diff options
228 files changed, 249 insertions, 2732 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 894b8c1f9..856778dc8 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -50,10 +50,10 @@ typedef enum { NDPI_PROTOCOL_POSTGRES = 19, NDPI_PROTOCOL_MYSQL = 20, NDPI_PROTOCOL_MS_OUTLOOK = 21, /* Hotmail / Microsoft Outlook / Exchange */ - NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK = 22, + NDPI_PROTOCOL_FREE_22 = 22, /* FREE */ NDPI_PROTOCOL_MAIL_POPS = 23, - NDPI_PROTOCOL_APPLEJUICE = 24, - NDPI_PROTOCOL_DIRECTCONNECT = 25, + NDPI_PROTOCOL_FREE_24 = 24, /* FREE */ + NDPI_PROTOCOL_FREE_25 = 25, /* FREE */ NDPI_PROTOCOL_NTOP = 26, NDPI_PROTOCOL_COAP = 27, NDPI_PROTOCOL_VMWARE = 28, @@ -61,8 +61,8 @@ typedef enum { NDPI_PROTOCOL_DTLS = 30, NDPI_PROTOCOL_UBNTAC2 = 31, /* Ubiquity UBNT AirControl = 2 */ NDPI_PROTOCOL_KONTIKI = 32, - NDPI_PROTOCOL_OPENFT = 33, - NDPI_PROTOCOL_FASTTRACK = 34, + NDPI_PROTOCOL_FREE_33 = 33, /* FREE */ + NDPI_PROTOCOL_FREE_34 = 34, /* FREE */ NDPI_PROTOCOL_GNUTELLA = 35, NDPI_PROTOCOL_EDONKEY = 36, NDPI_PROTOCOL_BITTORRENT = 37, @@ -84,17 +84,17 @@ typedef enum { NDPI_PROTOCOL_CPHA = 53, NDPI_PROTOCOL_PPSTREAM = 54, NDPI_PROTOCOL_ZATTOO = 55, - NDPI_PROTOCOL_SHOUTCAST = 56, - NDPI_PROTOCOL_SOPCAST = 57, + NDPI_PROTOCOL_FREE_56 = 56, /* FREE */ + NDPI_PROTOCOL_FREE_57 = 57, /* FREE */ NDPI_PROTOCOL_DISCORD = 58, NDPI_PROTOCOL_TVUPLAYER = 59, NDPI_PROTOCOL_MONGODB = 60, NDPI_PROTOCOL_PLURALSIGHT = 61, - NDPI_PROTOCOL_THUNDER = 62, + NDPI_PROTOCOL_FREE_62 = 62, /* FREE */ NDPI_PROTOCOL_OCSP = 63, NDPI_PROTOCOL_VXLAN = 64, NDPI_PROTOCOL_IRC = 65, - NDPI_PROTOCOL_AYIYA = 66, + NDPI_PROTOCOL_FREE_66 = 66, /* FREE */ NDPI_PROTOCOL_JABBER = 67, NDPI_PROTOCOL_NATS = 68, NDPI_PROTOCOL_AMONG_US = 69, @@ -126,8 +126,8 @@ typedef enum { NDPI_PROTOCOL_IAX = 95, NDPI_PROTOCOL_TFTP = 96, NDPI_PROTOCOL_AFP = 97, - NDPI_PROTOCOL_STEALTHNET = 98, - NDPI_PROTOCOL_AIMINI = 99, + NDPI_PROTOCOL_FREE_98 = 98, /* FREE */ + NDPI_PROTOCOL_FREE_99 = 99, /* FREE */ NDPI_PROTOCOL_SIP = 100, NDPI_PROTOCOL_TRUPHONE = 101, NDPI_PROTOCOL_IP_ICMPV6 = 102, @@ -135,8 +135,8 @@ typedef enum { NDPI_PROTOCOL_ARMAGETRON = 104, NDPI_PROTOCOL_CROSSFIRE = 105, NDPI_PROTOCOL_DOFUS = 106, - NDPI_PROTOCOL_FIESTA = 107, - NDPI_PROTOCOL_FLORENSIA = 108, + NDPI_PROTOCOL_FREE_107 = 107, /* FREE */ + NDPI_PROTOCOL_FREE_108 = 108, /* FREE */ NDPI_PROTOCOL_GUILDWARS = 109, NDPI_PROTOCOL_AMAZON_ALEXA = 110, NDPI_PROTOCOL_KERBEROS = 111, diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index be07c517c..d489b4cdf 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -53,10 +53,7 @@ void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, st void init_diameter_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_afp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_applejuice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_armagetron_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_ayiya_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_amqp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_bgp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_bittorrent_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); @@ -71,16 +68,11 @@ void init_crossfire_dissector(struct ndpi_detection_module_struct *ndpi_struct, void init_dcerpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dhcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dhcpv6_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_directconnect_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dns_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dofus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_directdownloadlink_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dropbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_eaq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_edonkey_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_fasttrack_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_fiesta_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_florensia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_ftp_control_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_ftp_data_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_gnutella_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); @@ -118,7 +110,6 @@ void init_nfs_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int3 void init_noe_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_non_tcp_udp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_ntp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_openft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_openvpn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_oracle_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_postgres_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); @@ -144,13 +135,11 @@ void init_skype_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in void init_smb_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_snmp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_socrates_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_sopcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_socks_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_spotify_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_ssh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_tls_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_starcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_stealthnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_syslog_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); @@ -160,7 +149,6 @@ void init_teamviewer_dissector(struct ndpi_detection_module_struct *ndpi_struct, void init_telegram_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_telnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_tftp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_thunder_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_tvuplayer_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_usenet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_wsd_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 093150407..d9de63d5e 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -730,15 +730,9 @@ struct ndpi_flow_tcp_struct { /* NDPI_PROTOCOL_DOFUS */ u_int32_t dofus_stage:1; - /* NDPI_PROTOCOL_FIESTA */ - u_int32_t fiesta_stage:2; - /* NDPI_PROTOCOL_WORLDOFWARCRAFT */ u_int32_t wow_stage:2; - /* NDPI_PROTOCOL_SHOUTCAST */ - u_int32_t shoutcast_stage:2; - /* NDPI_PROTOCOL_RTP */ u_int32_t rtp_special_packets_seen:1; @@ -761,9 +755,6 @@ struct ndpi_flow_tcp_struct { u_int8_t prev_zmq_pkt_len; u_char prev_zmq_pkt[10]; - /* NDPI_PROTOCOL_PPSTREAM */ - u_int32_t ppstream_stage:3; - /* NDPI_PROTOCOL_MEMCACHED */ u_int8_t memcached_matches; @@ -783,9 +774,6 @@ struct ndpi_flow_udp_struct { /* NDPI_PROTOCOL_TFTP */ u_int32_t tftp_stage:2; - /* NDPI_PROTOCOL_AIMINI */ - u_int32_t aimini_stage:5; - /* NDPI_PROTOCOL_XBOX */ u_int32_t xbox_stage:1; @@ -1533,9 +1521,6 @@ struct ndpi_flow_struct { u_int8_t bittorrent_stage; // can be 0 - 255 u_int8_t bt_check_performed : 1; - /* NDPI_PROTOCOL_DIRECTCONNECT */ - u_int8_t directconnect_stage:2; // 0 - 1 - /* NDPI_PROTOCOL_HTTP */ u_int8_t http_detected:1; @@ -1545,12 +1530,6 @@ struct ndpi_flow_struct { /* NDPI_PROTOCOL_ZATTOO */ u_int8_t zattoo_stage:3; - /* NDPI_PROTOCOL_THUNDER */ - u_int8_t thunder_stage:2; // 0 - 3 - - /* NDPI_PROTOCOL_FLORENSIA */ - u_int8_t florensia_stage:1; - /* NDPI_PROTOCOL_SOCKS */ u_int8_t socks5_stage:2, socks4_stage:2; // 0 - 3 diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 97317a1c1..c67e7b2c8 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1049,10 +1049,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_build_default_ports(ports_a, 80, 0 /* ntop */, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_subprotocols(ndpi_str, NDPI_PROTOCOL_HTTP, - NDPI_PROTOCOL_AIMINI, NDPI_PROTOCOL_CROSSFIRE, NDPI_PROTOCOL_SOAP, - NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, NDPI_PROTOCOL_GNUTELLA, + NDPI_PROTOCOL_CROSSFIRE, NDPI_PROTOCOL_SOAP, + NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_GNUTELLA, NDPI_PROTOCOL_MAPLESTORY, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_WORLDOFWARCRAFT, - NDPI_PROTOCOL_THUNDER, NDPI_PROTOCOL_IRC, + NDPI_PROTOCOL_IRC, NDPI_PROTOCOL_IPP, NDPI_PROTOCOL_MPEGDASH, NDPI_PROTOCOL_RTSP, @@ -1113,16 +1113,16 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "MySQL", NDPI_PROTOCOL_CATEGORY_DATABASE, ndpi_build_default_ports(ports_a, 3306, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, - "Direct_Download_Link", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_22, + "Free22", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_APPLEJUICE, - "AppleJuice", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_24, + "Free24", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_DIRECTCONNECT, - "DirectConnect", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_25, + "Free25", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_NATS, @@ -1145,12 +1145,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Kontiki", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_OPENFT, - "OpenFT", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_33, + "Free33", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FASTTRACK, - "FastTrack", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_34, + "Free34", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_GNUTELLA, @@ -1265,12 +1265,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Zattoo", NDPI_PROTOCOL_CATEGORY_VIDEO, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_SHOUTCAST, - "ShoutCast", NDPI_PROTOCOL_CATEGORY_MUSIC, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_56, + "Free56", NDPI_PROTOCOL_CATEGORY_MUSIC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_SOPCAST, - "Sopcast", NDPI_PROTOCOL_CATEGORY_VIDEO, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_57, + "Free57", NDPI_PROTOCOL_CATEGORY_VIDEO, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DISCORD, @@ -1285,8 +1285,8 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Pluralsight", NDPI_PROTOCOL_CATEGORY_VIDEO, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_THUNDER, - "Thunder", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_62, + "Free62", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_OCSP, @@ -1301,8 +1301,8 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "IRC", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 194, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 194, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AYIYA, - "Ayiya", NDPI_PROTOCOL_CATEGORY_NETWORK, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_66, + "Free66", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 5072, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_JABBER, @@ -1447,12 +1447,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "CHECKMK", NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, ndpi_build_default_ports(ports_a, 6556, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_STEALTHNET, - "Stealthnet", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_98, + "Free98", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_AIMINI, - "Aimini", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_99, + "Free99", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SIP, @@ -1483,12 +1483,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Dofus", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FIESTA, - "Fiesta", NDPI_PROTOCOL_CATEGORY_GAME, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_107, + "Free107", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FLORENSIA, - "Florensia", NDPI_PROTOCOL_CATEGORY_GAME, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_108, + "Free108", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_GUILDWARS, @@ -4225,21 +4225,12 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* EDONKEY */ init_edonkey_dissector(ndpi_str, &a); - /* FASTTRACK */ - init_fasttrack_dissector(ndpi_str, &a); - /* GNUTELLA */ init_gnutella_dissector(ndpi_str, &a); - /* DIRECTCONNECT */ - init_directconnect_dissector(ndpi_str, &a); - /* NATS */ init_nats_dissector(ndpi_str, &a); - /* APPLEJUICE */ - init_applejuice_dissector(ndpi_str, &a); - /* SOCKS */ init_socks_dissector(ndpi_str, &a); @@ -4270,9 +4261,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* NON_TCP_UDP */ init_non_tcp_udp_dissector(ndpi_str, &a); - /* SOPCAST */ - init_sopcast_dissector(ndpi_str, &a); - /* TVUPLAYER */ init_tvuplayer_dissector(ndpi_str, &a); @@ -4294,12 +4282,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* SSH */ init_ssh_dissector(ndpi_str, &a); - /* AYIYA */ - init_ayiya_dissector(ndpi_str, &a); - - /* THUNDER */ - init_thunder_dissector(ndpi_str, &a); - /* VNC */ init_vnc_dissector(ndpi_str, &a); @@ -4360,21 +4342,12 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* ICECAST */ init_icecast_dissector(ndpi_str, &a); - /* SHOUTCAST */ - init_shoutcast_dissector(ndpi_str, &a); - /* KERBEROS */ init_kerberos_dissector(ndpi_str, &a); - /* OPENFT */ - init_openft_dissector(ndpi_str, &a); - /* SYSLOG */ init_syslog_dissector(ndpi_str, &a); - /* DIRECT_DOWNLOAD_LINK */ - init_directdownloadlink_dissector(ndpi_str, &a); - /* NETBIOS */ init_netbios_dissector(ndpi_str, &a); @@ -4399,9 +4372,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* PPTP */ init_pptp_dissector(ndpi_str, &a); - /* STEALTHNET */ - init_stealthnet_dissector(ndpi_str, &a); - /* DHCPV6 */ init_dhcpv6_dissector(ndpi_str, &a); @@ -4414,12 +4384,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* cpha */ init_cpha_dissector(ndpi_str, &a); - /* AIMINI */ - init_aimini_dissector(ndpi_str, &a); - - /* FLORENSIA */ - init_florensia_dissector(ndpi_str, &a); - /* MAPLESTORY */ init_maplestory_dissector(ndpi_str, &a); @@ -4429,9 +4393,6 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* WORLD_OF_KUNG_FU */ init_world_of_kung_fu_dissector(ndpi_str, &a); - /* FIESTA */ - init_fiesta_dissector(ndpi_str, &a); - /* CROSSIFIRE */ init_crossfire_dissector(ndpi_str, &a); diff --git a/src/lib/protocols/aimini.c b/src/lib/protocols/aimini.c deleted file mode 100644 index 4e08612c6..000000000 --- a/src/lib/protocols/aimini.c +++ /dev/null @@ -1,270 +0,0 @@ -/* - * aimini.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_AIMINI - -#include "ndpi_api.h" - - -static void ndpi_int_aimini_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ - /* ndpi_protocol_type_t protocol_type */) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AIMINI, NDPI_PROTOCOL_HTTP, NDPI_CONFIDENCE_DPI); -} - - -void ndpi_search_aimini(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search aimini\n"); - - if (packet->udp != NULL) { - if (flow->l4.udp.aimini_stage == 0) { - if (packet->payload_packet_len == 64 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010b) { - flow->l4.udp.aimini_stage = 1; - NDPI_LOG_DBG2(ndpi_struct, "stage = 1\n"); - return; - } - if (packet->payload_packet_len == 136 - && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165)) { - flow->l4.udp.aimini_stage = 4; - NDPI_LOG_DBG2(ndpi_struct, "stage = 4\n"); - return; - } - if (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101) { - flow->l4.udp.aimini_stage = 7; - NDPI_LOG_DBG2(ndpi_struct, "stage = 7\n"); - return; - } - if (packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) { - flow->l4.udp.aimini_stage = 10; - NDPI_LOG_DBG2(ndpi_struct, "stage = 10\n"); - return; - } - if (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) { - flow->l4.udp.aimini_stage = 13; - NDPI_LOG_DBG2(ndpi_struct, "stage = 13\n"); - return; - } - if (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) { - flow->l4.udp.aimini_stage = 16; - NDPI_LOG_DBG2(ndpi_struct, "stage = 16\n"); - return; - } - } - /* first packet chronology: (len, value): (64, 0x010b), (>100, 0x0115), (16, 0x010c || 64, 0x010b || 88, 0x0115), - * (16, 0x010c || 64, 0x010b || >100, 0x0115) - */ - if (flow->l4.udp.aimini_stage == 1 && packet->payload_packet_len > 100 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0115) { - flow->l4.udp.aimini_stage = 2; - NDPI_LOG_DBG2(ndpi_struct, "stage = 2\n"); - return; - } - if (flow->l4.udp.aimini_stage == 2 && - ((packet->payload_packet_len == 16 && get_u_int16_t(packet->payload, 0) == htons(0x010c)) || - (packet->payload_packet_len == 64 && get_u_int16_t(packet->payload, 0) == htons(0x010b)) || - (packet->payload_packet_len == 88 && get_u_int16_t(packet->payload, 0) == ntohs(0x0115)))) { - flow->l4.udp.aimini_stage = 3; - NDPI_LOG_DBG2(ndpi_struct, "stage = 3\n"); - return; - } - if (flow->l4.udp.aimini_stage == 3 - && ((packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) - || (packet->payload_packet_len == 64 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010b) - || (packet->payload_packet_len > 100 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0115))) { - NDPI_LOG_INFO(ndpi_struct, "found aimini (64, 0x010b), (>300, 0x0115), " - "(16, 0x010c || 64, 0x010b), (16, 0x010c || 64, 0x010b || >100, 0x0115).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* second packet chronology: (len, value): (136, 0x01c9), (136, 0x01c9),(136, 0x01c9),(136, 0x01c9 || 32, 0x01ca) */ - - if (flow->l4.udp.aimini_stage == 4 && packet->payload_packet_len == 136 - && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165)) { - flow->l4.udp.aimini_stage = 5; - NDPI_LOG_DBG2(ndpi_struct, "stage = 5\n"); - return; - } - if (flow->l4.udp.aimini_stage == 5 && (packet->payload_packet_len == 136 - && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 - || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165))) { - flow->l4.udp.aimini_stage = 6; - NDPI_LOG_DBG2(ndpi_struct, "stage = 6\n"); - return; - } - if (flow->l4.udp.aimini_stage == 6 && ((packet->payload_packet_len == 136 - && ((ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165) - || ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9)) - || (packet->payload_packet_len == 32 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (136, 0x01c9), (136, 0x01c9)," "(136, 0x01c9),(136, 0x01c9 || 32, 0x01ca).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* third packet chronology: (len, value): (88, 0x0101), (88, 0x0101),(88, 0x0101),(88, 0x0101) */ - - if (flow->l4.udp.aimini_stage == 7 && packet->payload_packet_len == 88 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101) { - flow->l4.udp.aimini_stage = 8; - NDPI_LOG_DBG2(ndpi_struct, "stage = 8\n"); - return; - } - if (flow->l4.udp.aimini_stage == 8 - && (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101)) { - flow->l4.udp.aimini_stage = 9; - NDPI_LOG_DBG2(ndpi_struct, "stage = 9\n"); - return; - } - if (flow->l4.udp.aimini_stage == 9 - && (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101)) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (88, 0x0101), (88, 0x0101)," "(88, 0x0101),(88, 0x0101).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* fourth packet chronology: (len, value): (104, 0x0102), (104, 0x0102), (104, 0x0102), (104, 0x0102) */ - - if (flow->l4.udp.aimini_stage == 10 && packet->payload_packet_len == 104 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) { - flow->l4.udp.aimini_stage = 11; - NDPI_LOG_DBG2(ndpi_struct, "stage = 11\n"); - return; - } - if (flow->l4.udp.aimini_stage == 11 - && (packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102)) { - flow->l4.udp.aimini_stage = 12; - NDPI_LOG_DBG2(ndpi_struct, "stage = 12\n"); - return; - } - if (flow->l4.udp.aimini_stage == 12 - && ((packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) - || (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (104, 0x0102), (104, 0x0102), " "(104, 0x0102), (104, 0x0102).