aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/include/ndpi_protocol_ids.h8
-rw-r--r--src/lib/ndpi_content_match.c.inc21
-rw-r--r--src/lib/protocols/dns.c2
-rw-r--r--src/lib/protocols/quic.c229
-rw-r--r--src/lib/protocols/rx.c4
-rw-r--r--tests/pcap/quic.pcapbin261506 -> 356878 bytes
-rw-r--r--tests/pcap/weibo.pcapbin0 -> 275547 bytes
-rw-r--r--tests/result/6in4tunnel.pcap.out8
-rw-r--r--tests/result/NTPv3.pcap.out4
-rw-r--r--tests/result/http_ipv6.pcap.out4
-rw-r--r--tests/result/quic.pcap.out17
-rw-r--r--tests/result/weibo.pcap.out51
12 files changed, 196 insertions, 152 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 23d659bd2..4e06da989 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -269,10 +269,12 @@
#define NDPI_SERVICE_OFFICE_365 219
#define NDPI_SERVICE_CLOUDFLARE 220
#define NDPI_SERVICE_MS_ONE_DRIVE 221
-#define NDPI_PROTOCOL_MQTT 222
-#define NDPI_PROTOCOL_RX 223 /* RX: RPC protocol used by AFS */
+#define NDPI_PROTOCOL_MQTT 222
+#define NDPI_PROTOCOL_RX 223
+#define NDPI_SERVICE_WEIBO 224
+#define NDPI_SERVICE_OPENDNS 225
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_RX
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_SERVICE_OPENDNS
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index af6215842..8c05bd87d 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -22,7 +22,13 @@
static ndpi_network host_protocol_list[] = {
- /*
+ /*
+ OpenDNS
+ 208.67.216.0/21
+ */
+ { 0xD043D800 /* 208.67.216.0/21 */, 21, NDPI_SERVICE_OPENDNS },
+
+ /*
Microsoft Corporation (MS One Drive)
204.79.195.0/24
204.79.196.0/23
@@ -40,7 +46,6 @@ static ndpi_network host_protocol_list[] = {
{ 0x83FD1200 /* 131.253.18.0/24 */, 24, NDPI_SERVICE_MS_ONE_DRIVE },
{ 0x4136BF00 /* 65.54.191.0/24 */, 24, NDPI_SERVICE_MS_ONE_DRIVE },
-
/*
Amazon-EU-AWS Elastic Compute Cloud, EC2 (also used by Netflix)
46.137.128.0/18
@@ -7253,6 +7258,7 @@ ndpi_protocol_match host_match[] = {
{ "images-amazon.com", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
{ "amazonaws.com", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
{ "amazon-adsystem.com", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".cloudfront.net", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
{ ".apple.com", "Apple", NDPI_SERVICE_APPLE, NDPI_PROTOCOL_ACCEPTABLE },
{ ".mzstatic.com", "Apple", NDPI_SERVICE_APPLE, NDPI_PROTOCOL_ACCEPTABLE },
{ ".icloud.com", "AppleiCloud", NDPI_SERVICE_APPLE_ICLOUD, NDPI_PROTOCOL_ACCEPTABLE },
@@ -7333,6 +7339,12 @@ ndpi_protocol_match host_match[] = {
{ "tim.com.br", "TIM", NDPI_SERVICE_TIM, NDPI_PROTOCOL_ACCEPTABLE },
{ "tim.it", "TIM", NDPI_SERVICE_TIM, NDPI_PROTOCOL_ACCEPTABLE },
{ ".qq.com", "QQ", NDPI_PROTOCOL_QQ, NDPI_PROTOCOL_FUN },
+ { ".weibo.com", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+ { ".sinaimg.cn", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+ { ".sinajs.cn", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+ { ".sina.cn", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+ { ".sina.com.cn", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+
/* https://support.cipafilter.com/index.php?/Knowledgebase/Article/View/117/0/snapchat---how-to-block */
{ "feelinsonice.appspot.com", "Snapchat", NDPI_SERVICE_SNAPCHAT, NDPI_PROTOCOL_FUN },
