084 299903/299938 104911/129819][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/76 221/91 51/13][Plen Bins: 12,63,12,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 10 TCP 192.168.2.100:37614 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][9 pkts/808 bytes <-> 6 pkts/453 bytes][Goodput ratio: 37/26][393.79 sec][bytes ratio: 0.282 (Upload)][IAT c2s/s2c min/avg/max/stddev: 24/1 13370/23387 93313/93412 32637/40429][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/76 221/91 51/13][Plen Bins: 12,63,12,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 11 TCP 192.168.58.1:53460 <-> 192.168.58.153:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][7 pkts/565 bytes <-> 6 pkts/336 bytes][Goodput ratio: 28/0][0.07 sec][bytes ratio: 0.254 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/14 13/7 48/14 18/7][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 81/56 173/66 38/4][PLAIN TEXT (xml version)][Plen Bins: 66,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 12 TCP 172.16.0.62:57126 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][4 pkts/280 bytes <-> 3 pkts/210 bytes][Goodput ratio: 6/0][0.00 sec][bytes ratio: 0.143 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 70/70 82/78 7/6][PLAIN TEXT (/stream)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/kerberos-login.pcap.out b/tests/result/kerberos-login.pcap.out index d305f3b2d..fa15d673a 100644 --- a/tests/result/kerberos-login.pcap.out +++ b/tests/result/kerberos-login.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) DPI Packets (UDP): 12 (1.00 pkts/flow) Confidence DPI : 13 (flows) -Num dissector calls: 35 (2.69 diss/flow) +Num dissector calls: 31 (2.38 diss/flow) Kerberos 39 37272 13 diff --git a/tests/result/kerberos.pcap.out b/tests/result/kerberos.pcap.out index 5ab16f635..e5b7ab086 100644 --- a/tests/result/kerberos.pcap.out +++ b/tests/result/kerberos.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (2.14 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 23 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 3863 (107.31 diss/flow) +Num dissector calls: 3865 (107.36 diss/flow) Unknown 9 3031 2 SMBv23 6 1914 3 diff --git a/tests/result/lisp_registration.pcap.out b/tests/result/lisp_registration.pcap.out index 6fe6db23f..134ed6b69 100644 --- a/tests/result/lisp_registration.pcap.out +++ b/tests/result/lisp_registration.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 232 (58.00 diss/flow) +Num dissector calls: 226 (56.50 diss/flow) LISP 30 5266 4 diff --git a/tests/result/log4j-webapp-exploit.pcap.out b/tests/result/log4j-webapp-exploit.pcap.out index 817084f4a..aa5170e9e 100644 --- a/tests/result/log4j-webapp-exploit.pcap.out +++ b/tests/result/log4j-webapp-exploit.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 111 (15.86 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 569 (81.29 diss/flow) +Num dissector calls: 549 (78.43 diss/flow) Unknown 356 25081 2 HTTP 34 6741 3 diff --git a/tests/result/long_tls_certificate.pcap.out b/tests/result/long_tls_certificate.pcap.out index c82ad1250..c5b18b67e 100644 --- a/tests/result/long_tls_certificate.pcap.out +++ b/tests/result/long_tls_certificate.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (12.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Alibaba 47 14812 1 diff --git a/tests/result/malware.pcap.out b/tests/result/malware.pcap.out index a759a779c..83539ecf0 100644 --- a/tests/result/malware.pcap.out +++ b/tests/result/malware.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 42 (8.40 diss/flow) +Num dissector calls: 38 (7.60 diss/flow) DNS 2 216 1 HTTP 1 66 1 diff --git a/tests/result/memcached.cap.out b/tests/result/memcached.cap.out index 315c18e59..3b61ed2ee 100644 --- a/tests/result/memcached.cap.out +++ b/tests/result/memcached.cap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 139 (139.00 diss/flow) +Num dissector calls: 135 (135.00 diss/flow) Memcached 10 1711 1 diff --git a/tests/result/monero.pcap.out b/tests/result/monero.pcap.out index 8f9a8a1e2..37c9d46da 100644 --- a/tests/result/monero.pcap.out +++ b/tests/result/monero.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 94 (47.00 diss/flow) +Num dissector calls: 88 (44.00 diss/flow) Mining 319 166676 2 diff --git a/tests/result/mongodb.pcap.out b/tests/result/mongodb.pcap.out index 41bb93a32..217e7ae43 100644 --- a/tests/result/mongodb.pcap.out +++ b/tests/result/mongodb.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 27 (3.38 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 239 (29.88 diss/flow) +Num dissector calls: 217 (27.12 diss/flow) Unknown 3 230 1 MongoDB 24 2510 7 diff --git a/tests/result/mpeg-dash.pcap.out b/tests/result/mpeg-dash.pcap.out index 9ccf2c17f..4289fc287 100644 --- a/tests/result/mpeg-dash.pcap.out +++ b/tests/result/mpeg-dash.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (2.50 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 93 (23.25 diss/flow) +Num dissector calls: 88 (22.00 diss/flow) AmazonAWS 9 2693 3 MpegDash 4 1976 1 diff --git a/tests/result/mpeg.pcap.out b/tests/result/mpeg.pcap.out index 966b42c6a..dbac65857 100644 --- a/tests/result/mpeg.pcap.out +++ b/tests/result/mpeg.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) ntop 19 10643 1 diff --git a/tests/result/mqtt.pcap.out b/tests/result/mqtt.pcap.out index 2f7add490..8dfc471fc 100644 --- a/tests/result/mqtt.pcap.out +++ b/tests/result/mqtt.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (1.