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* fifth packet chronology (len, value): (32,0x01ca), (32,0x01ca), (32,0x01ca), ((136, 0x0166) || (32,0x01ca)) */ - - if (flow->l4.udp.aimini_stage == 13 && packet->payload_packet_len == 32 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) { - flow->l4.udp.aimini_stage = 14; - NDPI_LOG_DBG2(ndpi_struct, "stage = 14\n"); - return; - } - if (flow->l4.udp.aimini_stage == 14 - && ((packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) - || (packet->payload_packet_len == 136 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0166))) { - flow->l4.udp.aimini_stage = 15; - NDPI_LOG_DBG2(ndpi_struct, "stage = 15\n"); - return; - } - if (flow->l4.udp.aimini_stage == 15 - && ((packet->payload_packet_len == 136 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0166) - || (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (32,0x01ca), (32,0x01ca), (32,0x01ca), ((136, 0x0166)||(32,0x01ca)).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - - /* sixth packet chronology (len, value): (16, 0x010c), (16, 0x010c), (16, 0x010c), (16, 0x010c) */ - - if (flow->l4.udp.aimini_stage == 16 && packet->payload_packet_len == 16 - && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) { - flow->l4.udp.aimini_stage = 17; - NDPI_LOG_DBG2(ndpi_struct, "stage = 17\n"); - return; - } - if (flow->l4.udp.aimini_stage == 17 - && (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c)) { - flow->l4.udp.aimini_stage = 18; - NDPI_LOG_DBG2(ndpi_struct, "stage = 18\n"); - return; - } - if (flow->l4.udp.aimini_stage == 18 - && (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c)) { - NDPI_LOG_INFO(ndpi_struct, - "found aimini (16, 0x010c), (16, 0x010c), (16, 0x010c), (16, 0x010c).\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - } - - if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP) { - if (flow->http.method == NDPI_HTTP_METHOD_GET) - { - if ((LINE_STARTS(packet->http_url_name, "/download/") == 1 || - LINE_STARTS(packet->http_url_name, "/player/") == 1 || - LINE_STARTS(packet->http_url_name, "/webcounter/") == 1 || - LINE_STARTS(packet->http_url_name, "/play/") == 1 || - LINE_STARTS(packet->http_url_name, "/search/") == 1 || - LINE_STARTS(packet->http_url_name, "/member/") == 1) && - (LINE_ENDS(packet->host_line, ".aimini.net") == 1 || - LINE_ENDS(packet->host_line, ".aimini.com") == 1)) - { - NDPI_LOG_INFO(ndpi_struct, "found AIMINI HTTP traffic\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - } else if (flow->http.method == NDPI_HTTP_METHOD_POST) - { - if ((LINE_STARTS(packet->http_url_name, "/upload/") == 1 || - LINE_STARTS(packet->http_url_name, "/member/") == 1) && - (LINE_ENDS(packet->host_line, ".aimini.net") == 1 || - LINE_ENDS(packet->host_line, ".aimini.com") == 1)) - { - NDPI_LOG_INFO(ndpi_struct, "found AIMINI HTTP traffic\n"); - ndpi_int_aimini_add_connection(ndpi_struct, flow); - return; - } - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - -} - - -void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Aimini", ndpi_struct, *id, - NDPI_PROTOCOL_AIMINI, - ndpi_search_aimini, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/applejuice.c b/src/lib/protocols/applejuice.c deleted file mode 100644 index a8d2e810c..000000000 --- a/src/lib/protocols/applejuice.c +++ /dev/null @@ -1,67 +0,0 @@ -/* - * applejuice.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_APPLEJUICE - -#include "ndpi_api.h" - - -static void ndpi_int_applejuice_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_APPLEJUICE, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_applejuice_tcp(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search applejuice\n"); - - if ((packet->payload_packet_len > 7) && (packet->payload[6] == 0x0d) - && (packet->payload[7] == 0x0a) - && (memcmp(packet->payload, "ajprot", 6) == 0)) { - NDPI_LOG_INFO(ndpi_struct, "found applejuice\n"); - ndpi_int_applejuice_add_connection(ndpi_struct, flow); - return; - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_applejuice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("AppleJuice", ndpi_struct, *id, - NDPI_PROTOCOL_APPLEJUICE, - ndpi_search_applejuice_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/ayiya.c b/src/lib/protocols/ayiya.c deleted file mode 100644 index 43b0c84c9..000000000 --- a/src/lib/protocols/ayiya.c +++ /dev/null @@ -1,87 +0,0 @@ -/* - * ayiya.c - * - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -/* - http://en.wikipedia.org/wiki/Anything_In_Anything - http://tools.ietf.org/html/rfc4891 -*/ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_AYIYA - -#include "ndpi_api.h" - -struct ayiya { - u_int8_t flags[3]; - u_int8_t next_header; - u_int32_t epoch; - u_int8_t identity[16]; - u_int8_t signature[20]; -}; - -void ndpi_search_ayiya(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search AYIYA\n"); - - if(packet->udp && (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN)) { - /* Ayiya is udp based, port 5072 */ - u_int16_t port_to_match = htons(5072); - - if ((packet->udp->source == port_to_match || packet->udp->dest == port_to_match) - /* check for ayiya new packet */ - && (packet->payload_packet_len > 44) - ) { - /* FINISH */ - struct ayiya *a = (struct ayiya*)packet->payload; - u_int32_t epoch = ntohl(a->epoch), now; - u_int32_t fiveyears = 86400 * 365 * 5; - - now = packet->current_time_ms; - - if((epoch >= (now - fiveyears)) && (epoch <= (now+86400 /* 1 day */))) { - NDPI_LOG_INFO(ndpi_struct, "found AYIYA\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AYIYA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); - } - - return; - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - } -} - - -void init_ayiya_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Ayiya", ndpi_struct, *id, - NDPI_PROTOCOL_AYIYA, - ndpi_search_ayiya, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/directconnect.c b/src/lib/protocols/directconnect.c deleted file mode 100644 index 01caf79ff..000000000 --- a/src/lib/protocols/directconnect.c +++ /dev/null @@ -1,207 +0,0 @@ -/* - * directconnect.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DIRECTCONNECT - -#include "ndpi_api.h" - - -//#define NDPI_DEBUG_DIRECTCONNECT -//#define NDPI_DIRECTCONNECT_PORT_DEBUG -//#define NDPI_DEBUG_DIRECTCONNECT_CONN - - -#define DIRECT_CONNECT_TYPE_HUB 0 -#define DIRECT_CONNECT_TYPE_PEER 1 -#define DIRECT_CONNECT_ADC_PEER 2 - -static u_int32_t skip_unknown_headers(const u_int8_t * payload, u_int32_t payload_len, u_int32_t pos) -{ - u_int32_t i = pos; - while (i < payload_len && payload[i] != 0x0a) - i++; - - i++; - return i; - -} - -static u_int16_t parse_binf_message(struct ndpi_detection_module_struct - *ndpi_struct, const u_int8_t * payload, uint32_t payload_len) -{ - u_int32_t i = 4; - u_int16_t bytes_read = 0; - u_int16_t ssl_port = 0; - while (i < payload_len) { - i = skip_unknown_headers(payload, payload_len, i); - if((i + 30) < payload_len) { - if(memcmp(&payload[i], "DCTM", 4) == 0) { - if(memcmp(&payload[i + 15], "ADCS", 4) == 0) { - ssl_port = ntohs_ndpi_bytestream_to_number(&payload[i + 25], 5, &bytes_read); - NDPI_LOG_DBG2(ndpi_struct, "DC ssl port parsed %d\n", ssl_port); - } - } - } else { - break; - } - - } - return ssl_port; -} - -static void ndpi_int_directconnect_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow, - const u_int8_t connection_type) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -static void ndpi_search_directconnect_tcp(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) { - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_DIRECTCONNECT) { - if(packet->payload_packet_len >= 40 && memcmp(&packet->payload[0], "BINF", 4) == 0) { - parse_binf_message(ndpi_struct, - &packet->payload[4], - packet->payload_packet_len - 4); - } - - return; - - } - - if(flow->directconnect_stage == 0) { - - if(packet->payload_packet_len > 6) { - if(packet->payload[0] == '$' - && packet->payload[packet->payload_packet_len - 1] == '|' - && (memcmp(&packet->payload[1], "Lock ", 5) == 0)) { - NDPI_LOG_DBG2(ndpi_struct, "maybe first dc connect to hub detected\n"); - flow->directconnect_stage = 1; - return; - } - if(packet->payload_packet_len > 7 - && packet->payload[0] == '$' - && packet->payload[packet->payload_packet_len - 1] == '|' - && (memcmp(&packet->payload[1], "MyNick ", 7) == 0)) { - NDPI_LOG_DBG2(ndpi_struct, "maybe first dc connect between peers detected\n"); - flow->directconnect_stage = 2; - return; - } - - } - if(packet->payload_packet_len >= 11) { - /* did not see this pattern in any trace */ - if(memcmp(&packet->payload[0], "HSUP ADBAS0", 11) == 0 - || memcmp(&packet->payload[0], "HSUP ADBASE", 11) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found DC HSUP ADBAS0 E\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); - return; - /* did not see this pattern in any trace */ - } else if(memcmp(&packet->payload[0], "CSUP ADBAS0", 11) == 0 || - memcmp(&packet->payload[0], "CSUP ADBASE", 11) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found DC CSUP ADBAS0 E\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_ADC_PEER); - return; - - } - - } - - } else if(flow->directconnect_stage == 1) { - if(packet->payload_packet_len >= 11) { - /* did not see this pattern in any trace */ - if(memcmp(&packet->payload[0], "HSUP ADBAS0", 11) == 0 - || memcmp(&packet->payload[0], "HSUP ADBASE", 11) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found DC HSUP ADBAS E in second packet\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); - return; - /* did not see this pattern in any trace */ - } else if(memcmp(&packet->payload[0], "CSUP ADBAS0", 11) == 0 || - memcmp(&packet->payload[0], "CSUP ADBASE", 11) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found DC HSUP ADBAS0 E in second packet\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_ADC_PEER); - return; - - } - } - /* get client hello answer or server message */ - if(packet->payload_packet_len > 6) { - if((packet->payload[0] == '$' || packet->payload[0] == '<') - && packet->payload[packet->payload_packet_len - 1] == '|') { - NDPI_LOG_INFO(ndpi_struct, "found DC second\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); - return; - } else { - NDPI_LOG_DBG2(ndpi_struct, "second dc not detected\n"); - } - - } - } else if(flow->directconnect_stage == 2) { - /* get client hello answer or server message */ - if(packet->payload_packet_len > 6) { - if(packet->payload[0] == '$' && packet->payload[packet->payload_packet_len - 1] == '|') { - NDPI_LOG_INFO(ndpi_struct, "found DC between peers\n"); - ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_PEER); - return; - } else { - NDPI_LOG_DBG2(ndpi_struct, "second dc between peers not detected\n"); - } - } - - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - -} - -void ndpi_search_directconnect(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search DC\n"); - - if(packet->tcp != NULL) { - ndpi_search_directconnect_tcp(ndpi_struct, flow); - } -} - - -void init_directconnect_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("DirectConnect", ndpi_struct, *id, - NDPI_PROTOCOL_DIRECTCONNECT, - ndpi_search_directconnect, - /* TODO: UDP?*/ - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/directdownloadlink.c b/src/lib/protocols/directdownloadlink.c deleted file mode 100644 index 2821490b6..000000000 --- a/src/lib/protocols/directdownloadlink.c +++ /dev/null @@ -1,726 +0,0 @@ -/* - * directdownloadlink.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK - -#include "ndpi_api.h" - - -#ifdef NDPI_DEBUG_DIRECT_DOWNLOAD_LINK -//#define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_NOTHING_FOUND -//#define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_PACKET_TOO_SMALL -#define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_IP -#endif - -static void ndpi_int_direct_download_link_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - - - -/* - return 0 if nothing has been detected - return 1 if it is a megaupload packet -*/ -u_int8_t search_ddl_domains(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - u_int16_t filename_start = 0; - u_int16_t i = 1; - u_int16_t host_line_len_without_port; - - if (packet->payload_packet_len < 100) { - NDPI_LOG_DBG2(ndpi_struct, "DDL: Packet too small\n"); - goto end_ddl_nothing_found; - } - - - - if (memcmp(packet->payload, "POST ", 5) == 0) { - filename_start = 5; // POST - NDPI_LOG_DBG2(ndpi_struct, "DDL: POST FOUND\n"); - } else if (memcmp(packet->payload, "GET ", 4) == 0) { - filename_start = 4; // GET - NDPI_LOG_DBG2(ndpi_struct, "DDL: GET FOUND\n"); - } else { - goto end_ddl_nothing_found; - } - // parse packet - ndpi_parse_packet_line_info(ndpi_struct, flow); - - if (packet->host_line.ptr == NULL) { - NDPI_LOG_DBG2(ndpi_struct, "DDL: NO HOST FOUND\n"); - goto end_ddl_nothing_found; - } - - NDPI_LOG_DBG2(ndpi_struct, "DDL: Host: found\n"); - - if (packet->line[0].len < 9 + filename_start - || memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) != 0) { - NDPI_LOG_DBG2(ndpi_struct, "DDL: PACKET NOT HTTP CONFORM.\nXXX%.*sXXX\n", - 8, &packet->line[0].ptr[packet->line[0].len - 9]); - goto end_ddl_nothing_found; - } - // BEGIN OF AUTOMATED CODE GENERATION - // first see if we have ':port' at the end of the line - host_line_len_without_port = packet->host_line.len; - if (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] >= '0' - && packet->host_line.ptr[packet->host_line.len - i] <= '9') { - i = 2; - while (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] >= '0' - && packet->host_line.ptr[host_line_len_without_port - i] <= '9') { - NDPI_LOG_DBG2(ndpi_struct, "DDL: number found\n"); - i++; - } - if (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] == ':') { - NDPI_LOG_DBG2(ndpi_struct, "DDL: ':' found\n"); - host_line_len_without_port = host_line_len_without_port - i; - } - } - // then start automated code generation - - if (host_line_len_without_port >= 0 + 4 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 4], ".com", 4) == 0) { - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'd') { - if (host_line_len_without_port >= 5 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 6], "4share", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "fileclou", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 5 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "uploa", 5) == 0) { - if (host_line_len_without_port >= 10 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 6], "files-", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "mega", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "rapid", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "turbo", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'o') { - if (host_line_len_without_port >= 5 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 6], "badong", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "fileh", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'g') { - if (host_line_len_without_port >= 5 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 2], "in", 2) == 0) { - if (host_line_len_without_port >= 7 + 4 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 4], "shar", 4) == 0) { - if (host_line_len_without_port >= 11 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 11 - 4], "best", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 11 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 11 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 11 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 11 - 5], "quick", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 11 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 11 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 7 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 6], "upload", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 7 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 7 - 6 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "sharebi", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 8], "bigfilez", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'e') { - if (host_line_len_without_port >= 5 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 3], "fil", 3) == 0) { - if (host_line_len_without_port >= 8 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 2], "mo", 2) == 0) { - if (host_line_len_without_port >= 10 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "china", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 2 + 1 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 2 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 2 - 1] == '.')) { - goto end_ddl_found; - } - } - if (host_line_len_without_port >= 8 + 3 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 3], "hot", 3) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 6], "keepmy", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 1 - && packet->host_line.ptr[host_line_len_without_port - 8 - 1] == 'e') { - if (host_line_len_without_port >= 9 + 3 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 3], "sav", 3) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 3 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 9 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 5], "sendm", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 8 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 8], "sharebig", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 3 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 3], "up-", 3) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 1 && packet->host_line.ptr[host_line_len_without_port - 5 - 1] == 'r') { - if (host_line_len_without_port >= 6 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 3], "sha", 3) == 0) { - if (host_line_len_without_port >= 9 + 1 - && packet->host_line.ptr[host_line_len_without_port - 9 - 1] == '-') { - if (host_line_len_without_port >= 10 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "easy", - 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == - '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "fast", - 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == - '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "live", - 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == - '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 9 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "ftp2", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 9 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "gige", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 9 + 4 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "mega", 4) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 9 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 5], "rapid", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 6 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 7], "mediafi", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 6 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 6 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "gigasiz", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "sendspac", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "sharebe", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 11 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 11], "sharebigfli", 11) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "fileserv", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 's') { - if (host_line_len_without_port >= 5 + 1 && packet->host_line.ptr[host_line_len_without_port - 5 - 1] == 'e') { - if (host_line_len_without_port >= 6 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 10], "depositfil", - 10) == 0 && (packet->host_line.ptr[host_line_len_without_port - 6 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 6 - 10 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 6 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 8], "megashar", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 6 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 6 - 8 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "fileupyour", 10) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 