@@ -7386,7 +7398,7 @@ ndpi_protocol_match host_match[] = {
{ "evsecure-ocsp.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ "evsecure-aia.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ "evsecure-crl.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
- { ".omniroot.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".omniroot.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ ".verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ ".symcb.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ ".symcd.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
@@ -7400,7 +7412,10 @@ ndpi_protocol_match host_match[] = {
{ "coby.ns.cloudflare.com", "Cloudflare", NDPI_SERVICE_CLOUDFLARE, NDPI_PROTOCOL_ACCEPTABLE },
{ "amanda.ns.cloudflare.com", "Cloudflare", NDPI_SERVICE_CLOUDFLARE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "d295hzzivaok4k.cloudfront.net", "OpenDNS", NDPI_SERVICE_OPENDNS, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".opendns.com", "OpenDNS", NDPI_SERVICE_OPENDNS, NDPI_PROTOCOL_ACCEPTABLE },
+
{ NULL, 0 }
};
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index c54c62f18..f8b50f733 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -75,7 +75,7 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
if((dns_header.flags & FLAGS_MASK) == 0x0000)
is_query = 1;
/* 0x8000 RESPONSE */
- else if((dns_header.flags & FLAGS_MASK) != 0x8000)
+ else if((dns_header.flags & FLAGS_MASK) == 0x8000)
is_query = 0;
else
invalid = 1;
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index fed4dc2ac..ac443951b 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1,11 +1,12 @@
/*
* quic.c
*
+ * Copyright (C) 2012-16 - ntop.org
+ *
+ * Based on code of:
* Andrea Buscarinu - <andrea.buscarinu@gmail.com>
* Michele Campus - <campus@ntop.org>
*
- * Copyright (C) 2012-15 - ntop.org
- *
* This module is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
@@ -24,163 +25,125 @@
#include "ndpi_api.h"
-#define QUIC_NO_V_RES_RSV 0xC3 // 1100 0011
-
-#define QUIC_CID_MASK 0x0C // 0000 1100
-#define QUIC_VER_MASK 0x01 // 0000 0001
-#define QUIC_SEQ_MASK 0x30 // 0011 0000
+#ifdef NDPI_PROTOCOL_QUIC
-#define CID_LEN_8 0x0C // 0000 1100
-#define CID_LEN_4 0x08 // 0000 1000
-#define CID_LEN_1 0x04 // 0000 0100
-#define CID_LEN_0 0x00 // 0000 0000
+static int quic_ports(u_int16_t sport, u_int16_t dport)
+{
+ if ((sport == 443 || dport == 443 || sport == 80 || dport == 80) &&
+ (sport != 123 && dport != 123))
+ return 1;
-#define SEQ_LEN_6 0x30 // 0011 0000
-#define SEQ_LEN_4 0x20 // 0010 0000
-#define SEQ_LEN_2 0x10 // 0001 0000
-#define SEQ_LEN_1 0x00 // 0000 0000
+ return 0;
+}
-#define SEQ_CONV(ARR) (ARR[0] | ARR[1] | ARR[2] | ARR[3] | ARR[4] | ARR[5] << 8)
+/* ***************************************************************** */
+static int quic_payload(const u_int8_t *payload) {
+ if((payload[0] == 'Q')
+ && isdigit(payload[1])
+ && isdigit(payload[2])
+ && isdigit(payload[3]))
+ return(1);
-#ifdef NDPI_PROTOCOL_QUIC
-static void ndpi_int_quic_add_connection(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN);
+ return(0);
}
-static int connect_id(const unsigned char pflags)
-{
- u_int cid_len;
-
- // Check CID length.
