diff options
56 files changed, 16651 insertions, 1035 deletions
diff --git a/example/ndpiReader.c b/example/ndpiReader.c index 3e8eb6241..bbc78bf02 100644 --- a/example/ndpiReader.c +++ b/example/ndpiReader.c @@ -1145,6 +1145,7 @@ static void printFlow(u_int16_t id, struct ndpi_flow_info *flow, u_int16_t threa fprintf(out, "[< 1 sec]"); if(flow->telnet.username[0] != '\0') fprintf(out, "[Username: %s]", flow->telnet.username); + if(flow->telnet.password[0] != '\0') fprintf(out, "[Password: %s]", flow->telnet.password); if(flow->host_server_name[0] != '\0') fprintf(out, "[Host: %s]", flow->host_server_name); if(flow->info[0] != '\0') fprintf(out, "[%s]", flow->info); diff --git a/example/reader_util.c b/example/reader_util.c index 8646018e3..b90cf8256 100644 --- a/example/reader_util.c +++ b/example/reader_util.c @@ -972,19 +972,23 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl || /* POP */ is_ndpi_proto(flow, NDPI_PROTOCOL_MAIL_POP) || /* SMTP */ is_ndpi_proto(flow, NDPI_PROTOCOL_MAIL_SMTP)) { if(flow->ndpi_flow->protos.ftp_imap_pop_smtp.username[0] != '\0') - snprintf(flow->info, sizeof(flow->info), "User: %s][Pwd: %s", + snprintf(flow->info, sizeof(flow->info), "User: %s][Pwd: %s%s", flow->ndpi_flow->protos.ftp_imap_pop_smtp.username, - flow->ndpi_flow->protos.ftp_imap_pop_smtp.password); + flow->ndpi_flow->protos.ftp_imap_pop_smtp.password, + flow->ndpi_flow->protos.ftp_imap_pop_smtp.auth_failed ? "][Auth Failed" : ""); } /* KERBEROS */ else if(is_ndpi_proto(flow, NDPI_PROTOCOL_KERBEROS)) { if((flow->ndpi_flow->protos.kerberos.hostname[0] != '\0') || (flow->ndpi_flow->protos.kerberos.username[0] != '\0')) { - snprintf(flow->info, sizeof(flow->info), "%s%s (%s)", + snprintf(flow->info, sizeof(flow->info), "%s%s%s%s", + flow->ndpi_flow->protos.kerberos.domain /* = realm */, + flow->ndpi_flow->protos.kerberos.domain[0] != '\0' ? "\\" : "", flow->ndpi_flow->protos.kerberos.hostname, - flow->ndpi_flow->protos.kerberos.username, + flow->ndpi_flow->protos.kerberos.username); + } else if(flow->ndpi_flow->protos.kerberos.domain[0] != '\0') + snprintf(flow->info, sizeof(flow->info), "%s", flow->ndpi_flow->protos.kerberos.domain); - } } /* HTTP */ else if((flow->detected_protocol.master_protocol == NDPI_PROTOCOL_HTTP) @@ -997,6 +1001,7 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl } } else if(is_ndpi_proto(flow, NDPI_PROTOCOL_TELNET)) { snprintf(flow->telnet.username, sizeof(flow->telnet.username), "%s", flow->ndpi_flow->protos.telnet.username); + snprintf(flow->telnet.password, sizeof(flow->telnet.password), "%s", flow->ndpi_flow->protos.telnet.password); } else if(is_ndpi_proto(flow, NDPI_PROTOCOL_SSH)) { snprintf(flow->ssh_tls.client_info, sizeof(flow->ssh_tls.client_info), "%s", flow->ndpi_flow->protos.ssh.client_signature); @@ -1212,21 +1217,21 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, if((flow->entropy.src2dst_pkt_count+flow->entropy.dst2src_pkt_count) <= max_num_packets_per_flow) { if(flow->bidirectional) flow->entropy.score = ndpi_classify(flow->entropy.src2dst_pkt_len, flow->entropy.src2dst_pkt_time, - flow->entropy.dst2src_pkt_len, flow->entropy.dst2src_pkt_time, - flow->entropy.src2dst_start, flow->entropy.dst2src_start, - max_num_packets_per_flow, flow->src_port, flow->dst_port, - flow->src2dst_packets, flow->dst2src_packets, - flow->entropy.src2dst_opackets, flow->entropy.dst2src_opackets, - flow->entropy.src2dst_l4_bytes, flow->entropy.dst2src_l4_bytes, 1, - flow->entropy.src2dst_byte_count, flow->entropy.dst2src_byte_count); - else - flow->entropy.score = ndpi_classify(flow->entropy.src2dst_pkt_len, flow->entropy.src2dst_pkt_time, - NULL, NULL, flow->entropy.src2dst_start, flow->entropy.src2dst_start, - max_num_packets_per_flow, flow->src_port, flow->dst_port, - flow->src2dst_packets, 0, - flow->entropy.src2dst_opackets, 0, - flow->entropy.src2dst_l4_bytes, 0, 1, - flow->entropy.src2dst_byte_count, NULL); + flow->entropy.dst2src_pkt_len, flow->entropy.dst2src_pkt_time, + flow->entropy.src2dst_start, flow->entropy.dst2src_start, + max_num_packets_per_flow, flow->src_port, flow->dst_port, + flow->src2dst_packets, flow->dst2src_packets, + flow->entropy.src2dst_opackets, flow->entropy.dst2src_opackets, + flow->entropy.src2dst_l4_bytes, flow->entropy.dst2src_l4_bytes, 1, + flow->entropy.src2dst_byte_count, flow->entropy.dst2src_byte_count); + else + flow->entropy.score = ndpi_classify(flow->entropy.src2dst_pkt_len, flow->entropy.src2dst_pkt_time, + NULL, NULL, flow->entropy.src2dst_start, flow->entropy.src2dst_start, + max_num_packets_per_flow, flow->src_port, flow->dst_port, + flow->src2dst_packets, 0, + flow->entropy.src2dst_opackets, 0, + flow->entropy.src2dst_l4_bytes, 0, 1, + flow->entropy.src2dst_byte_count, NULL); } } @@ -1362,7 +1367,7 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, u_int64_t time; u_int16_t ip_offset = 0, ip_len; u_int16_t frag_off = 0, vlan_id = 0; - u_int8_t proto = 0; + u_int8_t proto = 0, recheck_type; /*u_int32_t label;*/ /* counters */ @@ -1490,6 +1495,8 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, } ether_type_check: + recheck_type = 0; + /* check ether type */ switch(type) { case VLAN: @@ -1497,13 +1504,16 @@ ether_type_check: type = (packet[ip_offset+2] << 8) + packet[ip_offset+3]; ip_offset += 4; vlan_packet = 1; + // double tagging for 802.1Q while((type == 0x8100) && (ip_offset < header->caplen)) { vlan_id = ((packet[ip_offset] << 8) + packet[ip_offset+1]) & 0xFFF; type = (packet[ip_offset+2] << 8) + packet[ip_offset+3]; ip_offset += 4; } + recheck_type = 1; break; + case MPLS_UNI: case MPLS_MULTI: mpls.u32 = *((uint32_t *) &packet[ip_offset]); @@ -1516,16 +1526,23 @@ ether_type_check: mpls.u32 = ntohl(mpls.u32); ip_offset += 4; } + recheck_type = 1; break; + case PPPoE: workflow->stats.pppoe_count++; type = ETH_P_IP; ip_offset += 8; + recheck_type = 1; break; + default: break; } - + + if(recheck_type) + goto ether_type_check; + workflow->stats.vlan_count += vlan_packet; iph_check: diff --git a/example/reader_util.h b/example/reader_util.h index fce34c7c3..c420ca211 100644 --- a/example/reader_util.h +++ b/example/reader_util.h @@ -211,14 +211,13 @@ typedef struct ndpi_flow_info { } http; struct { - char username[32]; + char username[32], password[32]; } telnet; void *src_id, *dst_id; struct ndpi_entropy entropy; - struct ndpi_entropy last_entropy; - + struct ndpi_entropy last_entropy; } ndpi_flow_info_t; diff --git a/python/README b/python/README deleted file mode 100644 index f55139d0c..000000000 --- a/python/README +++ /dev/null @@ -1,11 +0,0 @@ -This directory contains the Python3 bindings for nDPI - -Demo example: -- python3 ndpi_example.py <interface> -- python3 ndpi_example.py <pcap_file> - -Additional example (using nfstream package): -- python3 flow_printer.py <interface> -- python3 flow_printer.py <pcap_file> - -Code courtesy of: Massimo Puddu, Zied Aouini diff --git a/python/README.rst b/python/README.rst new file mode 100644 index 000000000..dfdce0a25 --- /dev/null +++ b/python/README.rst @@ -0,0 +1,44 @@ +nDPI Python bindings +-------------------- + +This directory contains the Python3 bindings for nDPI. We provide both ctypes and cffi based bindings. + +**ctypes bindings** + +Files: + +* ndpi_typestruct.py +* ndpi_wrap.c +* Makefile.in + +Example: + +.. code-block:: bash + + pip3 install scapy + python3 ndpi_example.py <interface> + python3 ndpi_example.py <pcap_file> + +Code courtesy: + +* Massimo Puddu +* Zied Aouini + +**cffi bindings** + +Files: + +* ndpi.py + + +Example (using NFStream package): + +.. code-block:: bash + + pip3 install nfstream + python3 flow_printer.py <interface> + python3 flow_printer.py <pcap_file> + +Code courtesy: + +* Zied Aouini
\ No newline at end of file diff --git a/python/flow_printer.py b/python/flow_printer.py index a30ea79b9..305500f0f 100644 --- a/python/flow_printer.py +++ b/python/flow_printer.py @@ -17,11 +17,23 @@ You should have received a copy of the GNU General Public License along with nfs If not, see <http://www.gnu.org/licenses/>. """ -from nfstream.streamer import Streamer +from nfstream import NFStreamer import sys -flow_streamer = Streamer(source=sys.argv[1]) -flows_count = 0 -for flow in flow_streamer: - print("flow[{}]: \n{}\n".format(flows_count, flow)) - flows_count += 1 + +path = sys.argv[1] +flow_streamer = NFStreamer(source=path) +result = {} +try: + for flow in flow_streamer: + print(flow) + try: + result[flow.application_name] += flow.total_packets + except KeyError: + result[flow.application_name] = flow.total_packets + print("Summary (Application Name: Packets):") + print(result) +except KeyboardInterrupt: + print("Summary (Application Name: Packets):") + print(result) + print("Terminated.")
\ No newline at end of file diff --git a/python/ndpi.py b/python/ndpi.py new file mode 100644 index 000000000..324fd7204 --- /dev/null +++ b/python/ndpi.py @@ -0,0 +1,1274 @@ +""" +file: ndpi.py +This file is part of nfstream. + +Copyright (C) 2019 - Zied Aouini <aouinizied@gmail.com> + +nfstream is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License +as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. + +nfstream is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty +of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. + +You should have received a copy of the GNU General Public License along with nfstream. +If not, see <http://www.gnu.org/licenses/>. +""" + +from os.path import abspath, dirname +import cffi + +cc = """ +typedef enum { + ndpi_l4_proto_unknown = 0, + ndpi_l4_proto_tcp_only, + ndpi_l4_proto_udp_only, + ndpi_l4_proto_tcp_and_udp, +} ndpi_l4_proto_info; +typedef enum { + ndpi_no_tunnel = 0, + ndpi_gtp_tunnel, + ndpi_capwap_tunnel, + ndpi_tzsp_tunnel, + ndpi_l2tp_tunnel, +} ndpi_packet_tunnel; + +typedef enum { + ndpi_url_no_problem = 0, + ndpi_url_possible_xss, + ndpi_url_possible_sql_injection +} ndpi_url_risk; + +/* NDPI_VISIT */ +typedef enum { + ndpi_preorder, + ndpi_postorder, + ndpi_endorder, + ndpi_leaf +} ndpi_VISIT; + +/* NDPI_NODE */ +typedef struct node_t { + char *key; + struct node_t *left, *right; +} ndpi_node; + +/* NDPI_MASK_SIZE */ +typedef uint32_t ndpi_ndpi_mask; + +/* NDPI_PROTO_BITMASK_STRUCT */ +typedef struct ndpi_protocol_bitmask_struct { + ndpi_ndpi_mask fds_bits[16]; +} NDPI_PROTOCOL_BITMASK; + +typedef struct spinlock { + volatile int val; +} spinlock_t; + +typedef struct atomic { + volatile int counter; +} atomic_t; + +typedef long int time_t; + +struct hash_ip4p_node { + struct hash_ip4p_node *next,*prev; + time_t lchg; + uint16_t port,count:12,flag:4; + uint32_t ip; + // + 12 bytes for ipv6 +}; + +struct hash_ip4p { + struct hash_ip4p_node *top; + spinlock_t lock; + size_t len; +}; + +struct hash_ip4p_table { + size_t size; + int ipv6; + spinlock_t lock; + atomic_t count; + struct hash_ip4p tbl; +}; + +struct bt_announce { // 192 bytes + uint32_t hash[5]; + uint32_t ip[4]; + uint32_t time; + uint16_t port; + uint8_t name_len, + name[149]; // 149 bytes +}; + +/* NDPI_PROTOCOL_TINC */ +#define TINC_CACHE_MAX_SIZE 10 + +typedef enum { + NDPI_HTTP_METHOD_UNKNOWN = 0, + NDPI_HTTP_METHOD_OPTIONS, + NDPI_HTTP_METHOD_GET, + NDPI_HTTP_METHOD_HEAD, + NDPI_HTTP_METHOD_PATCH, + NDPI_HTTP_METHOD_POST, + NDPI_HTTP_METHOD_PUT, + NDPI_HTTP_METHOD_DELETE, + NDPI_HTTP_METHOD_TRACE, + NDPI_HTTP_METHOD_CONNECT +} ndpi_http_method; + +struct ndpi_lru_cache_entry { + uint32_t key; /* Store the whole key to avoid ambiguities */ + uint32_t is_full:1, value:16, pad:15; +}; + +struct ndpi_lru_cache { + uint32_t num_entries; + struct ndpi_lru_cache_entry *entries; +}; + +""" + +cc_ndpi_network_headers = """ +struct ndpi_chdlc +{ + uint8_t addr; /* 0x0F (Unicast) - 0x8F (Broadcast) */ + uint8_t ctrl; /* always 0x00 */ + uint16_t proto_code; /* protocol type (e.g. 0x0800 IP) */ +}; + +/* SLARP - Serial Line ARP http://tinyurl.com/qa54e95 */ +struct ndpi_slarp +{ + /* address requests (0x00) + address replies (0x01) + keep-alive (0x02) + */ + uint32_t slarp_type; + uint32_t addr_1; + uint32_t addr_2; +}; + +/* Cisco Discovery Protocol http://tinyurl.com/qa6yw9l */ +struct ndpi_cdp +{ + uint8_t version; + uint8_t ttl; + uint16_t checksum; + uint16_t type; + uint16_t length; +}; + +/* +++++++++++++++ Ethernet header (IEEE 802.3) +++++++++++++++ */ +struct ndpi_ethhdr +{ + uint8_t h_dest[6]; /* destination eth addr */ + uint8_t h_source[6]; /* source ether addr */ + uint16_t h_proto; /* data length (<= 1500) or type ID proto (>=1536) */ +}; + +/* +++++++++++++++ ARP header +++++++++++++++ */ +struct ndpi_arphdr +{ + uint16_t ar_hrd;/* Format of hardware address. */ + uint16_t ar_pro;/* Format of protocol address. */ + uint8_t ar_hln;/* Length of hardware address. */ + uint8_t ar_pln;/* Length of protocol address. */ + uint16_t ar_op;/* ARP opcode (command). */ + uint8_t arp_sha[6];/* sender hardware address */ + uint32_t arp_spa;/* sender protocol address */ + uint8_t arp_tha[6];/* target hardware address */ + uint32_t arp_tpa;/* target protocol address */ +}; + +/* +++++++++++++++ DHCP header +++++++++++++++ */ +struct ndpi_dhcphdr { + uint8_t msgType; + uint8_t htype; + uint8_t hlen; + uint8_t hops; + uint32_t xid;/* 4 */ + uint16_t secs;/* 8 */ + uint16_t flags; + uint32_t ciaddr;/* 12 */ + uint32_t yiaddr;/* 16 */ + uint32_t siaddr;/* 20 */ + uint32_t giaddr;/* 24 */ + uint8_t chaddr[16]; /* 28 */ + uint8_t sname[64]; /* 44 */ + uint8_t file[128]; /* 108 */ + uint32_t magic; /* 236 */ + uint8_t options[308]; +}; + +/* +++++++++++++++ MDNS rsp header +++++++++++++++ */ +struct ndpi_mdns_rsp_entry { + uint16_t rsp_type, rsp_class; + uint32_t ttl; + uint16_t data_len; +}; + +/* +++++++++++++++++++ LLC header (IEEE 802.2) ++++++++++++++++ */ +struct ndpi_snap_extension +{ + uint16_t oui; + uint8_t oui2; + uint16_t proto_ID; +}; + +struct ndpi_llc_header_snap +{ + uint8_t dsap; + uint8_t ssap; + uint8_t ctrl; + struct ndpi_snap_extension snap; +}; + +/* ++++++++++ RADIO TAP header (for IEEE 802.11) +++++++++++++ */ +struct ndpi_radiotap_header +{ + uint8_t version; /* set to 0 */ + uint8_t pad; + uint16_t len; + uint32_t present; + uint64_t MAC_timestamp; + uint8_t flags; +}; + +/* ++++++++++++ Wireless header (IEEE 802.11) ++++++++++++++++ */ +struct ndpi_wifi_header +{ + uint16_t fc; + uint16_t duration; + uint8_t rcvr[6]; + uint8_t trsm[6]; + uint8_t dest[6]; + uint16_t seq_ctrl; + /* uint64_t ccmp - for data encryption only - check fc.flag */ +}; + +/* +++++++++++++++++++++++ MPLS header +++++++++++++++++++++++ */ +struct ndpi_mpls_header +{ + uint32_t ttl:8, s:1, exp:3, label:20; +}; + +extern union mpls { + uint32_t u32; + struct ndpi_mpls_header mpls; +} mpls; + +/* ++++++++++++++++++++++++ IP header ++++++++++++++++++++++++ */ +struct ndpi_iphdr { + uint8_t ihl:4, version:4; + uint8_t tos; + uint16_t tot_len; + uint16_t id; + uint16_t frag_off; + uint8_t ttl; + uint8_t protocol; + uint16_t check; + uint32_t saddr; + uint32_t daddr; +}; + +/* +++++++++++++++++++++++ IPv6 header +++++++++++++++++++++++ */ +/* rfc3542 */ +struct ndpi_in6_addr { + union { + uint8_t u6_addr8[16]; + uint16_t u6_addr16[8]; + uint32_t u6_addr32[4]; + uint64_t u6_addr64[2]; + } u6_addr; /* 128-bit IP6 address */ +}; + +struct ndpi_ip6_hdrctl { + uint32_t ip6_un1_flow; + uint16_t ip6_un1_plen; + uint8_t ip6_un1_nxt; + uint8_t ip6_un1_hlim; +}; + +struct ndpi_ipv6hdr { + struct ndpi_ip6_hdrctl ip6_hdr; + struct ndpi_in6_addr ip6_src; + struct ndpi_in6_addr ip6_dst; +}; + +/* +++++++++++++++++++++++ TCP header +++++++++++++++++++++++ */ +struct ndpi_tcphdr +{ + uint16_t source; + uint16_t dest; + uint32_t seq; + uint32_t ack_seq; + uint16_t res1:4, doff:4, fin:1, syn:1, rst:1, psh:1, ack:1, urg:1, ece:1, cwr:1; + uint16_t window; + uint16_t check; + uint16_t urg_ptr; +}; + +/* +++++++++++++++++++++++ UDP header +++++++++++++++++++++++ */ +struct ndpi_udphdr +{ + uint16_t source; + uint16_t dest; + uint16_t len; + uint16_t check; +}; + +struct ndpi_dns_packet_header { + uint16_t tr_id; + uint16_t flags; + uint16_t num_queries; + uint16_t num_answers; + uint16_t authority_rrs; + uint16_t additional_rrs; +}; + +typedef union +{ + uint32_t ipv4; + uint8_t ipv4_uint8_t[4]; + struct ndpi_in6_addr ipv6; +} ndpi_ip_addr_t; + + +/* +++++++++++++++++++++++ ICMP header +++++++++++++++++++++++ */ +struct ndpi_icmphdr { + uint8_t type;/* message type */ + uint8_t code;/* type sub-code */ + uint16_t checksum; + union { + struct { + uint16_t id; + uint16_t sequence; + } echo; /* echo datagram */ + + uint32_t gateway; /* gateway address */ + struct { + uint16_t _unused; + uint16_t mtu; + } frag;/* path mtu discovery */ + } un; +}; + +/* +++++++++++++++++++++++ ICMP6 header +++++++++++++++++++++++ */ +struct ndpi_icmp6hdr { + uint8_t icmp6_type; /* type field */ + uint8_t icmp6_code; /* code field */ + uint16_t icmp6_cksum; /* checksum field */ + union { + uint32_t icmp6_un_data32[1]; /* type-specific field */ + uint16_t icmp6_un_data16[2]; /* type-specific field */ + uint8_t icmp6_un_data8[4]; /* type-specific field */ + } icmp6_dataun; +}; + +/* +++++++++++++++++++++++ VXLAN header +++++++++++++++++++++++ */ +struct ndpi_vxlanhdr { + uint16_t flags; + uint16_t groupPolicy; + uint32_t vni; +}; + +struct tinc_cache_entry { + uint32_t src_address; + uint32_t dst_address; + uint16_t dst_port; +}; +""" + +cc_ndpi_id_struct = """ +struct ndpi_id_struct { + /** detected_protocol_bitmask: + access this bitmask to find out whether an id has used skype or not + if a flag is set here, it will not be reset + to compare this, use: + **/ + NDPI_PROTOCOL_BITMASK detected_protocol_bitmask; + /* NDPI_PROTOCOL_RTSP */ + ndpi_ip_addr_t rtsp_ip_address; + /* NDPI_PROTOCOL_YAHOO */ + uint32_t yahoo_video_lan_timer; + /* NDPI_PROTOCOL_IRC_MAXPORT % 2 must be 0 */ + /* NDPI_PROTOCOL_IRC */ + #define NDPI_PROTOCOL_IRC_MAXPORT 8 + uint16_t irc_port[NDPI_PROTOCOL_IRC_MAXPORT]; + uint32_t last_time_port_used[NDPI_PROTOCOL_IRC_MAXPORT]; + uint32_t irc_ts; + /* NDPI_PROTOCOL_GNUTELLA */ + uint32_t gnutella_ts; + /* NDPI_PROTOCOL_BATTLEFIELD */ + uint32_t battlefield_ts; + /* NDPI_PROTOCOL_THUNDER */ + uint32_t thunder_ts; + /* NDPI_PROTOCOL_RTSP */ + uint32_t rtsp_timer; + /* NDPI_PROTOCOL_OSCAR */ + uint32_t oscar_last_safe_access_time; + /* NDPI_PROTOCOL_ZATTOO */ + uint32_t zattoo_ts; + /* NDPI_PROTOCOL_UNENCRYPTED_JABBER */ + uint32_t jabber_stun_or_ft_ts; + /* NDPI_PROTOCOL_DIRECTCONNECT */ + uint32_t directconnect_last_safe_access_time; + /* NDPI_PROTOCOL_SOULSEEK */ + uint32_t soulseek_last_safe_access_time; + /* NDPI_PROTOCOL_DIRECTCONNECT */ + uint16_t