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 9 (4.50 diss/flow) +Num dissector calls: 8 (4.00 diss/flow) MQTT 9 1481 2 diff --git a/tests/result/mssql_tds.pcap.out b/tests/result/mssql_tds.pcap.out index 7afca8fa3..678fa52d9 100644 --- a/tests/result/mssql_tds.pcap.out +++ b/tests/result/mssql_tds.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 18 (1.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 285 (23.75 diss/flow) +Num dissector calls: 287 (23.92 diss/flow) MsSQL-TDS 38 16260 12 diff --git a/tests/result/mysql-8.pcap.out b/tests/result/mysql-8.pcap.out index 5210a832e..b7f3f0beb 100644 --- a/tests/result/mysql-8.pcap.out +++ b/tests/result/mysql-8.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) MySQL 4 367 1 diff --git a/tests/result/nats.pcap.out b/tests/result/nats.pcap.out index cc329c0da..2d5e55056 100644 --- a/tests/result/nats.pcap.out +++ b/tests/result/nats.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 64 (32.00 diss/flow) +Num dissector calls: 56 (28.00 diss/flow) Nats 27 2460 2 diff --git a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out index c68fc0818..86a5158c2 100644 --- a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out +++ b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 25 (25.00 diss/flow) +Num dissector calls: 24 (24.00 diss/flow) SOAP 13 2935 1 diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out index 92367ca22..fed1d3419 100644 --- a/tests/result/nest_log_sink.pcap.out +++ b/tests/result/nest_log_sink.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 176 (13.54 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 2195 (156.79 diss/flow) +Num dissector calls: 2104 (150.29 diss/flow) DNS 15 1612 1 NestLogSink 676 112058 12 diff --git a/tests/result/netbios.pcap.out b/tests/result/netbios.pcap.out index 1d5a27846..5d31a930b 100644 --- a/tests/result/netbios.pcap.out +++ b/tests/result/netbios.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 14 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 14 (flows) -Num dissector calls: 137 (9.13 diss/flow) +Num dissector calls: 136 (9.07 diss/flow) NetBIOS 258 24196 13 SMBv1 2 486 2 diff --git a/tests/result/netflix.pcap.out b/tests/result/netflix.pcap.out index 394360cef..341e1f477 100644 --- a/tests/result/netflix.pcap.out +++ b/tests/result/netflix.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (2.08 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 60 (flows) -Num dissector calls: 1250 (20.49 diss/flow) +Num dissector calls: 1110 (18.20 diss/flow) DNS 4 386 2 SSDP 16 2648 1 diff --git a/tests/result/nintendo.pcap.out b/tests/result/nintendo.pcap.out index 573f5e82e..54016ff23 100644 --- a/tests/result/nintendo.pcap.out +++ b/tests/result/nintendo.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 35 (2.33 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by IP : 6 (flows) Confidence DPI : 15 (flows) -Num dissector calls: 1314 (62.57 diss/flow) +Num dissector calls: 1310 (62.38 diss/flow) ICMP 30 2100 2 Nintendo 890 320242 12 diff --git a/tests/result/nntp.pcap.out b/tests/result/nntp.pcap.out index 32a122e87..43a7e1a1d 100644 --- a/tests/result/nntp.pcap.out +++ b/tests/result/nntp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 145 (145.00 diss/flow) +Num dissector calls: 141 (141.00 diss/flow) Usenet 32 7037 1 diff --git a/tests/result/no_sni.pcap.out b/tests/result/no_sni.pcap.out index bf05e1f48..a806185f7 100644 --- a/tests/result/no_sni.pcap.out +++ b/tests/result/no_sni.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 51 (6.38 pkts/flow) Confidence DPI : 8 (flows) -Num dissector calls: 127 (15.88 diss/flow) +Num dissector calls: 106 (13.25 diss/flow) DoH_DoT 268 31882 1 Cloudflare 917 562254 7 diff --git a/tests/result/ocs.pcap.out b/tests/result/ocs.pcap.out index 1a7c4e2a7..d5d25cb93 100644 --- a/tests/result/ocs.pcap.out +++ b/tests/result/ocs.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 92 (7.67 pkts/flow) DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 18 (flows) -Num dissector calls: 222 (11.10 diss/flow) +Num dissector calls: 200 (10.00 diss/flow) Google 29 3320 5 OCS 863 57552 7 diff --git a/tests/result/ocsp.pcapng.out b/tests/result/ocsp.pcapng.out index 4061abd12..8db082c9e 100644 --- a/tests/result/ocsp.pcapng.out +++ b/tests/result/ocsp.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 60 (6.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 320 (32.00 diss/flow) +Num dissector calls: 290 (29.00 diss/flow) HTTP 23 10871 1 OCSP 321 62776 9 diff --git a/tests/result/ookla.pcap.out b/tests/result/ookla.pcap.out index 477103dd9..6c33fdd4c 100644 --- a/tests/result/ookla.pcap.out +++ b/tests/result/ookla.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 16 (8.00 pkts/flow) Confidence DPI (cache) : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 145 (72.50 diss/flow) +Num dissector calls: 139 (69.50 diss/flow) Ookla 5086 4689745 2 diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out index f3b34fc66..a8eb736cc 100644 --- a/tests/result/openvpn.pcap.out +++ b/tests/result/openvpn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) DPI Packets (UDP): 5 (2.50 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 399 (133.00 diss/flow) +Num dissector calls: 395 (131.67 diss/flow) OpenVPN 298 57111 3 diff --git a/tests/result/oracle12.pcapng.out b/tests/result/oracle12.pcapng.out index 6038f6900..db76f0737 100644 --- a/tests/result/oracle12.pcapng.out +++ b/tests/result/oracle12.