- switch (pflags & QUIC_CID_MASK)
- {
- case CID_LEN_8: cid_len = 8; break;
- case CID_LEN_4: cid_len = 4; break;
- case CID_LEN_1: cid_len = 1; break;
- case CID_LEN_0: cid_len = 0; break;
- default:
- return -1;
-
- }
- // Return offset.
- return cid_len + 1;
+/* ***************************************************************** */
+
+static int quic_len(u_int8_t l) {
+ switch(l) {
+ case 0:
+ return(1);
+ break;
+ case 1:
+ return(2);
+ break;
+ case 2:
+ return(4);
+ break;
+ case 3:
+ return(8);
+ break;
+ }
+
+ return(0); /* NOTREACHED */
}
-static int sequence(const unsigned char *payload)
+/* ***************************************************************** */
+
+void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
{
- unsigned char conv[6] = {0};
- u_int seq_value = -1;
- int seq_lens;
- int cid_offs;
+ struct ndpi_packet_struct *packet = &flow->packet;
+ u_int32_t udp_len = packet->payload_packet_len;
+ u_int version_len = ((packet->payload[0] & 0x01) == 0) ? 0 : 4;
+ u_int cid_len = quic_len((packet->payload[0] & 0x0C) >> 2);
+ u_int seq_len = quic_len((packet->payload[0] & 0x30) >> 4);
+ u_int quic_hlen = 1 /* flags */ + version_len + seq_len + cid_len;
+
+ if(packet->udp != NULL
+ && (udp_len > (quic_hlen+4 /* QXXX */))
+ && ((packet->payload[0] & 0xC2) == 0x00)
+ && (quic_ports(ntohs(packet->udp->source), ntohs(packet->udp->dest)))
+ ) {
+ char *begin;
int i;
- // Search SEQ bytes length.
- switch (payload[0] & QUIC_SEQ_MASK)
- {
- case SEQ_LEN_6: seq_lens = 6; break;
- case SEQ_LEN_4: seq_lens = 4; break;
- case SEQ_LEN_2: seq_lens = 2; break;
- case SEQ_LEN_1: seq_lens = 1; break;
- default:
- return -1;
- }
- // Retrieve SEQ offset.
- cid_offs = connect_id(payload[0]);
-
- if (cid_offs >= 0 && seq_lens > 0)
- {
- for (i = 0; i < seq_lens; i++)
- conv[i] = payload[cid_offs + i];
-
- seq_value = SEQ_CONV(conv);
- }
-
- // Return SEQ dec value;
- return seq_value;
-}
+ if((version_len > 0) && (packet->payload[1+cid_len] != 'Q'))
+ goto no_quic;
-void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- struct ndpi_packet_struct *packet = &flow->packet;
- int ver_offs;
-
- if(packet->udp != NULL) {
-
- u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
-
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "calculating quic over udp.\n");
-
- if((((sport == 80) || (dport == 80) || (sport == 443) || (dport == 443))))
- {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
-
-
- // Settings without version. First check if PUBLIC FLAGS & SEQ bytes are 0x0. SEQ must be 1 at least.
- if ((packet->payload[0] == 0x00 && packet->payload[1] != 0x00) || ((packet->payload[0] & QUIC_NO_V_RES_RSV) == 0))
- {
- if (sequence(packet->payload) < 1)
- {
-
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
- }
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN);
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
- ndpi_int_quic_add_connection(ndpi_struct, flow);
- }
+ if(!strncmp((char*)&packet->payload[quic_hlen+17], "CHLO" /* Client Hello */, 4)) {
+ /* Check if SNI (Server Name Identification) is present */
+ for(i=quic_hlen+12; i<udp_len-3; i++) {
+ if((packet->payload[i] == 'S')
+ && (packet->payload[i+1] == 'N')
+ && (packet->payload[i+2] == 'I')
+ && (packet->payload[i+3] == 0)) {
+ u_int32_t offset = *((u_int32_t*)&packet->payload[i+4]);
+ u_int32_t prev_offset = *((u_int32_t*)&packet->payload[i-4]);
+ int len = offset-prev_offset;
+ int sni_offset = i+prev_offset+1;
+
+ while((packet->payload[sni_offset] == '-') && (sni_offset < udp_len))
+ sni_offset++;
- // Check if version, than the CID length.