detected_directconnect_port; + uint16_t detected_directconnect_udp_port; + uint16_t detected_directconnect_ssl_port; + /* NDPI_PROTOCOL_BITTORRENT */ + #define NDPI_BT_PORTS 8 + uint16_t bt_port_t[NDPI_BT_PORTS]; + uint16_t bt_port_u[NDPI_BT_PORTS]; + /* NDPI_PROTOCOL_UNENCRYPTED_JABBER */ + #define JABBER_MAX_STUN_PORTS 6 + uint16_t jabber_voice_stun_port[JABBER_MAX_STUN_PORTS]; + uint16_t jabber_file_transfer_port[2]; + /* NDPI_PROTOCOL_GNUTELLA */ + uint16_t detected_gnutella_port; + /* NDPI_PROTOCOL_GNUTELLA */ + uint16_t detected_gnutella_udp_port1; + uint16_t detected_gnutella_udp_port2; + /* NDPI_PROTOCOL_SOULSEEK */ + uint16_t soulseek_listen_port; + /* NDPI_PROTOCOL_IRC */ + uint8_t irc_number_of_port; + /* NDPI_PROTOCOL_OSCAR */ + uint8_t oscar_ssl_session_id[33]; + /* NDPI_PROTOCOL_UNENCRYPTED_JABBER */ + uint8_t jabber_voice_stun_used_ports; + /* NDPI_PROTOCOL_SIP */ + /* NDPI_PROTOCOL_YAHOO */ + uint32_t yahoo_video_lan_dir:1; + /* NDPI_PROTOCOL_YAHOO */ + uint32_t yahoo_conf_logged_in:1; + uint32_t yahoo_voice_conf_logged_in:1; + /* NDPI_PROTOCOL_RTSP */ + uint32_t rtsp_ts_set:1; +}; +""" +cc_ndpi_flow_tcp_struct = """ +struct ndpi_flow_tcp_struct { + /* NDPI_PROTOCOL_MAIL_SMTP */ + uint16_t smtp_command_bitmask; + /* NDPI_PROTOCOL_MAIL_POP */ + uint16_t pop_command_bitmask; + /* NDPI_PROTOCOL_QQ */ + uint16_t qq_nxt_len; + /* NDPI_PROTOCOL_WHATSAPP */ + uint8_t wa_matched_so_far; + /* NDPI_PROTOCOL_TDS */ + uint8_t tds_login_version; + + /* NDPI_PROTOCOL_IRC */ + uint8_t irc_stage; + uint8_t irc_port; + + /* NDPI_PROTOCOL_H323 */ + uint8_t h323_valid_packets; + + /* NDPI_PROTOCOL_GNUTELLA */ + uint8_t gnutella_msg_id[3]; + + /* NDPI_PROTOCOL_IRC */ + uint32_t irc_3a_counter:3; + uint32_t irc_stage2:5; + uint32_t irc_direction:2; + uint32_t irc_0x1000_full:1; + + /* NDPI_PROTOCOL_SOULSEEK */ + uint32_t soulseek_stage:2; + + /* NDPI_PROTOCOL_TDS */ + uint32_t tds_stage:3; + + /* NDPI_PROTOCOL_USENET */ + uint32_t usenet_stage:2; + + /* NDPI_PROTOCOL_IMESH */ + uint32_t imesh_stage:4; + + /* NDPI_PROTOCOL_HTTP */ + uint32_t http_setup_dir:2; + uint32_t http_stage:2; + uint32_t http_empty_line_seen:1; + uint32_t http_wait_for_retransmission:1; + + /* NDPI_PROTOCOL_GNUTELLA */ + uint32_t gnutella_stage:2; // 0 - 2 + /* NDPI_CONTENT_MMS */ + uint32_t mms_stage:2; + /* NDPI_PROTOCOL_YAHOO */ + uint32_t yahoo_sip_comm:1; + uint32_t yahoo_http_proxy_stage:2; + + /* NDPI_PROTOCOL_MSN */ + uint32_t msn_stage:3; + uint32_t msn_ssl_ft:2; + + /* NDPI_PROTOCOL_SSH */ + uint32_t ssh_stage:3; + + /* NDPI_PROTOCOL_VNC */ + uint32_t vnc_stage:2; // 0 - 3 + + /* NDPI_PROTOCOL_TELNET */ + uint32_t telnet_stage:2; // 0 - 2 + void* tls_srv_cert_fingerprint_ctx; + + /* NDPI_PROTOCOL_TLS */ + uint8_t tls_seen_client_cert:1, + tls_seen_server_cert:1, + tls_seen_certificate:1, + tls_srv_cert_fingerprint_found:1, + tls_srv_cert_fingerprint_processed:1, + tls_stage:2, _pad:1; // 0 - 5 + int16_t tls_record_offset, tls_fingerprint_len; /* Need to be signed */ + uint8_t tls_sha1_certificate_fingerprint[20]; + + /* NDPI_PROTOCOL_POSTGRES */ + uint32_t postgres_stage:3; + + /* NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK */ + uint32_t ddlink_server_direction:1; + uint32_t seen_syn:1; + uint32_t seen_syn_ack:1; + uint32_t seen_ack:1; + + /* NDPI_PROTOCOL_ICECAST */ + uint32_t icecast_stage:1; + + /* NDPI_PROTOCOL_DOFUS */ + uint32_t dofus_stage:1; + + /* NDPI_PROTOCOL_FIESTA */ + uint32_t fiesta_stage:2; + + /* NDPI_PROTOCOL_WORLDOFWARCRAFT */ + uint32_t wow_stage:2; + + /* NDPI_PROTOCOL_HTTP_APPLICATION_VEOHTV */ + uint32_t veoh_tv_stage:2; + + /* NDPI_PROTOCOL_SHOUTCAST */ + uint32_t shoutcast_stage:2; + + /* NDPI_PROTOCOL_RTP */ + uint32_t rtp_special_packets_seen:1; + + /* NDPI_PROTOCOL_MAIL_POP */ + uint32_t mail_pop_stage:2; + + /* NDPI_PROTOCOL_MAIL_IMAP */ + uint32_t mail_imap_stage:3, mail_imap_starttls:2; + + /* NDPI_PROTOCOL_SKYPE */ + uint8_t skype_packet_id; + + /* NDPI_PROTOCOL_CITRIX */ + uint8_t citrix_packet_id; + /* NDPI_PROTOCOL_LOTUS_NOTES */ + uint8_t lotus_notes_packet_id; + + /* NDPI_PROTOCOL_TEAMVIEWER */ + uint8_t teamviewer_stage; + + /* NDPI_PROTOCOL_ZMQ */ + uint8_t prev_zmq_pkt_len; + uint8_t prev_zmq_pkt[10]; + + /* NDPI_PROTOCOL_PPSTREAM */ + uint32_t ppstream_stage:3; + + /* NDPI_PROTOCOL_MEMCACHED */ + uint8_t memcached_matches; + + /* NDPI_PROTOCOL_NEST_LOG_SINK */ + uint8_t nest_log_sink_matches; +}; +""" + +cc_ndpi_flow_udp_struct = """ +struct ndpi_flow_udp_struct { + /* NDPI_PROTOCOL_BATTLEFIELD */ + uint32_t battlefield_msg_id; + /* NDPI_PROTOCOL_SNMP */ + uint32_t snmp_msg_id; + /* NDPI_PROTOCOL_BATTLEFIELD */ + uint32_t battlefield_stage:3; + /* NDPI_PROTOCOL_SNMP */ + uint32_t snmp_stage:2; + /* NDPI_PROTOCOL_PPSTREAM */ + uint32_t ppstream_stage:3; // 0 - 7 + /* NDPI_PROTOCOL_HALFLIFE2 */ + uint32_t halflife2_stage:2; // 0 - 2 + /* NDPI_PROTOCOL_TFTP */ + uint32_t tftp_stage:1; + /* NDPI_PROTOCOL_AIMINI */ + uint32_t aimini_stage:5; + /* NDPI_PROTOCOL_XBOX */ + uint32_t xbox_stage:1; + /* NDPI_PROTOCOL_WINDOWS_UPDATE */ + uint32_t wsus_stage:1; + /* NDPI_PROTOCOL_SKYPE */ + uint8_t skype_packet_id; + /* NDPI_PROTOCOL_TEAMVIEWER */ + uint8_t teamviewer_stage; + /* NDPI_PROTOCOL_EAQ */ + uint8_t eaq_pkt_id; + uint32_t eaq_sequence; + /* NDPI_PROTOCOL_RX */ + uint32_t rx_conn_epoch; + uint32_t rx_conn_id; + /* NDPI_PROTOCOL_MEMCACHED */ + uint8_t memcached_matches; + /* NDPI_PROTOCOL_WIREGUARD */ + uint8_t wireguard_stage; + uint32_t wireguard_peer_index[2]; +}; +""" + +cc_ndpi_int_one_line_struct = """ +struct ndpi_int_one_line_struct { + const uint8_t *ptr; + uint16_t len; +}; +""" + +cc_ndpi_packet_struct_stack = """ +struct ndpi_packet_struct_stack { + uint8_t detected_subprotocol_stack[2]; + uint16_t protocol_stack_info; +}; +struct ndpi_flow_struct_stack { + uint16_t detected_protocol_stack[2]; + uint16_t protocol_stack_info; +}; +""" + +cc_ndpi_packet_struct = """ +struct ndpi_packet_struct { + const struct ndpi_iphdr *iph; + const struct ndpi_ipv6hdr *iphv6; + const struct ndpi_tcphdr *tcp; + const struct ndpi_udphdr *udp; + const uint8_t *generic_l4_ptr; /* is set only for non tcp-udp traffic */ + const uint8_t *payload; + uint32_t tick_timestamp; + uint64_t tick_timestamp_l; + struct ndpi_packet_struct_stack ndpi_packet_stack; + struct ndpi_int_one_line_struct line[64]; + /* HTTP headers */ + struct ndpi_int_one_line_struct host_line; + struct ndpi_int_one_line_struct forwarded_line; + struct ndpi_int_one_line_struct referer_line; + struct ndpi_int_one_line_struct content_line; + struct ndpi_int_one_line_struct accept_line; + struct ndpi_int_one_line_struct user_agent_line; + struct ndpi_int_one_line_struct http_url_name; + struct ndpi_int_one_line_struct http_encoding; + struct ndpi_int_one_line_struct http_transfer_encoding; + struct ndpi_int_one_line_struct http_contentlen; + struct ndpi_int_one_line_struct http_cookie; + struct ndpi_int_one_line_struct http_origin; + struct ndpi_int_one_line_struct http_x_session_type; + struct ndpi_int_one_line_struct server_line; + struct ndpi_int_one_line_struct http_method; + struct ndpi_int_one_line_struct http_response; /* the first "word" in this pointer is the response code in the + packet (200, etc) */ + uint8_t http_num_headers; /* number of found (valid) header lines in HTTP request or response */ + uint16_t l3_packet_len; + uint16_t l4_packet_len; + uint16_t payload_packet_len; + uint16_t actual_payload_len; + uint16_t num_retried_bytes; + uint16_t parsed_lines; + uint16_t parsed_unix_lines; + uint16_t empty_line_position; + uint8_t tcp_retransmission; + uint8_t l4_protocol; + uint8_t tls_certificate_detected:4, tls_certificate_num_checks:4; + uint8_t packet_lines_parsed_complete:1, + packet_direction:1, empty_line_position_set:1, pad:5; +}; +struct ndpi_detection_module_struct; +struct ndpi_flow_struct; +struct ndpi_call_function_struct { + NDPI_PROTOCOL_BITMASK detection_bitmask; + NDPI_PROTOCOL_BITMASK excluded_protocol_bitmask; + uint32_t ndpi_selection_bitmask; + void (*func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow); + uint8_t detection_feature; +}; +struct ndpi_subprotocol_conf_struct { + void (*func) (struct ndpi_detection_module_struct *, char *attr, char *value, int protocol_id); +}; + +typedef struct { + uint16_t port_low, port_high; +} ndpi_port_range; + +typedef enum { + NDPI_PROTOCOL_SAFE = 0, /* Surely doesn't provide risks for the network. (e.g., a news site) */ + NDPI_PROTOCOL_ACCEPTABLE, /* Probably doesn't provide risks, but could be malicious (e.g., Dropbox) */ + NDPI_PROTOCOL_FUN, /* Pure fun protocol, which may be prohibited by the user policy (e.g., Netflix) */ + NDPI_PROTOCOL_UNSAFE, /* Probably provides risks, but could be a normal traffic. Unencrypted protocols with clear pass should be here (e.g., telnet) */ + NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, /* Possibly dangerous (ex. Tor). */ + NDPI_PROTOCOL_DANGEROUS, /* Surely is dangerous (ex. smbv1). Be prepared to troubles */ + NDPI_PROTOCOL_TRACKER_ADS, /* Trackers, Advertisements... */ + NDPI_PROTOCOL_UNRATED /* No idea, not implemented or impossible to classify */ +} ndpi_protocol_breed_t; + +#define NUM_BREEDS 8 + +/* Abstract categories to group the protocols. */ +typedef enum { + NDPI_PROTOCOL_CATEGORY_UNSPECIFIED = 0, /* For general services and unknown protocols */ + NDPI_PROTOCOL_CATEGORY_MEDIA, /* Multimedia and streaming */ + NDPI_PROTOCOL_CATEGORY_VPN, /* Virtual Private Networks */ + NDPI_PROTOCOL_CATEGORY_MAIL, /* Protocols to send/receive/sync emails */ + NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, /* AFS/NFS and similar protocols */ + NDPI_PROTOCOL_CATEGORY_WEB, /* Web/mobile protocols and services */ + NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, /* Social networks */ + NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, /* Download, FTP, file transfer/sharing */ + NDPI_PROTOCOL_CATEGORY_GAME, /* Online games */ + NDPI_PROTOCOL_CATEGORY_CHAT, /* Instant messaging */ + NDPI_PROTOCOL_CATEGORY_VOIP, /* Real-time communications and conferencing */ + NDPI_PROTOCOL_CATEGORY_DATABASE, /* Protocols for database communication */ + NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, /* Remote access and control */ + NDPI_PROTOCOL_CATEGORY_CLOUD, /* Online cloud services */ + NDPI_PROTOCOL_CATEGORY_NETWORK, /* Network infrastructure protocols */ + NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, /* Software for collaborative development, including Webmail */ + NDPI_PROTOCOL_CATEGORY_RPC, /* High level network communication protocols */ + NDPI_PROTOCOL_CATEGORY_STREAMING, /* Streaming protocols */ + NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, /* System/Operating System level applications */ + NDPI_PROTOCOL_CATEGORY_SW_UPDATE, /* Software update */ + + /* See #define NUM_CUSTOM_CATEGORIES */ + NDPI_PROTOCOL_CATEGORY_CUSTOM_1, /* User custom category 1 */ + NDPI_PROTOCOL_CATEGORY_CUSTOM_2, /* User custom category 2 */ + NDPI_PROTOCOL_CATEGORY_CUSTOM_3, /* User custom category 3 */ + NDPI_PROTOCOL_CATEGORY_CUSTOM_4, /* User custom category 4 */ + NDPI_PROTOCOL_CATEGORY_CUSTOM_5, /* User custom category 5 */ + + /* Further categories... */ + NDPI_PROTOCOL_CATEGORY_MUSIC, + NDPI_PROTOCOL_CATEGORY_VIDEO, + NDPI_PROTOCOL_CATEGORY_SHOPPING, + NDPI_PROTOCOL_CATEGORY_PRODUCTIVITY, + NDPI_PROTOCOL_CATEGORY_FILE_SHARING, + + /* Some custom categories */ + CUSTOM_CATEGORY_MINING = 99, + CUSTOM_CATEGORY_MALWARE = 100, + CUSTOM_CATEGORY_ADVERTISEMENT = 101, + CUSTOM_CATEGORY_BANNED_SITE = 102, + CUSTOM_CATEGORY_SITE_UNAVAILABLE = 103, + CUSTOM_CATEGORY_ALLOWED_SITE = 104, + /* + The category below is used to track communications made by + security applications (e.g. sophosxl.net, spamhaus.org) + to track malware, spam etc. + */ + CUSTOM_CATEGORY_ANTIMALWARE = 105, + /* + IMPORTANT + Please keep in sync with + static const char* categories[] = { ..} + in ndpi_main.c + */ + NDPI_PROTOCOL_NUM_CATEGORIES + /* + NOTE: Keep this as last member + Unused as value but useful to getting the number of elements + in this datastructure + */ +} ndpi_protocol_category_t; + +typedef enum { + ndpi_pref_direction_detect_disable = 0, + ndpi_pref_disable_metadata_export, +} ndpi_detection_preference; + +/* ntop extensions */ +typedef struct ndpi_proto_defaults { + char *protoName; + ndpi_protocol_category_t protoCategory; + uint8_t can_have_a_subprotocol; + uint16_t protoId, protoIdx; + uint16_t master_tcp_protoId[2], master_udp_protoId[2]; /* The main protocols on which this sub-protocol sits on */ + ndpi_protocol_breed_t protoBreed; + void (*func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow); +} ndpi_proto_defaults_t; + +typedef struct ndpi_default_ports_tree_node { + ndpi_proto_defaults_t *proto; + uint8_t customUserProto; + uint16_t default_port; +} ndpi_default_ports_tree_node_t; + +typedef struct _ndpi_automa { + void *ac_automa; /* Real type is AC_AUTOMATA_t */ + uint8_t ac_automa_finalized; +} ndpi_automa; + +typedef struct ndpi_proto { + /* + Note + below we do not use ndpi_protocol_id_t as users can define their own + custom protocols and thus the typedef could be too short in size. + */ + uint16_t master_protocol /* e.g. HTTP */, app_protocol /* e.g. FaceBook */; + ndpi_protocol_category_t category; +} ndpi_protocol; + +#define NUM_CUSTOM_CATEGORIES 5 +#define CUSTOM_CATEGORY_LABEL_LEN 32 + +typedef enum { + NDPI_LOG_ERROR, + NDPI_LOG_TRACE, + NDPI_LOG_DEBUG, + NDPI_LOG_DEBUG_EXTRA +} ndpi_log_level_t; + + +struct ndpi_detection_module_struct { + NDPI_PROTOCOL_BITMASK detection_bitmask; + NDPI_PROTOCOL_BITMASK generic_http_packet_bitmask; + uint32_t current_ts; + uint32_t ticks_per_second; + char custom_category_labels[NUM_CUSTOM_CATEGORIES][CUSTOM_CATEGORY_LABEL_LEN]; + /* callback function buffer */ + struct ndpi_call_function_struct callback_buffer[250]; + uint32_t callback_buffer_size; + struct ndpi_call_function_struct callback_buffer_tcp_no_payload[250]; + uint32_t callback_buffer_size_tcp_no_payload; + struct ndpi_call_function_struct callback_buffer_tcp_payload[250]; + uint32_t callback_buffer_size_tcp_payload; + struct ndpi_call_function_struct callback_buffer_udp[250]; + uint32_t callback_buffer_size_udp; + struct ndpi_call_function_struct callback_buffer_non_tcp_udp[250]; + uint32_t callback_buffer_size_non_tcp_udp; + ndpi_default_ports_tree_node_t *tcpRoot, *udpRoot; + ndpi_log_level_t ndpi_log_level; /* default error */ + /* misc parameters */ + uint32_t tcp_max_retransmission_window_size; + uint32_t directconnect_connection_ip_tick_timeout; + /* subprotocol registration handler */ + struct ndpi_subprotocol_conf_struct subprotocol_conf[250]; + unsigned ndpi_num_supported_protocols; + unsigned ndpi_num_custom_protocols; + /* HTTP/DNS/HTTPS host matching */ + ndpi_automa host_automa, /* Used for DNS/HTTPS */ + content_automa, /* Used for HTTP subprotocol_detection */ + subprotocol_automa, /* Used for HTTP subprotocol_detection */ + bigrams_automa, impossible_bigrams_automa; /* TOR */ + /* IMPORTANT: please update ndpi_finalize_initalization() whenever you add a new automa */ + + struct { + ndpi_automa hostnames, hostnames_shadow; + void *ipAddresses, *ipAddresses_shadow; /* Patricia */ + uint8_t categories_loaded; + } custom_categories; + + /* IP-based protocol detection */ + void *protocols_ptree; + + /* irc parameters */ + uint32_t irc_timeout; + /* gnutella parameters */ + uint32_t gnutella_timeout; + /* battlefield parameters */ + uint32_t battlefield_timeout; + /* thunder parameters */ + uint32_t thunder_timeout; + /* SoulSeek parameters */ + uint32_t soulseek_connection_ip_tick_timeout; + /* rtsp parameters */ + uint32_t rtsp_connection_timeout; + /* tvants parameters */ + uint32_t tvants_connection_timeout; + /* rstp */ + uint32_t orb_rstp_ts_timeout; + /* yahoo */ + uint8_t yahoo_detect_http_connections; + uint32_t yahoo_lan_video_timeout; + uint32_t zattoo_connection_timeout; + uint32_t jabber_stun_timeout; + uint32_t jabber_file_transfer_timeout; + uint8_t ip_version_limit; + /* NDPI_PROTOCOL_BITTORRENT */ + struct hash_ip4p_table *bt_ht; + struct hash_ip4p_table *bt6_ht; + + /* BT_ANNOUNCE */ + struct bt_announce *bt_ann; + int bt_ann_len; + + /* NDPI_PROTOCOL_OOKLA */ + struct ndpi_lru_cache *ookla_cache; + /* NDPI_PROTOCOL_TINC */ + struct cache *tinc_cache; + /* NDPI_PROTOCOL_STUN and subprotocols */ + struct ndpi_lru_cache *stun_cache; + ndpi_proto_defaults_t proto_defaults[512]; + uint8_t direction_detect_disable:1, /* disable internal detection of packet direction */ + disable_metadata_export:1 /* No metadata is exported */ + ; + void *hyperscan; /* Intel Hyperscan */ +}; + +#define NDPI_CIPHER_SAFE 0 +#define NDPI_CIPHER_WEAK 1 +#define NDPI_CIPHER_INSECURE 2 + +typedef enum { + ndpi_cipher_safe = NDPI_CIPHER_SAFE, + ndpi_cipher_weak = NDPI_CIPHER_WEAK, + ndpi_cipher_insecure = NDPI_CIPHER_INSECURE +} ndpi_cipher_weakness; + +struct ndpi_flow_struct { + struct ndpi_flow_struct_stack ndpi_flow_stack; + /* init parameter, internal used to set up timestamp,... */ + uint16_t guessed_protocol_id, guessed_host_protocol_id, guessed_category, guessed_header_category; + uint8_t l4_proto, protocol_id_already_guessed:1, host_already_guessed:1, init_finished:1, setup_packet_direction:1, packet_direction:1, check_extra_packets:1; + + /* + if ndpi_struct->direction_detect_disable == 1 + tcp sequence number connection tracking + */ + uint32_t next_tcp_seq_nr[2]; + + uint8_t max_extra_packets_to_check; + uint8_t num_extra_packets_checked; + uint8_t num_processed_pkts; /* <= WARNING it can wrap but we do expect people to giveup earlier */ + + int (*extra_packets_func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow); + + /* + the tcp / udp / other l4 value union + used to reduce the number of bytes for tcp or udp protocol states + */ + union { + struct ndpi_flow_tcp_struct tcp; + struct ndpi_flow_udp_struct udp; + } l4; + + /* + Pointer to src or dst that identifies the + server of this connection + */ + struct ndpi_id_struct *server_id; + /* HTTP host or DNS query */ + uint8_t host_server_name[256]; + + /* + This structure below will not not stay inside the protos + structure below as HTTP is used by many subprotocols + such as FaceBook, Google... so it is hard to know + when to use it or not. Thus we leave it outside for the + time being. + */ + struct { + ndpi_http_method method; + char *url, *content_type; + uint8_t num_request_headers, num_response_headers; + uint8_t request_version; /* 0=1.0 and 1=1.1. Create an enum