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 20 (20.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 314 (314.00 diss/flow) +Num dissector calls: 311 (311.00 diss/flow) Oracle 20 2518 1 diff --git a/tests/result/pgsql.pcap.out b/tests/result/pgsql.pcap.out index e78f56619..2a19914b7 100644 --- a/tests/result/pgsql.pcap.out +++ b/tests/result/pgsql.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 278 (139.00 diss/flow) +Num dissector calls: 270 (135.00 diss/flow) PostgreSQL 39 4709 2 diff --git a/tests/result/pinterest.pcap.out b/tests/result/pinterest.pcap.out index 61cd55954..650960951 100644 --- a/tests/result/pinterest.pcap.out +++ b/tests/result/pinterest.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 16 DPI Packets (TCP): 224 (6.05 pkts/flow) Confidence Match by port : 16 (flows) Confidence DPI : 21 (flows) -Num dissector calls: 425 (11.49 diss/flow) +Num dissector calls: 333 (9.00 diss/flow) TLS 979 1924858 20 Facebook 242 237988 2 diff --git a/tests/result/pluralsight.pcap.out b/tests/result/pluralsight.pcap.out index 19415d334..2d4995bc0 100644 --- a/tests/result/pluralsight.pcap.out +++ b/tests/result/pluralsight.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 33 (5.50 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 78 (13.00 diss/flow) +Num dissector calls: 66 (11.00 diss/flow) Pluralsight 44 29652 6 diff --git a/tests/result/pop3.pcap.out b/tests/result/pop3.pcap.out index 89f65c615..8171df058 100644 --- a/tests/result/pop3.pcap.out +++ b/tests/result/pop3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 196 (196.00 diss/flow) +Num dissector calls: 191 (191.00 diss/flow) POP3 31 3915 1 diff --git a/tests/result/pops.pcapng.out b/tests/result/pops.pcapng.out index 4407b2750..0ec1ad423 100644 --- a/tests/result/pops.pcapng.out +++ b/tests/result/pops.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 13 (13.00 diss/flow) POPS 5 2998 1 diff --git a/tests/result/pps.pcap.out b/tests/result/pps.pcap.out index 4f3d7ceb6..4bf187ab9 100644 --- a/tests/result/pps.pcap.out +++ b/tests/result/pps.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 201 (4.57 pkts/flow) Confidence Unknown : 34 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 71 (flows) -Num dissector calls: 6416 (59.96 diss/flow) +Num dissector calls: 6427 (60.07 diss/flow) Unknown 990 378832 34 HTTP 377 402676 46 diff --git a/tests/result/pptp.pcap.out b/tests/result/pptp.pcap.out index c65c847a3..e321170f5 100644 --- a/tests/result/pptp.pcap.out +++ b/tests/result/pptp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 63 (63.00 diss/flow) PPTP 24 2328 1 diff --git a/tests/result/psiphon3.pcap.out b/tests/result/psiphon3.pcap.out index afd80def8..cdad295eb 100644 --- a/tests/result/psiphon3.pcap.out +++ b/tests/result/psiphon3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (12.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 23 (23.00 diss/flow) +Num dissector calls: 19 (19.00 diss/flow) Psiphon 62 11818 1 diff --git a/tests/result/punycode-idn.pcap.out b/tests/result/punycode-idn.pcap.out index 86b2f11c4..e7dc4475f 100644 --- a/tests/result/punycode-idn.pcap.out +++ b/tests/result/punycode-idn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 34 (11.33 diss/flow) +Num dissector calls: 31 (10.33 diss/flow) DNS 2 162 1 HTTP 12 1597 1 diff --git a/tests/result/radius_false_positive.pcapng.out b/tests/result/radius_false_positive.pcapng.out index 511e6637f..6b7f1d774 100644 --- a/tests/result/radius_false_positive.pcapng.out +++ b/tests/result/radius_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 10 (10.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 180 (180.00 diss/flow) +Num dissector calls: 182 (182.00 diss/flow) Unknown 10 7479 1 diff --git a/tests/result/rdp.pcap.out b/tests/result/rdp.pcap.out index 8533a8fbd..f0bc275a0 100644 --- a/tests/result/rdp.pcap.out +++ b/tests/result/rdp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) RDP 2010 622743 1 diff --git a/tests/result/reasm_crash_anon.pcapng.out b/tests/result/reasm_crash_anon.pcapng.out index 66c11808f..7c223a646 100644 --- a/tests/result/reasm_crash_anon.pcapng.out +++ b/tests/result/reasm_crash_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 81 (81.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 335 (335.00 diss/flow) +Num dissector calls: 337 (337.00 diss/flow) Unknown 200 20067 1 diff --git a/tests/result/reasm_segv_anon.pcapng.out b/tests/result/reasm_segv_anon.pcapng.out index cfed4a73d..73a0cdfe4 100644 --- a/tests/result/reasm_segv_anon.pcapng.out +++ b/tests/result/reasm_segv_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 81 (81.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 338 (338.00 diss/flow) +Num dissector calls: 336 (336.00 diss/flow) HTTP 82 77940 1 diff --git a/tests/result/reddit.pcap.out b/tests/result/reddit.pcap.out index 399fcba38..b7816cb49 100644 --- a/tests/result/reddit.pcap.out +++ b/tests/result/reddit.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 445 (7.42 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 59 (flows) -Num dissector calls: 839 (13.98 diss/flow) +Num dissector calls: 659 (10.98 diss/flow) TLS 508 331149 13 Twitter 863 686585 3 diff --git a/tests/result/rsh.pcap.out b/tests/result/rsh.pcap.out index 7796b2f4e..f319d3470 100644 --- a/tests/result/rsh.pcap.out +++ b/tests/result/rsh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 332 (166.00 diss/flow) +Num dissector calls: 324 (162.00 diss/flow) RSH 24 1721 2 diff --git a/tests/result/rsync.pcap.out b/tests/result/rsync.pcap.out index 323118a22..0153b6e26 100644 --- a/tests/result/rsync.pcap.out +++ b/tests/result/rsync.