- else if (packet->payload[0] & QUIC_VER_MASK)
- {
- // Skip CID length.
- ver_offs = connect_id(packet->payload[0]);
-
- if (ver_offs >= 0)
- {
- unsigned char vers[] = {packet->payload[ver_offs], packet->payload[ver_offs + 1],
- packet->payload[ver_offs + 2], packet->payload[ver_offs + 3]};
-
- // Version Match.
- if ((vers[0] == 'Q' && vers[1] == '0') &&
- ((vers[2] == '3' && (vers[3] == '3' || vers[3] == '2' || vers[3] == '1' || vers[3] == '0' )) ||
- (vers[2] == '2' && (vers[3] == '9' || vers[3] == '8' || vers[3] == '7' || vers[3] == '6' ||
- vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
- vers[3] == '1' || vers[3] == '0')) ||
- (vers[2] == '1' && (vers[3] == '9' || vers[3] == '8' || vers[3] == '7' || vers[3] == '6' ||
- vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
- vers[3] == '1' || vers[3] == '0')) ||
- (vers[2] == '0' && vers[3] == '9')))
-
- {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
- ndpi_int_quic_add_connection(ndpi_struct, flow);
+ if((sni_offset+len) < udp_len) {
+ int max_len = sizeof(flow->host_server_name)-1, j = 0;
+
+ if(len > max_len) len = max_len;
+
+ while((len > 0) && (sni_offset < udp_len)) {
+ flow->host_server_name[j++] = packet->payload[sni_offset];
+ sni_offset++, len--;
}
}
+
+ break;
}
- }
- else
- {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
}
}
+ return;
+ }
+
+ no_quic:
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude QUIC.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
}
+/* ***************************************************************** */
-void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask)
{
- ndpi_set_bitmask_protocol_detection("Quic", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_QUIC,
- ndpi_search_quic,
+ ndpi_set_bitmask_protocol_detection("QUIC", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_QUIC, ndpi_search_quic,
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
*id += 1;
}
-#endif
+#endif /* NDPI_PROTOCOL_QUIC */
diff --git a/src/lib/protocols/rx.c b/src/lib/protocols/rx.c
index b7ebd5a4b..8ae98aafd 100644
--- a/src/lib/protocols/rx.c
+++ b/src/lib/protocols/rx.c
@@ -150,8 +150,8 @@ void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct,
found = 1;
else {
NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX);
- return;
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX);
+ return;
}
}
else {
diff --git a/tests/pcap/quic.pcap b/tests/pcap/quic.pcap
index 5de878c1a..1b1994a70 100644
--- a/tests/pcap/quic.pcap
+++ b/tests/pcap/quic.pcap
Binary files differ