for this? */ + uint16_t response_status_code; /* 200, 404, etc. */ + } http; + + union { + /* the only fields useful for nDPI and ntopng */ + struct { + uint8_t num_queries, num_answers, reply_code, is_query; + uint16_t query_type, query_class, rsp_type; + ndpi_ip_addr_t rsp_addr; /* The first address in a DNS response packet */ + } dns; + + struct { + uint8_t request_code; + uint8_t version; + } ntp; + + struct { + char cname[24], realm[24]; + } kerberos; + + struct { + struct { + uint16_t ssl_version; + char client_certificate[64], server_certificate[64], server_organization[64]; + uint32_t notBefore, notAfter; + char ja3_client[33], ja3_server[33]; + uint16_t server_cipher; + ndpi_cipher_weakness server_unsafe_cipher; + } ssl; + + struct { + uint8_t num_udp_pkts, num_processed_pkts, num_binding_requests; + } stun; + + /* We can have STUN over SSL/TLS thus they need to live together */ + } stun_ssl; + + struct { + char client_signature[48], server_signature[48]; + char hassh_client[33], hassh_server[33]; + } ssh; + + struct { + uint8_t last_one_byte_pkt, last_byte; + } imo; + + struct { + char answer[96]; + } mdns; + + struct { + char version[32]; + } ubntac2; + + struct { + /* Via HTTP User-Agent */ + uint8_t detected_os[32]; + /* Via HTTP X-Forwarded-For */ + uint8_t nat_ip[24]; + } http; + + struct { + /* Bittorrent hash */ + uint8_t hash[20]; + } bittorrent; + + struct { + char fingerprint[48]; + char class_ident[48]; + } dhcp; + } protos; + + /*** ALL protocol specific 64 bit variables here ***/ + + /* protocols which have marked a connection as this connection cannot be protocol XXX, multiple uint64_t */ + NDPI_PROTOCOL_BITMASK excluded_protocol_bitmask; + + ndpi_protocol_category_t category; + + /* NDPI_PROTOCOL_REDIS */ + uint8_t redis_s2d_first_char, redis_d2s_first_char; + + uint16_t packet_counter; // can be 0 - 65000 + uint16_t packet_direction_counter[2]; + uint16_t byte_counter[2]; + /* NDPI_PROTOCOL_BITTORRENT */ + uint8_t bittorrent_stage; // can be 0 - 255 + + /* NDPI_PROTOCOL_DIRECTCONNECT */ + uint8_t directconnect_stage:2; // 0 - 1 + + /* NDPI_PROTOCOL_YAHOO */ + uint8_t sip_yahoo_voice:1; + + /* NDPI_PROTOCOL_HTTP */ + uint8_t http_detected:1; + uint16_t http_upper_protocol, http_lower_protocol; + + /* NDPI_PROTOCOL_RTSP */ + uint8_t rtsprdt_stage:2, rtsp_control_flow:1; + + /* NDPI_PROTOCOL_YAHOO */ + uint8_t yahoo_detection_finished:2; + + /* NDPI_PROTOCOL_ZATTOO */ + uint8_t zattoo_stage:3; + + /* NDPI_PROTOCOL_QQ */ + uint8_t qq_stage:3; + + /* NDPI_PROTOCOL_THUNDER */ + uint8_t thunder_stage:2; // 0 - 3 + + /* NDPI_PROTOCOL_OSCAR */ + uint8_t oscar_ssl_voice_stage:3, oscar_video_voice:1; + + /* NDPI_PROTOCOL_FLORENSIA */ + uint8_t florensia_stage:1; + + /* NDPI_PROTOCOL_SOCKS */ + uint8_t socks5_stage:2, socks4_stage:2; // 0 - 3 + + /* NDPI_PROTOCOL_EDONKEY */ + uint8_t edonkey_stage:2; // 0 - 3 + + /* NDPI_PROTOCOL_FTP_CONTROL */ + uint8_t ftp_control_stage:2; + + /* NDPI_PROTOCOL_RTMP */ + uint8_t rtmp_stage:2; + + /* NDPI_PROTOCOL_PANDO */ + uint8_t pando_stage:3; + + /* NDPI_PROTOCOL_STEAM */ + uint16_t steam_stage:3, steam_stage1:3, steam_stage2:2, steam_stage3:2; + + /* NDPI_PROTOCOL_PPLIVE */ + uint8_t pplive_stage1:3, pplive_stage2:2, pplive_stage3:2; + + /* NDPI_PROTOCOL_STARCRAFT */ + uint8_t starcraft_udp_stage : 3; // 0-7 + + /* NDPI_PROTOCOL_OPENVPN */ + uint8_t ovpn_session_id[8]; + uint8_t ovpn_counter; + + /* NDPI_PROTOCOL_TINC */ + uint8_t tinc_state; + struct tinc_cache_entry tinc_cache_entry; + + /* NDPI_PROTOCOL_CSGO */ + uint8_t csgo_strid[18],csgo_state,csgo_s2; + uint32_t csgo_id2; + + /* NDPI_PROTOCOL_1KXUN || NDPI_PROTOCOL_IQIYI */ + uint16_t kxun_counter, iqiyi_counter; + + /* internal structures to save functions calls */ + struct ndpi_packet_struct packet; + struct ndpi_flow_struct *flow; + struct ndpi_id_struct *src; + struct ndpi_id_struct *dst; +}; +typedef struct { + char *string_to_match, *string2_to_match, *pattern_to_match, *proto_name; + int protocol_id; + ndpi_protocol_category_t protocol_category; + ndpi_protocol_breed_t protocol_breed; +} ndpi_protocol_match; + +typedef struct { + char *string_to_match, *hyperscan_string_to_match; + ndpi_protocol_category_t protocol_category; +} ndpi_category_match; + +typedef struct { + uint32_t network; + uint8_t cidr; + uint8_t value; +} ndpi_network; + +typedef uint32_t ndpi_init_prefs; + +typedef enum +{ + ndpi_no_prefs = 0, + ndpi_dont_load_tor_hosts, +} ndpi_prefs; + +typedef struct { + int protocol_id; + ndpi_protocol_category_t protocol_category; + ndpi_protocol_breed_t protocol_breed; +} ndpi_protocol_match_result; + +#define DEFAULT_SERIES_LEN 64 +#define MAX_SERIES_LEN 512 +#define MIN_SERIES_LEN 8 +""" + +cc_ndpi_apis = """ +struct ndpi_detection_module_struct *ndpi_init_detection_module(void); +void *memset(void *str, int c, size_t n); +void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *ndpi_struct, + const NDPI_PROTOCOL_BITMASK * detection_bitmask); +ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow, + const unsigned char *packet, + const unsigned short packetlen, + const uint64_t current_tick, + struct ndpi_id_struct *src, + struct ndpi_id_struct *dst); +ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow, + uint8_t enable_guess, + uint8_t *protocol_was_guessed); + +void * ndpi_malloc(size_t size); +void ndpi_free(void *ptr); +void * ndpi_flow_malloc(size_t size); +void ndpi_flow_free(void *ptr); +void ndpi_exit_detection_module(struct ndpi_detection_module_struct *ndpi_struct); +char* ndpi_protocol2name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol proto, char *buf, unsigned buf_len); +const char* ndpi_category_get_name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_category_t category); +char* ndpi_revision(void); +void ndpi_finalize_initalization(struct ndpi_detection_module_struct *ndpi_str); +""" + + +class NDPI(): + def __init__(self, libpath=None): + self._ffi = cffi.FFI() + if libpath is None: + self._ndpi = self._ffi.dlopen(dirname(abspath(__file__)) + '/libs/libndpi.so') + else: + self._ndpi = self._ffi.dlopen(libpath) + self._ffi.cdef(cc) + self._ffi.cdef(cc_ndpi_network_headers, packed=True) + self._ffi.cdef(cc_ndpi_id_struct) + self._ffi.cdef(cc_ndpi_flow_tcp_struct, packed=True) + self._ffi.cdef(cc_ndpi_flow_udp_struct, packed=True) + self._ffi.cdef(cc_ndpi_int_one_line_struct) + self._ffi.cdef(cc_ndpi_packet_struct_stack, packed=True) + self._ffi.cdef(cc_ndpi_packet_struct) + self._ffi.cdef(cc_ndpi_apis) + self._mod = self._ndpi.ndpi_init_detection_module() + ndpi_revision = self._ffi.string(self._ndpi.ndpi_revision()).decode('utf-8', errors='ignore') + if ndpi_revision[:3] >= '3.1': + self._ndpi.ndpi_finalize_initalization(self._mod) + all = self._ffi.new('NDPI_PROTOCOL_BITMASK*') + self._ndpi.memset(self._ffi.cast("char *", all), 0xFF, self._ffi.sizeof("NDPI_PROTOCOL_BITMASK")) + self._ndpi.ndpi_set_protocol_detection_bitmask2(self._mod, all) + self.SIZEOF_FLOW_STRUCT = self._ffi.sizeof("struct ndpi_flow_struct") + self.SIZEOF_ID_STRUCT = self._ffi.sizeof("struct ndpi_id_struct") + self.NULL = self._ffi.NULL + + def new_ndpi_flow(self): + f = self._ffi.cast('struct ndpi_flow_struct*', self._ndpi.ndpi_flow_malloc(self.SIZEOF_FLOW_STRUCT)) + self._ndpi.memset(f, 0, self.SIZEOF_FLOW_STRUCT) + return f + + def new_ndpi_id(self): + i = self._ffi.cast('struct ndpi_id_struct*', self._ndpi.ndpi_malloc(self.SIZEOF_ID_STRUCT)) + self._ndpi.memset(i, 0, self.SIZEOF_ID_STRUCT) + return i + + def ndpi_detection_process_packet(self, flow, packet, packetlen, current_tick, src, dst): + return self._ndpi.ndpi_detection_process_packet(self._mod, flow, packet, packetlen, current_tick, src, dst) + + def ndpi_detection_giveup(self, flow): + return self._ndpi.ndpi_detection_giveup(self._mod, flow, 1, self._ffi.new("uint8_t*", 0)) + + def ndpi_flow_free(self, flow): + return self._ndpi.ndpi_flow_free(flow) + + def ndpi_free(self, ptr): + return self._ndpi.ndpi_free(ptr) + + def get_str_field(self, ptr): + return self._ffi.string(ptr).decode('utf-8', errors='ignore') + + def ndpi_protocol2name(self, proto): + buf = self._ffi.new("char[32]") + self._ndpi.ndpi_protocol2name(self._mod, proto, buf, self._ffi.sizeof(buf)) + return self._ffi.string(buf).decode('utf-8', errors='ignore') + + def ndpi_category_get_name(self, category): + return self._ffi.string(self._ndpi.ndpi_category_get_name(self._mod, category)).decode('utf-8', errors='ignore') + + def ndpi_exit_detection_module(self): + self._ndpi.ndpi_exit_detection_module(self._mod) diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 4f793baec..a9c14dc85 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -278,7 +278,7 @@ typedef enum { NDPI_PROTOCOL_WHATSAPP_FILES = 242, /* Videos, pictures, voice messages... */ NDPI_PROTOCOL_TARGUS_GETDATA = 243, NDPI_PROTOCOL_DNP3 = 244, - NDPI_PROTOCOL_104 = 245, + NDPI_PROTOCOL_IEC60870 = 245, /* https://en.wikipedia.org/wiki/IEC_60870-5 */ NDPI_PROTOCOL_BLOOMBERG = 246, NDPI_PROTOCOL_CAPWAP = 247, NDPI_PROTOCOL_ZABBIX = 248, diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 3325e9cd9..ae7b2462f 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -1189,6 +1189,17 @@ struct ndpi_flow_struct { u_int16_t response_status_code; /* 200, 404, etc. */ } http; + /* + Put outside of the union to avoid issues in case the protocol + is remapped to somethign pther than Kerberos due to a faulty + dissector + */ + struct { + char *pktbuf; + u_int16_t pktbuf_maxlen, pktbuf_currlen; + } kerberos_buf; + + union { /* the only fields useful for nDPI and ntopng */ struct { @@ -1203,8 +1214,7 @@ struct ndpi_flow_struct { } ntp; struct { - - char hostname[24], domain[24], username[24]; + char hostname[48], domain[48], username[48]; } kerberos; struct { @@ -1234,9 +1244,11 @@ struct ndpi_flow_struct { } imo; struct { - u_int8_t username_detected:1, username_found:1, skip_next:1, _pad:5; + u_int8_t username_detected:1, username_found:1, + password_detected:1, password_found:1, + skip_next:1, _pad:3; u_int8_t character_id; - char username[32]; + char username[32], password[32]; } telnet; struct { @@ -1255,7 +1267,7 @@ struct ndpi_flow_struct { } http; struct { - u_int8_t auth_found; + u_int8_t auth_found:1, auth_failed:1, _pad:5; char username[16], password[16]; } ftp_imap_pop_smtp; diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 0421b6192..a4aacc55a 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -79,8 +79,67 @@ static ndpi_network host_protocol_list[] = { /* WhatsApp Inc. - List of the WhatsApp server IP addresses and ranges (https://developers.facebook.com/docs/whatsapp/network-debugging/ Dec 21, 2018) + List of the WhatsApp server IP addresses and ranges + https://developers.facebook.com/docs/whatsapp/network-debugging/ + Dec 1st, 2019 */ + { 0x1F0D4033 /* 31.13.64.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4035 /* 31.13.64.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4131 /* 31.13.65.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4132 /* 31.13.65.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4233 /* 31.13.66.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4238 /* 31.13.66.56/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4334 /* 31.13.67.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4430 /* 31.13.68.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4434 /* 31.13.68.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4631 /* 31.13.70.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4632 /* 31.13.70.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4731 /* 31.13.71.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4732 /* 31.13.71.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4830 /* 31.13.72.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4834 /* 31.13.72.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4934 /* 31.13.73.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4A34 /* 31.13.74.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4F35 /* 31.13.79.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D4F36 /* 31.13.79.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5030 /* 31.13.80.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5035 /* 31.13.80.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5130 /* 31.13.81.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5135 /* 31.13.81.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5233 /* 31.13.82.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5237 /* 31.13.82.55/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5331 /* 31.13.83.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5333 /* 31.13.83.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5431 /* 31.13.84.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5433 /* 31.13.84.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5531 /* 31.13.85.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5533 /* 31.13.85.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5631 /* 31.13.86.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5633 /* 31.13.86.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5730 /* 31.13.87.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5733 /* 31.13.87.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5935 /* 31.13.89.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5936 /* 31.13.89.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5A31 /* 31.13.90.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5A33 /* 31.13.90.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5B31 /* 31.13.91.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5B33 /* 31.13.91.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5C30 /* 31.13.92.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5C34 /* 31.13.92.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5D35 /* 31.13.93.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5D36 /* 31.13.93.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5E34 /* 31.13.94.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5E36 /* 31.13.94.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5F32 /* 31.13.95.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x1F0D5F3F /* 31.13.95.63/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x3216F0A0 /* 50.22.240.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0x32175A80 /* 50.23.90.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0x45ABEF0B /* 69.171.239.11/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x45ABFA34 /* 69.171.250.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x45ABFA36 /* 69.171.250.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x45ABFF0B /* 69.171.255.11/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x66846036 /* 102.132.96.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x66846136 /* 102.132.97.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, { 0x6CA8AE00 /* 108.168.174.0/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0x6CA8B0C0 /* 108.168.176.192/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, { 0x6CA8B100 /* 108.168.177.0/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, @@ -90,6 +149,17 @@ static ndpi_network host_protocol_list[] = { { 0x6CA8FFE3 /* 108.168.255.227/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF00135 /* 157.240.1.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF00136 /* 157.240.1.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00235 /* 157.240.2.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00236 /* 157.240.2.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00336 /* 157.240.3.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00635 /* 157.240.6.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00636 /* 157.240.6.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00735 /* 157.240.7.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00736 /* 157.240.7.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00835 /* 157.240.8.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00836 /* 157.240.8.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00935 /* 157.240.9.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF00936 /* 157.240.9.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF00A35 /* 157.240.10.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF00A36 /* 157.240.10.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF00B35 /* 157.240.11.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, @@ -104,141 +174,91 @@ static ndpi_network host_protocol_list[] = { { 0x9DF01234 /* 157.240.18.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01335 /* 157.240.19.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01336 /* 157.240.19.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00235 /* 157.240.2.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00236 /* 157.240.2.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01434 /* 157.240.20.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01534 /* 157.240.21.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01635 /* 157.240.22.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01636 /* 157.240.22.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01735 /* 157.240.23.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01736 /* 157.240.23.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF01836 /* 157.240.24.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF01936 /* 157.240.25.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF01A36 /* 157.240.26.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF01B36 /* 157.240.27.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF01C33 /* 157.240.28.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF01C37 /* 157.240.28.55/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01D35 /* 157.240.29.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0x9DF01D36 /* 157.240.29.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00635 /* 157.240.6.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00636 /* 157.240.6.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00735 /* 157.240.7.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00736 /* 157.240.7.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00835 /* 157.240.8.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00836 /* 157.240.8.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00935 /* 157.240.9.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00936 /* 157.240.9.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF01E36 /* 157.240.30.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C034 /* 157.240.192.