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 188 (188.00 diss/flow) +Num dissector calls: 183 (183.00 diss/flow) RSYNC 30 2493 1 diff --git a/tests/result/rtmp.pcap.out b/tests/result/rtmp.pcap.out index c78fd4d33..d34e8e54c 100644 --- a/tests/result/rtmp.pcap.out +++ b/tests/result/rtmp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 170 (170.00 diss/flow) +Num dissector calls: 165 (165.00 diss/flow) RTMP 26 8368 1 diff --git a/tests/result/rtsp.pcap.out b/tests/result/rtsp.pcap.out index a59a794f2..d9feb9fd7 100644 --- a/tests/result/rtsp.pcap.out +++ b/tests/result/rtsp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 87 (12.43 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 310 (44.29 diss/flow) +Num dissector calls: 256 (36.57 diss/flow) RTSP 568 100872 7 diff --git a/tests/result/safari.pcap.out b/tests/result/safari.pcap.out index 2aece435a..18654eebb 100644 --- a/tests/result/safari.pcap.out +++ b/tests/result/safari.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 46 (6.57 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 126 (18.00 diss/flow) +Num dissector calls: 105 (15.00 diss/flow) TLS 6019 5570309 7 diff --git a/tests/result/salesforce.pcap.out b/tests/result/salesforce.pcap.out index eb832c64b..12f0b9c86 100644 --- a/tests/result/salesforce.pcap.out +++ b/tests/result/salesforce.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Salesforce 15 5205 1 diff --git a/tests/result/sccp_hw_conf_register.pcapng.out b/tests/result/sccp_hw_conf_register.pcapng.out index 26f83a155..d2f013bee 100644 --- a/tests/result/sccp_hw_conf_register.pcapng.out +++ b/tests/result/sccp_hw_conf_register.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) CiscoSkinny 17 1522 1 diff --git a/tests/result/selfsigned.pcap.out b/tests/result/selfsigned.pcap.out index 2e2adf081..3d433501a 100644 --- a/tests/result/selfsigned.pcap.out +++ b/tests/result/selfsigned.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 25 (25.00 diss/flow) +Num dissector calls: 21 (21.00 diss/flow) ntop 20 3766 1 diff --git a/tests/result/signal.pcap.out b/tests/result/signal.pcap.out index d76d87f3b..6feaef838 100644 --- a/tests/result/signal.pcap.out +++ b/tests/result/signal.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 97 (6.47 pkts/flow) DPI Packets (UDP): 5 (1.67 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence DPI : 19 (flows) -Num dissector calls: 223 (11.74 diss/flow) +Num dissector calls: 187 (9.84 diss/flow) DNS 2 186 1 DHCP 4 1368 1 diff --git a/tests/result/simple-dnscrypt.pcap.out b/tests/result/simple-dnscrypt.pcap.out index 9c69a8afe..4b804b84a 100644 --- a/tests/result/simple-dnscrypt.pcap.out +++ b/tests/result/simple-dnscrypt.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 47 (11.75 pkts/flow) Confidence DPI (cache) : 3 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 72 (18.00 diss/flow) +Num dissector calls: 60 (15.00 diss/flow) DNScrypt 111 44676 4 diff --git a/tests/result/sip_hello.pcapng.out b/tests/result/sip_hello.pcapng.out index 3dd0e2f29..5f4797eb8 100644 --- a/tests/result/sip_hello.pcapng.out +++ b/tests/result/sip_hello.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 208 (208.00 diss/flow) +Num dissector calls: 210 (210.00 diss/flow) SIP 30 5592 1 diff --git a/tests/result/sites.pcapng.out b/tests/result/sites.pcapng.out index 4f5397832..90f173ca6 100644 --- a/tests/result/sites.pcapng.out +++ b/tests/result/sites.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence Match by IP : 3 (flows) Confidence DPI : 43 (flows) -Num dissector calls: 630 (13.40 diss/flow) +Num dissector calls: 533 (11.34 diss/flow) HTTP 2 148 1 Xbox 4 2245 1 diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out index fbb332b2e..db9211b9a 100644 --- a/tests/result/skype.pcap.out +++ b/tests/result/skype.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 61 (flows) Confidence Match by port : 27 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 204 (flows) -Num dissector calls: 32494 (110.90 diss/flow) +Num dissector calls: 32126 (109.65 diss/flow) Unknown 1575 272476 61 DNS 2 267 1 diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out index 3c83f3c36..65719b382 100644 --- a/tests/result/skype_no_unknown.pcap.out +++ b/tests/result/skype_no_unknown.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 45 (flows) Confidence Match by port : 22 (flows) Confidence DPI : 200 (flows) -Num dissector calls: 26571 (99.52 diss/flow) +Num dissector calls: 26274 (98.40 diss/flow) Unknown 850 152468 45 DNS 2 267 1 diff --git a/tests/result/smb_frags.pcap.out b/tests/result/smb_frags.pcap.out index 69a0164b4..09aab382e 100644 --- a/tests/result/smb_frags.pcap.out +++ b/tests/result/smb_frags.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 161 (161.00 diss/flow) +Num dissector calls: 159 (159.00 diss/flow) SMBv1 8 2763 1 diff --git a/tests/result/smpp_in_general.pcap.out b/tests/result/smpp_in_general.pcap.out index 57ba71483..334d974c6 100644 --- a/tests/result/smpp_in_general.pcap.out +++ b/tests/result/smpp_in_general.