diff --git a/tests/pcap/weibo.pcap b/tests/pcap/weibo.pcap
new file mode 100644
index 000000000..44ab450c9
--- /dev/null
+++ b/tests/pcap/weibo.pcap
Binary files differ
diff --git a/tests/result/6in4tunnel.pcap.out b/tests/result/6in4tunnel.pcap.out
index 8e7d1cec7..7786f4a3a 100644
--- a/tests/result/6in4tunnel.pcap.out
+++ b/tests/result/6in4tunnel.pcap.out
@@ -4,13 +4,13 @@ SSL 28 15397 1
ICMPV6 48 7862 3
Facebook 37 14726 3
- 1 TCP [2001:470:1f17:13f:3e97:eff:fe73:4dec]:443 <-> [2a03:2880:1010:6f03:face:b00c:0:2]:53234 [proto: 91.119/SSL.Facebook][33 pkts/13926 bytes][SSL client: www.facebook.com]
- 2 UDP [2001:470:1f16:13f::2]:6404 <-> [2a03:2880:fffe:b:face:b00c:0:99]:53 [proto: 5.119/DNS.Facebook][2 pkts/394 bytes][Host: star.c10r.facebook.com]
+ 1 TCP [2001:470:1f17:13f:3e97:eff:fe73:4dec]:443 <-> [2a03:2880:1010:6f03:face:b00c::2]:53234 [proto: 91.119/SSL.Facebook][33 pkts/13926 bytes][SSL client: www.facebook.com]
+ 2 UDP [2001:470:1f16:13f::2]:6404 <-> [2a03:2880:fffe:b:face:b00c::99]:53 [proto: 5.119/DNS.Facebook][2 pkts/394 bytes][Host: star.c10r.facebook.com]
3 TCP [2001:470:1f17:13f:3e97:eff:fe73:4dec]:443 <-> [2604:a880:1:20::224:b001]:60205 [proto: 91/SSL][28 pkts/15397 bytes][SSL client: mail.tomasu.net]
4 ICMPV6 [2001:470:1f16:13f::2]:0 <-> [2604:a880:1:20::224:b001]:0 [proto: 102/ICMPV6][1 pkts/200 bytes]
- 5 ICMPV6 [2a03:2880:1010:6f03:face:b00c:0:2]:0 <-> [2001:470:1f17:13f:3e97:eff:fe73:4dec]:0 [proto: 102/ICMPV6][1 pkts/1314 bytes]
+ 5 ICMPV6 [2a03:2880:1010:6f03:face:b00c::2]:0 <-> [2001:470:1f17:13f:3e97:eff:fe73:4dec]:0 [proto: 102/ICMPV6][1 pkts/1314 bytes]
6 TCP [2604:a880:1:20::224:b001]:993 <-> [2001:470:1f17:13f:6d69:c72:7313:616f]:35610 [proto: 51/IMAPS][2 pkts/258 bytes]
7 ICMPV6 [2001:470:1f17:13f:3e97:eff:fe73:4dec]:0 <-> [2604:a880:1:20::224:b001]:0 [proto: 102/ICMPV6][46 pkts/6348 bytes]
8 TCP [2604:a880:1:20::224:b001]:993 <-> [2001:470:1f17:13f:6d69:c72:7313:616f]:56381 [proto: 51/IMAPS][2 pkts/258 bytes]
- 9 UDP [2001:470:1f16:13f::2]:53959 <-> [2a03:2880:fffe:b:face:b00c:0:99]:53 [proto: 5.119/DNS.Facebook][2 pkts/406 bytes][Host: star.c10r.facebook.com]
+ 9 UDP [2001:470:1f16:13f::2]:53959 <-> [2a03:2880:fffe:b:face:b00c::99]:53 [proto: 5.119/DNS.Facebook][2 pkts/406 bytes][Host: star.c10r.facebook.com]
10 TCP [2001:470:1f17:13f:3e97:eff:fe73:4dec]:80 <-> [2604:a880:1:20::224:b001]:41538 [proto: 7/HTTP][10 pkts/1792 bytes][Host: mail.tomasu.net]
diff --git a/tests/result/NTPv3.pcap.out b/tests/result/NTPv3.pcap.out
index d7937ec96..91d817e5e 100644
--- a/tests/result/NTPv3.pcap.out