11 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 11], "filefactory", 11) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 11 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 11 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 't') { - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "filefron", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "uploadingi", 10) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 11 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 11], "yourfilehos", 11) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'r') { - if (host_line_len_without_port >= 5 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "mytempdi", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "uploadpowe", 10) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "mega.1280", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "filesonic", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 4 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 4], ".net", 4) == 0) { - if (host_line_len_without_port >= 4 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "badongo", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'd') { - if (host_line_len_without_port >= 5 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 3], "loa", 3) == 0) { - if (host_line_len_without_port >= 8 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "fast-", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 2], "up", 2) == 0) { - if (host_line_len_without_port >= 10 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "file-", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 6], "simple", - 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == - '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 10 + 3 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 3], "wii", 3) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 10 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 10 - 3 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 5 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "filesen", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 4 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 5], "filer", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "livedepot", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'e') { - if (host_line_len_without_port >= 5 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "mofil", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 17 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 17], "odsiebie.najlepsz", - 17) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 17 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 17 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 5 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "zshar", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'u') { - if (host_line_len_without_port >= 1 + 6 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 6], "data.h", 6) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 1 - 6 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 1 - 6 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 1 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 2], ".r", 2) == 0) { - if (host_line_len_without_port >= 3 + 10 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 10], "filearchiv", 10) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 10 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 10 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 3 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 8], "filepost", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 8 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 3 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 7], "ifolder", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 11 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 11], "filehost.tv", 11) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 0 - 11 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 0 - 11 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 0 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 3], ".to", 3) == 0) { - if (host_line_len_without_port >= 3 + 1 && packet->host_line.ptr[host_line_len_without_port - 3 - 1] == 'e') { - if (host_line_len_without_port >= 4 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "filesaf", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 8 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 8], "sharebas", 8) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 3 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 5], "files", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 3 + 1 && packet->host_line.ptr[host_line_len_without_port - 3 - 1] == 'd') { - if (host_line_len_without_port >= 4 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 3], "loa", 3) == 0) { - if (host_line_len_without_port >= 7 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 7], "file-up", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 7 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 7 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 4 + 3 + 1 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 3 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 3 - 1] == '.')) { - goto end_ddl_found; - } - } - if (host_line_len_without_port >= 4 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "uploade", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'z') { - if (host_line_len_without_port >= 1 + 14 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 14], "leteckaposta.c", 14) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 1 - 14 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 1 - 14 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 1 + 12 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 12], "yourfiles.bi", 12) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 1 - 12 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 1 - 12 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'n') { - if (host_line_len_without_port >= 1 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 9], "netload.i", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 1 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 1 - 9 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 1 + 2 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 2], ".v", 2) == 0) { - if (host_line_len_without_port >= 3 + 7 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 7], "4shared", 7) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 3 + 9 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 9], "megashare", 9) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 9 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 9 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 3 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 3], ".de", 3) == 0) { - if (host_line_len_without_port >= 3 + 5 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 5], "share", 5) == 0) { - if (host_line_len_without_port >= 8 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "rapid", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { - goto end_ddl_found; - } - if (host_line_len_without_port >= 8 + 5 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "ultra", 5) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 3 + 15 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 15], "uploadyourfiles", 15) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 3 - 15 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 3 - 15 - 1] == '.')) { - goto end_ddl_found; - } - goto end_ddl_nothing_found; - } - if (host_line_len_without_port >= 0 + 14 + 1 - && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 14], "speedshare.org", 14) == 0 - && (packet->host_line.ptr[host_line_len_without_port - 0 - 14 - 1] == ' ' - || packet->host_line.ptr[host_line_len_without_port - 0 - 14 - 1] == '.')) { - goto end_ddl_found; - } - // END OF AUTOMATED CODE GENERATION - - /* This is the hard way. We do this in order to find the download of services when other - domains are involved. This is not significant if ddl is blocked. --> then the link can not be started because - the ads are not viewed. But when ddl is only limited then the download is the important part. - */ - - end_ddl_nothing_found: - NDPI_LOG_DBG2(ndpi_struct, - "Nothing Found\n"); - return 0; - - end_ddl_found: - NDPI_LOG_INFO(ndpi_struct, "found DIRECT DOWNLOAD LINK\n"); - ndpi_int_direct_download_link_add_connection(ndpi_struct, flow); - return 1; -} - - -void ndpi_search_direct_download_link_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - /* do not detect again if it is already ddl */ - if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK) { - if (search_ddl_domains(ndpi_struct, flow) != 0) { - return; - } - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - } - -} - -void init_directdownloadlink_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Direct_Download_Link", ndpi_struct, *id, - NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, - ndpi_search_direct_download_link_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - diff --git a/src/lib/protocols/fasttrack.c b/src/lib/protocols/fasttrack.c deleted file mode 100644 index 88693967a..000000000 --- a/src/lib/protocols/fasttrack.c +++ /dev/null @@ -1,95 +0,0 @@ -/* - * fasttrack.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FASTTRACK - -#include "ndpi_api.h" - - -static void ndpi_int_fasttrack_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FASTTRACK, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - - -void ndpi_search_fasttrack_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search FASTTRACK\n"); - - if ( (packet->payload != NULL) - && (packet->payload_packet_len > 6) - && (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a)) { - NDPI_LOG_DBG2(ndpi_struct, "detected 0d0a at the end of the packet\n"); - - if (memcmp(packet->payload, "GIVE ", 5) == 0 && packet->payload_packet_len >= 8) { - u_int16_t i; - for (i = 5; i < (packet->payload_packet_len - 2); i++) { - // make shure that the argument to GIVE is numeric - if (!(packet->payload[i] >= '0' && packet->payload[i] <= '9')) { - goto exclude_fasttrack; - } - } - - NDPI_LOG_INFO(ndpi_struct, "found FASTTRACK\n"); - ndpi_int_fasttrack_add_connection(ndpi_struct, flow); - return; - } - - if (packet->payload_packet_len > 50 && memcmp(packet->payload, "GET /", 5) == 0) { - u_int16_t a = 0; - NDPI_LOG_DBG2(ndpi_struct, "detected GET /. \n"); - - ndpi_parse_packet_line_info(ndpi_struct, flow); - for (a = 0; a < packet->parsed_lines; a++) { - if ((packet->line[a].len > 17 && memcmp(packet->line[a].ptr, "X-Kazaa-Username: ", 18) == 0) - || (packet->line[a].len > 23 && memcmp(packet->line[a].ptr, "User-Agent: PeerEnabler/", 24) == 0)) { - NDPI_LOG_INFO(ndpi_struct, - "found FASTTRACK X-Kazaa-Username: || User-Agent: PeerEnabler/\n"); - ndpi_int_fasttrack_add_connection(ndpi_struct, flow); - return; - } - } - } - } - - exclude_fasttrack: - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_fasttrack_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("FastTrack", ndpi_struct, *id, - NDPI_PROTOCOL_FASTTRACK, - ndpi_search_fasttrack_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/fiesta.c b/src/lib/protocols/fiesta.c deleted file mode 100644 index 40e813bf1..000000000 --- a/src/lib/protocols/fiesta.c +++ /dev/null @@ -1,105 +0,0 @@ -/* - * fiesta.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FIESTA - -#include "ndpi_api.h" - - -static void ndpi_int_fiesta_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FIESTA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_fiesta(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search fiesta\n"); - - if (flow->l4.tcp.fiesta_stage == 0 && packet->payload_packet_len == 5 - && get_u_int16_t(packet->payload, 0) == ntohs(0x0407) - && (packet->payload[2] == 0x08) - && (packet->payload[4] == 0x00 || packet->payload[4] == 0x01)) { - - NDPI_LOG_DBG2(ndpi_struct, "maybe fiesta symmetric, first packet\n"); - flow->l4.tcp.fiesta_stage = 1 + packet->packet_direction; - goto maybe_fiesta; - } - if (flow->l4.tcp.fiesta_stage == (2 - packet->packet_direction) - && ((packet->payload_packet_len > 1 && packet->payload_packet_len - 1 == packet->payload[0]) - || (packet->payload_packet_len > 3 && packet->payload[0] == 0 - && get_l16(packet->payload, 1) == packet->payload_packet_len - 3))) { - NDPI_LOG_DBG2(ndpi_struct, "Maybe fiesta\n"); - goto maybe_fiesta; - } - if (flow->l4.tcp.fiesta_stage == (1 + packet->packet_direction)) { - if (packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x03050c01)) { - goto add_fiesta; - } - if (packet->payload_packet_len == 5 && get_u_int32_t(packet->payload, 0) == htonl(0x04030c01) - && packet->payload[4] == 0) { - goto add_fiesta; - } - if (packet->payload_packet_len == 6 && get_u_int32_t(packet->payload, 0) == htonl(0x050e080b)) { - goto add_fiesta; - } - if (packet->payload_packet_len == 100 && packet->payload[0] == 0x63 && packet->payload[61] == 0x52 - && packet->payload[81] == 0x5a && get_u_int16_t(packet->payload, 1) == htons(0x3810) - && get_u_int16_t(packet->payload, 62) == htons(0x6f75)) { - goto add_fiesta; - } - if (packet->payload_packet_len > 3 && packet->payload_packet_len - 1 == packet->payload[0] - && get_u_int16_t(packet->payload, 1) == htons(0x140c)) { - goto add_fiesta; - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - return; - - maybe_fiesta: - NDPI_LOG_DBG2(ndpi_struct, "Stage is set to %d\n", flow->l4.tcp.fiesta_stage); - return; - - add_fiesta: - NDPI_LOG_INFO(ndpi_struct, "found fiesta\n"); - ndpi_int_fiesta_add_connection(ndpi_struct, flow); - return; -} - - -void init_fiesta_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Fiesta", ndpi_struct, *id, - NDPI_PROTOCOL_FIESTA, - ndpi_search_fiesta, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/florensia.c b/src/lib/protocols/florensia.c deleted file mode 100644 index 13bbe7d4d..000000000 --- a/src/lib/protocols/florensia.c +++ /dev/null @@ -1,130 +0,0 @@ -/* - * florensia.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FLORENSIA - -#include "ndpi_api.h" - - -static void ndpi_florensia_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FLORENSIA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_florensia(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search florensia\n"); - - if (packet->tcp != NULL) { - if (packet->payload_packet_len == 5 && get_l16(packet->payload, 0) == packet->payload_packet_len - && packet->payload[2] == 0x65 && packet->payload[4] == 0xff) { - if (flow->florensia_stage == 1) { - NDPI_LOG_INFO(ndpi_struct, "found florensia\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - if (packet->payload_packet_len > 8 && get_l16(packet->payload, 0) == packet->payload_packet_len - && get_u_int16_t(packet->payload, 2) == htons(0x0201) && get_u_int32_t(packet->payload, 4) == htonl(0xFFFFFFFF)) { - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - if (packet->payload_packet_len == 406 && get_l16(packet->payload, 0) == packet->payload_packet_len - && packet->payload[2] == 0x63) { - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - if (packet->payload_packet_len == 12 && get_l16(packet->payload, 0) == packet->payload_packet_len - && get_u_int16_t(packet->payload, 2) == htons(0x0301)) { - if (flow->florensia_stage == 1) { - NDPI_LOG_INFO(ndpi_struct, "found florensia\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - - if (flow->florensia_stage == 1) { - if (packet->payload_packet_len == 8 && get_l16(packet->payload, 0) == packet->payload_packet_len - && get_u_int16_t(packet->payload, 2) == htons(0x0302) && get_u_int32_t(packet->payload, 4) == htonl(0xFFFFFFFF)) { - NDPI_LOG_INFO(ndpi_struct, "found florensia asymmetrically\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - if (packet->payload_packet_len == 24 && get_l16(packet->payload, 0) == packet->payload_packet_len - && get_u_int16_t(packet->payload, 2) == htons(0x0202) - && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) == htonl(0xFFFFFFFF)) { - NDPI_LOG_INFO(ndpi_struct, "found florensia\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - if (flow->packet_counter < 10 && packet->payload_packet_len >=2 && - get_l16(packet->payload, 0) == packet->payload_packet_len) { - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia\n"); - return; - } - } - } - - if (packet->udp != NULL) { - if (flow->florensia_stage == 0 && packet->payload_packet_len == 6 - && get_u_int16_t(packet->payload, 0) == ntohs(0x0503) && get_u_int32_t(packet->payload, 2) == htonl(0xFFFF0000)) { - NDPI_LOG_DBG2(ndpi_struct, "maybe florensia -> stage is set to 1\n"); - flow->florensia_stage = 1; - return; - } - if (flow->florensia_stage == 1 && packet->payload_packet_len == 8 - && get_u_int16_t(packet->payload, 0) == ntohs(0x0500) && get_u_int16_t(packet->payload, 4) == htons(0x4191)) { - NDPI_LOG_INFO(ndpi_struct, "found florensia\n"); - ndpi_florensia_add_connection(ndpi_struct, flow); - return; - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_florensia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Florensia", ndpi_struct, *id, - NDPI_PROTOCOL_FLORENSIA, - ndpi_search_florensia, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/openft.c b/src/lib/protocols/openft.c deleted file mode 100644 index c9bfd4ea8..000000000 --- a/src/lib/protocols/openft.c +++ /dev/null @@ -1,67 +0,0 @@ -/* - * openft.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_OPENFT - -#include "ndpi_api.h" - -static void ndpi_int_openft_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OPENFT, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_openft_tcp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 5 && memcmp(packet->payload, "GET /", 5) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "HTTP packet detected\n"); - ndpi_parse_packet_line_info(ndpi_struct, flow); - if (packet->parsed_lines >= 2 - && packet->line[1].len > 13 && memcmp(packet->line[1].ptr, "X-OpenftAlias:", 14) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found OpenFT\n"); - ndpi_int_openft_add_connection(ndpi_struct, flow); - return; - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_openft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("OpenFT", ndpi_struct, *id, - NDPI_PROTOCOL_OPENFT, - ndpi_search_openft_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/ppstream.c b/src/lib/protocols/ppstream.c index d54a994af..a1c68e404 100644 --- a/src/lib/protocols/ppstream.c +++ b/src/lib/protocols/ppstream.c @@ -228,7 +228,7 @@ void init_ppstream_dissector(struct ndpi_detection_module_struct *ndpi_struct, u ndpi_set_bitmask_protocol_detection("PPStream", ndpi_struct, *id, NDPI_PROTOCOL_PPSTREAM, ndpi_search_ppstream, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); diff --git a/src/lib/protocols/shoutcast.c b/src/lib/protocols/shoutcast.c deleted file mode 100644 index 155e2cea7..000000000 --- a/src/lib/protocols/shoutcast.c +++ /dev/null @@ -1,118 +0,0 @@ -/* - * shoutcast.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SHOUTCAST - -#include "ndpi_api.h" - -static void ndpi_int_shoutcast_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SHOUTCAST, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_shoutcast_tcp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - - NDPI_LOG_DBG(ndpi_struct, "search shoutcast\n"); - - if (flow->packet_counter == 1) { -/* this case in paul_upload_oddcast_002.pcap */ - if (packet->payload_packet_len >= 6 - && packet->payload_packet_len < 80 && memcmp(packet->payload, "123456", 6) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "Shoutcast stage 1, \"123456\"\n"); - return; - } - if (flow->packet_counter < 3 - && flow->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP - ) { - NDPI_LOG_DBG2(ndpi_struct, - "http detected, need next packet for shoutcast detection.