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 104 (104.00 diss/flow) +Num dissector calls: 101 (101.00 diss/flow) SMPP 17 1144 1 diff --git a/tests/result/smtp-starttls.pcap.out b/tests/result/smtp-starttls.pcap.out index 4211cd474..bb240e768 100644 --- a/tests/result/smtp-starttls.pcap.out +++ b/tests/result/smtp-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Google 36 8403 1 diff --git a/tests/result/smtp.pcap.out b/tests/result/smtp.pcap.out index 9e70e354e..5bbe595e7 100644 --- a/tests/result/smtp.pcap.out +++ b/tests/result/smtp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 212 (212.00 diss/flow) +Num dissector calls: 208 (208.00 diss/flow) SMTP 95 23157 1 diff --git a/tests/result/smtps.pcapng.out b/tests/result/smtps.pcapng.out index 6ce445685..670ed2419 100644 --- a/tests/result/smtps.pcapng.out +++ b/tests/result/smtps.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 13 (13.00 diss/flow) SMTPS 4 936 1 diff --git a/tests/result/snapchat.pcap.out b/tests/result/snapchat.pcap.out index a2781a132..6ff4f180b 100644 --- a/tests/result/snapchat.pcap.out +++ b/tests/result/snapchat.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 18 (6.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 54 (18.00 diss/flow) +Num dissector calls: 45 (15.00 diss/flow) Google 22 2879 1 Snapchat 34 7320 2 diff --git a/tests/result/soap.pcap.out b/tests/result/soap.pcap.out index 5e6d6b8b4..b3b914695 100644 --- a/tests/result/soap.pcap.out +++ b/tests/result/soap.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (3.67 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 369 (123.00 diss/flow) +Num dissector calls: 366 (122.00 diss/flow) Microsoft 1 1506 1 SOAP 19 9442 2 diff --git a/tests/result/socks-http-example.pcap.out b/tests/result/socks-http-example.pcap.out index 16aab48eb..dcadc21e8 100644 --- a/tests/result/socks-http-example.pcap.out +++ b/tests/result/socks-http-example.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 29 (9.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 531 (177.00 diss/flow) +Num dissector calls: 520 (173.33 diss/flow) SOCKS 46 8383 3 diff --git a/tests/result/softether-http.pcap.out b/tests/result/softether-http.pcap.out index 702d3a2d6..95d83222d 100644 --- a/tests/result/softether-http.pcap.out +++ b/tests/result/softether-http.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) Softether 4 1392 1 diff --git a/tests/result/ssh.pcap.out b/tests/result/ssh.pcap.out index 0e3295097..7e85e85c4 100644 --- a/tests/result/ssh.pcap.out +++ b/tests/result/ssh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) SSH 258 35546 1 diff --git a/tests/result/ssl-cert-name-mismatch.pcap.out b/tests/result/ssl-cert-name-mismatch.pcap.out index 264617bed..80ba311e2 100644 --- a/tests/result/ssl-cert-name-mismatch.pcap.out +++ b/tests/result/ssl-cert-name-mismatch.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) GoogleCloud 21 5412 1 diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out index 71d76cc25..7e996c351 100644 --- a/tests/result/starcraft_battle.pcap.out +++ b/tests/result/starcraft_battle.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 8 (flows) Confidence Match by IP : 5 (flows) Confidence DPI : 39 (flows) -Num dissector calls: 1954 (37.58 diss/flow) +Num dissector calls: 1873 (36.02 diss/flow) DNS 26 2848 7 HTTP 450 294880 19 diff --git a/tests/result/stun_signal.pcapng.out b/tests/result/stun_signal.pcapng.out index ddf62cc95..426da18fa 100644 --- a/tests/result/stun_signal.pcapng.out +++ b/tests/result/stun_signal.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence DPI (partial) : 1 (flows) Confidence DPI (cache) : 2 (flows) Confidence DPI : 20 (flows) -Num dissector calls: 1838 (79.91 diss/flow) +Num dissector calls: 1846 (80.26 diss/flow) ICMP 53 5186 2 GoogleHangoutDuo 40 2720 4 diff --git a/tests/result/synscan.pcap.out b/tests/result/synscan.pcap.out index 9f67e2214..c6b391182 100644 --- a/tests/result/synscan.pcap.out +++ b/tests/result/synscan.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1992 DPI Packets (TCP): 2011 (1.01 pkts/flow) Confidence Unknown : 1868 (flows) Confidence Match by port : 126 (flows) -Num dissector calls: 13987 (7.01 diss/flow) +Num dissector calls: 11984 (6.01 diss/flow) Unknown 1872 108584 1868 FTP_CONTROL 2 116 2 diff --git a/tests/result/syslog.pcap.out b/tests/result/syslog.pcap.out index 7d794c4db..546e7982e 100644 --- a/tests/result/syslog.pcap.out +++ b/tests/result/syslog.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 10 (5.00 pkts/flow) DPI Packets (UDP): 20 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 21 (flows) -Num dissector calls: 75 (3.41 diss/flow) +Num dissector calls: 73 (3.32 diss/flow) Unknown 1 78 1 Syslog 93 20321 21 diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out index c44fdba1b..b29ff3448 100644 --- a/tests/result/teams.pcap.out +++ b/tests/result/teams.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by IP : 1 (flows) Confidence DPI (partial) : 1 (flows) Confidence DPI : 80 (flows) -Num dissector calls: 1283 (15.46 diss/flow) +Num dissector calls: 1166 (14.05 diss/flow) Unknown 4 456 1 DNS 10 1357 5 diff --git a/tests/result/teamviewer.pcap.out b/tests/result/teamviewer.pcap.out index e2cb0a102..4c0e93893 100644 --- a/tests/result/teamviewer.pcap.out +++ b/tests/result/teamviewer.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 161 (80.50 diss/flow) +Num dissector calls: 159 (79.50 diss/flow) TeamViewer 1298 704218 2 diff --git a/tests/result/telegram.pcap.out b/tests/result/telegram.pcap.out index 284f205d3..57abf22e1 100644 --- a/tests/result/telegram.pcap.out +++ b/tests/result/telegram.