+++ b/tests/result/NTPv3.pcap.out
@@ -1,3 +1,3 @@
-QUIC 1 90 1
+NTP 1 90 1
- 1 UDP 78.46.76.2:80 <-> 175.144.140.29:123 [proto: 188/QUIC][1 pkts/90 bytes]
+ 1 UDP 78.46.76.2:80 <-> 175.144.140.29:123 [proto: 9/NTP][1 pkts/90 bytes]
diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out
index 71cb7be63..ab9b3e6ef 100644
--- a/tests/result/http_ipv6.pcap.out
+++ b/tests/result/http_ipv6.pcap.out
@@ -14,6 +14,6 @@ QUIC 65 16479 2
10 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4006:803::2008]:58660 [proto: 91/SSL][2 pkts/172 bytes]
11 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4001:803::1012]:59690 [proto: 91/SSL][2 pkts/172 bytes]
12 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:60124 <-> [2a02:26f0:ad:1a1::eed]:443 [proto: 91/SSL][2 pkts/172 bytes]
- 13 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:40308 <-> [2a03:2880:1010:3f20:face:b00c:0:25de]:443 [proto: 91/SSL][2 pkts/172 bytes]
- 14 UDP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4001:803::1017]:45931 [proto: 188/QUIC][62 pkts/15977 bytes]
+ 13 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:40308 <-> [2a03:2880:1010:3f20:face:b00c::25de]:443 [proto: 91/SSL][2 pkts/172 bytes]
+ 14 UDP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4001:803::1017]:45931 [proto: 188/QUIC][62 pkts/15977 bytes][Host: www.google.it]
15 UDP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:55145 <-> [2a00:1450:400b:c02::5f]:443 [proto: 188/QUIC][3 pkts/502 bytes]
diff --git a/tests/result/quic.pcap.out b/tests/result/quic.pcap.out
index 5cde7c822..9c56d2d75 100644
--- a/tests/result/quic.pcap.out
+++ b/tests/result/quic.pcap.out
@@ -1,3 +1,16 @@
-QUIC 413 254874 1
+Unknown 6 7072 1
+QUIC 512 341494 9
- 1 UDP 216.58.212.101:443 <-> 192.168.1.109:57833 [proto: 188/QUIC][413 pkts/254874 bytes]
+ 1 UDP 192.168.1.105:48445 <-> 216.58.214.110:443 [proto: 188/QUIC][3 pkts/2863 bytes][Host: i.ytimg.com]
+ 2 UDP 192.168.1.105:53817 <-> 216.58.210.225:443 [proto: 188/QUIC][2 pkts/2784 bytes][Host: yt3.ggpht.com]
+ 3 UDP 216.58.212.101:443 <-> 192.168.1.109:57833 [proto: 188/QUIC][413 pkts/254874 bytes][Host: mail.google.com]
+ 4 UDP 172.217.16.3:443 <-> 192.168.1.105:40461 [proto: 188/QUIC][3 pkts/364 bytes]
+ 5 UDP 172.217.16.4:443 <-> 192.168.1.105:45669 [proto: 188/QUIC][5 pkts/4334 bytes][Host: www.google.com]
+ 6 UDP 192.168.1.105:34438 <-> 216.58.210.238:443 [proto: 188/QUIC][7 pkts/6545 bytes][Host: www.youtube.com]
+ 7 UDP 192.168.1.109:35236 <-> 216.58.210.206:443 [proto: 188/QUIC][69 pkts/58433 bytes][Host: www.youtube.com]