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C037 /* 157.240.192.55/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C132 /* 157.240.193.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C137 /* 157.240.193.55/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C236 /* 157.240.194.54/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C336 /* 157.240.195.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C338 /* 157.240.195.56/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C43C /* 157.240.196.60/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, + { 0x9DF0C93C /* 157.240.201.60/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, { 0x9E550060 /* 158.85.0.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x9E55E0A0 /* 158.85.224.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x9E55E920 /* 158.85.233.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x9E55F980 /* 158.85.249.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x9E55FE40 /* 158.85.254.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0x9E5505C0 /* 158.85.5.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0x9E552E80 /* 158.85.46.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0x9E5530E0 /* 158.85.48.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x9E5505C0 /* 158.85.5.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x9E553A00 /* 158.85.58.0/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, + { 0x9E553A20 /* 158.85.58.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0x9E553A60 /* 158.85.58.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0x9E553DC0 /* 158.85.61.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92CA700 /* 169.44.167.0/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C2400 /* 169.44.36.0/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C3940 /* 169.44.57.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C3A40 /* 169.44.58.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C5000 /* 169.44.80.0/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C5280 /* 169.44.82.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C52C0 /* 169.44.82.192/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, + { 0x9E55E0A0 /* 158.85.224.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0x9E55E920 /* 158.85.233.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92C2400 /* 169.44.36.0/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92C5020 /* 169.44.80.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92C5260 /* 169.44.82.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C5300 /* 169.44.83.0/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C5380 /* 169.44.83.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C53C0 /* 169.44.83.192/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C5360 /* 169.44.83.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C5400 /* 169.44.84.0/24 */, 24, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C5540 /* 169.44.85.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92C57A0 /* 169.44.87.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92C5480 /* 169.44.84.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92D4720 /* 169.45.71.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92D5780 /* 169.45.87.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92DA9C0 /* 169.45.169.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92DB660 /* 169.45.182.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92DD240 /* 169.45.210.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92DD6E0 /* 169.45.214.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92DDBE0 /* 169.45.219.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92DEDC0 /* 169.45.237.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92DEE20 /* 169.45.238.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92DF2C0 /* 169.45.242.192/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92DF8A0 /* 169.45.248.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92DF860 /* 169.45.248.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92D4720 /* 169.45.71.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92D4760 /* 169.45.71.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92D5780 /* 169.45.87.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92E6F90 /* 169.46.111.144/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92E34E0 /* 169.46.52.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F8260 /* 169.47.130.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F9100 /* 169.47.145.0/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F9980 /* 169.47.153.128/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92FC0C0 /* 169.47.192.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92FC280 /* 169.47.194.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92FC680 /* 169.47.198.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92FD4A0 /* 169.47.212.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F2180 /* 169.47.33.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92DF8A0 /* 169.45.248.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92F05C0 /* 169.47.5.192/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92F0640 /* 169.47.6.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92F2320 /* 169.47.35.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F2580 /* 169.47.37.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92F2880 /* 169.47.40.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92F2A60 /* 169.47.42.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92F2AA0 /* 169.47.42.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92F2AC0 /* 169.47.42.192/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F2A60 /* 169.47.42.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F2FA0 /* 169.47.47.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F05C0 /* 169.47.5.192/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA92F0640 /* 169.47.6.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA9307220 /* 169.48.114.32/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93079C0 /* 169.48.121.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA9307A40 /* 169.48.122.64/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA930D2B0 /* 169.48.210.176/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0xA930D2E0 /* 169.48.210.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA930D340 /* 169.48.211.64/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA930D480 /* 169.48.212.128/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, - { 0xA935FA80 /* 169.53.250.128/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA935FC40 /* 169.53.252.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA935FF40 /* 169.53.255.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA9351D80 /* 169.53.29.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA9353020 /* 169.53.48.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92F8260 /* 169.47.130.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92F9980 /* 169.47.153.128/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92FC680 /* 169.47.198.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA92FD4A0 /* 169.47.212.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA93547E0 /* 169.53.71.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA9355140 /* 169.53.81.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA936C1A0 /* 169.54.193.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93602A0 /* 169.54.2.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA936D200 /* 169.54.210.0/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA936DE80 /* 169.54.222.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA9362CE0 /* 169.54.44.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA9363320 /* 169.54.51.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA93637C0 /* 169.54.55.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93764A0 /* 169.55.100.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA9377E40 /* 169.55.126.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA937D260 /* 169.55.210.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA937EBA0 /* 169.55.235.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, + { 0xA936DE80 /* 169.54.222.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA9373C94 /* 169.55.60.148/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0xA9373CAA /* 169.55.60.170/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0xA93743E0 /* 169.55.67.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA9374580 /* 169.55.69.128/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, + { 0xA93745A0 /* 169.55.69.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA9374A20 /* 169.55.74.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA9374B60 /* 169.55.75.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93C8180 /* 169.60.129.128/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93C9300 /* 169.60.147.0/24 */, 24, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93CC540 /* 169.60.197.64/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93C4A70 /* 169.60.74.112/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93C4A80 /* 169.60.74.128/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93C4A20 /* 169.60.74.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA93C4B80 /* 169.60.75.128/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, { 0xA93C4F00 /* 169.60.79.0/24 */, 24, NDPI_PROTOCOL_WHATSAPP }, + { 0xA93C9300 /* 169.60.147.0/24 */, 24, NDPI_PROTOCOL_WHATSAPP }, { 0xA93D6500 /* 169.61.101.0/24 */, 24, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93D5190 /* 169.61.81.144/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93D51E0 /* 169.61.81.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93D5240 /* 169.61.82.64/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, - { 0xA93D5480 /* 169.61.84.128/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, + { 0xA93E9F10 /* 169.62.159.16/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, { 0xA93F4080 /* 169.63.64.128/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, { 0xA93F4920 /* 169.63.73.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA93F4940 /* 169.63.73.64/26 */, 26, NDPI_PROTOCOL_WHATSAPP }, { 0xA93F4C00 /* 169.63.76.0/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, { 0xADC0A220 /* 173.192.162.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xADC0DB80 /* 173.192.219.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xADC0DEA0 /* 173.192.222.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xADC1E680 /* 173.193.230.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xADC1E6C0 /* 173.193.230.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xADC1EF00 /* 173.193.239.0/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xAE24D080 /* 174.36.208.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xAE24D220 /* 174.36.210.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xAE24FBC0 /* 174.36.251.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xAE25F340 /* 174.37.243.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xAE25FB00 /* 174.37.251.0/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xB33CC030 /* 179.60.192.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0xB33CC031 /* 179.60.192.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0xB33CC033 /* 179.60.192.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0xB33CC134 /* 179.60.193.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, @@ -250,7 +270,6 @@ static ndpi_network host_protocol_list[] = { { 0xB8AD9320 /* 184.173.147.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xB8ADA140 /* 184.173.161.64/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0xB8ADAD74 /* 184.173.173.116/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0xB8ADB320 /* 184.173.179.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xB93CD835 /* 185.60.216.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0xB93CD836 /* 185.60.216.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, { 0xB93CD935 /* 185.60.217.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, @@ -264,101 +283,6 @@ static ndpi_network host_protocol_list[] = { { 0xC60BFB20 /* 198.11.251.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xC6175000 /* 198.23.80.0/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xD02B73C0 /* 208.43.115.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0xD02B754F /* 208.43.117.79/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0xD02B7A80 /* 208.43.122.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4033 /* 31.13.64.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4035 /* 31.13.64.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4131 /* 31.13.65.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4132 /* 31.13.65.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4334 /* 31.13.67.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4430 /* 31.13.68.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4434 /* 31.13.68.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D45F0 /* 31.13.69.240/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4631 /* 31.13.70.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4632 /* 31.13.70.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4731 /* 31.13.71.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4732 /* 31.13.71.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4830 /* 31.13.72.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4834 /* 31.13.72.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4934 /* 31.13.73.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4A34 /* 31.13.74.52/31 */, 31, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4B30 /* 31.13.75.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4B34 /* 31.13.75.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4C51 /* 31.13.76.81/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4C52 /* 31.13.76.82/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4E35 /* 31.13.78.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4E37 /* 31.13.78.55/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5030 /* 31.13.80.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5035 /* 31.13.80.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5130 /* 31.13.81.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5135 /* 31.13.81.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5233 /* 31.13.82.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5237 /* 31.13.82.55/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5331 /* 31.13.83.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5333 /* 31.13.83.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5431 /* 31.13.84.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5433 /* 31.13.84.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5531 /* 31.13.85.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5533 /* 31.13.85.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5631 /* 31.13.86.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5633 /* 31.13.86.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5730 /* 31.13.87.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5733 /* 31.13.87.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5831 /* 31.13.88.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5834 /* 31.13.88.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5935 /* 31.13.89.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5936 /* 31.13.89.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5A31 /* 31.13.90.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5A33 /* 31.13.90.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5B31 /* 31.13.91.49/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5B33 /* 31.13.91.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5C30 /* 31.13.92.48/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5C34 /* 31.13.92.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5D35 /* 31.13.93.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5D36 /* 31.13.93.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5E34 /* 31.13.94.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5E36 /* 31.13.94.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5F32 /* 31.13.95.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D5F3F /* 31.13.95.63/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x3216C6CC /* 50.22.198.204/30 */, 30, NDPI_PROTOCOL_WHATSAPP }, - { 0x3216D280 /* 50.22.210.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x3216D220 /* 50.22.210.32/30 */, 30, NDPI_PROTOCOL_WHATSAPP }, - { 0x3216E140 /* 50.22.225.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x3216EBF8 /* 50.22.235.248/30 */, 30, NDPI_PROTOCOL_WHATSAPP }, - { 0x3216F0A0 /* 50.22.240.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x32175A80 /* 50.23.90.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x32613980 /* 50.97.57.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x4B7E0C70 /* 75.126.12.112/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0x4B7E7B40 /* 75.126.123.64/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0x4B7E8AA0 /* 75.126.138.160/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0x4B7E8D50 /* 75.126.141.80/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0x4B7E1430 /* 75.126.20.48/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0x4B7E2720 /* 75.126.39.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, - { 0x4B7E51C0 /* 75.126.81.192/28 */, 28, NDPI_PROTOCOL_WHATSAPP }, - { 0x66846036 /* 102.132.96.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x66846136 /* 102.132.97.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00D36 /* 157.240.13.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00E34 /* 157.240.14.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01034 /* 157.240.16.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01234 /* 157.240.18.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF0C034 /* 157.240.192.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF0C132 /* 157.240.193.50/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF0C236 /* 157.240.194.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01434 /* 157.240.20.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01533 /* 157.240.21.51/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01534 /* 157.240.21.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01836 /* 157.240.24.