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 5 DPI Packets (UDP): 93 (1.94 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 46 (flows) -Num dissector calls: 1676 (34.92 diss/flow) +Num dissector calls: 1678 (34.96 diss/flow) Unknown 304 72496 2 DNS 8 716 4 diff --git a/tests/result/telnet.pcap.out b/tests/result/telnet.pcap.out index c32e97589..03dab2978 100644 --- a/tests/result/telnet.pcap.out +++ b/tests/result/telnet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 167 (167.00 diss/flow) +Num dissector calls: 163 (163.00 diss/flow) Telnet 87 7418 1 diff --git a/tests/result/tftp.pcap.out b/tests/result/tftp.pcap.out index 9aa19884c..765bfcdb4 100644 --- a/tests/result/tftp.pcap.out +++ b/tests/result/tftp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 13 (1.86 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 300 (42.86 diss/flow) +Num dissector calls: 302 (43.14 diss/flow) TFTP 107 31296 7 diff --git a/tests/result/threema.pcap.out b/tests/result/threema.pcap.out index 5ed877b48..3063bb027 100644 --- a/tests/result/threema.pcap.out +++ b/tests/result/threema.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 66 (11.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 1348 (224.67 diss/flow) +Num dissector calls: 1334 (222.33 diss/flow) Threema 83 11578 6 diff --git a/tests/result/tinc.pcap.out b/tests/result/tinc.pcap.out index 3673c2105..972426f23 100644 --- a/tests/result/tinc.pcap.out +++ b/tests/result/tinc.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 19 (9.50 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI (cache) : 2 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 565 (141.25 diss/flow) +Num dissector calls: 557 (139.25 diss/flow) TINC 317 352291 4 diff --git a/tests/result/tls_alert.pcap.out b/tests/result/tls_alert.pcap.out index 6726ca2b0..830dcdde0 100644 --- a/tests/result/tls_alert.pcap.out +++ b/tests/result/tls_alert.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 19 (9.50 diss/flow) +Num dissector calls: 16 (8.00 diss/flow) TLS 7 533 1 Google 11 952 1 diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out index f3c6e29c0..8c4385eaa 100644 --- a/tests/result/tls_certificate_too_long.pcap.out +++ b/tests/result/tls_certificate_too_long.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 784 (22.40 diss/flow) +Num dissector calls: 751 (21.46 diss/flow) Unknown 13 5582 1 MDNS 5 983 3 diff --git a/tests/result/tls_esni_sni_both.pcap.out b/tests/result/tls_esni_sni_both.pcap.out index ffc582aa1..55447114f 100644 --- a/tests/result/tls_esni_sni_both.pcap.out +++ b/tests/result/tls_esni_sni_both.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 36 (18.00 diss/flow) +Num dissector calls: 30 (15.00 diss/flow) Cloudflare 38 15899 2 diff --git a/tests/result/tls_false_positives.pcapng.out b/tests/result/tls_false_positives.pcapng.out index 5b13c02a8..fd047dade 100644 --- a/tests/result/tls_false_positives.pcapng.out +++ b/tests/result/tls_false_positives.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 30 (30.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 407 (407.00 diss/flow) +Num dissector calls: 408 (408.00 diss/flow) Unknown 30 37313 1 diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out index 3ff497c2f..837c43721 100644 --- a/tests/result/tls_invalid_reads.pcap.out +++ b/tests/result/tls_invalid_reads.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 10 (3.33 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 147 (49.00 diss/flow) +Num dissector calls: 143 (47.67 diss/flow) TLS 7 1827 1 Crashlytics 3 560 1 diff --git a/tests/result/tls_long_cert.pcap.out b/tests/result/tls_long_cert.pcap.out index ae1ee5a6d..4251e3d83 100644 --- a/tests/result/tls_long_cert.pcap.out +++ b/tests/result/tls_long_cert.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) TLS 182 117601 1 diff --git a/tests/result/tls_port_80.pcapng.out b/tests/result/tls_port_80.pcapng.out index d498233dd..586a6e683 100644 --- a/tests/result/tls_port_80.pcapng.out +++ b/tests/result/tls_port_80.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 13 (13.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 20 (20.00 diss/flow) +Num dissector calls: 17 (17.00 diss/flow) TLS 13 2439 1 diff --git a/tests/result/tls_torrent.pcapng.out b/tests/result/tls_torrent.pcapng.out index c80af76a0..f4852eb48 100644 --- a/tests/result/tls_torrent.pcapng.out +++ b/tests/result/tls_torrent.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 13 (13.00 diss/flow) +Num dissector calls: 11 (11.00 diss/flow) BitTorrent 7 6308 1 diff --git a/tests/result/tls_verylong_certificate.pcap.out b/tests/result/tls_verylong_certificate.pcap.out index 8f74dda01..f0d348799 100644 --- a/tests/result/tls_verylong_certificate.pcap.out +++ b/tests/result/tls_verylong_certificate.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) TLS 48 22229 1 diff --git a/tests/result/tor.pcap.out b/tests/result/tor.pcap.out index 28806f21e..549b17689 100644 --- a/tests/result/tor.pcap.out +++ b/tests/result/tor.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 43 (5.38 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 10 (flows) -Num dissector calls: 177 (16.09 diss/flow) +Num dissector calls: 155 (14.09 diss/flow) SMBv1 1 252 1 TLS 2028 1601908 4 diff --git a/tests/result/trickbot.pcap.out b/tests/result/trickbot.pcap.out index d4aea00d4..d4b7f3595 100644 --- a/tests/result/trickbot.pcap.out +++ b/tests/result/trickbot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 74 62002 1 diff --git a/tests/result/tumblr.pcap.out b/tests/result/tumblr.pcap.out index 0b351ebbf..d9ffdd088 100644 --- a/tests/result/tumblr.pcap.out +++ b/tests/result/tumblr.