+ 8 UDP 192.168.1.105:40030 <-> 216.58.201.227:443 [proto: 188/QUIC][6 pkts/5729 bytes][Host: fonts.gstatic.com]
+ 9 UDP 192.168.1.105:55934 <-> 216.58.201.238:443 [proto: 188/QUIC][4 pkts/5568 bytes][Host: s.ytimg.com]
+
+
+Undetected flows:
+ 1 UDP 10.0.0.3:6121 <-> 10.0.0.4:40134 [proto: 0/Unknown][6 pkts/7072 bytes]
diff --git a/tests/result/weibo.pcap.out b/tests/result/weibo.pcap.out
new file mode 100644
index 000000000..f9982efd5
--- /dev/null
+++ b/tests/result/weibo.pcap.out
@@ -0,0 +1,51 @@
+DNS 11 1129 6
+HTTP 19 2275 5
+SSL 17 1366 11
+Google 10 660 5
+QUIC 23 4118 2
+Weibo 418 258007 15
+
+ 1 TCP 140.205.174.1:443 <-> 192.168.1.105:48352 [proto: 91/SSL][1 pkts/74 bytes]
+ 2 TCP 140.205.174.1:443 <-> 192.168.1.105:48356 [proto: 91/SSL][1 pkts/74 bytes]
+ 3 TCP 192.168.1.105:59120 <-> 114.134.80.162:80 [proto: 7/HTTP][3 pkts/194 bytes]
+ 4 TCP 216.58.212.65:443 <-> 192.168.1.105:34699 [proto: 91.126/SSL.Google][2 pkts/132 bytes]
+ 5 TCP 222.73.28.96:80 <-> 192.168.1.105:42275 [proto: 7.224/HTTP.Weibo][4 pkts/676 bytes][Host: u1.img.mobile.sina.cn]
+ 6 UDP 192.168.1.1:53 <-> 192.168.1.105:50533 [proto: 5.224/DNS.Weibo][1 pkts/74 bytes][Host: data.weibo.com]
+ 7 UDP 192.168.1.1:53 <-> 192.168.1.105:53543 [proto: 5.224/DNS.Weibo][2 pkts/266 bytes][Host: img.t.sinajs.cn]
+ 8 UDP 216.58.210.14:443 <-> 192.168.1.105:49361 [proto: 188/QUIC][9 pkts/1944 bytes]
+ 9 TCP 216.58.214.78:443 <-> 192.168.1.105:58481 [proto: 91.126/SSL.Google][2 pkts/132 bytes]
+ 10 UDP 192.168.1.1:53 <-> 192.168.1.105:7148 [proto: 5.224/DNS.Weibo][2 pkts/215 bytes][Host: www.weibo.com]
+ 11 TCP 192.168.1.105:35803 <-> 93.188.134.246:80 [proto: 7.224/HTTP.Weibo][106 pkts/76903 bytes][Host: img.t.sinajs.cn]
+ 12 TCP 192.168.1.105:35805 <-> 93.188.134.246:80 [proto: 7.224/HTTP.Weibo][41 pkts/23245 bytes][Host: img.t.sinajs.cn]
+ 13 TCP 192.168.1.105:35807 <-> 93.188.134.246:80 [proto: 7.224/HTTP.Weibo][53 pkts/36468 bytes][Host: img.t.sinajs.cn]
+ 14 TCP 192.168.1.105:35809 <-> 93.188.134.246:80 [proto: 7.224/HTTP.Weibo][35 pkts/22361 bytes][Host: img.t.sinajs.cn]
+ 15 TCP 192.168.1.105:35811 <-> 93.188.134.246:80 [proto: 7.224/HTTP.Weibo][5 pkts/744 bytes][Host: js.t.sinajs.cn]
+ 16 TCP 192.168.1.105:50827 <-> 47.89.65.229:443 [proto: 91/SSL][4 pkts/448 bytes][SSL client: g.alicdn.com]
+ 17 TCP 192.168.1.105:50831 <-> 47.89.65.229:443 [proto: 91/SSL][3 pkts/194 bytes]
+ 18 TCP 42.156.184.19:443 <-> 192.168.1.105:52272 [proto: 91/SSL][1 pkts/74 bytes]
+ 19 TCP 42.156.184.19:443 <-> 192.168.1.105:52274 [proto: 91/SSL][1 pkts/74 bytes]