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01936 /* 157.240.25.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01A36 /* 157.240.26.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01B36 /* 157.240.27.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF00336 /* 157.240.3.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x9DF01E36 /* 157.240.30.54/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0xB33CC134 /* 179.60.193.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4238 /* 31.13.66.56/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4334 /* 31.13.67.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4934 /* 31.13.73.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4A34 /* 31.13.74.52/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, - { 0x1F0D4F35 /* 31.13.79.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP }, /* Files */ { 0xB93CD835 /* 185.60.216.53/32 */, 32, NDPI_PROTOCOL_WHATSAPP_FILES }, @@ -9069,13 +8993,18 @@ static ndpi_protocol_match host_match[] = { /* ******************************************************************** */ +/* + IMPORTANT + + Do NOT pur here strings that overlap with string in host_match[] + specified above +*/ static ndpi_category_match category_match[] = { { ".edgecastcdn.net", "egdecastcdn" TLD, NDPI_PROTOCOL_CATEGORY_MEDIA }, { ".hwcdn.net", "hwcdn" TLD, NDPI_PROTOCOL_CATEGORY_MEDIA }, { ".llnwd.net", "llnwd" TLD, NDPI_PROTOCOL_CATEGORY_MEDIA }, { ".llns.net", "llns" TLD, NDPI_PROTOCOL_CATEGORY_MEDIA }, - { ".fastly.net", "fastly" TLD, NDPI_PROTOCOL_CATEGORY_MEDIA }, - { ".akamaiedge.net", "akamaiedge" TLD, NDPI_PROTOCOL_CATEGORY_MEDIA }, + { ".fastly.net", "fastly" TLD, NDPI_PROTOCOL_CATEGORY_MEDIA }, { ".vultr.com", "vultr" TLD, NDPI_PROTOCOL_CATEGORY_CLOUD }, { "baidu.com", "baidu" TLD, NDPI_PROTOCOL_CATEGORY_WEB }, { "icq.com", "icq" TLD, NDPI_PROTOCOL_CATEGORY_CHAT }, @@ -9090,7 +9019,10 @@ static ndpi_category_match category_match[] = { { ".playercdn.net", "\\.playercdn" TLD, NDPI_PROTOCOL_CATEGORY_STREAMING }, { "showmax.com", "showmax" TLD, NDPI_PROTOCOL_CATEGORY_STREAMING }, { "showmax.akamaized.net", "showmax\\.akamaized" TLD, NDPI_PROTOCOL_CATEGORY_STREAMING }, - + { "skyq.sky.com", "skyq\\.sky\\.com" TLD, NDPI_PROTOCOL_CATEGORY_STREAMING }, + { "iptv.sky.", "iptv\\.sky\\." TLD, NDPI_PROTOCOL_CATEGORY_STREAMING }, + { "pcdn.skycdn.", "pcdn\\.skycdn\\." TLD, NDPI_PROTOCOL_CATEGORY_STREAMING }, + /* Hulu Streaming services AS23286 */ { "8.28.124.0/24", NULL, NDPI_PROTOCOL_CATEGORY_STREAMING }, { "8.28.125.0/24", NULL, NDPI_PROTOCOL_CATEGORY_STREAMING }, diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 572c2a736..85e3c0fbd 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1757,16 +1757,16 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp no_master, "DNP3", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 20000, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_104, + ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IEC60870, 1 /* no subprotocol */, no_master, - no_master, "104", NDPI_PROTOCOL_CATEGORY_NETWORK, /* Perhaps IoT in the future */ + no_master, "IEC60870", NDPI_PROTOCOL_CATEGORY_NETWORK, /* Perhaps IoT in the future */ ndpi_build_default_ports(ports_a, 2404, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_BLOOMBERG, 1 /* no subprotocol */, no_master, no_master, "Bloomberg", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, - ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_CAPWAP, 1 /* no subprotocol */, no_master, no_master, "CAPWAP", NDPI_PROTOCOL_CATEGORY_NETWORK, @@ -1950,7 +1950,7 @@ static patricia_node_t* add_to_ptree(patricia_tree_t *tree, int family, /* ******************************************* */ /* - Load a file containing IPv4 addresses in CIDR format as 'protocol_id' + Load a file containing IPv4 addresses in CIDR format as 'protocol_id' Return: the number of entries loaded or -1 in case of error */ @@ -1960,7 +1960,7 @@ int ndpi_load_ipv4_ptree(struct ndpi_detection_module_struct *ndpi_str, FILE *fd; int len; u_int num_loaded = 0; - + fd = fopen(path, "r"); if(fd == NULL) { @@ -1985,9 +1985,9 @@ int ndpi_load_ipv4_ptree(struct ndpi_detection_module_struct *ndpi_str, if(addr) { struct in_addr pin; patricia_node_t *node; - + cidr = strtok_r(NULL, "\n", &saveptr); - + pin.s_addr = inet_addr(addr); if((node = add_to_ptree(ndpi_str->protocols_ptree, AF_INET, &pin, cidr ? atoi(cidr) : 32 /* bits */)) != NULL) @@ -2013,7 +2013,7 @@ static void ndpi_init_ptree_ipv4(struct ndpi_detection_module_struct *ndpi_str, if(skip_tor_hosts && (host_list[i].value == NDPI_PROTOCOL_TOR)) continue; - + pin.s_addr = htonl(host_list[i].network); if((node = add_to_ptree(ptree, AF_INET, &pin, host_list[i].cidr /* bits */)) != NULL) @@ -2307,7 +2307,7 @@ void ndpi_finalize_initalization(struct ndpi_detection_module_struct *ndpi_str) automa = &ndpi_str->impossible_bigrams_automa; break; } - + ac_automata_finalize((AC_AUTOMATA_t*)automa->ac_automa); automa->ac_automa_finalized = 1; } @@ -3509,7 +3509,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main_init.c" #endif - + /* ----------------------------------------------------------------- */ ndpi_str->callback_buffer_size = a; @@ -4055,22 +4055,24 @@ void check_ndpi_udp_flow_func(struct ndpi_detection_module_struct *ndpi_str, func = ndpi_str->proto_defaults[flow->guessed_protocol_id].func; } - for(a = 0; a < ndpi_str->callback_buffer_size_udp; a++) { - if((func != ndpi_str->callback_buffer_udp[a].func) - && (ndpi_str->callback_buffer_udp[a].ndpi_selection_bitmask & *ndpi_selection_packet) == - ndpi_str->callback_buffer_udp[a].ndpi_selection_bitmask - && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, - ndpi_str->callback_buffer_udp[a].excluded_protocol_bitmask) == 0 - && NDPI_BITMASK_COMPARE(ndpi_str->callback_buffer_udp[a].detection_bitmask, - detection_bitmask) != 0) { - ndpi_str->callback_buffer_udp[a].func(ndpi_str, flow); - - // NDPI_LOG_DBG(ndpi_str, "[UDP,CALL] dissector of protocol as callback_buffer idx = %d\n",a); - if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) - break; /* Stop after detecting the first protocol */ - } else - if(_ndpi_debug_callbacks) NDPI_LOG_DBG2(ndpi_str, - "[UDP,SKIP] dissector of protocol as callback_buffer idx = %d\n",a); + if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { + for(a = 0; a < ndpi_str->callback_buffer_size_udp; a++) { + if((func != ndpi_str->callback_buffer_udp[a].func) + && (ndpi_str->callback_buffer_udp[a].ndpi_selection_bitmask & *ndpi_selection_packet) == + ndpi_str->callback_buffer_udp[a].ndpi_selection_bitmask + && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, + ndpi_str->callback_buffer_udp[a].excluded_protocol_bitmask) == 0 + && NDPI_BITMASK_COMPARE(ndpi_str->callback_buffer_udp[a].detection_bitmask, + detection_bitmask) != 0) { + ndpi_str->callback_buffer_udp[a].func(ndpi_str, flow); + + // NDPI_LOG_DBG(ndpi_str, "[UDP,CALL] dissector of protocol as callback_buffer idx = %d\n",a); + if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) + break; /* Stop after detecting the first protocol */ + } else + if(_ndpi_debug_callbacks) NDPI_LOG_DBG2(ndpi_str, + "[UDP,SKIP] dissector of protocol as callback_buffer idx = %d\n",a); + } } } @@ -4191,7 +4193,7 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st ndpi_protocol ret = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_CATEGORY_UNSPECIFIED }; *protocol_was_guessed = 0; - + if(flow == NULL) return(ret); @@ -4205,7 +4207,8 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st /* TODO: add the remaining stage_XXXX protocols */ if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { - u_int16_t guessed_protocol_id, guessed_host_protocol_id; + u_int16_t guessed_protocol_id = NDPI_PROTOCOL_UNKNOWN, + guessed_host_protocol_id = NDPI_PROTOCOL_UNKNOWN; if(flow->guessed_protocol_id == NDPI_PROTOCOL_STUN) goto check_stun_export; @@ -4249,6 +4252,8 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st if(flow->host_server_name[0] != '\0') { ndpi_protocol_match_result ret_match; + memset(&ret_match, 0, sizeof(ret_match)); + ndpi_match_host_subprotocol(ndpi_str, flow, (char *)flow->host_server_name, strlen((const char*)flow->host_server_name), @@ -4297,10 +4302,10 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st ret.app_protocol = NDPI_PROTOCOL_HANGOUT_DUO; } } - + if(ret.app_protocol != NDPI_PROTOCOL_UNKNOWN) - ndpi_fill_protocol_category(ndpi_str, flow, &ret); - + ndpi_fill_protocol_category(ndpi_str, flow, &ret); + return(ret); } @@ -4696,8 +4701,8 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct if(flow->check_extra_packets) { ndpi_process_extra_packet(ndpi_str, flow, packet, packetlen, current_tick_l, src, dst); /* Update in case of new match */ - ret.master_protocol = flow->detected_protocol_stack[1], ret.app_protocol = flow->detected_protocol_stack[0]; - return(ret); + ret.master_protocol = flow->detected_protocol_stack[1], ret.app_protocol = flow->detected_protocol_stack[0], ret.category = flow->category;; + goto invalidate_ptr; } else goto ret_protocols; } @@ -4795,7 +4800,7 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct if(flow->packet.iph) { if(flow->guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN) { u_int8_t protocol_was_guessed; - + /* ret.master_protocol = flow->guessed_protocol_id , ret.app_protocol = flow->guessed_host_protocol_id; /\* ****** *\/ */ ret = ndpi_detection_giveup(ndpi_str, flow, 0, &protocol_was_guessed); } @@ -4815,34 +4820,33 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct addr.s_addr = flow->packet.iph->daddr; flow->guessed_host_protocol_id = ndpi_network_ptree_match(ndpi_str, &addr); } + + /* + We could implement a shortcut here skipping dissectors for + protocols we have identified by other means such as with the IP + + However we do NOT stop here and skip invoking the dissectors + because we want to dissect the flow (e.g. dissect the TLS) + and extract metadata. + */ +#if SKIP_INVOKING_THE_DISSECTORS + if(flow->guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN) { + /* + We have identified a protocol using the IP address so + it is not worth to dissect the traffic as we already have + the solution + */ + ret.master_protocol = flow->guessed_protocol_id, + ret.app_protocol = flow->guessed_host_protocol_id; + } +#endif } } } if(flow->guessed_host_protocol_id > NDPI_MAX_SUPPORTED_PROTOCOLS) { /* This is a custom protocol and it has priority over everything else */ - ret.master_protocol = NDPI_PROTOCOL_UNKNOWN, ret.app_protocol = flow->guessed_host_protocol_id; - - if(flow->packet.tcp && (ret.master_protocol == NDPI_PROTOCOL_UNKNOWN)) { - /* Minimal guess for HTTP/SSL-based protocols */ - int i; - - for(i=0; i<2; i++) { - u_int16_t port = (i == 0) ? ntohs(flow->packet.tcp->dest) : ntohs(flow->packet.tcp->source); - - switch(port) { - case 80: - ret.master_protocol = NDPI_PROTOCOL_HTTP; - break; - case 443: - ret.master_protocol = NDPI_PROTOCOL_TLS; /* QUIC could also match */ - break; - } - - if(ret.master_protocol != NDPI_PROTOCOL_UNKNOWN) - break; - } - } + ret.master_protocol = flow->guessed_protocol_id, ret.app_protocol = flow->guessed_host_protocol_id; ndpi_check_flow_func(ndpi_str, flow, &ndpi_selection_packet); ndpi_fill_protocol_category(ndpi_str, flow, &ret); @@ -4878,7 +4882,8 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct ret.app_protocol = flow->detected_protocol_stack[0]; /* Don't overwrite the category if already set */ - if(flow->category == NDPI_PROTOCOL_CATEGORY_UNSPECIFIED) + if((flow->category == NDPI_PROTOCOL_CATEGORY_UNSPECIFIED) + && (ret.app_protocol != NDPI_PROTOCOL_UNKNOWN)) ndpi_fill_protocol_category(ndpi_str, flow, &ret); else ret.category = flow->category; @@ -4891,7 +4896,7 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct && (flow->guessed_protocol_id == 0) ) { u_int8_t protocol_was_guessed; - + /* This is a TCP flow - whose first packet is NOT a SYN @@ -4903,6 +4908,13 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct ret = ndpi_detection_giveup(ndpi_str, flow, 0, &protocol_was_guessed); } + if((ret.master_protocol == NDPI_PROTOCOL_UNKNOWN) + && (ret.app_protocol != NDPI_PROTOCOL_UNKNOWN) + && (flow->guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN)) { + ret.master_protocol = ret.app_protocol; + ret.app_protocol = flow->guessed_host_protocol_id; + } + invalidate_ptr: /* Invalidate packet memory to avoid accessing the pointers below @@ -5086,7 +5098,7 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str, for(a = 0; (a < packet->payload_packet_len) && (packet->parsed_lines < NDPI_MAX_PARSE_LINES_PER_PACKET); a++) { - if((a + 1) == packet->payload_packet_len) + if((a + 1) >= packet->payload_packet_len) return; /* Return if only one byte remains (prevent invalid reads past end-of-buffer) */ if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) { /* If end of line char sequence CR+NL "\r\n", process line */ @@ -5167,7 +5179,7 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str, while((packet->content_line.len > 0) && (packet->content_line.ptr[0] == ' ')) packet->content_line.len--, packet->content_line.ptr++; - + packet->http_num_headers++; } /* "Content-Type:" header line in HTTP AGAIN. Probably a bogus response without space after ":" */ @@ -5184,14 +5196,14 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str, char separator[] = { ';', '\r', '\0' }; int i; - for(i=0; separator[i] != '\0'; i++) { + for(i=0; separator[i] != '\0'; i++) { char *c = memchr((char*)packet->content_line.ptr, separator[i], packet->content_line.len); - + if(c != NULL) packet->content_line.len = c - (char*)packet->content_line.ptr; } } - + /* "Accept:" header line in HTTP request. */ if(packet->line[packet->parsed_lines].len > 8 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Accept: ", 8) == 0) { @@ -6200,7 +6212,7 @@ static u_int8_t ndpi_is_more_generic_protocol(u_int16_t previous_proto, u_int16_ if((previous_proto == NDPI_PROTOCOL_UNKNOWN) || (previous_proto == new_proto)) return(0); - + switch(previous_proto) { case NDPI_PROTOCOL_WHATSAPP_CALL: case NDPI_PROTOCOL_WHATSAPP_FILES: @@ -6304,16 +6316,12 @@ u_int16_t ndpi_match_host_subprotocol(struct ndpi_detection_module_struct *ndpi_ u_int16_t rc = ndpi_automa_match_string_subprotocol(ndpi_str, flow, string_to_match, string_to_match_len, master_protocol_id, ret_match, 1); + unsigned long id = ret_match->protocol_category; - if((flow->category == NDPI_PROTOCOL_CATEGORY_UNSPECIFIED) - && (ret_match->protocol_category == NDPI_PROTOCOL_CATEGORY_UNSPECIFIED)) { - unsigned long id = ret_match->protocol_category; - - if(ndpi_get_custom_category_match(ndpi_str, string_to_match, string_to_match_len, &id) != -1) { - if(id != -1) { - flow->category = ret_match->protocol_category = id; - rc = master_protocol_id; - } + if(ndpi_get_custom_category_match(ndpi_str, string_to_match, string_to_match_len, &id) != -1) { + if(id != -1) { + flow->category = ret_match->protocol_category = id; + rc = master_protocol_id; } } @@ -6365,10 +6373,11 @@ int ndpi_match_bigram(struct ndpi_detection_module_struct *ndpi_str, void ndpi_free_flow(struct ndpi_flow_struct *flow) { if(flow) { - if(flow->http.url) ndpi_free(flow->http.url); - if(flow->http.content_type) ndpi_free(flow->http.content_type); - if(flow->http.user_agent) ndpi_free(flow->http.user_agent); - + if(flow->http.url) ndpi_free(flow->http.url); + if(flow->http.content_type) ndpi_free(flow->http.content_type); + if(flow->http.user_agent) ndpi_free(flow->http.user_agent); + if(flow->kerberos_buf.pktbuf) ndpi_free(flow->kerberos_buf.pktbuf); + if(flow->l4_proto == IPPROTO_TCP) { if(flow->l4.tcp.tls_srv_cert_fingerprint_ctx) ndpi_free(flow->l4.tcp.tls_srv_cert_fingerprint_ctx); @@ -6580,7 +6589,7 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp break; case NDPI_PROTOCOL_TELNET: - if(!flow->protos.telnet.username_detected) + if(!flow->protos.telnet.password_detected) return(1); break; } @@ -6595,15 +6604,15 @@ const char* ndpi_get_l4_proto_name(ndpi_l4_proto_info proto) { case ndpi_l4_proto_unknown: return(""); break; - + case ndpi_l4_proto_tcp_only: return("TCP"); break; - + case ndpi_l4_proto_udp_only: return("UDP"); break; - + case ndpi_l4_proto_tcp_and_udp: return("TCP/UDP"); break; @@ -6615,7 +6624,7 @@ const char* ndpi_get_l4_proto_name(ndpi_l4_proto_info proto) { /* ******************************************************************** */ ndpi_l4_proto_info ndpi_get_l4_proto_info(struct ndpi_detection_module_struct *ndpi_struct, - u_int16_t ndpi_proto_id) { + u_int16_t ndpi_proto_id) { if(ndpi_proto_id < ndpi_struct->ndpi_num_supported_protocols) { u_int16_t idx = ndpi_struct->proto_defaults[ndpi_proto_id].protoIdx; NDPI_SELECTION_BITMASK_PROTOCOL_SIZE bm = ndpi_struct->callback_buffer[idx].ndpi_selection_bitmask; diff --git a/src/lib/ndpi_serializer.c b/src/lib/ndpi_serializer.c index baacfd403..36ff154d2 100644 --- a/src/lib/ndpi_serializer.c +++ b/src/lib/ndpi_serializer.c @@ -200,7 +200,7 @@ char* ndpi_serializer_get_buffer(ndpi_serializer *_serializer, u_int32_t *buffer *buffer_len = serializer->status.size_used; if(serializer->fmt == ndpi_serialization_format_json) { - while(buf[0] == '\0') + while((buf[0] == '\0') || (buf[0] == ' ')) buf++, *buffer_len = *buffer_len - 1; } diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c index 067c9456d..9b0339c3c 100644 --- a/src/lib/ndpi_utils.c +++ b/src/lib/ndpi_utils.c @@ -48,6 +48,10 @@ #include "third_party/include/ndpi_patricia.h" #include "third_party/include/ht_hash.h" +#include "third_party/include/libinjection.h" +#include "third_party/include/libinjection_sqli.h" +#include "third_party/include/libinjection_xss.h" + #define NDPI_CONST_GENERIC_PROTOCOL_NAME "GenericProtocol" // #define MATCH_DEBUG 1 @@ -211,10 +215,11 @@ void ndpi_tdestroy(void *vrootp, void (*freefct)(void *)) u_int8_t ndpi_net_match(u_int32_t ip_to_check, u_int32_t net, - u_int32_t num_bits) -{ + u_int32_t num_bits) { u_int32_t mask = 0; + num_bits &= 0x1F; /* Avoid overflows */ + mask = ~(~mask >> num_bits); return(((ip_to_check & mask) == (net & mask)) ? 