\n"); - if (packet->payload_packet_len > 4 - && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) != htonl(0x0d0a0d0a)) { - NDPI_LOG_DBG2(ndpi_struct, "segmented packet found\n"); - flow->l4.tcp.shoutcast_stage = 1 + packet->packet_direction; - } - return; - } - - - /* else - goto exclude_shoutcast; */ - - } - /* evtl. für asym detection noch User-Agent:Winamp dazunehmen. */ - if (packet->payload_packet_len > 11 && memcmp(packet->payload, "ICY 200 OK\x0d\x0a", 12) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found shoutcast by ICY 200 OK\n"); - ndpi_int_shoutcast_add_connection(ndpi_struct, flow); - return; - } - if (flow->l4.tcp.shoutcast_stage == 1 + packet->packet_direction - && flow->packet_direction_counter[packet->packet_direction] < 5) { - return; - } - - if (flow->packet_counter == 2) { - if (packet->payload_packet_len == 2 && memcmp(packet->payload, "\x0d\x0a", 2) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "Shoutcast stage 1 continuation\n"); - return; - } else if (packet->payload_packet_len > 3 && memcmp(&packet->payload[0], "OK2", 3) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "Shoutcast stage 2, OK2 found\n"); - return; - } else - goto exclude_shoutcast; - } else if (flow->packet_counter == 3 || flow->packet_counter == 4) { - if (packet->payload_packet_len > 3 && memcmp(&packet->payload[0], "OK2", 3) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "Shoutcast stage 2, OK2 found\n"); - return; - } else if (packet->payload_packet_len > 4 && memcmp(&packet->payload[0], "icy-", 4) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found Shoutcast\n"); - ndpi_int_shoutcast_add_connection(ndpi_struct, flow); - return; - } else - goto exclude_shoutcast; - } - - exclude_shoutcast: - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - - -void init_shoutcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("ShoutCast", ndpi_struct, *id, - NDPI_PROTOCOL_SHOUTCAST, - ndpi_search_shoutcast_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - diff --git a/src/lib/protocols/sopcast.c b/src/lib/protocols/sopcast.c deleted file mode 100644 index b903538cc..000000000 --- a/src/lib/protocols/sopcast.c +++ /dev/null @@ -1,223 +0,0 @@ -/* - * sopcast.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SOPCAST - -#include "ndpi_api.h" - - -static void ndpi_int_sopcast_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOPCAST, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -/** - * this function checks for sopcast tcp pattern - * - * NOTE: if you add more patterns please keep the number of if levels - * low, it is already complex enough - */ - -#if !defined(WIN32) -static inline -#elif defined(MINGW_GCC) -__mingw_forceinline static -#else -__forceinline static -#endif -u_int8_t ndpi_int_is_sopcast_tcp(const u_int8_t * payload, const u_int16_t payload_len) -{ - if (payload[2] != payload[3] - 4 && payload[2] != payload[3] + 4) - return 0; - - if (payload[2] != payload[4] - 1 && payload[2] != payload[4] + 1) - return 0; - - if (payload[25] != payload[25 + 16 - 1] + 1 && payload[25] != payload[25 + 16 - 1] - 1) { - - if (payload[3] != payload[25] && - payload[3] != payload[25] - 4 && payload[3] != payload[25] + 4 && payload[3] != payload[25] - 21) { - return 0; - } - } - - if (payload[4] != payload[28] || - payload[28] != payload[30] || - payload[30] != payload[31] || - get_u_int16_t(payload, 30) != get_u_int16_t(payload, 32) || get_u_int16_t(payload, 32) != get_u_int16_t(payload, 34)) { - - if ((payload[2] != payload[5] - 1 && payload[2] != payload[5] + 1) || - payload[2] != payload[25] || - payload[4] != payload[28] || - payload[4] != payload[31] || - payload[4] != payload[32] || - payload[4] != payload[33] || - payload[4] != payload[34] || - payload[4] != payload[35] || payload[4] != payload[30] || payload[2] != payload[36]) { - return 0; - } - } - - if (payload[42] != payload[53]) - return 0; - - if (payload[45] != payload[46] + 1 && payload[45] != payload[46] - 1) - return 0; - - if (payload[45] != payload[49] || payload[46] != payload[50] || payload[47] != payload[51]) - return 0; - - return 1; -} - -static void ndpi_search_sopcast_tcp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (flow->packet_counter == 1 && packet->payload_packet_len == 54 && get_u_int16_t(packet->payload, 0) == ntohs(0x0036)) { - if (ndpi_int_is_sopcast_tcp(packet->payload, packet->payload_packet_len)) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast TCP \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - -} - -static void ndpi_search_sopcast_udp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search sopcast. \n"); - - if (packet->payload_packet_len == 52 && packet->payload[0] == 0xff - && packet->payload[1] == 0xff && packet->payload[2] == 0x01 - && packet->payload[8] == 0x02 && packet->payload[9] == 0xff - && packet->payload[10] == 0x00 && packet->payload[11] == 0x2c - && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if I. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - if ((packet->payload_packet_len == 80 || packet->payload_packet_len == 28 || packet->payload_packet_len == 94) - && packet->payload[0] == 0x00 && (packet->payload[2] == 0x02 || packet->payload[2] == 0x01) - && packet->payload[8] == 0x01 && packet->payload[9] == 0xff - && packet->payload[10] == 0x00 && packet->payload[11] == 0x14 - && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if II. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - /* this case has been seen once. Please remove this comment, if you see it another time */ - if (packet->payload_packet_len == 60 && packet->payload[0] == 0x00 - && packet->payload[2] == 0x01 - && packet->payload[8] == 0x03 && packet->payload[9] == 0xff - && packet->payload[10] == 0x00 && packet->payload[11] == 0x34 - && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if III. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - if (packet->payload_packet_len == 42 && packet->payload[0] == 0x00 - && packet->payload[1] == 0x02 && packet->payload[2] == 0x01 - && packet->payload[3] == 0x07 && packet->payload[4] == 0x03 - && packet->payload[8] == 0x06 - && packet->payload[9] == 0x01 && packet->payload[10] == 0x00 - && packet->payload[11] == 0x22 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if IV. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - if (packet->payload_packet_len == 28 && packet->payload[0] == 0x00 - && packet->payload[1] == 0x0c && packet->payload[2] == 0x01 - && packet->payload[3] == 0x07 && packet->payload[4] == 0x00 - && packet->payload[8] == 0x01 - && packet->payload[9] == 0x01 && packet->payload[10] == 0x00 - && packet->payload[11] == 0x14 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if V. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - /* this case has been seen once. Please remove this comment, if you see it another time */ - if (packet->payload_packet_len == 286 && packet->payload[0] == 0x00 - && packet->payload[1] == 0x02 && packet->payload[2] == 0x01 - && packet->payload[3] == 0x07 && packet->payload[4] == 0x03 - && packet->payload[8] == 0x06 - && packet->payload[9] == 0x01 && packet->payload[10] == 0x01 - && packet->payload[11] == 0x16 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if VI. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - if (packet->payload_packet_len == 76 && packet->payload[0] == 0xff - && packet->payload[1] == 0xff && packet->payload[2] == 0x01 - && packet->payload[8] == 0x0c && packet->payload[9] == 0xff - && packet->payload[10] == 0x00 && packet->payload[11] == 0x44 - && packet->payload[16] == 0x01 && packet->payload[15] == 0x01 - && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, "found sopcast with if VII. \n"); - ndpi_int_sopcast_add_connection(ndpi_struct, flow); - return; - } - - /* Attention please: no asymmetric detection necessary. This detection works asymmetrically as well. */ - - NDPI_LOG_DBG(ndpi_struct, "exclude sopcast. \n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOPCAST); - -} - -void ndpi_search_sopcast(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->udp != NULL) - ndpi_search_sopcast_udp(ndpi_struct, flow); - if (packet->tcp != NULL) - ndpi_search_sopcast_tcp(ndpi_struct, flow); - -} - - -void init_sopcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Sopcast", ndpi_struct, *id, - NDPI_PROTOCOL_SOPCAST, - ndpi_search_sopcast, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - diff --git a/src/lib/protocols/stealthnet.c b/src/lib/protocols/stealthnet.c deleted file mode 100644 index f4099e194..000000000 --- a/src/lib/protocols/stealthnet.c +++ /dev/null @@ -1,69 +0,0 @@ -/* - * stealthnet.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_STEALTHNET - -#include "ndpi_api.h" - - -static void ndpi_int_stealthnet_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STEALTHNET, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - -void ndpi_search_stealthnet(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - NDPI_LOG_DBG(ndpi_struct, "search stealthnet\n"); - - if (packet->payload_packet_len > 40 - && memcmp(packet->payload, "LARS REGENSBURGER'S FILE SHARING PROTOCOL", 41) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found stealthnet\n"); - ndpi_int_stealthnet_add_connection(ndpi_struct, flow); - return; - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - -} - - -void init_stealthnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - - ndpi_set_bitmask_protocol_detection("Stealthnet", ndpi_struct, *id, - NDPI_PROTOCOL_STEALTHNET, - ndpi_search_stealthnet, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - diff --git a/src/lib/protocols/thunder.c b/src/lib/protocols/thunder.c deleted file mode 100644 index 258e7750f..000000000 --- a/src/lib/protocols/thunder.c +++ /dev/null @@ -1,193 +0,0 @@ -/* - * thunder.c - * - * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see <http://www.gnu.org/licenses/>. - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_THUNDER - -#include "ndpi_api.h" - - -static void ndpi_int_thunder_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow/* , ndpi_protocol_type_t protocol_type */) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_THUNDER, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); -} - - - -#if !defined(WIN32) -static inline -#elif defined(MINGW_GCC) -__mingw_forceinline static -#else -__forceinline static -#endif -void ndpi_int_search_thunder_udp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30 - && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) { - if (flow->thunder_stage == 3) { - NDPI_LOG_INFO(ndpi_struct, "found THUNDER udp\n"); - ndpi_int_thunder_add_connection(ndpi_struct, flow); - return; - } - - flow->thunder_stage++; - NDPI_LOG_DBG2(ndpi_struct, - "maybe thunder udp packet detected, stage increased to %u\n", flow->thunder_stage); - return; - } - - NDPI_LOG_DBG(ndpi_struct, "excluding thunder udp at stage %u\n", flow->thunder_stage); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER); -} - - -#if !defined(WIN32) -static inline -#elif defined(MINGW_GCC) -__mingw_forceinline static -#else -__forceinline static -#endif -void ndpi_int_search_thunder_tcp(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30 - && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) { - if (flow->thunder_stage == 3) { - NDPI_LOG_INFO(ndpi_struct, "found THUNDER tcp\n"); - ndpi_int_thunder_add_connection(ndpi_struct, flow); - return; - } - - flow->thunder_stage++; - NDPI_LOG_DBG2(ndpi_struct, - "maybe thunder tcp packet detected, stage increased to %u\n", flow->thunder_stage); - return; - } - - if (flow->thunder_stage == 0 && packet->payload_packet_len > 17 - && memcmp(packet->payload, "POST / HTTP/1.1\r\n", 17) == 0) { - ndpi_parse_packet_line_info(ndpi_struct, flow); - - NDPI_LOG_DBG2(ndpi_struct, - "maybe thunder http POST packet detected, parsed packet lines: %u, empty line set %u (at: %u)\n", - packet->parsed_lines, packet->empty_line_position_set, packet->empty_line_position); - - if (packet->empty_line_position_set != 0 && - packet->content_line.ptr != NULL && - packet->content_line.len == 24 && - memcmp(packet->content_line.ptr, "application/octet-stream", - 24) == 0 && packet->empty_line_position_set < (packet->payload_packet_len - 8) - && packet->payload_packet_len > (packet->empty_line_position + 5) - && packet->payload[packet->empty_line_position + 2] >= 0x30 - && packet->payload[packet->empty_line_position + 2] < 0x40 - && packet->payload[packet->empty_line_position + 3] == 0x00 - && packet->payload[packet->empty_line_position + 4] == 0x00 - && packet->payload[packet->empty_line_position + 5] == 0x00) { - NDPI_LOG_INFO(ndpi_struct, - "found thunder http POST packet application does match\n"); - ndpi_int_thunder_add_connection(ndpi_struct, flow); - return; - } - } - NDPI_LOG_DBG(ndpi_struct, "excluding thunder tcp at stage %u\n", flow->thunder_stage); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER); -} - - -#if !defined(WIN32) -static inline -#elif defined(MINGW_GCC) -__mingw_forceinline static -#else -__forceinline static -#endif -void ndpi_int_search_thunder_http(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 5 - && memcmp(packet->payload, "GET /", 5) == 0) { - NDPI_LOG_DBG2(ndpi_struct, "HTTP packet detected\n"); - ndpi_parse_packet_line_info(ndpi_struct, flow); - - if (packet->parsed_lines > 7 - && packet->parsed_lines < 11 - && packet->line[1].len > 10 - && memcmp(packet->line[1].ptr, "Accept: */*", 11) == 0 - && packet->line[2].len > 22 - && memcmp(packet->line[2].ptr, "Cache-Control: no-cache", - 23) == 0 && packet->line[3].len > 16 - && memcmp(packet->line[3].ptr, "Connection: close", 17) == 0 - && packet->line[4].len > 6 - && memcmp(packet->line[4].ptr, "Host: ", 6) == 0 - && packet->line[5].len > 15 - && memcmp(packet->line[5].ptr, "Pragma: no-cache", 16) == 0 - && packet->user_agent_line.ptr != NULL - && packet->user_agent_line.len > 49 - && memcmp(packet->user_agent_line.ptr, - "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)", 50) == 0) { - NDPI_LOG_INFO(ndpi_struct, - "found thunder HTTP download detected\n"); - ndpi_int_thunder_add_connection(ndpi_struct, flow); - } - } -} - -void ndpi_search_thunder(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &ndpi_struct->packet; - // - //struct ndpi_id_struct *src = flow->src; - //struct ndpi_id_struct *dst = flow->dst; - - if (packet->tcp != NULL) { - ndpi_int_search_thunder_http(ndpi_struct, flow); - ndpi_int_search_thunder_tcp(ndpi_struct, flow); - } else if (packet->udp != NULL) { - ndpi_int_search_thunder_udp(ndpi_struct, flow); - } -} - - -void init_thunder_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("Thunder", ndpi_struct, *id, - NDPI_PROTOCOL_THUNDER, - ndpi_search_thunder, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/tests/pcap/aimini-http.pcap b/tests/pcap/aimini-http.pcap Binary files differdeleted file mode 100644 index e844cd094..000000000 --- a/tests/pcap/aimini-http.pcap +++ /dev/null diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out index c07d774de..7947eb95a 100644 --- a/tests/result/1kxun.pcap.out +++ b/tests/result/1kxun.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow) Confidence Unknown : 14 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 177 (flows) -Num dissector calls: 4824 (24.49 diss/flow) +Num dissector calls: 4395 (22.31 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/45/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/443-chrome.pcap.out b/tests/result/443-chrome.pcap.out index 6562ef8d5..02479494d 100644 --- a/tests/result/443-chrome.pcap.out +++ b/tests/result/443-chrome.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 129 (129.00 diss/flow) +Num dissector calls: 116 (116.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/443-opvn.pcap.out b/tests/result/443-opvn.pcap.out index e6f8ccbc6..1495a2c69 100644 --- a/tests/result/443-opvn.pcap.out +++ b/tests/result/443-opvn.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 130 (130.00 diss/flow) +Num dissector calls: 117 (117.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/4in4tunnel.pcap.out b/tests/result/4in4tunnel.pcap.out index 3391c8797..f5caa2ccc 100644 --- a/tests/result/4in4tunnel.pcap.out +++ b/tests/result/4in4tunnel.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 5 (5.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 178 (178.00 diss/flow) +Num dissector calls: 173 (173.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/6in4tunnel.pcap.out b/tests/result/6in4tunnel.pcap.out index b7ddc71fa..663da9a8b 100644 --- a/tests/result/6in4tunnel.pcap.out +++ b/tests/result/6in4tunnel.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 29 (5.80 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) DPI Packets (other): 3 (1.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 28 (2.80 diss/flow) +Num dissector calls: 25 (2.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/6in6tunnel.pcap.out b/tests/result/6in6tunnel.pcap.out index b45a11252..a746abada 100644 --- a/tests/result/6in6tunnel.pcap.out +++ b/tests/result/6in6tunnel.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 124 (124.00 diss/flow) +Num dissector calls: 119 (119.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/EAQ.pcap.out b/tests/result/EAQ.pcap.out index ee07089fb..64cefa32d 100644 --- a/tests/result/EAQ.pcap.out +++ b/tests/result/EAQ.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) DPI Packets (UDP): 116 (4.00 pkts/flow) Confidence DPI : 31 (flows) -Num dissector calls: 4364 (140.77 diss/flow) +Num dissector calls: 4213 (135.90 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/KakaoTalk_chat.pcap.out b/tests/result/KakaoTalk_chat.pcap.out index 8035fe770..4406ae624 100644 --- a/tests/result/KakaoTalk_chat.pcap.out +++ b/tests/result/KakaoTalk_chat.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 5 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 651 (17.13 diss/flow) +Num dissector calls: 599 (15.76 diss/flow) LRU cache ookla: 0/1/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out index 09dd19100..0da95b68c 100644 --- a/tests/result/KakaoTalk_talk.pcap.out +++ b/tests/result/KakaoTalk_talk.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 6 (1.20 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 8 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 890 (44.50 diss/flow) +Num dissector calls: 818 (40.90 diss/flow) LRU cache ookla: 0/2/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/Oscar.pcap.out b/tests/result/Oscar.pcap.out index 56d06cc22..0b87499ae 100644 --- a/tests/result/Oscar.pcap.out +++ b/tests/result/Oscar.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 360 (360.00 diss/flow) +Num dissector calls: 330 (330.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/WebattackRCE.pcap.out b/tests/result/WebattackRCE.pcap.out index 00183ca2f..6c1769d03 100644 --- a/tests/result/WebattackRCE.pcap.out +++ b/tests/result/WebattackRCE.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 797 DPI Packets (TCP): 797 (1.00 pkts/flow) Confidence DPI : 797 (flows) -Num dissector calls: 11955 (15.00 diss/flow) +Num dissector calls: 9564 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/WebattackSQLinj.pcap.out b/tests/result/WebattackSQLinj.pcap.out index a7b2595de..027fbe8d9 100644 --- a/tests/result/WebattackSQLinj.pcap.out +++ b/tests/result/WebattackSQLinj.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 54 (6.00 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 135 (15.00 diss/flow) +Num dissector calls: 108 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/WebattackXSS.pcap.out b/tests/result/WebattackXSS.pcap.out index 907e68670..4d2cb78e9 100644 --- a/tests/result/WebattackXSS.pcap.out +++ b/tests/result/WebattackXSS.