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 32 DPI Packets (TCP): 237 (5.04 pkts/flow) Confidence Match by port : 28 (flows) Confidence DPI : 19 (flows) -Num dissector calls: 411 (8.74 diss/flow) +Num dissector calls: 323 (6.87 diss/flow) Yahoo 31 9933 1 Tumblr 1733 1208864 2 diff --git a/tests/result/tunnelbear.pcap.out b/tests/result/tunnelbear.pcap.out index 109e3b5c6..bf168ff0d 100644 --- a/tests/result/tunnelbear.pcap.out +++ b/tests/result/tunnelbear.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (TCP): 125 (5.95 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 20 (flows) -Num dissector calls: 379 (18.05 diss/flow) +Num dissector calls: 316 (15.05 diss/flow) TLS 34 13737 2 Google 5 306 1 diff --git a/tests/result/ultrasurf.pcap.out b/tests/result/ultrasurf.pcap.out index 45bbc93f4..6fe3c1363 100644 --- a/tests/result/ultrasurf.pcap.out +++ b/tests/result/ultrasurf.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 13 (4.33 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 160 (53.33 diss/flow) +Num dissector calls: 154 (51.33 diss/flow) TLS 5171 5127023 2 UltraSurf 2971 2991918 1 diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out index cfd203dff..31236788f 100644 --- a/tests/result/viber.pcap.out +++ b/tests/result/viber.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (1.93 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by IP : 4 (flows) Confidence DPI : 25 (flows) -Num dissector calls: 757 (26.10 diss/flow) +Num dissector calls: 719 (24.79 diss/flow) DNS 8 1267 4 MDNS 4 412 1 diff --git a/tests/result/vnc.pcap.out b/tests/result/vnc.pcap.out index 760f06f35..593745647 100644 --- a/tests/result/vnc.pcap.out +++ b/tests/result/vnc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 286 (143.00 diss/flow) +Num dissector calls: 280 (140.00 diss/flow) VNC 4551 329158 2 diff --git a/tests/result/wa_video.pcap.out b/tests/result/wa_video.pcap.out index 0d490880b..6cfc8d954 100644 --- a/tests/result/wa_video.pcap.out +++ b/tests/result/wa_video.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 81 (81.00 pkts/flow) DPI Packets (UDP): 13 (1.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 545 (38.93 diss/flow) +Num dissector calls: 546 (39.00 diss/flow) SSDP 8 1377 3 DHCP 2 684 1 diff --git a/tests/result/wa_voice.pcap.out b/tests/result/wa_voice.pcap.out index 02d1f638e..b9d6f7ebb 100644 --- a/tests/result/wa_voice.pcap.out +++ b/tests/result/wa_voice.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 33 (1.57 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 27 (flows) -Num dissector calls: 508 (18.14 diss/flow) +Num dissector calls: 497 (17.75 diss/flow) Unknown 2 120 1 MDNS 10 1188 2 diff --git a/tests/result/waze.pcap.out b/tests/result/waze.pcap.out index 54d289469..74f86de6d 100644 --- a/tests/result/waze.pcap.out +++ b/tests/result/waze.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 9 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 990 (30.00 diss/flow) +Num dissector calls: 887 (26.88 diss/flow) Unknown 10 786 1 HTTP 65 64777 8 diff --git a/tests/result/webex.pcap.out b/tests/result/webex.pcap.out index 12c19e46a..e9bc2c5b2 100644 --- a/tests/result/webex.pcap.out +++ b/tests/result/webex.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 17 (8.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence Match by IP : 3 (flows) Confidence DPI : 53 (flows) -Num dissector calls: 1247 (21.88 diss/flow) +Num dissector calls: 1087 (19.07 diss/flow) HTTP 22 3182 2 TLS 106 11841 8 diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out index faa9524f8..15b2e5c9f 100644 --- a/tests/result/wechat.pcap.out +++ b/tests/result/wechat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Match by port : 17 (flows) Confidence Match by IP : 8 (flows) Confidence DPI : 78 (flows) -Num dissector calls: 1811 (17.58 diss/flow) +Num dissector calls: 1531 (14.86 diss/flow) DNS 13 1075 8 HTTP 70 4620 8 diff --git a/tests/result/weibo.pcap.out b/tests/result/weibo.pcap.out index 93549c109..363cfeff9 100644 --- a/tests/result/weibo.pcap.out +++ b/tests/result/weibo.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 44 (3.14 pkts/flow) Confidence Match by port : 13 (flows) Confidence Match by IP : 8 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 987 (22.43 diss/flow) +Num dissector calls: 925 (21.02 diss/flow) DNS 6 630 3 HTTP 19 2275 5 diff --git a/tests/result/whatsapp.pcap.out b/tests/result/whatsapp.pcap.out index 5fb2e26a1..adef2b112 100644 --- a/tests/result/whatsapp.pcap.out +++ b/tests/result/whatsapp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 344 (4.00 pkts/flow) Confidence DPI : 86 (flows) -Num dissector calls: 13330 (155.00 diss/flow) +Num dissector calls: 13158 (153.00 diss/flow) WhatsApp 679 96293 86 diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out index 9ad6d881e..632cece10 100644 --- a/tests/result/whatsapp_login_call.pcap.out +++ b/tests/result/whatsapp_login_call.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 16 (flows) Confidence DPI : 37 (flows) -Num dissector calls: 767 (13.46 diss/flow) +Num dissector calls: 690 (12.11 diss/flow) HTTP 11 726 3 MDNS 8 952 4 diff --git a/tests/result/whatsapp_login_chat.pcap.out b/tests/result/whatsapp_login_chat.pcap.out index 529977ee5..ad80872b4 100644 --- a/tests/result/whatsapp_login_chat.pcap.out +++ b/tests/result/whatsapp_login_chat.