1 : 0); @@ -970,6 +975,7 @@ int ndpi_flow2json(struct ndpi_detection_module_struct *ndpi_struct, case NDPI_PROTOCOL_TELNET: ndpi_serialize_start_of_block(serializer, "telnet"); ndpi_serialize_string_string(serializer, "username", flow->protos.telnet.username); + ndpi_serialize_string_string(serializer, "password", flow->protos.telnet.password); ndpi_serialize_end_of_block(serializer); break; @@ -1009,6 +1015,7 @@ int ndpi_flow2json(struct ndpi_detection_module_struct *ndpi_struct, ndpi_serialize_start_of_block(serializer, "ftp"); ndpi_serialize_string_string(serializer, "user", flow->protos.ftp_imap_pop_smtp.username); ndpi_serialize_string_string(serializer, "password", flow->protos.ftp_imap_pop_smtp.password); + ndpi_serialize_string_uint32(serializer, "auth_failed", flow->protos.ftp_imap_pop_smtp.auth_failed); ndpi_serialize_end_of_block(serializer); break; @@ -1135,56 +1142,20 @@ static int ndpi_url_decode(const char *s, char *out) { /* ********************************** */ -/* #define URL_CHECK_DEBUG 1 */ - -static int find_occurrency(char *str, char *what) { - char *found = strstr(str, what); - u_int len; - -#ifdef URL_CHECK_DEBUG - printf("%s() [%s][%s]\n", __FUNCTION__, str, what); -#endif - - if(!found) return(0); - - len = strlen(what); - - if(((found[len] != '\0') || (found[len] != ' ')) - && ((found == str) || (found[-1] == ' '))) - return(1); - else - return(find_occurrency(&found[len], what)); -} - -/* ********************************** */ - -static int ndpi_check_tokens(char* query, char* keywords[]) { -#ifdef URL_CHECK_DEBUG - printf("%s() [%s]\n", __FUNCTION__, query); -#endif - - for(int i=0; keywords[i] != NULL; i++) { - if(find_occurrency(query, keywords[i]) > 0) - return(1); - } - - return(0); -} +static int ndpi_is_sql_injection(char* query) { + struct libinjection_sqli_state state; -/* ********************************** */ + size_t qlen = strlen(query); + libinjection_sqli_init(&state, query, qlen, FLAG_NONE); -static int ndpi_is_sql_injection(char* query) { - char* sql_keywords[] = { "select", "from", "where", "any", "all", "join", "inner", "left", "right", "full", - "table", "alter", "create", "delete", "union", "update", "drop", "group", "order", - "limit", "primary", "column", NULL }; - return(ndpi_check_tokens(query, sql_keywords)); + return libinjection_is_sqli(&state); } /* ********************************** */ static int ndpi_is_xss_injection(char* query) { - char* js_keywords[] = { "<script>", "console.", "log.", NULL }; - return(ndpi_check_tokens(query, js_keywords)); + size_t qlen = strlen(query); + return libinjection_xss(query, qlen); } /* ********************************** */ diff --git a/src/lib/protocols/amazon_video.c b/src/lib/protocols/amazon_video.c index 41356d9ad..e92c87ad5 100644 --- a/src/lib/protocols/amazon_video.c +++ b/src/lib/protocols/amazon_video.c @@ -1,7 +1,7 @@ /* * amazon_video.c * - * Copyright (C) 2018 by ntop.org + * Copyright (C) 2018-19 by ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH @@ -28,37 +28,36 @@ #include "ndpi_api.h" static void ndpi_check_amazon_video(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) { - + struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG_DBG(ndpi_struct, "search Amazon Prime\n"); - if((packet->tcp != NULL) && - (packet->payload[0] == 0xFE && - packet->payload[1] == 0xED && - packet->payload[2] == 0xFA && - packet->payload[3] == 0xCE)) - { + if(packet->payload_packet_len > 4) { + if((packet->tcp != NULL) && + (packet->payload[0] == 0xFE && + packet->payload[1] == 0xED && + packet->payload[2] == 0xFA && + packet->payload[3] == 0xCE)) { NDPI_LOG_INFO(ndpi_struct, "found Amazon Video on TCP\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AMAZON_VIDEO, NDPI_PROTOCOL_UNKNOWN); return; - } - else if((packet->udp != NULL) && - (packet->payload[0] == 0xDE && - packet->payload[1] == 0xAD && - packet->payload[2] == 0xBE && - packet->payload[3] == 0xEF)) - { + } else if((packet->udp != NULL) && + (packet->payload[0] == 0xDE && + packet->payload[1] == 0xAD && + packet->payload[2] == 0xBE && + packet->payload[3] == 0xEF)) { NDPI_LOG_INFO(ndpi_struct, "found Amazon Video on UDP\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AMAZON_VIDEO, NDPI_PROTOCOL_UNKNOWN); - } else { - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } } + + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); } -void ndpi_search_amazon_video(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ +void ndpi_search_amazon_video(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG_DBG(ndpi_struct, "search amazon_video\n"); @@ -69,8 +68,8 @@ void ndpi_search_amazon_video(struct ndpi_detection_module_struct *ndpi_struct, } -void init_amazon_video_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) -{ +void init_amazon_video_dissector(struct ndpi_detection_module_struct *ndpi_struct, + u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("AMAZON_VIDEO", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_AMAZON_VIDEO, ndpi_search_amazon_video, diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c index 7051b2227..3fbb39915 100644 --- a/src/lib/protocols/dns.c +++ b/src/lib/protocols/dns.c @@ -47,7 +47,9 @@ static u_int16_t get16(int *i, const u_int8_t *payload) { /* *********************************************** */ static u_int getNameLength(u_int i, const u_int8_t *payload, u_int payloadLen) { - if(payload[i] == 0x00) + if(i >= payloadLen) + return(0); + else if(payload[i] == 0x00) return(1); else if(payload[i] == 0xC0) return(2); diff --git a/src/lib/protocols/ftp_control.c b/src/lib/protocols/ftp_control.c index 135096743..2fbbece28 100644 --- a/src/lib/protocols/ftp_control.c +++ b/src/lib/protocols/ftp_control.c @@ -553,411 +553,21 @@ static int ndpi_ftp_control_check_response(struct ndpi_flow_struct *flow, printf("%s() [%s]\n", __FUNCTION__, payload); #endif - if(ndpi_match_strprefix(payload, payload_len, "110-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "120-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "125-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "150-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "202-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "211-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "212-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "213-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "214-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "215-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "220-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "221-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "225-")) { - return 1; - } + if(payload_len == 0) return(1); - if(ndpi_match_strprefix(payload, payload_len, "226-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "227-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "228-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "229-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "230-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "231-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "232-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "250-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "257-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "331-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "332-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "350-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "421-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "425-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "426-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "430-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "434-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "450-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "451-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "452-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "501-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "502-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "503-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "504-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "530-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "532-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "550-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "551-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "552-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "553-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "631-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "632-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "633-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10054-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10060-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10061-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10066-")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10068-")) { - return 1; - } + switch(payload[0]) { + case '1': + case '2': + case '3': + case '6': + return(1); + break; - if(ndpi_match_strprefix(payload, payload_len, "110 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "120 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "125 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "150 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "202 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "211 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "212 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "213 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "214 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "215 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "220 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "221 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "225 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "226 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "227 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "228 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "229 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "230 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "231 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "232 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "250 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "257 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "331 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "332 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "350 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "421 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "425 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "426 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "430 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "434 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "450 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "451 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "452 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "501 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "502 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "503 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "504 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "530 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "532 ")) { - return 1; - } - if(ndpi_match_strprefix(payload, payload_len, "550 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "551 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "552 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "553 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "631 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "632 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "633 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10054 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10060 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10061 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10066 ")) { - return 1; - } - - if(ndpi_match_strprefix(payload, payload_len, "10068 ")) { - return 1; + case '4': + case '5': + flow->protos.ftp_imap_pop_smtp.auth_failed = 1; + return(1); + break; } return 0; @@ -972,8 +582,10 @@ static void ndpi_check_ftp_control(struct ndpi_detection_module_struct *ndpi_str /* Check connection over TCP */ if(packet->tcp) { + u_int16_t twentyfive = htons(25); + /* Exclude SMTP, which uses similar commands. */ - if(packet->tcp->dest == htons(25) || packet->tcp->source == htons(25)) { + if(packet->tcp->dest == twentyfive || packet->tcp->source == twentyfive) { NDPI_EXCLUDE_PROTO(ndpi_struct, flow); return; } @@ -988,8 +600,7 @@ static void ndpi_check_ftp_control(struct ndpi_detection_module_struct *ndpi_str if(flow->ftp_control_stage == 0) { NDPI_LOG_DBG2(ndpi_struct, "FTP_CONTROL stage 0: \n"); - if((payload_len > 0) - && ndpi_ftp_control_check_request(flow, packet->payload, payload_len)) { + if((payload_len > 0) && ndpi_ftp_control_check_request(flow, packet->payload, payload_len)) { NDPI_LOG_DBG2(ndpi_struct, "Possible FTP_CONTROL request detected, we will look further for the response..\n"); @@ -1011,8 +622,7 @@ static void ndpi_check_ftp_control(struct ndpi_detection_module_struct *ndpi_str } /* This is a packet in another direction. Check if we find the proper response. */ - if((payload_len > 0) - && ndpi_ftp_control_check_response(flow, packet->payload, payload_len)) { + if((payload_len > 0) && ndpi_ftp_control_check_response(flow, packet->payload, payload_len)) { NDPI_LOG_INFO(ndpi_struct, "found FTP_CONTROL\n"); #ifdef FTP_DEBUG diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index 2525cfbd7..70ca0c389 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -33,7 +33,8 @@ static void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struc /* *********************************************** */ -static int ndpi_search_http_tcp_again(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { +static int ndpi_search_http_tcp_again(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) { ndpi_search_http_tcp(ndpi_struct, flow); #ifdef HTTP_DEBUG @@ -52,9 +53,46 @@ static int ndpi_search_http_tcp_again(struct ndpi_detection_module_struct *ndpi_ /* *********************************************** */ +/* https://www.freeformatter.com/mime-types-list.html */ +static ndpi_protocol_category_t ndpi_http_check_content(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) { + struct ndpi_packet_struct *packet = &flow->packet; + + if(packet->content_line.len > 0) { + u_int app_len = sizeof("application"); + + if(packet->content_line.len > app_len) { + if(ndpi_strncasestr((const char *)&packet->content_line.ptr[app_len], "mpeg", + packet->content_line.len-app_len) != NULL) { + flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_STREAMING; + return(flow->category); + } + } + + switch(packet->content_line.ptr[0]) { + case 'a': + if(strncasecmp((const char *)packet->content_line.ptr, "audio", + ndpi_min(packet->content_line.len, 5)) == 0) + flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_MEDIA; + break; + + case 'v': + if(strncasecmp((const char *)packet->content_line.ptr, "video", + ndpi_min(packet->content_line.len, 5)) == 0) + flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_MEDIA; + break; + } + } + + return(flow->category); +} + +/* *********************************************** */ + static void ndpi_int_http_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, - u_int16_t category) { + u_int16_t http_protocol, + ndpi_protocol_category_t category) { #ifdef HTTP_DEBUG printf("=> %s()\n", __FUNCTION__); #endif @@ -66,30 +104,36 @@ static void ndpi_int_http_add_connection(struct ndpi_detection_module_struct *nd ndpi_search_tcp_or_udp(ndpi_struct, flow); /* If no custom protocol has been detected */ - if(flow->guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN) { - ndpi_int_reset_protocol(flow); - ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id, NDPI_PROTOCOL_HTTP); - } else - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_UNKNOWN); + if((flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) || (http_protocol != NDPI_PROTOCOL_HTTP)) + flow->guessed_host_protocol_id = http_protocol; + + category = ndpi_http_check_content(ndpi_struct, flow); + ndpi_int_reset_protocol(flow); + ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id, NDPI_PROTOCOL_HTTP); /* This is necessary to inform the core to call this dissector again */ flow->check_extra_packets = 1; flow->max_extra_packets_to_check = 5; flow->extra_packets_func = ndpi_search_http_tcp_again; - flow->http_detected = 1, flow->guessed_category = category; + flow->http_detected = 1, flow->guessed_category = flow->category = category; } +/* ************************************************************* */ + static void rtsp_parse_packet_acceptline(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; - if(packet->accept_line.len >= 28 && memcmp(packet->accept_line.ptr, "application/x-rtsp-tunnelled", 28) == 0) { + if((packet->accept_line.len >= 28) + && (memcmp(packet->accept_line.ptr, "application/x-rtsp-tunnelled", 28) == 0)) { NDPI_LOG_INFO(ndpi_struct, "found RTSP accept line\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_RTSP); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_RTSP, NDPI_PROTOCOL_CATEGORY_MEDIA); } } +/* ************************************************************* */ + static void setHttpUserAgent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *ua) { if ( !strcmp(ua, "Windows NT 5.0")) ua = "Windows 2000"; @@ -110,7 +154,10 @@ static void setHttpUserAgent(struct ndpi_detection_module_struct *ndpi_struct, } } -static void parseHttpSubprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { +/* ************************************************************* */ + +static void ndpi_http_parse_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) { if((flow->l4.tcp.http_stage == 0) || (flow->http.url && flow->http_detected)) { char *double_col = strchr((char*)flow->host_server_name, ':'); ndpi_protocol_match_result ret_match; @@ -124,13 +171,14 @@ static void parseHttpSubprotocol(struct ndpi_detection_module_struct *ndpi_struc } } +/* ************************************************************* */ + /** NOTE ndpi_parse_packet_line_info is in ndpi_main.c */ static void check_content_type_and_change_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { - struct ndpi_packet_struct *packet = &flow->packet; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_UNKNOWN); @@ -142,13 +190,12 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ /* PPStream */ if(flow->l4.tcp.ppstream_stage > 0 && flow->iqiyi_counter == 0) { NDPI_LOG_INFO(ndpi_struct, "found PPStream\n"); - /* ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_PPSTREAM); */ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_HTTP); - } - else if(flow->iqiyi_counter > 0) { + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PPSTREAM, + NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_CATEGORY_STREAMING); + } else if(flow->iqiyi_counter > 0) { NDPI_LOG_INFO(ndpi_struct, "found iQiyi\n"); - /* ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_IQIYI); */ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_HTTP); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IQIYI, + NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_CATEGORY_STREAMING); } #endif @@ -156,8 +203,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ /* 1KXUN */ if(flow->kxun_counter > 0) { NDPI_LOG_INFO(ndpi_struct, "found 1kxun\n"); - /* ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_1KXUN); */ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_1KXUN, NDPI_PROTOCOL_HTTP); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_1KXUN, NDPI_PROTOCOL_CATEGORY_STREAMING); } #endif @@ -257,10 +303,9 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ setHttpUserAgent(ndpi_struct, flow, token); } } - } - else if(memcmp(ua, "netflix-ios-app", 15) == 0) { + } else if(memcmp(ua, "netflix-ios-app", 15) == 0) { NDPI_LOG_INFO(ndpi_struct, "found netflix\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_NETFLIX); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_NETFLIX, NDPI_PROTOCOL_CATEGORY_STREAMING); return; } } @@ -287,17 +332,6 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ NDPI_LOG_DBG2(ndpi_struct, "HOST line found %.