+ 20 UDP 192.168.1.1:53 <-> 192.168.1.105:11798 [proto: 5.224/DNS.Weibo][1 pkts/77 bytes][Host: account.weibo.com]
+ 21 UDP 192.168.1.1:53 <-> 192.168.1.105:16804 [proto: 5/DNS][1 pkts/70 bytes][Host: c.weibo.cn]
+ 22 TCP 140.205.170.63:443 <-> 192.168.1.105:47721 [proto: 91/SSL][1 pkts/74 bytes]
+ 23 TCP 140.205.170.63:443 <-> 192.168.1.105:47723 [proto: 91/SSL][1 pkts/74 bytes]
+ 24 TCP 140.205.174.1:443 <-> 192.168.1.105:48353 [proto: 91/SSL][1 pkts/74 bytes]
+ 25 UDP 192.168.1.1:53 <-> 192.168.1.105:33822 [proto: 5/DNS][2 pkts/242 bytes][Host: login.taobao.com]
+ 26 TCP 192.168.1.105:59119 <-> 114.134.80.162:80 [proto: 7/HTTP][9 pkts/1599 bytes][Host: weibo.com]
+ 27 TCP 192.168.1.105:59121 <-> 114.134.80.162:80 [proto: 7/HTTP][3 pkts/194 bytes]
+ 28 TCP 192.168.1.105:35154 <-> 216.58.210.206:443 [proto: 91.126/SSL.Google][2 pkts/132 bytes]
+ 29 TCP 216.58.212.69:443 <-> 192.168.1.105:37802 [proto: 91.126/SSL.Google][2 pkts/132 bytes]
+ 30 UDP 192.168.1.1:53 <-> 192.168.1.105:41352 [proto: 5.224/DNS.Weibo][2 pkts/264 bytes][Host: js.t.sinajs.cn]
+ 31 TCP 222.73.28.96:80 <-> 192.168.1.105:42280 [proto: 7/HTTP][1 pkts/74 bytes]
+ 32 UDP 192.168.1.1:53 <-> 192.168.1.105:50640 [proto: 5/DNS][2 pkts/234 bytes][Host: acjstb.aliyun.com]
+ 33 UDP 192.168.1.1:53 <-> 192.168.1.105:51440 [proto: 5/DNS][2 pkts/243 bytes][Host: g.alicdn.com]
+ 34 UDP 192.168.1.1:53 <-> 192.168.1.105:53466 [proto: 5/DNS][2 pkts/186 bytes][Host: log.mmstat.com]
+ 35 UDP 192.168.1.1:53 <-> 192.168.1.105:54988 [proto: 5/DNS][2 pkts/154 bytes][Host: weibo.com]
+ 36 UDP 192.168.1.105:53656 <-> 216.58.210.227:443 [proto: 188/QUIC][14 pkts/2174 bytes]
+ 37 TCP 216.58.214.78:443 <-> 192.168.1.105:58480 [proto: 91.126/SSL.Google][2 pkts/132 bytes]
+ 38 TCP 192.168.1.105:40440 <-> 54.225.163.210:443 [proto: 91/SSL][2 pkts/132 bytes]
+ 39 TCP 192.168.1.105:35804 <-> 93.188.134.246:80 [proto: 7.224/HTTP.Weibo][72 pkts/54281 bytes][Host: img.t.sinajs.cn]
+ 40 TCP 192.168.1.105:35806 <-> 93.188.134.246:80 [proto: 7.224/HTTP.Weibo][13 pkts/4701 bytes][Host: img.t.sinajs.cn]
+ 41 TCP 192.168.1.105:35808 <-> 93.188.134.246:80 [proto: 7/HTTP][3 pkts/214 bytes]
+ 42 TCP 42.156.184.19:443 <-> 192.168.1.105:52271 [proto: 91/SSL][1 pkts/74 bytes]
+ 43 UDP 192.168.1.1:53 <-> 192.168.1.105:18035 [proto: 5.224/DNS.Weibo][2 pkts/240 bytes][Host: u1.img.mobile.sina.cn]
+ 44 TCP 192.168.1.105:51698 <-> 93.188.134.137:80 [proto: 7.224/HTTP.Weibo][79 pkts/37492 bytes][Host: www.weibo.com]
Powered by cgit, Themed by Ted Yin.