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 25 (8.33 pkts/flow) DPI Packets (UDP): 7 (1.17 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 320 (35.56 diss/flow) +Num dissector calls: 316 (35.11 diss/flow) MDNS 2 202 2 DHCP 6 2052 1 diff --git a/tests/result/whatsapp_voice_and_message.pcap.out b/tests/result/whatsapp_voice_and_message.pcap.out index 35f953260..ea8787fd4 100644 --- a/tests/result/whatsapp_voice_and_message.pcap.out +++ b/tests/result/whatsapp_voice_and_message.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 20 (4.00 pkts/flow) DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence DPI : 13 (flows) -Num dissector calls: 568 (43.69 diss/flow) +Num dissector calls: 553 (42.54 diss/flow) WhatsAppCall 44 5916 8 WhatsApp 217 22139 5 diff --git a/tests/result/whatsappfiles.pcap.out b/tests/result/whatsappfiles.pcap.out index 86152b7a0..927310911 100644 --- a/tests/result/whatsappfiles.pcap.out +++ b/tests/result/whatsappfiles.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 14 (7.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 36 (18.00 diss/flow) +Num dissector calls: 30 (15.00 diss/flow) WhatsAppFiles 620 452233 2 diff --git a/tests/result/whois.pcapng.out b/tests/result/whois.pcapng.out index 5bd20e422..7050cd29a 100644 --- a/tests/result/whois.pcapng.out +++ b/tests/result/whois.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 16 (5.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 222 (74.00 diss/flow) +Num dissector calls: 215 (71.67 diss/flow) TLS 7 2046 1 Whois-DAS 16 4294 2 diff --git a/tests/result/windowsupdate_over_http.pcap.out b/tests/result/windowsupdate_over_http.pcap.out index 215aba005..c55aba02f 100644 --- a/tests/result/windowsupdate_over_http.pcap.out +++ b/tests/result/windowsupdate_over_http.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) WindowsUpdate 20 15975 1 diff --git a/tests/result/wow.pcap.out b/tests/result/wow.pcap.out index 1c8107121..972e454fa 100644 --- a/tests/result/wow.pcap.out +++ b/tests/result/wow.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (7.20 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 237 (47.40 diss/flow) +Num dissector calls: 217 (43.40 diss/flow) WorldOfWarcraft 95 10688 5 diff --git a/tests/result/xiaomi.pcap.out b/tests/result/xiaomi.pcap.out index 9ee5e97ed..73bbb1682 100644 --- a/tests/result/xiaomi.pcap.out +++ b/tests/result/xiaomi.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 19 (2.71 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 779 (111.29 diss/flow) +Num dissector calls: 767 (109.57 diss/flow) Xiaomi 52 11467 7 diff --git a/tests/result/xss.pcap.out b/tests/result/xss.pcap.out index 60ca773de..ca3f0c265 100644 --- a/tests/result/xss.pcap.out +++ b/tests/result/xss.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 9 (4.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 49 (24.50 diss/flow) +Num dissector calls: 43 (21.50 diss/flow) HTTP 11 3209 2 diff --git a/tests/result/youtubeupload.pcap.out b/tests/result/youtubeupload.pcap.out index 1e9e69b24..00f6cfb00 100644 --- a/tests/result/youtubeupload.pcap.out +++ b/tests/result/youtubeupload.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 20 (6.67 diss/flow) +Num dissector calls: 17 (5.67 diss/flow) YouTubeUpload 137 127038 3 diff --git a/tests/result/z3950.pcapng.out b/tests/result/z3950.pcapng.out index 89c9cdf84..3e2e6aedf 100644 --- a/tests/result/z3950.pcapng.out +++ b/tests/result/z3950.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 502 (251.00 diss/flow) +Num dissector calls: 497 (248.50 diss/flow) Z3950 31 6308 2 diff --git a/tests/result/zabbix.pcap.out b/tests/result/zabbix.pcap.out index de10216f7..c907c5830 100644 --- a/tests/result/zabbix.pcap.out +++ b/tests/result/zabbix.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Zabbix 10 715 1 diff --git a/tests/result/zattoo.pcap.out b/tests/result/zattoo.pcap.out index 1ebbdef98..77e208862 100644 --- a/tests/result/zattoo.pcap.out +++ b/tests/result/zattoo.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 49 (24.50 diss/flow) +Num dissector calls: 43 (21.50 diss/flow) Zattoo 32 13467 2 diff --git a/tests/result/zcash.pcap.out b/tests/result/zcash.pcap.out index a17fc501a..2167c29c1 100644 --- a/tests/result/zcash.pcap.out +++ b/tests/result/zcash.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 47 (47.00 diss/flow) +Num dissector calls: 44 (44.00 diss/flow) Mining 145 20644 1 diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out index c9c40ec39..b9873da96 100644 --- a/tests/result/zoom.pcap.out +++ b/tests/result/zoom.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 25 (1.47 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 31 (flows) -Num dissector calls: 971 (29.42 diss/flow) +Num dissector calls: 942 (28.55 diss/flow) DNS 2 205 1 MDNS 1 87 1 diff --git a/tests/result/zoom2.pcap.out b/tests/result/zoom2.pcap.out index aeaa48b98..007b4edea 100644 --- a/tests/result/zoom2.pcap.out +++ b/tests/result/zoom2.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 75 (25.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by IP : 3 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 940 (188.00 diss/flow) +Num dissector calls: 943 (188.60 diss/flow) ICMP 27 1890 1 Zoom 11950 9004950 4 |