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 639 DPI Packets (TCP): 3972 (6.01 pkts/flow) Confidence Match by port : 639 (flows) Confidence DPI : 22 (flows) -Num dissector calls: 330 (0.50 diss/flow) +Num dissector calls: 264 (0.40 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/activision.pcap.out b/tests/result/activision.pcap.out index eb9deb0cc..716e0caf8 100644 --- a/tests/result/activision.pcap.out +++ b/tests/result/activision.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 404 (101.00 diss/flow) +Num dissector calls: 384 (96.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/agora-sd-rtn.pcap.out b/tests/result/agora-sd-rtn.pcap.out index 2dc65eb64..d791f1f52 100644 --- a/tests/result/agora-sd-rtn.pcap.out +++ b/tests/result/agora-sd-rtn.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 26 (1.00 pkts/flow) Confidence DPI : 26 (flows) -Num dissector calls: 2444 (94.00 diss/flow) +Num dissector calls: 2314 (89.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/aimini-http.pcap.out b/tests/result/aimini-http.pcap.out deleted file mode 100644 index 096bbfed3..000000000 --- a/tests/result/aimini-http.pcap.out +++ /dev/null @@ -1,28 +0,0 @@ -Guessed flow protos: 0 - -DPI Packets (TCP): 36 (9.00 pkts/flow) -Confidence DPI : 4 (flows) -Num dissector calls: 76 (19.00 diss/flow) -LRU cache ookla: 0/0/0 (insert/search/found) -LRU cache bittorrent: 0/0/0 (insert/search/found) -LRU cache zoom: 0/0/0 (insert/search/found) -LRU cache stun: 0/0/0 (insert/search/found) -LRU cache tls_cert: 0/0/0 (insert/search/found) -LRU cache mining: 0/0/0 (insert/search/found) -LRU cache msteams: 0/0/0 (insert/search/found) -LRU cache stun_zoom: 0/0/0 (insert/search/found) -Automa host: 4/0 (search/found) -Automa domain: 4/0 (search/found) -Automa tls cert: 0/0 (search/found) -Automa risk mask: 0/0 (search/found) -Automa common alpns: 0/0 (search/found) -Patricia risk mask: 16/0 (search/found) -Patricia risk: 0/0 (search/found) -Patricia protocols: 16/0 (search/found) - -Aimini 133 86722 4 - - 1 TCP 10.101.0.2:28501 <-> 10.102.0.2:80 [proto: 7.99/HTTP.Aimini][IP: 0/Unknown][ClearText][Confidence: DPI][cat: Download/7][38 pkts/36756 bytes <-> 34 pkts/28010 bytes][Goodput ratio: 94/93][0.00 sec][Hostname/SNI: www.aimini.net][bytes ratio: 0.135 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 1/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 967/824 1514/1514 664/699][URL: www.aimini.net/member/signup/][StatusCode: 200][User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17][PLAIN TEXT (GET /member/signup/ HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,4,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,83,0,0] - 2 TCP 10.101.0.2:28503 <-> 10.102.0.2:80 [proto: 7.99/HTTP.Aimini][IP: 0/Unknown][ClearText][Confidence: DPI][cat: Download/7][12 pkts/1920 bytes <-> 18 pkts/13384 bytes][Goodput ratio: 63/92][0.00 sec][Hostname/SNI: www.aimini.net][bytes ratio: -0.749 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 160/744 658/1514 223/696][URL: www.aimini.net/search/?q=pictures&sca=][StatusCode: 200][User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17][PLAIN TEXT (GET /search/)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,67,0,0] - 3 TCP 10.101.0.2:28502 <-> 10.102.0.2:80 [proto: 7.99/HTTP.Aimini][IP: 0/Unknown][ClearText][Confidence: DPI][cat: Download/7][10 pkts/2690 bytes <-> 8 pkts/1544 bytes][Goodput ratio: 78/70][0.00 sec][Hostname/SNI: www.aimini.com][bytes ratio: 0.271 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 269/193 585/339 255/132][URL: www.aimini.com/webcounter/w.php?___hm=.net_SignUp_&_lh_=http://www.aimini.net/member/signup/&__Refer_=http://www.aimini.net/][StatusCode: 200][User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17][PLAIN TEXT (GET /webcounter/w.php)][Plen Bins: 0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 4 TCP 10.101.0.2:28504 <-> 10.102.0.2:80 [proto: 7.99/HTTP.Aimini][IP: 0/Unknown][ClearText][Confidence: DPI][cat: Download/7][8 pkts/1556 bytes <-> 5 pkts/862 bytes][Goodput ratio: 70/66][0.00 sec][Hostname/SNI: www.aimini.com][bytes ratio: 0.287 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 194/172 596/339 232/136][URL: www.aimini.com/webcounter/w.php?___hm=.net_Search_&_lh_=http://www.aimini.net/search/?q=pictures&sca=&__Refer_=http://www.aimini.net/][StatusCode: 200][User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17][PLAIN TEXT (GET /webcounter/w.php)][Plen Bins: 0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/alexa-app.pcapng.out b/tests/result/alexa-app.pcapng.out index 3653e8723..de0e954d4 100644 --- a/tests/result/alexa-app.pcapng.out +++ b/tests/result/alexa-app.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow) DPI Packets (other): 6 (1.00 pkts/flow) Confidence Match by port : 14 (flows) Confidence DPI : 146 (flows) -Num dissector calls: 543 (3.39 diss/flow) +Num dissector calls: 473 (2.96 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/alicloud.pcap.out b/tests/result/alicloud.pcap.out index 42898e5eb..784c08309 100644 --- a/tests/result/alicloud.pcap.out +++ b/tests/result/alicloud.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 60 (4.00 pkts/flow) Confidence DPI : 15 (flows) -Num dissector calls: 1830 (122.00 diss/flow) +Num dissector calls: 1635 (109.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/amqp.pcap.out b/tests/result/amqp.pcap.out index f5ba7759d..715270f24 100644 --- a/tests/result/amqp.pcap.out +++ b/tests/result/amqp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (3.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 413 (137.67 diss/flow) +Num dissector calls: 371 (123.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/android.pcap.out b/tests/result/android.pcap.out index c3aa80b39..475fa0a7c 100644 --- a/tests/result/android.pcap.out +++ b/tests/result/android.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 4 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 60 (flows) -Num dissector calls: 280 (4.44 diss/flow) +Num dissector calls: 257 (4.08 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out index c3be0a420..74b455c6d 100644 --- a/tests/result/anyconnect-vpn.pcap.out +++ b/tests/result/anyconnect-vpn.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 61 (flows) -Num dissector calls: 939 (13.61 diss/flow) +Num dissector calls: 877 (12.71 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/avast.pcap.out b/tests/result/avast.pcap.out index 2aed40a3d..5c6e9d9f8 100644 --- a/tests/result/avast.pcap.out +++ b/tests/result/avast.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 40 (4.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 1230 (123.00 diss/flow) +Num dissector calls: 1100 (110.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/avast_securedns.pcapng.out b/tests/result/avast_securedns.pcapng.out index 5b0f63c05..547cb991a 100644 --- a/tests/result/avast_securedns.pcapng.out +++ b/tests/result/avast_securedns.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 39 (1.00 pkts/flow) Confidence DPI : 39 (flows) -Num dissector calls: 3549 (91.00 diss/flow) +Num dissector calls: 3354 (86.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/117/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/bittorrent.pcap.out b/tests/result/bittorrent.pcap.out index 8d03ee46a..3ac65446e 100644 --- a/tests/result/bittorrent.pcap.out +++ b/tests/result/bittorrent.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 24 (1.00 pkts/flow) Confidence DPI : 24 (flows) -Num dissector calls: 2114 (88.08 diss/flow) +Num dissector calls: 1828 (76.17 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 120/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/bittorrent_utp.pcap.out b/tests/result/bittorrent_utp.pcap.out index 6fa47e0ea..1b0be1fd3 100644 --- a/tests/result/bittorrent_utp.pcap.out +++ b/tests/result/bittorrent_utp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 81 (81.00 diss/flow) +Num dissector calls: 76 (76.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 5/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/bot.pcap.out b/tests/result/bot.pcap.out index 5e1bc143e..783dc6a41 100644 --- a/tests/result/bot.pcap.out +++ b/tests/result/bot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/cassandra.pcap.out b/tests/result/cassandra.pcap.out index 4c128f6e6..a8bd4e04b 100644 --- a/tests/result/cassandra.pcap.out +++ b/tests/result/cassandra.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 18 (9.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 362 (181.00 diss/flow) +Num dissector calls: 332 (166.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/cloudflare-warp.pcap.out b/tests/result/cloudflare-warp.pcap.out index 0cd0f0068..12075cb10 100644 --- a/tests/result/cloudflare-warp.pcap.out +++ b/tests/result/cloudflare-warp.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 188 (23.50 diss/flow) +Num dissector calls: 173 (21.62 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/coap_mqtt.pcap.out b/tests/result/coap_mqtt.pcap.out index fb346a0f5..5c9d7be1c 100644 --- a/tests/result/coap_mqtt.pcap.out +++ b/tests/result/coap_mqtt.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (1.75 pkts/flow) DPI Packets (UDP): 12 (1.00 pkts/flow) Confidence DPI : 16 (flows) -Num dissector calls: 352 (22.00 diss/flow) +Num dissector calls: 300 (18.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/collectd.pcap.out b/tests/result/collectd.pcap.out index 983a5355f..33fa52f54 100644 --- a/tests/result/collectd.pcap.out +++ b/tests/result/collectd.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 13 (1.62 pkts/flow) Confidence Match by port : 3 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 404 (50.50 diss/flow) +Num dissector calls: 389 (48.62 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/corba.pcap.out b/tests/result/corba.pcap.out index 9b2bba127..c0dcf2cc9 100644 --- a/tests/result/corba.pcap.out +++ b/tests/result/corba.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 228 (76.00 diss/flow) +Num dissector calls: 189 (63.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/crynet.pcap.out b/tests/result/crynet.pcap.out index 129b7256d..9da37d657 100644 --- a/tests/result/crynet.pcap.out +++ b/tests/result/crynet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 424 (106.00 diss/flow) +Num dissector calls: 404 (101.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dcerpc.pcap.out b/tests/result/dcerpc.pcap.out index b172bf1ce..d89f5c3e4 100644 --- a/tests/result/dcerpc.pcap.out +++ b/tests/result/dcerpc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 216 (54.00 diss/flow) +Num dissector calls: 196 (49.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dhcp-fuzz.pcapng.out b/tests/result/dhcp-fuzz.pcapng.out index b4099f936..c00dffeb8 100644 --- a/tests/result/dhcp-fuzz.pcapng.out +++ b/tests/result/dhcp-fuzz.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 109 (109.00 diss/flow) +Num dissector calls: 104 (104.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/discord.pcap.out b/tests/result/discord.pcap.out index a525f5cd7..b401a2914 100644 --- a/tests/result/discord.pcap.out +++ b/tests/result/discord.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) DPI Packets (UDP): 60 (1.82 pkts/flow) Confidence DPI : 34 (flows) -Num dissector calls: 4069 (119.68 diss/flow) +Num dissector calls: 3904 (114.82 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out b/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out index febea1f67..a6101325e 100644 --- a/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out +++ b/tests/result/dnscrypt-v1-and-resolver-pings.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 256 (1.04 pkts/flow) Confidence DPI : 245 (flows) -Num dissector calls: 21984 (89.73 diss/flow) +Num dissector calls: 20759 (84.73 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/513/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dnscrypt-v2.pcap.out b/tests/result/dnscrypt-v2.pcap.out index 06ba9367e..8545b48ad 100644 --- a/tests/result/dnscrypt-v2.pcap.out +++ b/tests/result/dnscrypt-v2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 6 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 378 (126.00 diss/flow) +Num dissector calls: 363 (121.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/dnscrypt_skype_false_positive.pcapng.out b/tests/result/dnscrypt_skype_false_positive.pcapng.out index 9f1fc3382..69bcbfb59 100644 --- a/tests/result/dnscrypt_skype_false_positive.pcapng.out +++ b/tests/result/dnscrypt_skype_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 127 (127.00 diss/flow) +Num dissector calls: 122 (122.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/doq.pcapng.out b/tests/result/doq.pcapng.out index 09e71bd61..e4674ee61 100644 --- a/tests/result/doq.pcapng.out +++ b/tests/result/doq.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 65 (32.50 diss/flow) +Num dissector calls: 60 (30.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/doq_adguard.pcapng.out b/tests/result/doq_adguard.pcapng.out index 2680d038f..0aae97804 100644 --- a/tests/result/doq_adguard.pcapng.out +++ b/tests/result/doq_adguard.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 61 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/drda_db2.pcap.out b/tests/result/drda_db2.pcap.out index 74972d68d..463468ae6 100644 --- a/tests/result/drda_db2.pcap.out +++ b/tests/result/drda_db2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 89 (89.00 diss/flow) +Num dissector calls: 76 (76.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/elasticsearch.pcap.out b/tests/result/elasticsearch.pcap.out index ce7c4fa67..220a24486 100644 --- a/tests/result/elasticsearch.pcap.out +++ b/tests/result/elasticsearch.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 16 (2.29 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 896 (128.00 diss/flow) +Num dissector calls: 805 (115.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/emotet.pcap.out b/tests/result/emotet.pcap.out index b677fab60..3f32bb523 100644 --- a/tests/result/emotet.pcap.out +++ b/tests/result/emotet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 48 (8.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 206 (34.33 diss/flow) +Num dissector calls: 183 (30.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ethereum.pcap.out b/tests/result/ethereum.pcap.out index f6e9b61d4..0f365da67 100644 --- a/tests/result/ethereum.pcap.out +++ b/tests/result/ethereum.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 217 (3.88 pkts/flow) DPI Packets (UDP): 18 (1.00 pkts/flow) Confidence Match by port : 3 (flows) Confidence DPI : 71 (flows) -Num dissector calls: 593 (8.01 diss/flow) +Num dissector calls: 539 (7.28 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/exe_download.pcap.out b/tests/result/exe_download.pcap.out index c31e90f01..202d39f73 100644 --- a/tests/result/exe_download.pcap.out +++ b/tests/result/exe_download.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/exe_download_as_png.pcap.out b/tests/result/exe_download_as_png.pcap.out index 988402dc0..7d0eb973b 100644 --- a/tests/result/exe_download_as_png.pcap.out +++ b/tests/result/exe_download_as_png.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fastcgi.pcap.out b/tests/result/fastcgi.pcap.out index df0f4dc5c..e27ee2872 100644 --- a/tests/result/fastcgi.pcap.out +++ b/tests/result/fastcgi.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 160 (160.00 diss/flow) +Num dissector calls: 146 (146.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fix.pcap.out b/tests/result/fix.pcap.out index 036f11e53..a2cd932c9 100644 --- a/tests/result/fix.pcap.out +++ b/tests/result/fix.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (1.00 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1104 (92.00 diss/flow) +Num dissector calls: 948 (79.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fix2.pcap.out b/tests/result/fix2.pcap.out index f1711651d..7abddbc4f 100644 --- a/tests/result/fix2.pcap.out +++ b/tests/result/fix2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 184 (92.00 diss/flow) +Num dissector calls: 158 (79.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ftp-start-tls.pcap.out b/tests/result/ftp-start-tls.pcap.out index e7351527c..96d79a4e2 100644 --- a/tests/result/ftp-start-tls.pcap.out +++ b/tests/result/ftp-start-tls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 17 (17.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 159 (159.00 diss/flow) +Num dissector calls: 145 (145.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ftp.pcap.out b/tests/result/ftp.pcap.out index e6eeefaf8..1af6b3147 100644 --- a/tests/result/ftp.pcap.out +++ b/tests/result/ftp.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 49 (16.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 669 (223.00 diss/flow) +Num dissector calls: 612 (204.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ftp_failed.pcap.out b/tests/result/ftp_failed.pcap.out index 063713433..3537298e0 100644 --- a/tests/result/ftp_failed.pcap.out +++ b/tests/result/ftp_failed.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 159 (159.00 diss/flow) +Num dissector calls: 145 (145.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out index 131583b5d..3b1a8963c 100644 --- a/tests/result/fuzz-2006-06-26-2594.pcap.out +++ b/tests/result/fuzz-2006-06-26-2594.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 30 (flows) Confidence Match by port : 28 (flows) Confidence DPI : 193 (flows) -Num dissector calls: 5648 (22.50 diss/flow) +Num dissector calls: 5305 (21.14 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/129/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fuzz-2006-09-29-28586.pcap.out b/tests/result/fuzz-2006-09-29-28586.pcap.out index 7f2cb6d99..73f2ed1a9 100644 --- a/tests/result/fuzz-2006-09-29-28586.pcap.out +++ b/tests/result/fuzz-2006-09-29-28586.pcap.out @@ -5,7 +5,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 3 (flows) Confidence Match by port : 26 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 1043 (26.08 diss/flow) +Num dissector calls: 928 (23.20 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fuzz-2020-02-16-11740.pcap.out b/tests/result/fuzz-2020-02-16-11740.pcap.out index 3be32e644..59851d41f 100644 --- a/tests/result/fuzz-2020-02-16-11740.pcap.out +++ b/tests/result/fuzz-2020-02-16-11740.pcap.out @@ -5,7 +5,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Unknown : 19 (flows) Confidence Match by port : 3 (flows) Confidence DPI : 55 (flows) -Num dissector calls: 1805 (23.44 diss/flow) +Num dissector calls: 1725 (22.40 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/57/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/fuzz-2021-10-13.pcap.out b/tests/result/fuzz-2021-10-13.pcap.out index 8f3509f57..92c94af44 100644 --- a/tests/result/fuzz-2021-10-13.pcap.out +++ b/tests/result/fuzz-2021-10-13.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 128 (128.00 diss/flow) +Num dissector calls: 115 (115.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/genshin-impact.pcap.out b/tests/result/genshin-impact.pcap.out index 6d2cc266b..45ae7b81f 100644 --- a/tests/result/genshin-impact.pcap.out +++ b/tests/result/genshin-impact.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 520 (86.67 diss/flow) +Num dissector calls: 471 (78.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/gnutella.pcap.out b/tests/result/gnutella.pcap.out index 66f19a91e..94d25b2c7 100644 --- a/tests/result/gnutella.pcap.out +++ b/tests/result/gnutella.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow) Confidence Unknown : 592 (flows) Confidence Match by port : 1 (flows) Confidence DPI : 167 (flows) -Num dissector calls: 67770 (89.17 diss/flow) +Num dissector calls: 65122 (85.69 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/1776/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/google_ssl.pcap.out b/tests/result/google_ssl.pcap.out index 2d0e41957..cf8dfa984 100644 --- a/tests/result/google_ssl.pcap.out +++ b/tests/result/google_ssl.