*s\n", packet->host_line.len, packet->host_line.ptr); - /* call ndpi_match_host_subprotocol to see if there is a match with known-host HTTP subprotocol */ - if(flow->http_detected) { - ndpi_protocol_match_result ret_match; - - ndpi_match_host_subprotocol(ndpi_struct, flow, - (char*)packet->host_line.ptr, - packet->host_line.len, - &ret_match, - NDPI_PROTOCOL_HTTP); - } - /* Copy result for nDPI apps */ if(!ndpi_struct->disable_metadata_export) { len = ndpi_min(packet->host_line.len, sizeof(flow->host_server_name)-1); @@ -316,7 +350,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ } } - parseHttpSubprotocol(ndpi_struct, flow); + ndpi_http_parse_subprotocol(ndpi_struct, flow); /** check result of host subprotocol detection @@ -355,7 +389,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_HTTP) { NDPI_LOG_INFO(ndpi_struct, "found HTTP/%s\n", ndpi_get_proto_name(ndpi_struct, packet->detected_protocol_stack[0])); - ndpi_int_http_add_connection(ndpi_struct, flow, packet->detected_protocol_stack[0]); + ndpi_int_http_add_connection(ndpi_struct, flow, packet->detected_protocol_stack[0], NDPI_PROTOCOL_CATEGORY_WEB); return; /* We have identified a sub-protocol so we're done */ } } @@ -363,7 +397,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ #if 0 if(flow->http_detected) - parseHttpSubprotocol(ndpi_struct, flow); + ndpi_http_parse_subprotocol(ndpi_struct, flow); #endif if(flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN) @@ -385,7 +419,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ if((flow->http.content_type == NULL) && (packet->content_line.len > 0)) { int len = packet->content_line.len + 1; - + flow->http.content_type = ndpi_malloc(len); if(flow->http.content_type) { strncpy(flow->http.content_type, (char*)packet->content_line.ptr, @@ -393,7 +427,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ flow->http.content_type[packet->content_line.len] = '\0'; } } - + if(flow->http_detected) { ndpi_protocol_match_result ret_match; @@ -403,13 +437,17 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ } } - ndpi_int_http_add_connection(ndpi_struct, flow, packet->detected_protocol_stack[0]); + ndpi_int_http_add_connection(ndpi_struct, flow, packet->detected_protocol_stack[0], NDPI_PROTOCOL_CATEGORY_WEB); } +/* ************************************************************* */ + static void check_http_payload(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { /* Add here your paylod code check */ } +/* ************************************************************* */ + /** * Functions to check whether the packet begins with a valid http request * @param ndpi_struct @@ -446,7 +484,7 @@ static u_int16_t http_request_url_offset(struct ndpi_detection_module_struct *nd packet->payload_packet_len); /* Check first char */ - if(!strchr(http_fs,packet->payload[0])) return 0; + if(!packet->payload_packet_len || !strchr(http_fs,packet->payload[0])) return 0; /** FIRST PAYLOAD PACKET FROM CLIENT **/ @@ -540,7 +578,7 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct </cross-domain-policy> */ ookla_found: - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_UNKNOWN); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_CATEGORY_WEB); if(ndpi_struct->ookla_cache == NULL) ndpi_struct->ookla_cache = ndpi_lru_cache_init(1024); @@ -604,34 +642,12 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct goto ookla_found; } -#if OBSOLETE - /* Check for additional field introduced by Steam */ - int x = 1; - if(packet->line[x].len >= 11 && (memcmp(packet->line[x].ptr, "x-steam-sid", 11)) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found STEAM\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_STEAM); - check_content_type_and_change_protocol(ndpi_struct, flow); - return; - } - - /* Check for additional field introduced by Facebook */ - x = 1; - while(packet->line[x].len != 0) { - if(packet->line[x].len >= 12 && (memcmp(packet->line[x].ptr, "X-FB-SIM-HNI", 12)) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found FACEBOOK\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_FACEBOOK); - check_content_type_and_change_protocol(ndpi_struct, flow); - return; - } - x++; - } -#endif - #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI) /* check PPStream protocol or iQiyi service (iqiyi is delivered by ppstream) */ // substring in url - if(ndpi_strnstr((const char*) &packet->payload[filename_start], "iqiyi.com", (packet->payload_packet_len - filename_start)) != NULL) { + if(ndpi_strnstr((const char*) &packet->payload[filename_start], "iqiyi.com", + (packet->payload_packet_len - filename_start)) != NULL) { if(flow->kxun_counter == 0) { flow->l4.tcp.ppstream_stage++; flow->iqiyi_counter++; @@ -673,14 +689,14 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct if((packet->http_url_name.len > 7) && (!strncmp((const char*) packet->http_url_name.ptr, "http://", 7))) { NDPI_LOG_INFO(ndpi_struct, "found HTTP_PROXY\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_PROXY); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_PROXY, NDPI_PROTOCOL_CATEGORY_WEB); check_content_type_and_change_protocol(ndpi_struct, flow); } if(filename_start == 8 && (memcmp(packet->payload, "CONNECT ", 8) == 0)) { /* nathan@getoffmalawn.com */ NDPI_LOG_INFO(ndpi_struct, "found HTTP_CONNECT\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_CONNECT); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_CONNECT, NDPI_PROTOCOL_CATEGORY_WEB); check_content_type_and_change_protocol(ndpi_struct, flow); } @@ -695,7 +711,7 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct in 99.99% of the cases is like that. */ - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_CATEGORY_WEB); flow->http_detected = 1; NDPI_LOG_DBG2(ndpi_struct, "HTTP START Found, we will look further for the response...\n"); @@ -723,7 +739,8 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OOKLA); /** - At first check, if this is for sure a response packet (in another direction. If not, if HTTP is detected do nothing now and return, + At first check, if this is for sure a response packet + (in another direction. If not, if HTTP is detected do nothing now and return, otherwise check the second packet for the HTTP request */ if((flow->l4.tcp.http_stage - packet->packet_direction) == 1) { /* Expected a response package */ @@ -757,7 +774,7 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct && memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) == 0) { NDPI_LOG_INFO(ndpi_struct, "found HTTP\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_CATEGORY_WEB); check_content_type_and_change_protocol(ndpi_struct, flow); NDPI_LOG_DBG2(ndpi_struct, @@ -779,7 +796,7 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct if((packet->parsed_lines == 1) && (packet->packet_direction == 1 /* server -> client */)) { /* In Apache if you do "GET /\n\n" the response comes without any header */ NDPI_LOG_INFO(ndpi_struct, "found HTTP. (apache)\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_CATEGORY_WEB); check_content_type_and_change_protocol(ndpi_struct, flow); return; } @@ -787,7 +804,7 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct /* If we already detected the HTTP request, we can add the connection and then check for the sub-protocol */ if(flow->http_detected) { NDPI_LOG_INFO(ndpi_struct, "found HTTP\n"); - ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_CATEGORY_WEB); } /* Parse packet line and we look for the subprotocols */ diff --git a/src/lib/protocols/iec60870-5-104.c b/src/lib/protocols/iec60870-5-104.c index e34ca3d63..040a1842a 100644 --- a/src/lib/protocols/iec60870-5-104.c +++ b/src/lib/protocols/iec60870-5-104.c @@ -27,16 +27,16 @@ #include "ndpi_protocol_ids.h" #include "ndpi_api.h" -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_104 +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_IEC60870 -void ndpi_search_104_tcp(struct ndpi_detection_module_struct *ndpi_struct, +void ndpi_search_iec60870_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; - NDPI_LOG_DBG(ndpi_struct, "search 104\n"); - u_int16_t iec104_port = htons(2404); // port used by 104 + u_int16_t iec104_port = htons(2404); // port used by IEC60870 /* Check connection over TCP */ - + NDPI_LOG_DBG(ndpi_struct, "search IEC60870\n"); + if(packet->tcp) { /* The start byte of 104 is 0x68 * The usual port: 2404 @@ -44,7 +44,7 @@ void ndpi_search_104_tcp(struct ndpi_detection_module_struct *ndpi_struct, if((packet->payload[0] == 0x68) && ((packet->tcp->dest == iec104_port) || (packet->tcp->source == iec104_port)) ){ NDPI_LOG_INFO(ndpi_struct, "found 104\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_104, NDPI_PROTOCOL_UNKNOWN); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IEC60870, NDPI_PROTOCOL_UNKNOWN); return; } } @@ -56,9 +56,9 @@ void ndpi_search_104_tcp(struct ndpi_detection_module_struct *ndpi_struct, void init_104_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { - ndpi_set_bitmask_protocol_detection("104", ndpi_struct, detection_bitmask, *id, - NDPI_PROTOCOL_104, - ndpi_search_104_tcp, + ndpi_set_bitmask_protocol_detection("IEC60870", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_IEC60870, + ndpi_search_iec60870_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); diff --git a/src/lib/protocols/irc.c b/src/lib/protocols/irc.c index ec22ee38b..37cfbe1ed 100644 --- a/src/lib/protocols/irc.c +++ b/src/lib/protocols/irc.c @@ -492,9 +492,10 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc ndpi_parse_packet_line_info(ndpi_struct, flow); } else { flow->l4.tcp.irc_3a_counter++; + packet->parsed_lines = 0; } for (i = 0; i < packet->parsed_lines; i++) { - if (packet->line[i].ptr[0] == ':') { + if ((packet->line[i].len > 0) && packet->line[i].ptr[0] == ':') { flow->l4.tcp.irc_3a_counter++; if (flow->l4.tcp.irc_3a_counter == 7) { /* ':' == 0x3a */ NDPI_LOG_INFO(ndpi_struct, "found irc. 0x3a. seven times."); diff --git a/src/lib/protocols/kerberos.c b/src/lib/protocols/kerberos.c index 533995604..1eb006108 100644 --- a/src/lib/protocols/kerberos.c +++ b/src/lib/protocols/kerberos.c @@ -28,7 +28,9 @@ #include "ndpi_api.h" -/* #define KERBEROS_DEBUG 1 */ +//#define KERBEROS_DEBUG 1 + +#define KERBEROS_PORT 88 static void ndpi_int_kerberos_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { @@ -41,62 +43,198 @@ static void ndpi_int_kerberos_add_connection(struct ndpi_detection_module_struct void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; + u_int16_t sport = packet->tcp ? ntohs(packet->tcp->source) : ntohs(packet->udp->source); + u_int16_t dport = packet->tcp ? ntohs(packet->tcp->dest) : ntohs(packet->udp->dest); + if((sport != KERBEROS_PORT) && (dport != KERBEROS_PORT)) { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + NDPI_LOG_DBG(ndpi_struct, "search KERBEROS\n"); +#ifdef KERBEROS_DEBUG + printf("\n[Kerberos] Process packet [len: %u]\n", packet->payload_packet_len); +#endif + + if(flow->kerberos_buf.pktbuf != NULL) { + u_int missing = flow->kerberos_buf.pktbuf_maxlen - flow->kerberos_buf.pktbuf_currlen; + + if(packet->payload_packet_len <= missing) { + memcpy(&flow->kerberos_buf.pktbuf[flow->kerberos_buf.pktbuf_currlen], packet->payload, packet->payload_packet_len); + flow->kerberos_buf.pktbuf_currlen += packet->payload_packet_len; + + if(flow->kerberos_buf.pktbuf_currlen == flow->kerberos_buf.pktbuf_maxlen) { + packet->payload = (u_int8_t *)flow->kerberos_buf.pktbuf; + packet->payload_packet_len = flow->kerberos_buf.pktbuf_currlen; +#ifdef KERBEROS_DEBUG + printf("[Kerberos] Packet is now full: processing\n"); +#endif + } else { +#ifdef KERBEROS_DEBUG + printf("[Kerberos] Missing %u bytes: skipping\n", + flow->kerberos_buf.pktbuf_maxlen - flow->kerberos_buf.pktbuf_currlen); +#endif + + return; + } + } + } + /* I have observed 0a,0c,0d,0e at packet->payload[19/21], maybe there are other possibilities */ if(packet->payload_packet_len >= 4) { - u_int32_t kerberos_len = ntohl(get_u_int32_t(packet->payload, 0)); - u_int32_t expected_len = packet->payload_packet_len - 4; + u_int32_t kerberos_len, expected_len; + u_int16_t base_offset = 0; + + if(packet->tcp) { + kerberos_len = ntohl(get_u_int32_t(packet->payload, 0)), + expected_len = packet->payload_packet_len - 4; + base_offset = 4; + } else + base_offset = 0, kerberos_len = expected_len = packet->payload_packet_len; - if(kerberos_len < 1514) { +#ifdef KERBEROS_DEBUG + printf("[Kerberos] [Kerberos len: %u][expected_len: %u]\n", kerberos_len, expected_len); +#endif + + if(kerberos_len < 12000) { /* Kerberos packets might be too long for a TCP packet so it could be split across two packets. Instead of rebuilding the stream we use a heuristic approach */ - if(kerberos_len >= expected_len) { + if(kerberos_len > expected_len) { + if(packet->tcp) { + flow->kerberos_buf.pktbuf = (char*)ndpi_malloc(kerberos_len+4); + if(flow->kerberos_buf.pktbuf != NULL) { + flow->kerberos_buf.pktbuf_maxlen = kerberos_len+4; + memcpy(flow->kerberos_buf.pktbuf, packet->payload, packet->payload_packet_len); + flow->kerberos_buf.pktbuf_currlen = packet->payload_packet_len; + } + } + + return; + } else if(kerberos_len == expected_len) { if(packet->payload_packet_len > 128) { - u_int16_t koffset; + u_int16_t koffset, i; - if(packet->payload[14] == 0x05) /* PVNO */ - koffset = 19; - else - koffset = 21; + for(i=8; i<16; i++) + if((packet->payload[base_offset+i] == 0x03) + && (packet->payload[base_offset+i+1] == 0x02) + && (packet->payload[base_offset+i+2] == 0x01) + && (packet->payload[base_offset+i+3] != 0x05) + ) + break; + + koffset = base_offset + i + 3; - if((packet->payload[koffset] == 0x0a || packet->payload[koffset] == 0x0c || packet->payload[koffset] == 0x0d || packet->payload[koffset] == 0x0e)) { #ifdef KERBEROS_DEBUG - printf("[Kerberos] Packet found\n"); + printf("[Kerberos] [msg-type: 0x%02X/%u][koffset: %u]\n", + packet->payload[koffset], packet->payload[koffset], koffset); +#endif + + if(((packet->payload[koffset] == 0x0A) + || (packet->payload[koffset] == 0x0C) + || (packet->payload[koffset] == 0x0D) + || (packet->payload[koffset] == 0x0E))) { + u_int16_t koffsetp, body_offset, pad_len; + u_int8_t msg_type = packet->payload[koffset]; + +#ifdef KERBEROS_DEBUG + printf("[Kerberos] Packet found 0x%02X/%u\n", msg_type, msg_type); +#endif + if(msg_type != 0x0d) /* TGS-REP */ { + /* Process only on requests */ + if(packet->payload[koffset+1] == 0xA3) { + if(packet->payload[koffset+3] == 0x30) + pad_len = packet->payload[koffset+4]; + else { + /* Long pad */ + pad_len = packet->payload[koffset+2]; + for(i=3; i<10; i++) if(packet->payload[koffset+i] == pad_len) break; + + pad_len = (packet->payload[koffset+i+1] << 8) + packet->payload[koffset+i+2]; + koffset += i-2; + } + } else + pad_len = 0; + +#ifdef KERBEROS_DEBUG + printf("pad_len=0x%02X/%u\n", pad_len, pad_len); +#endif + + if(pad_len > 0) { + koffsetp = koffset + 2; + for(i=0; i<4; i++) if(packet->payload[koffsetp] != 0x30) koffsetp++; /* ASN.1 */ +#ifdef KERBEROS_DEBUG + printf("koffsetp=%u [%02X %02X] [byte 0 must be 0x30]\n", koffsetp, packet->payload[koffsetp], packet->payload[koffsetp+1]); +#endif + } else + koffsetp = koffset; + + body_offset = koffsetp + 1 + pad_len; + + for(i=0; i<10; i++) if(packet->payload[body_offset] != 0x05) body_offset++; /* ASN.1 */ +#ifdef KERBEROS_DEBUG + printf("body_offset=%u [%02X %02X] [byte 0 must be 0x05]\n", body_offset, packet->payload[body_offset], packet->payload[body_offset+1]); +#endif + } + + if(msg_type == 0x0A) /* AS-REQ */ { +#ifdef KERBEROS_DEBUG + printf("[Kerberos] Processing AS-REQ\n"); #endif - if(packet->payload[koffset] == 0x0a) /* AS-REQ */ { - u_int16_t koffsetp, pad_data_len, body_offset; - - koffsetp = koffset + 4; - pad_data_len = packet->payload[koffsetp]; - body_offset = pad_data_len + koffsetp; if(body_offset < packet->payload_packet_len) { - u_int name_offset = body_offset + 30; + u_int16_t name_offset; + + name_offset = body_offset + 13; + for(i=0; i<10; i++) if(packet->payload[name_offset] != 0x1b) name_offset++; /* ASN.1 */ + +#ifdef KERBEROS_DEBUG + printf("name_offset=%u [%02X %02X] [byte 0 must be 0x1b]\n", name_offset, packet->payload[name_offset], packet->payload[name_offset+1]); +#endif if(name_offset < packet->payload_packet_len) { - u_int cname_len = packet->payload[name_offset]; + u_int cname_len; + + name_offset += 1; + if(packet->payload[name_offset+1] < ' ') /* Isn't printable ? */ + name_offset++; + + if(packet->payload[name_offset+1] == 0x1b) + name_offset += 2; + + cname_len = packet->payload[name_offset]; if((cname_len+name_offset) < packet->payload_packet_len) { - u_int realm_len, realm_offset = cname_len + name_offset + 4, i; - char cname_str[24]; + u_int realm_len, realm_offset, i; + char cname_str[48]; + u_int8_t num_cname = 0; - if(cname_len > sizeof(cname_str)-1) - cname_len = sizeof(cname_str)-1; + while(++num_cname <= 2) { + if(cname_len > sizeof(cname_str)-1) + cname_len = sizeof(cname_str)-1; - strncpy(cname_str, (char*)&packet->payload[name_offset+1], cname_len); - cname_str[cname_len] = '\0'; - for(i=0; i<cname_len; i++) cname_str[i] = tolower(cname_str[i]); + strncpy(cname_str, (char*)&packet->payload[name_offset+1], cname_len); + cname_str[cname_len] = '\0'; + for(i=0; i<cname_len; i++) cname_str[i] = tolower(cname_str[i]); #ifdef