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 28 (28.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 225 (225.00 diss/flow) +Num dissector calls: 206 (206.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/gtp_false_positive.pcapng.out b/tests/result/gtp_false_positive.pcapng.out index 675436f39..26a806c21 100644 --- a/tests/result/gtp_false_positive.pcapng.out +++ b/tests/result/gtp_false_positive.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 7 (2.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) -Num dissector calls: 400 (133.33 diss/flow) +Num dissector calls: 385 (128.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/gtp_prime.pcapng.out b/tests/result/gtp_prime.pcapng.out index 985fda54c..e919ff079 100644 --- a/tests/result/gtp_prime.pcapng.out +++ b/tests/result/gtp_prime.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 52 (52.00 diss/flow) +Num dissector calls: 47 (47.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/h323.pcap.out b/tests/result/h323.pcap.out index 9a0e28b48..697d98084 100644 --- a/tests/result/h323.pcap.out +++ b/tests/result/h323.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 131 (65.50 diss/flow) +Num dissector calls: 118 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/hangout.pcap.out b/tests/result/hangout.pcap.out index 95ee7343e..a46af7701 100644 --- a/tests/result/hangout.pcap.out +++ b/tests/result/hangout.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 74 (74.00 diss/flow) +Num dissector calls: 69 (69.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/hpvirtgrp.pcap.out b/tests/result/hpvirtgrp.pcap.out index f60d605f3..9c00c1dda 100644 --- a/tests/result/hpvirtgrp.pcap.out +++ b/tests/result/hpvirtgrp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 37 (4.11 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 1008 (112.00 diss/flow) +Num dissector calls: 891 (99.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/hsrp2_ipv6.pcapng.out b/tests/result/hsrp2_ipv6.pcapng.out index 4b40c2608..60b4c56b2 100644 --- a/tests/result/hsrp2_ipv6.pcapng.out +++ b/tests/result/hsrp2_ipv6.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 102 (51.00 diss/flow) +Num dissector calls: 92 (46.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http-crash-content-disposition.pcap.out b/tests/result/http-crash-content-disposition.pcap.out index 9c4c81da4..dfca9cff7 100644 --- a/tests/result/http-crash-content-disposition.pcap.out +++ b/tests/result/http-crash-content-disposition.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http-lines-split.pcap.out b/tests/result/http-lines-split.pcap.out index 492fa7ea6..5f504a7c1 100644 --- a/tests/result/http-lines-split.pcap.out +++ b/tests/result/http-lines-split.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http-manipulated.pcap.out b/tests/result/http-manipulated.pcap.out index d82e912ad..6f3bec10f 100644 --- a/tests/result/http-manipulated.pcap.out +++ b/tests/result/http-manipulated.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 30 (15.00 diss/flow) +Num dissector calls: 24 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http_auth.pcap.out b/tests/result/http_auth.pcap.out index e0258b66d..cb692fd24 100644 --- a/tests/result/http_auth.pcap.out +++ b/tests/result/http_auth.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http_guessed_host_and_guessed.pcapng.out b/tests/result/http_guessed_host_and_guessed.pcapng.out index 22ae008c8..da647d33f 100644 --- a/tests/result/http_guessed_host_and_guessed.pcapng.out +++ b/tests/result/http_guessed_host_and_guessed.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 129 (129.00 diss/flow) +Num dissector calls: 116 (116.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out index 552c91149..d7a7c81e0 100644 --- a/tests/result/http_ipv6.pcap.out +++ b/tests/result/http_ipv6.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (5.92 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence Match by port : 7 (flows) Confidence DPI : 8 (flows) -Num dissector calls: 147 (9.80 diss/flow) +Num dissector calls: 142 (9.47 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/http_on_sip_port.pcap.out b/tests/result/http_on_sip_port.pcap.out index 453544e72..dcc7ccd1b 100644 --- a/tests/result/http_on_sip_port.pcap.out +++ b/tests/result/http_on_sip_port.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 16 (16.00 diss/flow) +Num dissector calls: 13 (13.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/i3d.pcap.out b/tests/result/i3d.pcap.out index f4ff7ed89..56bb959d8 100644 --- a/tests/result/i3d.pcap.out +++ b/tests/result/i3d.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 392 (98.00 diss/flow) +Num dissector calls: 372 (93.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/imap-starttls.pcap.out b/tests/result/imap-starttls.pcap.out index ce3f964a0..724ffa060 100644 --- a/tests/result/imap-starttls.pcap.out +++ b/tests/result/imap-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 19 (19.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 211 (211.00 diss/flow) +Num dissector calls: 195 (195.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/imap.pcap.out b/tests/result/imap.pcap.out index 995793594..a887c0463 100644 --- a/tests/result/imap.pcap.out +++ b/tests/result/imap.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 211 (211.00 diss/flow) +Num dissector calls: 195 (195.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/imo.pcap.out b/tests/result/imo.pcap.out index 284442798..10598135e 100644 --- a/tests/result/imo.pcap.out +++ b/tests/result/imo.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 7 (3.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 290 (145.00 diss/flow) +Num dissector calls: 280 (140.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out index 8272b481e..ad441bba8 100644 --- a/tests/result/instagram.pcap.out +++ b/tests/result/instagram.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 7 (flows) Confidence DPI : 30 (flows) -Num dissector calls: 1927 (50.71 diss/flow) +Num dissector calls: 1780 (46.84 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/15/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/iphone.pcap.out b/tests/result/iphone.pcap.out index c9c7b63f2..0354a9eea 100644 --- a/tests/result/iphone.pcap.out +++ b/tests/result/iphone.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 55 (1.77 pkts/flow) DPI Packets (other): 5 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 50 (flows) -Num dissector calls: 363 (7.12 diss/flow) +Num dissector calls: 344 (6.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ipp.pcap.out b/tests/result/ipp.pcap.out index f72b05502..2f6289423 100644 --- a/tests/result/ipp.pcap.out +++ b/tests/result/ipp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 21 (7.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 57 (19.00 diss/flow) +Num dissector calls: 48 (16.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/irc.pcap.out b/tests/result/irc.pcap.out index 4a38b51fb..f47cd8437 100644 --- a/tests/result/irc.pcap.out +++ b/tests/result/irc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 165 (165.00 diss/flow) +Num dissector calls: 151 (151.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/jabber.pcap.out b/tests/result/jabber.pcap.out index e40262529..2c10d5f2b 100644 --- a/tests/result/jabber.pcap.out +++ b/tests/result/jabber.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 74 (6.17 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1481 (123.42 diss/flow) +Num dissector calls: 1346 (112.17 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/kerberos.pcap.out b/tests/result/kerberos.pcap.out index ad0451509..b969ba6b7 100644 --- a/tests/result/kerberos.pcap.out +++ b/tests/result/kerberos.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (2.14 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 23 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 4096 (113.78 diss/flow) +Num dissector calls: 3741 (103.92 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/kismet.pcap.out b/tests/result/kismet.pcap.out index 7bd36e174..9dffaf72d 100644 --- a/tests/result/kismet.pcap.out +++ b/tests/result/kismet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 125 (125.00 diss/flow) +Num dissector calls: 112 (112.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/kontiki.pcap.out b/tests/result/kontiki.pcap.out index 8b5089fb6..5410162f9 100644 --- a/tests/result/kontiki.pcap.out +++ b/tests/result/kontiki.pcap.out @@ -4,7 +4,7 @@ DPI Packets (UDP): 6 (1.50 pkts/flow) DPI Packets (other): 4 (1.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 6 (flows) -Num dissector calls: 328 (41.00 diss/flow) +Num dissector calls: 312 (39.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/line.pcap.out b/tests/result/line.pcap.out index 6ab60aa43..fbb93a2cb 100644 --- a/tests/result/line.pcap.out +++ b/tests/result/line.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 13 (6.50 pkts/flow) DPI Packets (UDP): 40 (13.33 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 722 (144.40 diss/flow) +Num dissector calls: 707 (141.40 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/lisp_registration.pcap.out b/tests/result/lisp_registration.pcap.out index c8f398b07..18e64595f 100644 --- a/tests/result/lisp_registration.pcap.out +++ b/tests/result/lisp_registration.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 202 (50.50 diss/flow) +Num dissector calls: 176 (44.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/log4j-webapp-exploit.pcap.out b/tests/result/log4j-webapp-exploit.pcap.out index 7fdd7de7f..75ca0ee27 100644 --- a/tests/result/log4j-webapp-exploit.pcap.out +++ b/tests/result/log4j-webapp-exploit.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 63 (9.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 470 (67.14 diss/flow) +Num dissector calls: 416 (59.43 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/lru_ipv6_caches.pcapng.out b/tests/result/lru_ipv6_caches.pcapng.out index dca6f6d78..8d8ed3ca5 100644 --- a/tests/result/lru_ipv6_caches.pcapng.out +++ b/tests/result/lru_ipv6_caches.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 42 (4.67 pkts/flow) Confidence Unknown : 4 (flows) Confidence DPI (cache) : 2 (flows) Confidence DPI : 6 (flows) -Num dissector calls: 1253 (104.42 diss/flow) +Num dissector calls: 1208 (100.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/12/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/malware.pcap.out b/tests/result/malware.pcap.out index 3d8eef892..8bd6bfc97 100644 --- a/tests/result/malware.pcap.out +++ b/tests/result/malware.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 18 (3.60 diss/flow) +Num dissector calls: 15 (3.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/memcached.cap.out b/tests/result/memcached.cap.out index 48cde8f9b..241e1dfd7 100644 --- a/tests/result/memcached.cap.out +++ b/tests/result/memcached.cap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 130 (130.00 diss/flow) +Num dissector calls: 117 (117.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mgcp.pcapng.out b/tests/result/mgcp.pcapng.out index 74efbc869..1098d00cf 100644 --- a/tests/result/mgcp.pcapng.out +++ b/tests/result/mgcp.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 38 (19.00 diss/flow) +Num dissector calls: 36 (18.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/monero.pcap.out b/tests/result/monero.pcap.out index 29ebc58fd..b66f89920 100644 --- a/tests/result/monero.pcap.out +++ b/tests/result/monero.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 64 (32.00 diss/flow) +Num dissector calls: 52 (26.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mongo_false_positive.pcapng.out b/tests/result/mongo_false_positive.pcapng.out index 226a29dfc..575897f83 100644 --- a/tests/result/mongo_false_positive.pcapng.out +++ b/tests/result/mongo_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (26.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 435 (435.00 diss/flow) +Num dissector calls: 401 (401.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mongodb.pcap.out b/tests/result/mongodb.pcap.out index 9ba93870a..3e47797f5 100644 --- a/tests/result/mongodb.pcap.out +++ b/tests/result/mongodb.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 27 (3.38 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 115 (14.38 diss/flow) +Num dissector calls: 102 (12.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mpeg-dash.pcap.out b/tests/result/mpeg-dash.pcap.out index 3d561c496..17a1f47f5 100644 --- a/tests/result/mpeg-dash.pcap.out +++ b/tests/result/mpeg-dash.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 3 DPI Packets (TCP): 13 (3.25 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 76 (19.00 diss/flow) +Num dissector calls: 64 (16.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mpeg.pcap.out b/tests/result/mpeg.pcap.out index 2b5ab16b0..92375b083 100644 --- a/tests/result/mpeg.pcap.out +++ b/tests/result/mpeg.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mpegts.pcap.out b/tests/result/mpegts.pcap.out index 07e3c1a91..2884fbfc8 100644 --- a/tests/result/mpegts.pcap.out +++ b/tests/result/mpegts.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 69 (69.00 diss/flow) +Num dissector calls: 64 (64.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/mssql_tds.pcap.out b/tests/result/mssql_tds.pcap.out index 942901b76..dbb86e0f7 100644 --- a/tests/result/mssql_tds.pcap.out +++ b/tests/result/mssql_tds.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 18 (1.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 299 (24.92 diss/flow) +Num dissector calls: 280 (23.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nats.pcap.out b/tests/result/nats.pcap.out index 126264521..1cf24e6a9 100644 --- a/tests/result/nats.pcap.out +++ b/tests/result/nats.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 24 (12.00 diss/flow) +Num dissector calls: 20 (10.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out index 45052ad00..0227259c2 100644 --- a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out +++ b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out index 66a081a1d..a9f00bb7f 100644 --- a/tests/result/nest_log_sink.pcap.out +++ b/tests/result/nest_log_sink.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 130 (10.00 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 1933 (138.07 diss/flow) +Num dissector calls: 1765 (126.07 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/netbios.pcap.out b/tests/result/netbios.pcap.out index 81f0b0de4..1ac20952f 100644 --- a/tests/result/netbios.pcap.out +++ b/tests/result/netbios.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 14 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 14 (flows) -Num dissector calls: 143 (9.53 diss/flow) +Num dissector calls: 130 (8.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/netflix.pcap.out b/tests/result/netflix.pcap.out index 0d9b93a1c..da4c406c8 100644 --- a/tests/result/netflix.pcap.out +++ b/tests/result/netflix.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (2.08 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 60 (flows) -Num dissector calls: 456 (7.48 diss/flow) +Num dissector calls: 375 (6.15 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/netflowv9.pcap.out b/tests/result/netflowv9.pcap.out index aa34159ac..a511aa78a 100644 --- a/tests/result/netflowv9.pcap.out +++ b/tests/result/netflowv9.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 55 (55.00 diss/flow) +Num dissector calls: 50 (50.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nfsv2.pcap.out b/tests/result/nfsv2.pcap.out index cda555a23..ed0aa8e1b 100644 --- a/tests/result/nfsv2.pcap.out +++ b/tests/result/nfsv2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 7 (1.00 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 162 (23.14 diss/flow) +Num dissector calls: 147 (21.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nfsv3.pcap.out b/tests/result/nfsv3.pcap.out index 218986cdc..20ec44279 100644 --- a/tests/result/nfsv3.pcap.out +++ b/tests/result/nfsv3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence DPI : 8 (flows) -Num dissector calls: 194 (24.25 diss/flow) +Num dissector calls: 176 (22.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nintendo.pcap.out b/tests/result/nintendo.pcap.out index c7cba9cc9..30f14ae5f 100644 --- a/tests/result/nintendo.pcap.out +++ b/tests/result/nintendo.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 5 (flows) Confidence Match by port : 1 (flows) Confidence DPI : 15 (flows) -Num dissector calls: 1310 (62.38 diss/flow) +Num dissector calls: 1250 (59.52 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/15/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/nntp.pcap.out b/tests/result/nntp.pcap.out index c06d0e81a..61d020eba 100644 --- a/tests/result/nntp.pcap.out +++ b/tests/result/nntp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 137 (137.00 diss/flow) +Num dissector calls: 124 (124.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ocs.pcap.out b/tests/result/ocs.pcap.out index c69b88a05..e7cf619ed 100644 --- a/tests/result/ocs.pcap.out +++ b/tests/result/ocs.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 92 (7.67 pkts/flow) DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 18 (flows) -Num dissector calls: 88 (4.40 diss/flow) +Num dissector calls: 73 (3.65 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ocsp.pcapng.out b/tests/result/ocsp.pcapng.out index 037e6cc05..41fcc3268 100644 --- a/tests/result/ocsp.pcapng.out +++ b/tests/result/ocsp.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 60 (6.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 150 (15.00 diss/flow) +Num dissector calls: 120 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ookla.pcap.out b/tests/result/ookla.pcap.out index 31a75000a..51ce83bdc 100644 --- a/tests/result/ookla.pcap.out +++ b/tests/result/ookla.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 16 (8.00 pkts/flow) Confidence DPI (cache) : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 113 (56.50 diss/flow) +Num dissector calls: 97 (48.50 diss/flow) LRU cache ookla: 3/1/1 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out index 999f386b4..97d0f32bd 100644 --- a/tests/result/openvpn.pcap.out +++ b/tests/result/openvpn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) DPI Packets (UDP): 5 (2.50 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 409 (136.33 diss/flow) +Num dissector calls: 385 (128.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/oracle12.pcapng.out b/tests/result/oracle12.pcapng.out index 6dd44d55e..66b742c81 100644 --- a/tests/result/oracle12.pcapng.out +++ b/tests/result/oracle12.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 20 (20.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 305 (305.00 diss/flow) +Num dissector calls: 282 (282.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pgsql.pcap.out b/tests/result/pgsql.pcap.out index a8c024ee9..0d1c5d4fe 100644 --- a/tests/result/pgsql.pcap.out +++ b/tests/result/pgsql.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (6.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 780 (130.00 diss/flow) +Num dissector calls: 702 (117.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pop3.pcap.out b/tests/result/pop3.pcap.out index b1c1e33d7..a91d37329 100644 --- a/tests/result/pop3.pcap.out +++ b/tests/result/pop3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 186 (186.00 diss/flow) +Num dissector calls: 171 (171.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pop3_stls.pcap.out b/tests/result/pop3_stls.pcap.out index ccce236ec..16497e800 100644 --- a/tests/result/pop3_stls.pcap.out +++ b/tests/result/pop3_stls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 18 (18.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 241 (241.00 diss/flow) +Num dissector calls: 223 (223.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pps.pcap.out b/tests/result/pps.pcap.out index 8370b157e..6b4d0ed13 100644 --- a/tests/result/pps.pcap.out +++ b/tests/result/pps.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 201 (4.57 pkts/flow) Confidence Unknown : 34 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 71 (flows) -Num dissector calls: 6631 (61.97 diss/flow) +Num dissector calls: 6248 (58.39 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/102/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/pptp.pcap.out b/tests/result/pptp.pcap.out index 801f19b61..3a5bda306 100644 --- a/tests/result/pptp.pcap.out +++ b/tests/result/pptp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 51 (51.00 diss/flow) +Num dissector calls: 42 (42.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/punycode-idn.pcap.out b/tests/result/punycode-idn.pcap.out index 909b1d5af..84219891a 100644 --- a/tests/result/punycode-idn.pcap.out +++ b/tests/result/punycode-idn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 17 (5.67 diss/flow) +Num dissector calls: 14 (4.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic-33.pcapng.out b/tests/result/quic-33.pcapng.out index a092cff38..a503b0ba4 100644 --- a/tests/result/quic-33.pcapng.out +++ b/tests/result/quic-33.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 64 (64.00 diss/flow) +Num dissector calls: 59 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic-34.pcap.out b/tests/result/quic-34.pcap.out index 41c542d06..a96e536d8 100644 --- a/tests/result/quic-34.pcap.out +++ b/tests/result/quic-34.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 61 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic-fuzz-overflow.pcapng.out b/tests/result/quic-fuzz-overflow.pcapng.out index 6cda2cccd..d3a71d6ce 100644 --- a/tests/result/quic-fuzz-overflow.pcapng.out +++ b/tests/result/quic-fuzz-overflow.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 61 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic-v2-01.pcapng.out b/tests/result/quic-v2-01.pcapng.out index 2d478d915..ac44400a9 100644 --- a/tests/result/quic-v2-01.pcapng.out +++ b/tests/result/quic-v2-01.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 61 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic.pcap.out b/tests/result/quic.pcap.out index f56017673..3502a3dd9 100644 --- a/tests/result/quic.pcap.out +++ b/tests/result/quic.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 12 (1.20 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 9 (flows) -Num dissector calls: 218 (21.80 diss/flow) +Num dissector calls: 208 (20.80 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic_0RTT.pcap.out b/tests/result/quic_0RTT.pcap.out index e3b745250..5f54739a4 100644 --- a/tests/result/quic_0RTT.pcap.out +++ b/tests/result/quic_0RTT.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 193 (96.50 diss/flow) +Num dissector calls: 183 (91.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic_frags_ch_in_multiple_packets.pcapng.out b/tests/result/quic_frags_ch_in_multiple_packets.pcapng.out index 1b33a5bfa..94f6d7e65 100644 --- a/tests/result/quic_frags_ch_in_multiple_packets.pcapng.out +++ b/tests/result/quic_frags_ch_in_multiple_packets.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 64 (64.00 diss/flow) +Num dissector calls: 59 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quic_interop_V.pcapng.out b/tests/result/quic_interop_V.pcapng.out index 9af2e3711..c1c451367 100644 --- a/tests/result/quic_interop_V.pcapng.out +++ b/tests/result/quic_interop_V.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 63 (1.00 pkts/flow) DPI Packets (other): 14 (1.00 pkts/flow) Confidence DPI : 77 (flows) -Num dissector calls: 2767 (35.94 diss/flow) +Num dissector calls: 2557 (33.21 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/quickplay.pcap.out b/tests/result/quickplay.pcap.out index 2c5abaf2c..f09de7f12 100644 --- a/tests/result/quickplay.pcap.out +++ b/tests/result/quickplay.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 8 DPI Packets (TCP): 78 (3.71 pkts/flow) Confidence DPI : 21 (flows) -Num dissector calls: 245 (11.67 diss/flow) +Num dissector calls: 197 (9.38 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/radius_false_positive.pcapng.out b/tests/result/radius_false_positive.pcapng.out index 2b49c58b5..c1602413c 100644 --- a/tests/result/radius_false_positive.pcapng.out +++ b/tests/result/radius_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 10 (10.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 203 (203.00 diss/flow) +Num dissector calls: 198 (198.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/raknet.pcap.out b/tests/result/raknet.pcap.out index 4f747e0de..4d7ad1fe7 100644 --- a/tests/result/raknet.pcap.out +++ b/tests/result/raknet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 24 (2.00 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1458 (121.50 diss/flow) +Num dissector calls: 1398 (116.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/reasm_crash_anon.pcapng.out b/tests/result/reasm_crash_anon.pcapng.out index 62d15db2f..1abdea29e 100644 --- a/tests/result/reasm_crash_anon.pcapng.out +++ b/tests/result/reasm_crash_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 343 (343.00 diss/flow) +Num dissector calls: 315 (315.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/reasm_segv_anon.pcapng.out b/tests/result/reasm_segv_anon.pcapng.out index 2df04b557..1dc811455 100644 --- a/tests/result/reasm_segv_anon.pcapng.out +++ b/tests/result/reasm_segv_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 273 (273.00 diss/flow) +Num dissector calls: 251 (251.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/riotgames.pcap.out b/tests/result/riotgames.pcap.out index 8474e1ae3..00889bc7b 100644 --- a/tests/result/riotgames.pcap.out +++ b/tests/result/riotgames.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 9 (1.00 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 897 (99.67 diss/flow) +Num dissector calls: 852 (94.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/rsh.pcap.out b/tests/result/rsh.pcap.out index 114ad230d..3e5b3cb10 100644 --- a/tests/result/rsh.pcap.out +++ b/tests/result/rsh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 314 (157.00 diss/flow) +Num dissector calls: 286 (143.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/rsync.pcap.out b/tests/result/rsync.pcap.out index 2678406d4..6b383384a 100644 --- a/tests/result/rsync.pcap.out +++ b/tests/result/rsync.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 179 (179.00 diss/flow) +Num dissector calls: 164 (164.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/rtmp.pcap.out b/tests/result/rtmp.pcap.out index 3667763d4..e009962e9 100644 --- a/tests/result/rtmp.pcap.out +++ b/tests/result/rtmp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 160 (160.00 diss/flow) +Num dissector calls: 146 (146.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/rx.pcap.out b/tests/result/rx.pcap.out index 9875ada36..e623c3e32 100644 --- a/tests/result/rx.pcap.out +++ b/tests/result/rx.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 10 (2.00 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 627 (125.40 diss/flow) +Num dissector calls: 602 (120.40 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sflow.pcap.out b/tests/result/sflow.pcap.out index e13b4a615..4b3d418ab 100644 --- a/tests/result/sflow.pcap.out +++ b/tests/result/sflow.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 110 (110.00 diss/flow) +Num dissector calls: 105 (105.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sip.pcap.out b/tests/result/sip.pcap.out index 753a54f21..c0c600956 100644 --- a/tests/result/sip.pcap.out +++ b/tests/result/sip.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 67 (16.75 diss/flow) +Num dissector calls: 62 (15.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sip_hello.pcapng.out b/tests/result/sip_hello.pcapng.out index f7a4fa217..a1b689827 100644 --- a/tests/result/sip_hello.pcapng.out +++ b/tests/result/sip_hello.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 213 (213.00 diss/flow) +Num dissector calls: 208 (208.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sites.pcapng.out b/tests/result/sites.pcapng.out index a96206e11..7b955fd5b 100644 --- a/tests/result/sites.pcapng.out +++ b/tests/result/sites.pcapng.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 229 (5.20 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence DPI : 43 (flows) -Num dissector calls: 57 (1.21 diss/flow) +Num dissector calls: 54 (1.15 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out index 64ee5595a..e06726df2 100644 --- a/tests/result/skype.pcap.out +++ b/tests/result/skype.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 59 (flows) Confidence Match by port : 28 (flows) Confidence DPI : 206 (flows) -Num dissector calls: 29278 (99.92 diss/flow) +Num dissector calls: 27117 (92.55 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/213/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out index e8e136d6c..e5efef9e8 100644 --- a/tests/result/skype_no_unknown.pcap.out +++ b/tests/result/skype_no_unknown.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 44 (flows) Confidence Match by port : 22 (flows) Confidence DPI : 201 (flows) -Num dissector calls: 24315 (91.07 diss/flow) +Num dissector calls: 22551 (84.46 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/156/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/skype_udp.pcap.out b/tests/result/skype_udp.pcap.out index 2e427c6af..62c0c6639 100644 --- a/tests/result/skype_udp.pcap.out +++ b/tests/result/skype_udp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 126 (126.00 diss/flow) +Num dissector calls: 121 (121.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smb_frags.pcap.out b/tests/result/smb_frags.pcap.out index 3d41aeb3d..047163150 100644 --- a/tests/result/smb_frags.pcap.out +++ b/tests/result/smb_frags.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 160 (160.00 diss/flow) +Num dissector calls: 146 (146.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smbv1.pcap.out b/tests/result/smbv1.pcap.out index b68989c25..c6c1e2a00 100644 --- a/tests/result/smbv1.pcap.out +++ b/tests/result/smbv1.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 162 (162.00 diss/flow) +Num dissector calls: 148 (148.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smpp_in_general.pcap.out b/tests/result/smpp_in_general.pcap.out index e3cd8bbd2..f4b642538 100644 --- a/tests/result/smpp_in_general.pcap.out +++ b/tests/result/smpp_in_general.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 90 (90.00 diss/flow) +Num dissector calls: 77 (77.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smtp-starttls.pcap.out b/tests/result/smtp-starttls.pcap.out index 715f38cc3..486224b15 100644 --- a/tests/result/smtp-starttls.pcap.out +++ b/tests/result/smtp-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 158 (79.00 diss/flow) +Num dissector calls: 144 (72.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/smtp.pcap.out b/tests/result/smtp.pcap.out index ec6b56ab4..8eb99708f 100644 --- a/tests/result/smtp.pcap.out +++ b/tests/result/smtp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 205 (205.00 diss/flow) +Num dissector calls: 189 (189.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/soap.pcap.out b/tests/result/soap.pcap.out index f755b9706..3f8904ca6 100644 --- a/tests/result/soap.pcap.out +++ b/tests/result/soap.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 20 (6.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 393 (131.00 diss/flow) +Num dissector calls: 360 (120.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/socks-http-example.pcap.out b/tests/result/socks-http-example.pcap.out index 84c2cb3e4..c2c92aa6b 100644 --- a/tests/result/socks-http-example.pcap.out +++ b/tests/result/socks-http-example.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 29 (9.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 500 (166.67 diss/flow) +Num dissector calls: 455 (151.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/softether.pcap.out b/tests/result/softether.pcap.out index f83f93faa..b7bee6d0c 100644 --- a/tests/result/softether.pcap.out +++ b/tests/result/softether.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 31 (10.33 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 379 (94.75 diss/flow) +Num dissector calls: 361 (90.25 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/someip-tp.pcap.out b/tests/result/someip-tp.pcap.out index e1f69fd0b..41ab4505a 100644 --- a/tests/result/someip-tp.pcap.out +++ b/tests/result/someip-tp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 72 (72.00 diss/flow) +Num dissector calls: 67 (67.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/someip-udp-method-call.pcapng.out b/tests/result/someip-udp-method-call.pcapng.out index 2a2b44d93..cba79dea0 100644 --- a/tests/result/someip-udp-method-call.pcapng.out +++ b/tests/result/someip-udp-method-call.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 144 (72.00 diss/flow) +Num dissector calls: 134 (67.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/sql_injection.pcap.out b/tests/result/sql_injection.pcap.out index 05bb71628..871e2e895 100644 --- a/tests/result/sql_injection.pcap.out +++ b/tests/result/sql_injection.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ssdp-m-search-ua.pcap.out b/tests/result/ssdp-m-search-ua.pcap.out index a8af95315..fa13e91c7 100644 --- a/tests/result/ssdp-m-search-ua.pcap.out +++ b/tests/result/ssdp-m-search-ua.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 33 (33.00 diss/flow) +Num dissector calls: 30 (30.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ssdp-m-search.pcap.out b/tests/result/ssdp-m-search.pcap.out index 0c021104e..ba7f0b8ca 100644 --- a/tests/result/ssdp-m-search.pcap.out +++ b/tests/result/ssdp-m-search.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 33 (33.00 diss/flow) +Num dissector calls: 30 (30.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out index 88f46f7b9..226cdb0e2 100644 --- a/tests/result/starcraft_battle.pcap.out +++ b/tests/result/starcraft_battle.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 12 (flows) Confidence DPI : 39 (flows) -Num dissector calls: 1541 (29.63 diss/flow) +Num dissector calls: 1410 (27.12 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/steam.pcap.out b/tests/result/steam.pcap.out index 4ab0c91b9..70ec32fe4 100644 --- a/tests/result/steam.pcap.out +++ b/tests/result/steam.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 55 (1.00 pkts/flow) Confidence DPI : 55 (flows) -Num dissector calls: 1485 (27.00 diss/flow) +Num dissector calls: 1320 (24.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/steam_datagram_relay_ping.pcapng.out b/tests/result/steam_datagram_relay_ping.pcapng.out index 5472477e8..4437b1115 100644 --- a/tests/result/steam_datagram_relay_ping.pcapng.out +++ b/tests/result/steam_datagram_relay_ping.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 27 (27.00 diss/flow) +Num dissector calls: 24 (24.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/stun.pcap.out b/tests/result/stun.pcap.out index bba1726c0..7e1dc7c26 100644 --- a/tests/result/stun.pcap.out +++ b/tests/result/stun.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 13 (4.33 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 596 (149.00 diss/flow) +Num dissector calls: 567 (141.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/stun_signal.pcapng.out b/tests/result/stun_signal.pcapng.out index 05bb9ebd5..16c5f7183 100644 --- a/tests/result/stun_signal.pcapng.out +++ b/tests/result/stun_signal.pcapng.out @@ -4,7 +4,7 @@ DPI Packets (UDP): 72 (3.43 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence DPI (partial) : 1 (flows) Confidence DPI : 22 (flows) -Num dissector calls: 2330 (101.30 diss/flow) +Num dissector calls: 2255 (98.04 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/24/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/syncthing.pcap.out b/tests/result/syncthing.pcap.out index 1eb3d054c..433e94139 100644 --- a/tests/result/syncthing.pcap.out +++ b/tests/result/syncthing.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 414 (103.50 diss/flow) +Num dissector calls: 394 (98.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/syslog.pcap.out b/tests/result/syslog.pcap.out index 943c02462..08c7caba3 100644 --- a/tests/result/syslog.pcap.out +++ b/tests/result/syslog.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 10 (5.00 pkts/flow) DPI Packets (UDP): 20 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 21 (flows) -Num dissector calls: 63 (2.86 diss/flow) +Num dissector calls: 55 (2.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/targusdataspeed_false_positives.pcap.out b/tests/result/targusdataspeed_false_positives.pcap.out index 452a4e7a3..64e91893e 100644 --- a/tests/result/targusdataspeed_false_positives.pcap.out +++ b/tests/result/targusdataspeed_false_positives.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 2 DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 162 (81.00 diss/flow) +Num dissector calls: 152 (76.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 10/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out index d8897466b..e7887be4b 100644 --- a/tests/result/teams.pcap.out +++ b/tests/result/teams.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by port : 1 (flows) Confidence DPI (partial) : 1 (flows) Confidence DPI : 80 (flows) -Num dissector calls: 615 (7.41 diss/flow) +Num dissector calls: 591 (7.12 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/teamspeak3.pcap.out b/tests/result/teamspeak3.pcap.out index 6fb97b23e..d658fb01d 100644 --- a/tests/result/teamspeak3.pcap.out +++ b/tests/result/teamspeak3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 205 (102.50 diss/flow) +Num dissector calls: 195 (97.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/teamviewer.pcap.out b/tests/result/teamviewer.pcap.out index c72e293cd..999da0e1b 100644 --- a/tests/result/teamviewer.pcap.out +++ b/tests/result/teamviewer.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 154 (77.00 diss/flow) +Num dissector calls: 149 (74.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/telegram.pcap.out b/tests/result/telegram.pcap.out index f15009a94..9047a2518 100644 --- a/tests/result/telegram.pcap.out +++ b/tests/result/telegram.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 5 DPI Packets (UDP): 93 (1.94 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 46 (flows) -Num dissector calls: 1676 (34.92 diss/flow) +Num dissector calls: 1576 (32.83 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/telnet.pcap.out b/tests/result/telnet.pcap.out index 8f596797a..b3a662978 100644 --- a/tests/result/telnet.pcap.out +++ b/tests/result/telnet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 159 (159.00 diss/flow) +Num dissector calls: 145 (145.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tftp.pcap.out b/tests/result/tftp.pcap.out index 1f60b251e..6597ed37a 100644 --- a/tests/result/tftp.pcap.out +++ b/tests/result/tftp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 13 (1.86 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 317 (45.29 diss/flow) +Num dissector calls: 307 (43.86 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/threema.pcap.out b/tests/result/threema.pcap.out index 8202050e3..ba12fa1d2 100644 --- a/tests/result/threema.pcap.out +++ b/tests/result/threema.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 66 (11.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 1308 (218.00 diss/flow) +Num dissector calls: 1208 (201.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tinc.pcap.out b/tests/result/tinc.pcap.out index 77ef30ec6..87664acc1 100644 --- a/tests/result/tinc.pcap.out +++ b/tests/result/tinc.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 19 (9.50 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI (cache) : 2 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 544 (136.00 diss/flow) +Num dissector calls: 502 (125.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls-appdata.pcap.out b/tests/result/tls-appdata.pcap.out index 5ec5aed1f..34305588e 100644 --- a/tests/result/tls-appdata.pcap.out +++ b/tests/result/tls-appdata.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 17 (8.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 131 (65.50 diss/flow) +Num dissector calls: 118 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out index ce9ee3032..0388f5b2a 100644 --- a/tests/result/tls_certificate_too_long.pcap.out +++ b/tests/result/tls_certificate_too_long.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 620 (17.71 diss/flow) +Num dissector calls: 569 (16.26 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls_false_positives.pcapng.out b/tests/result/tls_false_positives.pcapng.out index 1fe286f61..ebff2f8be 100644 --- a/tests/result/tls_false_positives.pcapng.out +++ b/tests/result/tls_false_positives.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 30 (30.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 442 (442.00 diss/flow) +Num dissector calls: 401 (401.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out index 8efdbccb6..9f0427ab0 100644 --- a/tests/result/tls_invalid_reads.pcap.out +++ b/tests/result/tls_invalid_reads.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 10 (3.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 131 (43.67 diss/flow) +Num dissector calls: 118 (39.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tls_missing_ch_frag.pcap.out b/tests/result/tls_missing_ch_frag.pcap.out index c994a7f36..5d5ffdc45 100644 --- a/tests/result/tls_missing_ch_frag.pcap.out +++ b/tests/result/tls_missing_ch_frag.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 130 (130.00 diss/flow) +Num dissector calls: 117 (117.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/toca-boca.pcap.out b/tests/result/toca-boca.pcap.out index 2f95f4812..1472f0181 100644 --- a/tests/result/toca-boca.pcap.out +++ b/tests/result/toca-boca.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 4 DPI Packets (UDP): 21 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence DPI : 17 (flows) -Num dissector calls: 453 (21.57 diss/flow) +Num dissector calls: 433 (20.62 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/tor.pcap.out b/tests/result/tor.pcap.out index eb9b2aa19..ce013fadb 100644 --- a/tests/result/tor.pcap.out +++ b/tests/result/tor.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 43 (5.38 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 10 (flows) -Num dissector calls: 51 (4.64 diss/flow) +Num dissector calls: 48 (4.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/trickbot.pcap.out b/tests/result/trickbot.pcap.out index 7253a9d92..a0584603d 100644 --- a/tests/result/trickbot.pcap.out +++ b/tests/result/trickbot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/ultrasurf.pcap.out b/tests/result/ultrasurf.pcap.out index a9d60e757..e71dc8b8f 100644 --- a/tests/result/ultrasurf.pcap.out +++ b/tests/result/ultrasurf.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 13 (4.33 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 126 (42.00 diss/flow) +Num dissector calls: 113 (37.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out index 5f2fa7561..90344d491 100644 --- a/tests/result/viber.pcap.out +++ b/tests/result/viber.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (1.93 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence DPI : 25 (flows) -Num dissector calls: 553 (19.07 diss/flow) +Num dissector calls: 518 (17.86 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/vnc.pcap.out b/tests/result/vnc.pcap.out index 781c217c3..0e8b3667d 100644 --- a/tests/result/vnc.pcap.out +++ b/tests/result/vnc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 274 (137.00 diss/flow) +Num dissector calls: 246 (123.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wa_video.pcap.out b/tests/result/wa_video.pcap.out index dc33be885..8dbcfe738 100644 --- a/tests/result/wa_video.pcap.out +++ b/tests/result/wa_video.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 33 (33.00 pkts/flow) DPI Packets (UDP): 13 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 539 (38.50 diss/flow) +Num dissector calls: 495 (35.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wa_voice.pcap.out b/tests/result/wa_voice.pcap.out index 309cd4b56..6fa698dce 100644 --- a/tests/result/wa_voice.pcap.out +++ b/tests/result/wa_voice.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 33 (1.57 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 27 (flows) -Num dissector calls: 448 (16.00 diss/flow) +Num dissector calls: 402 (14.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/waze.pcap.out b/tests/result/waze.pcap.out index 3b17c495e..f18979a47 100644 --- a/tests/result/waze.pcap.out +++ b/tests/result/waze.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 9 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 389 (11.79 diss/flow) +Num dissector calls: 338 (10.24 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/webex.pcap.out b/tests/result/webex.pcap.out index 597c7f1f0..9afa58673 100644 --- a/tests/result/webex.pcap.out +++ b/tests/result/webex.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 17 (8.50 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 3 (flows) Confidence DPI : 53 (flows) -Num dissector calls: 326 (5.72 diss/flow) +Num dissector calls: 315 (5.53 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/websocket.pcap.out b/tests/result/websocket.pcap.out index 3c47dcf62..89852524f 100644 --- a/tests/result/websocket.pcap.out +++ b/tests/result/websocket.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 108 (108.00 diss/flow) +Num dissector calls: 95 (95.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out index b354d12e9..cf167f77b 100644 --- a/tests/result/wechat.pcap.out +++ b/tests/result/wechat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 24 (flows) Confidence DPI : 78 (flows) -Num dissector calls: 322 (3.13 diss/flow) +Num dissector calls: 309 (3.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/weibo.pcap.out b/tests/result/weibo.pcap.out index b7bb2b77e..b794831f3 100644 --- a/tests/result/weibo.pcap.out +++ b/tests/result/weibo.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 100 (3.33 pkts/flow) DPI Packets (UDP): 44 (3.14 pkts/flow) Confidence Match by port : 21 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 602 (13.68 diss/flow) +Num dissector calls: 562 (12.77 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whatsapp.pcap.out b/tests/result/whatsapp.pcap.out index 244bc789a..af25bd911 100644 --- a/tests/result/whatsapp.pcap.out +++ b/tests/result/whatsapp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 344 (4.00 pkts/flow) Confidence DPI : 86 (flows) -Num dissector calls: 13158 (153.00 diss/flow) +Num dissector calls: 11954 (139.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out index b6852790f..9e600f4b9 100644 --- a/tests/result/whatsapp_login_call.pcap.out +++ b/tests/result/whatsapp_login_call.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 35 (1.21 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 20 (flows) Confidence DPI : 37 (flows) -Num dissector calls: 333 (5.84 diss/flow) +Num dissector calls: 302 (5.30 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whatsapp_login_chat.pcap.out b/tests/result/whatsapp_login_chat.pcap.out index 8bede1f7d..5fe31d854 100644 --- a/tests/result/whatsapp_login_chat.pcap.out +++ b/tests/result/whatsapp_login_chat.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 17 (5.67 pkts/flow) DPI Packets (UDP): 7 (1.17 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 308 (34.22 diss/flow) +Num dissector calls: 277 (30.78 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whatsapp_voice_and_message.pcap.out b/tests/result/whatsapp_voice_and_message.pcap.out index 7851aaa59..54c5fa2c8 100644 --- a/tests/result/whatsapp_voice_and_message.pcap.out +++ b/tests/result/whatsapp_voice_and_message.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 20 (4.00 pkts/flow) DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence DPI : 13 (flows) -Num dissector calls: 493 (37.92 diss/flow) +Num dissector calls: 428 (32.92 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/whois.pcapng.out b/tests/result/whois.pcapng.out index 0ed0a713e..9f335454e 100644 --- a/tests/result/whois.pcapng.out +++ b/tests/result/whois.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 16 (5.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 192 (64.00 diss/flow) +Num dissector calls: 177 (59.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/windowsupdate_over_http.pcap.out b/tests/result/windowsupdate_over_http.pcap.out index 63bc5f09c..ec86b99a4 100644 --- a/tests/result/windowsupdate_over_http.pcap.out +++ b/tests/result/windowsupdate_over_http.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 12 (12.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wireguard.pcap.out b/tests/result/wireguard.pcap.out index ae76bf57c..7808d6392 100644 --- a/tests/result/wireguard.pcap.out +++ b/tests/result/wireguard.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 149 (149.00 diss/flow) +Num dissector calls: 144 (144.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/wow.pcap.out b/tests/result/wow.pcap.out index 8f7997696..cec353537 100644 --- a/tests/result/wow.pcap.out +++ b/tests/result/wow.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (7.20 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 133 (26.60 diss/flow) +Num dissector calls: 109 (21.80 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/xiaomi.pcap.out b/tests/result/xiaomi.pcap.out index e5b5cc2ea..2c9be006b 100644 --- a/tests/result/xiaomi.pcap.out +++ b/tests/result/xiaomi.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 19 (2.71 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 717 (102.43 diss/flow) +Num dissector calls: 636 (90.86 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/xss.pcap.out b/tests/result/xss.pcap.out index 7660bab82..88049ff18 100644 --- a/tests/result/xss.pcap.out +++ b/tests/result/xss.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 9 (4.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 15 (7.50 diss/flow) +Num dissector calls: 12 (6.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/z3950.pcapng.out b/tests/result/z3950.pcapng.out index 47804ab8e..b1b67fd69 100644 --- a/tests/result/z3950.pcapng.out +++ b/tests/result/z3950.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 490 (245.00 diss/flow) +Num dissector calls: 453 (226.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/zattoo.pcap.out b/tests/result/zattoo.pcap.out index 2386e4647..8c81f3b2a 100644 --- a/tests/result/zattoo.pcap.out +++ b/tests/result/zattoo.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 15 (7.50 diss/flow) +Num dissector calls: 12 (6.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/zcash.pcap.out b/tests/result/zcash.pcap.out index 8cae41690..8d57f23a8 100644 --- a/tests/result/zcash.pcap.out +++ b/tests/result/zcash.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 26 (26.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out index e79a61f25..cfed69c91 100644 --- a/tests/result/zoom.pcap.out +++ b/tests/result/zoom.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 23 (1.35 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by port : 2 (flows) Confidence DPI : 31 (flows) -Num dissector calls: 705 (21.36 diss/flow) +Num dissector calls: 653 (19.79 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 7/0/0 (insert/search/found) diff --git a/tests/result/zoom2.pcap.out b/tests/result/zoom2.pcap.out index b4026f934..dffc43cc5 100644 --- a/tests/result/zoom2.pcap.out +++ b/tests/result/zoom2.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 15 (5.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 491 (98.20 diss/flow) +Num dissector calls: 476 (95.20 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 1/0/0 (insert/search/found) diff --git a/tests/result/zoom_p2p.pcapng.out b/tests/result/zoom_p2p.pcapng.out index 44b87e0fa..e3fe5bf4e 100644 --- a/tests/result/zoom_p2p.pcapng.out +++ b/tests/result/zoom_p2p.pcapng.out @@ -4,7 +4,7 @@ DPI Packets (UDP): 88 (8.80 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence DPI (partial cache): 4 (flows) Confidence DPI : 8 (flows) -Num dissector calls: 1099 (91.58 diss/flow) +Num dissector calls: 1079 (89.92 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/12/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/windows/nDPI.vcxproj b/windows/nDPI.vcxproj index 1ae3e8cbe..1cb0ce836 100644 --- a/windows/nDPI.vcxproj +++ b/windows/nDPI.vcxproj @@ -202,10 +202,7 @@ <ClCompile Include="..\src\lib\protocols\z3950.c" /> <ClCompile Include="..\src\lib\protocols\zabbix.c" /> <ClCompile Include="..\src\lib\third_party\src\ahocorasick.c" /> - <ClCompile Include="..\src\lib\protocols\aimini.c" /> - <ClCompile Include="..\src\lib\protocols\applejuice.c" /> <ClCompile Include="..\src\lib\protocols\armagetron.c" /> - <ClCompile Include="..\src\lib\protocols\ayiya.c" /> <ClCompile Include="..\src\lib\protocols\bgp.c" /> <ClCompile Include="..\src\lib\protocols\bittorrent.c" /> <ClCompile Include="..\src\lib\protocols\btlib.c" /> @@ -217,17 +214,12 @@ <ClCompile Include="..\src\lib\protocols\dcerpc.c" /> <ClCompile Include="..\src\lib\protocols\dhcp.c" /> <ClCompile Include="..\src\lib\protocols\dhcpv6.c" /> - <ClCompile Include="..\src\lib\protocols\directconnect.c" /> - <ClCompile Include="..\src\lib\protocols\directdownloadlink.c" /> <ClCompile Include="..\src\lib\protocols\dns.c" /> <ClCompile Include="..\src\lib\protocols\dofus.c" /> <ClCompile Include="..\src\lib\protocols\drda.c" /> <ClCompile Include="..\src\lib\protocols\dropbox.c" /> <ClCompile Include="..\src\lib\protocols\eaq.c" /> <ClCompile Include="..\src\lib\protocols\edonkey.c" /> - <ClCompile Include="..\src\lib\protocols\fasttrack.c" /> - <ClCompile Include="..\src\lib\protocols\fiesta.c" /> - <ClCompile Include="..\src\lib\protocols\florensia.c" /> <ClCompile Include="..\src\lib\protocols\ftp_control.c" /> <ClCompile Include="..\src\lib\protocols\ftp_data.c" /> <ClCompile Include="..\src\lib\protocols\git.c" /> @@ -265,7 +257,6 @@ <ClCompile Include="..\src\lib\protocols\noe.c" /> <ClCompile Include="..\src\lib\protocols\non_tcp_udp.c" /> <ClCompile Include="..\src\lib\protocols\ntp.c" /> - <ClCompile Include="..\src\lib\protocols\openft.c" /> <ClCompile Include="..\src\lib\protocols\openvpn.c" /> <ClCompile Include="..\src\lib\protocols\oracle.c" /> <ClCompile Include="..\src\lib\protocols\postgres.c" /> @@ -283,18 +274,15 @@ <ClCompile Include="..\src\lib\protocols\rtsp.c" /> <ClCompile Include="..\src\lib\protocols\rx.c" /> <ClCompile Include="..\src\lib\protocols\sflow.c" /> - <ClCompile Include="..\src\lib\protocols\shoutcast.c" /> <ClCompile Include="..\src\lib\protocols\sip.c" /> <ClCompile Include="..\src\lib\protocols\skinny.c" /> <ClCompile Include="..\src\lib\protocols\skype.c" /> <ClCompile Include="..\src\lib\protocols\smb.c" /> <ClCompile Include="..\src\lib\protocols\socks45.c" /> - <ClCompile Include="..\src\lib\protocols\sopcast.c" /> <ClCompile Include="..\src\lib\protocols\spotify.c" /> <ClCompile Include="..\src\lib\protocols\ssdp.c" /> <ClCompile Include="..\src\lib\protocols\ssh.c" /> <ClCompile Include="..\src\lib\protocols\starcraft.c" /> - <ClCompile Include="..\src\lib\protocols\stealthnet.c" /> <ClCompile Include="..\src\lib\protocols\steam.c" /> <ClCompile Include="..\src\lib\protocols\stun.c" /> <ClCompile Include="..\src\lib\protocols\syslog.c" /> @@ -305,7 +293,6 @@ <ClCompile Include="..\src\lib\protocols\telnet.c" /> <ClCompile Include="..\src\lib\protocols\teredo.c" /> <ClCompile Include="..\src\lib\protocols\tftp.c" /> - <ClCompile Include="..\src\lib\protocols\thunder.c" /> <ClCompile Include="..\src\lib\protocols\tplink_shp.c" /> <ClCompile Include="..\src\lib\protocols\tuya_lp.c" /> <ClCompile Include="..\src\lib\protocols\tvuplayer.c" /> diff --git a/windows/nDPI.vcxproj.filters b/windows/nDPI.vcxproj.filters index 4c1a0ab8f..b3e28e89a 100644 --- a/windows/nDPI.vcxproj.filters +++ b/windows/nDPI.vcxproj.filters @@ -3,10 +3,7 @@ <ItemGroup> <ClCompile Include="..\src\lib\protocols\afp.c" /> <ClCompile Include="..\src\lib\protocols\bjnp.c" /> - <ClCompile Include="..\src\lib\protocols\aimini.c" /> - <ClCompile Include="..\src\lib\protocols\applejuice.c" /> <ClCompile Include="..\src\lib\protocols\armagetron.c" /> - <ClCompile Include="..\src\lib\protocols\ayiya.c" /> <ClCompile Include="..\src\lib\protocols\bgp.c" /> <ClCompile Include="..\src\lib\protocols\bittorrent.c" /> <ClCompile Include="..\src\lib\protocols\btlib.c" /> @@ -18,17 +15,12 @@ <ClCompile Include="..\src\lib\protocols\dcerpc.c" /> <ClCompile Include="..\src\lib\protocols\dhcp.c" /> <ClCompile Include="..\src\lib\protocols\dhcpv6.c" /> - <ClCompile Include="..\src\lib\protocols\directconnect.c" /> - <ClCompile Include="..\src\lib\protocols\directdownloadlink.c" /> <ClCompile Include="..\src\lib\protocols\dns.c" /> <ClCompile Include="..\src\lib\protocols\dofus.c" /> <ClCompile Include="..\src\lib\protocols\drda.c" /> <ClCompile Include="..\src\lib\protocols\dropbox.c" /> <ClCompile Include="..\src\lib\protocols\eaq.c" /> <ClCompile Include="..\src\lib\protocols\edonkey.c" /> - <ClCompile Include="..\src\lib\protocols\fasttrack.c" /> - <ClCompile Include="..\src\lib\protocols\fiesta.c" /> - <ClCompile Include="..\src\lib\protocols\florensia.c" /> <ClCompile Include="..\src\lib\protocols\ftp_control.c" /> <ClCompile Include="..\src\lib\protocols\ftp_data.c" /> <ClCompile Include="..\src\lib\protocols\git.c" /> @@ -65,7 +57,6 @@ <ClCompile Include="..\src\lib\protocols\noe.c" /> <ClCompile Include="..\src\lib\protocols\non_tcp_udp.c" /> <ClCompile Include="..\src\lib\protocols\ntp.c" /> - <ClCompile Include="..\src\lib\protocols\openft.c" /> <ClCompile Include="..\src\lib\protocols\openvpn.c" /> <ClCompile Include="..\src\lib\protocols\oracle.c" /> <ClCompile Include="..\src\lib\protocols\postgres.c" /> @@ -83,18 +74,15 @@ <ClCompile Include="..\src\lib\protocols\rtsp.c" /> <ClCompile Include="..\src\lib\protocols\rx.c" /> <ClCompile Include="..\src\lib\protocols\sflow.c" /> - <ClCompile Include="..\src\lib\protocols\shoutcast.c" /> <ClCompile Include="..\src\lib\protocols\sip.c" /> <ClCompile Include="..\src\lib\protocols\skinny.c" /> <ClCompile Include="..\src\lib\protocols\skype.c" /> <ClCompile Include="..\src\lib\protocols\smb.c" /> <ClCompile Include="..\src\lib\protocols\socks45.c" /> - <ClCompile Include="..\src\lib\protocols\sopcast.c" /> <ClCompile Include="..\src\lib\protocols\spotify.c" /> <ClCompile Include="..\src\lib\protocols\ssdp.c" /> <ClCompile Include="..\src\lib\protocols\ssh.c" /> <ClCompile Include="..\src\lib\protocols\starcraft.c" /> - <ClCompile Include="..\src\lib\protocols\stealthnet.c" /> <ClCompile Include="..\src\lib\protocols\steam.c" /> <ClCompile Include="..\src\lib\protocols\stun.c" /> <ClCompile Include="..\src\lib\protocols\syslog.c" /> @@ -105,7 +93,6 @@ <ClCompile Include="..\src\lib\protocols\telnet.c" /> <ClCompile Include="..\src\lib\protocols\teredo.c" /> <ClCompile Include="..\src\lib\protocols\tftp.c" /> - <ClCompile Include="..\src\lib\protocols\thunder.c" /> <ClCompile Include="..\src\lib\protocols\tplink_shp.c" /> <ClCompile Include="..\src\lib\protocols\tuya_lp.c" /> <ClCompile Include="..\src\lib\protocols\tvuplayer.c" /> |