KERBEROS_DEBUG - printf("[Kerberos Cname][len: %u][%s]\n", cname_len, cname_str); + printf("[AS-REQ][s/dport: %u/%u][Kerberos Cname][len: %u][%s]\n", + sport, dport, cname_len, cname_str); #endif + if(((strcmp(cname_str, "host") == 0) || (strcmp(cname_str, "ldap") == 0)) && (packet->payload[name_offset+1+cname_len] == 0x1b)) { + name_offset += cname_len + 2; + cname_len = packet->payload[name_offset]; + } else + break; + } + + realm_offset = cname_len + name_offset + 3; + /* if cname does not end with a $ then it's a username */ if(cname_len && cname_str[cname_len-1] == '$') { cname_str[cname_len-1] = '\0'; @@ -104,62 +242,97 @@ void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, } else snprintf(flow->protos.kerberos.username, sizeof(flow->protos.kerberos.username), "%s", cname_str); + for(i=0; i<10; i++) if(packet->payload[realm_offset] != 0x1b) name_offset++; /* ASN.1 */ +#ifdef KERBEROS_DEBUG + printf("realm_offset=%u [%02X %02X] [byte 0 must be 0x1b]\n", realm_offset, packet->payload[realm_offset], packet->payload[realm_offset+1]); +#endif + realm_offset += 1; + //if(num_cname == 2) realm_offset++; realm_len = packet->payload[realm_offset]; if((realm_offset+realm_len) < packet->payload_packet_len) { - char realm_str[24]; + char realm_str[48]; if(realm_len > sizeof(realm_str)-1) realm_len = sizeof(realm_str); - strncpy(realm_str, (char*)&packet->payload[realm_offset+1], realm_len); + realm_offset += 1; + + strncpy(realm_str, (char*)&packet->payload[realm_offset], realm_len); realm_str[realm_len] = '\0'; for(i=0; i<realm_len; i++) realm_str[i] = tolower(realm_str[i]); #ifdef KERBEROS_DEBUG - printf("[Kerberos Realm][len: %u][%s]\n", realm_len, realm_str); + printf("[AS-REQ][Kerberos Realm][len: %u][%s]\n", realm_len, realm_str); #endif snprintf(flow->protos.kerberos.domain, sizeof(flow->protos.kerberos.domain), "%s", realm_str); } } } - } - } else if(packet->payload[koffset] == 0x0c) /* TGS-REQ */ { - u_int16_t koffsetp, pad_data_len, body_offset; - - koffsetp = koffset + 3; - pad_data_len = ntohs(*((u_int16_t*)&packet->payload[koffsetp])); - body_offset = pad_data_len + koffsetp + 4; + } + } else if(msg_type == 0x0c) /* TGS-REQ */ { +#ifdef KERBEROS_DEBUG + printf("[Kerberos] Processing TGS-REQ\n"); +#endif if(body_offset < packet->payload_packet_len) { - u_int name_offset = body_offset + 14; + u_int name_offset, padding_offset = body_offset + 4; + + name_offset = padding_offset; + for(i=0; i<10; i++) if(packet->payload[name_offset] != 0x1b) name_offset++; /* ASN.1 */ + +#ifdef KERBEROS_DEBUG + printf("name_offset=%u [%02X %02X] [byte 0 must be 0x1b]\n", name_offset, packet->payload[name_offset], packet->payload[name_offset+1]); +#endif if(name_offset < packet->payload_packet_len) { - u_int realm_len = packet->payload[name_offset]; + u_int realm_len; + + name_offset++; + realm_len = packet->payload[name_offset]; if((realm_len+name_offset) < packet->payload_packet_len) { u_int i; - char realm_str[24]; + char realm_str[48]; if(realm_len > sizeof(realm_str)-1) realm_len = sizeof(realm_str)-1; - strncpy(realm_str, (char*)&packet->payload[name_offset+1], realm_len); + name_offset += 1; + + strncpy(realm_str, (char*)&packet->payload[name_offset], realm_len); realm_str[realm_len] = '\0'; for(i=0; i<realm_len; i++) realm_str[i] = tolower(realm_str[i]); #ifdef KERBEROS_DEBUG - printf("[Kerberos Realm][len: %u][%s]\n", realm_len, realm_str); + printf("[TGS-REQ][s/dport: %u/%u][Kerberos Realm][len: %u][%s]\n", sport, dport, realm_len, realm_str); #endif snprintf(flow->protos.kerberos.domain, sizeof(flow->protos.kerberos.domain), "%s", realm_str); + + /* If necessary we can decode sname */ + + if(flow->kerberos_buf.pktbuf) ndpi_free(flow->kerberos_buf.pktbuf); + flow->kerberos_buf.pktbuf = NULL; } } } + if(packet->udp) + ndpi_int_kerberos_add_connection(ndpi_struct, flow); + /* We set the protocol in the response */ + if(flow->kerberos_buf.pktbuf != NULL) { + free(flow->kerberos_buf.pktbuf); + flow->kerberos_buf.pktbuf = NULL; + } + return; - } else if(packet->payload[koffset] == 0x0d) /* TGS-RES */ { + } else if(msg_type == 0x0d) /* TGS-REP */ { u_int16_t koffsetp, pad_data_len, cname_offset; + +#ifdef KERBEROS_DEBUG + printf("[Kerberos] Processing TGS-REP\n"); +#endif koffsetp = koffset + 4; pad_data_len = packet->payload[koffsetp]; @@ -170,20 +343,21 @@ void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t cname_len = packet->payload[cname_offset]; if((cname_offset+cname_offset) < packet->payload_packet_len) { - char cname_str[24]; + char cname_str[48]; u_int i; - + if(cname_len > sizeof(cname_str)-1) cname_len = sizeof(cname_str)-1; - + strncpy(cname_str, (char*)&packet->payload[cname_offset+1], cname_len); cname_str[cname_len] = '\0'; for(i=0; i<cname_len; i++) cname_str[i] = tolower(cname_str[i]); - + #ifdef KERBEROS_DEBUG - printf("[Kerberos Cname][len: %u][%s]\n", cname_len, cname_str); + printf("[TGS-REP][s/dport: %u/%u][Kerberos Cname][len: %u][%s]\n", + sport, dport, cname_len, cname_str); #endif - + if(cname_len && cname_str[cname_len-1] == '$') { cname_str[cname_len-1] = '\0'; snprintf(flow->protos.kerberos.hostname, sizeof(flow->protos.kerberos.hostname), "%s", cname_str); @@ -194,7 +368,7 @@ void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, } } } - + return; } @@ -208,6 +382,11 @@ void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, } } } else { +#ifdef KERBEROS_DEBUG + printf("[Kerberos][s/dport: %u/%u] Skipping packet: too long [kerberos_len: %u]\n", + sport, dport, kerberos_len); +#endif + if(flow->protos.kerberos.domain[0] != '\0') return; } @@ -222,7 +401,7 @@ void init_kerberos_dissector(struct ndpi_detection_module_struct *ndpi_struct, ndpi_set_bitmask_protocol_detection("Kerberos", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_KERBEROS, ndpi_search_kerberos, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); diff --git a/src/lib/protocols/mail_smtp.c b/src/lib/protocols/mail_smtp.c index 2cd4657c9..86ff79486 100644 --- a/src/lib/protocols/mail_smtp.c +++ b/src/lib/protocols/mail_smtp.c @@ -70,9 +70,9 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, NDPI_LOG_DBG(ndpi_struct, "search mail_smtp\n"); if((packet->payload_packet_len > 2) - && (packet->parsed_lines < NDPI_MAX_PARSE_LINES_PER_PACKET) - && (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a) - ) { + && (packet->parsed_lines < NDPI_MAX_PARSE_LINES_PER_PACKET) + && (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a) + ) { u_int8_t a; u_int8_t bit_count = 0; @@ -97,33 +97,33 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, // expected client requests if(packet->line[a].len >= 5) { if((((packet->line[a].ptr[0] == 'H' || packet->line[a].ptr[0] == 'h') - && (packet->line[a].ptr[1] == 'E' || packet->line[a].ptr[1] == 'e')) - || ((packet->line[a].ptr[0] == 'E' || packet->line[a].ptr[0] == 'e') - && (packet->line[a].ptr[1] == 'H' || packet->line[a].ptr[1] == 'h'))) - && (packet->line[a].ptr[2] == 'L' || packet->line[a].ptr[2] == 'l') - && (packet->line[a].ptr[3] == 'O' || packet->line[a].ptr[3] == 'o') - && packet->line[a].ptr[4] == ' ') { + && (packet->line[a].ptr[1] == 'E' || packet->line[a].ptr[1] == 'e')) + || ((packet->line[a].ptr[0] == 'E' || packet->line[a].ptr[0] == 'e') + && (packet->line[a].ptr[1] == 'H' || packet->line[a].ptr[1] == 'h'))) + && (packet->line[a].ptr[2] == 'L' || packet->line[a].ptr[2] == 'l') + && (packet->line[a].ptr[3] == 'O' || packet->line[a].ptr[3] == 'o') + && packet->line[a].ptr[4] == ' ') { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_HELO_EHLO; flow->protos.ftp_imap_pop_smtp.auth_found = 0; } else if((packet->line[a].ptr[0] == 'M' || packet->line[a].ptr[0] == 'm') - && (packet->line[a].ptr[1] == 'A' || packet->line[a].ptr[1] == 'a') - && (packet->line[a].ptr[2] == 'I' || packet->line[a].ptr[2] == 'i') - && (packet->line[a].ptr[3] == 'L' || packet->line[a].ptr[3] == 'l') - && packet->line[a].ptr[4] == ' ') { + && (packet->line[a].ptr[1] == 'A' || packet->line[a].ptr[1] == 'a') + && (packet->line[a].ptr[2] == 'I' || packet->line[a].ptr[2] == 'i') + && (packet->line[a].ptr[3] == 'L' || packet->line[a].ptr[3] == 'l') + && packet->line[a].ptr[4] == ' ') { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_MAIL; flow->protos.ftp_imap_pop_smtp.auth_found = 0; } else if((packet->line[a].ptr[0] == 'R' || packet->line[a].ptr[0] == 'r') - && (packet->line[a].ptr[1] == 'C' || packet->line[a].ptr[1] == 'c') - && (packet->line[a].ptr[2] == 'P' || packet->line[a].ptr[2] == 'p') - && (packet->line[a].ptr[3] == 'T' || packet->line[a].ptr[3] == 't') - && packet->line[a].ptr[4] == ' ') { + && (packet->line[a].ptr[1] == 'C' || packet->line[a].ptr[1] == 'c') + && (packet->line[a].ptr[2] == 'P' || packet->line[a].ptr[2] == 'p') + && (packet->line[a].ptr[3] == 'T' || packet->line[a].ptr[3] == 't') + && packet->line[a].ptr[4] == ' ') { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_RCPT; flow->protos.ftp_imap_pop_smtp.auth_found = 0; } else if((packet->line[a].ptr[0] == 'A' || packet->line[a].ptr[0] == 'a') - && (packet->line[a].ptr[1] == 'U' || packet->line[a].ptr[1] == 'u') - && (packet->line[a].ptr[2] == 'T' || packet->line[a].ptr[2] == 't') - && (packet->line[a].ptr[3] == 'H' || packet->line[a].ptr[3] == 'h') - && packet->line[a].ptr[4] == ' ') { + && (packet->line[a].ptr[1] == 'U' || packet->line[a].ptr[1] == 'u') + && (packet->line[a].ptr[2] == 'T' || packet->line[a].ptr[2] == 't') + && (packet->line[a].ptr[3] == 'H' || packet->line[a].ptr[3] == 'h') + && packet->line[a].ptr[4] == ' ') { #ifdef SMTP_DEBUG printf("%s() AUTH [%s]\n", __FUNCTION__, packet->line[a].ptr); #endif @@ -143,7 +143,7 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, u_char *out; size_t out_len; - ndpi_user_pwd_payload_copy(buf, sizeof(buf), 0, + ndpi_user_pwd_payload_copy(buf, sizeof(buf)-1, 0, packet->line[a].ptr, packet->line[a].len); #ifdef SMTP_DEBUG @@ -191,32 +191,32 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, if(packet->line[a].len >= 8) { if((packet->line[a].ptr[0] == 'S' || packet->line[a].ptr[0] == 's') - && (packet->line[a].ptr[1] == 'T' || packet->line[a].ptr[1] == 't') - && (packet->line[a].ptr[2] == 'A' || packet->line[a].ptr[2] == 'a') - && (packet->line[a].ptr[3] == 'R' || packet->line[a].ptr[3] == 'r') - && (packet->line[a].ptr[4] == 'T' || packet->line[a].ptr[4] == 't') - && (packet->line[a].ptr[5] == 'T' || packet->line[a].ptr[5] == 't') - && (packet->line[a].ptr[6] == 'L' || packet->line[a].ptr[6] == 'l') - && (packet->line[a].ptr[7] == 'S' || packet->line[a].ptr[7] == 's')) { + && (packet->line[a].ptr[1] == 'T' || packet->line[a].ptr[1] == 't') + && (packet->line[a].ptr[2] == 'A' || packet->line[a].ptr[2] == 'a') + && (packet->line[a].ptr[3] == 'R' || packet->line[a].ptr[3] == 'r') + && (packet->line[a].ptr[4] == 'T' || packet->line[a].ptr[4] == 't') + && (packet->line[a].ptr[5] == 'T' || packet->line[a].ptr[5] == 't') + && (packet->line[a].ptr[6] == 'L' || packet->line[a].ptr[6] == 'l') + && (packet->line[a].ptr[7] == 'S' || packet->line[a].ptr[7] == 's')) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_STARTTLS; } } if(packet->line[a].len >= 4) { if((packet->line[a].ptr[0] == 'D' || packet->line[a].ptr[0] == 'd') - && (packet->line[a].ptr[1] == 'A' || packet->line[a].ptr[1] == 'a') - && (packet->line[a].ptr[2] == 'T' || packet->line[a].ptr[2] == 't') - && (packet->line[a].ptr[3] == 'A' || packet->line[a].ptr[3] == 'a')) { + && (packet->line[a].ptr[1] == 'A' || packet->line[a].ptr[1] == 'a') + && (packet->line[a].ptr[2] == 'T' || packet->line[a].ptr[2] == 't') + && (packet->line[a].ptr[3] == 'A' || packet->line[a].ptr[3] == 'a')) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_DATA; } else if((packet->line[a].ptr[0] == 'N' || packet->line[a].ptr[0] == 'n') - && (packet->line[a].ptr[1] == 'O' || packet->line[a].ptr[1] == 'o') - && (packet->line[a].ptr[2] == 'O' || packet->line[a].ptr[2] == 'o') - && (packet->line[a].ptr[3] == 'P' || packet->line[a].ptr[3] == 'p')) { + && (packet->line[a].ptr[1] == 'O' || packet->line[a].ptr[1] == 'o') + && (packet->line[a].ptr[2] == 'O' || packet->line[a].ptr[2] == 'o') + && (packet->line[a].ptr[3] == 'P' || packet->line[a].ptr[3] == 'p')) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_NOOP; } else if((packet->line[a].ptr[0] == 'R' || packet->line[a].ptr[0] == 'r') - && (packet->line[a].ptr[1] == 'S' || packet->line[a].ptr[1] == 's') - && (packet->line[a].ptr[2] == 'E' || packet->line[a].ptr[2] == 'e') - && (packet->line[a].ptr[3] == 'T' || packet->line[a].ptr[3] == 't')) { + && (packet->line[a].ptr[1] == 'S' || packet->line[a].ptr[1] == 's') + && (packet->line[a].ptr[2] == 'E' || packet->line[a].ptr[2] == 'e') + && (packet->line[a].ptr[3] == 'T' || packet->line[a].ptr[3] == 't')) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_RSET; } } @@ -229,7 +229,7 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, } } NDPI_LOG_DBG2(ndpi_struct, "seen smtp commands and responses: %u\n", - bit_count); + bit_count); if(bit_count >= 3) { NDPI_LOG_INFO(ndpi_struct, "mail smtp identified\n"); @@ -251,9 +251,9 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, /* when the first or second packets are split into two packets, those packets are ignored. */ if(flow->packet_counter <= 4 && - packet->payload_packet_len >= 4 && - (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a - || memcmp(packet->payload, "220", 3) == 0 || memcmp(packet->payload, "EHLO", 4) == 0)) { + packet->payload_packet_len >= 4 && + (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a + || memcmp(packet->payload, "220", 3) == 0 || memcmp(packet->payload, "EHLO", 4) == 0)) { NDPI_LOG_DBG2(ndpi_struct, "maybe SMTP, need next packet\n"); return; } diff --git a/src/lib/protocols/ntp.c b/src/lib/protocols/ntp.c index a03ed3b43..126dadc4c 100644 --- a/src/lib/protocols/ntp.c +++ b/src/lib/protocols/ntp.c @@ -58,8 +58,8 @@ void ndpi_search_ntp_udp(struct ndpi_detection_module_struct *ndpi_struct, struc return; } } - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); } diff --git a/src/lib/protocols/smpp.c b/src/lib/protocols/smpp.c index c188bd91f..e0521ae12 100644 --- a/src/lib/protocols/smpp.c +++ b/src/lib/protocols/smpp.c @@ -68,7 +68,7 @@ void ndpi_search_smpp_tcp(struct ndpi_detection_module_struct* ndpi_struct, u_int32_t tmp_pdu_l = 0; u_int16_t pdu_c = 1; // loop PDUs (check if lengths are valid) - while(total_pdu_l < packet->payload_packet_len) { + while(total_pdu_l < (packet->payload_packet_len-4)) { // get next PDU length tmp_pdu_l = ntohl(get_u_int32_t(packet->payload, total_pdu_l)); // if zero or overflowing , return, will try the next TCP segment diff --git a/src/lib/protocols/ssh.c b/src/lib/protocols/ssh.c index 5bdf78959..068d2c345 100644 --- a/src/lib/protocols/ssh.c +++ b/src/lib/protocols/ssh.c @@ -296,7 +296,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct flow->l4.tcp.ssh_stage = 3; return; } - } else { + } else if(packet->payload_packet_len > 5) { u_int8_t msgcode = *(packet->payload + 5); ndpi_MD5_CTX ctx; diff --git a/src/lib/protocols/telnet.c b/src/lib/protocols/telnet.c index 0fd00e6d4..35693bf62 100644 --- a/src/lib/protocols/telnet.c +++ b/src/lib/protocols/telnet.c @@ -1,8 +1,8 @@ /* * telnet.c * - * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-19 - ntop.org + * Copyright (C) 2009-2011 by ipoque GmbH * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH @@ -47,6 +47,34 @@ static int search_telnet_again(struct ndpi_detection_module_struct *ndpi_struct, if(packet->payload_packet_len > 0) { int i; + if(flow->protos.telnet.username_detected) { + if((!flow->protos.telnet.password_found) + && (packet->payload_packet_len > 6)) { + + if(strncasecmp((char*)packet->payload, "password:", 9) == 0) { + flow->protos.telnet.password_found = 1; + } + + return(1); + } + + if(packet->payload[0] == '\r') { + if(!flow->protos.telnet.password_found) + return(1); + + flow->protos.telnet.password_detected = 1; + flow->protos.telnet.password[flow->protos.telnet.character_id] = '\0'; + return(0); + } + + for(i=0; i<packet->payload_packet_len; i++) { + if(flow->protos.telnet.character_id < (sizeof(flow->protos.telnet.password)-1)) + flow->protos.telnet.password[flow->protos.telnet.character_id++] = packet->payload[i]; + } + + return(1); + } + if((!flow->protos.telnet.username_found) && (packet->payload_packet_len > 6)) { @@ -60,7 +88,8 @@ static int search_telnet_again(struct ndpi_detection_module_struct *ndpi_struct, if(packet->payload[0] == '\r') { flow->protos.telnet.username_detected = 1; flow->protos.telnet.username[flow->protos.telnet.character_id] = '\0'; - return(0); + flow->protos.telnet.character_id = 0; + return(1); } for(i=0; i<packet->payload_packet_len; i++) { diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index 9d22a66db..ed92814d9 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -308,7 +308,11 @@ int getTLScertificate(struct ndpi_detection_module_struct *ndpi_struct, #endif offset += 2 + 1; - extension_len = ntohs(*((u_int16_t*)&packet->payload[offset])); + + if((offset + 1) < packet->payload_packet_len) /* +1 because we are goint to read 2 bytes */ + extension_len = ntohs(*((u_int16_t*)&packet->payload[offset])); + else + extension_len = 0; #ifdef DEBUG_TLS printf("TLS [server][extension_len: %u]\n", extension_len); @@ -870,7 +874,7 @@ int getSSCertificateFingerprint(struct ndpi_detection_module_struct *ndpi_struct return(0); /* That's all */ } else if(flow->l4.tcp.tls_seen_certificate) return(0); /* That's all */ - else if(packet->payload_packet_len > flow->l4.tcp.tls_record_offset+7) { + else if(packet->payload_packet_len > flow->l4.tcp.tls_record_offset+7+1/* +1 because we are going to read 2 bytes */) { /* This is a handshake but not a certificate record */ u_int16_t len = ntohs(*(u_int16_t*)&packet->payload[flow->l4.tcp.tls_record_offset+7]); @@ -1400,19 +1404,16 @@ void ndpi_search_tls_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t ret, skip_cert_processing = 0; #ifdef DEBUG_TLS - printf("%s()\n", __FUNCTION__); + printf("==>> %u [len: %u][version: %u]\n", + flow->guessed_host_protocol_id, + packet->payload_packet_len, + flow->protos.stun_ssl.ssl.ssl_version); #endif if(packet->udp != NULL) { /* DTLS dissector */ int rc = sslTryAndRetrieveServerCertificate(ndpi_struct, flow); - -#ifdef DEBUG_TLS - printf("==>> %u [rc: %d][len: %u][%s][version: %u]\n", - flow->guessed_host_protocol_id, rc, packet->payload_packet_len, flow->protos.stun_ssl.ssl.ja3_server, - flow->protos.stun_ssl.ssl.ssl_version); -#endif - + if((rc == 0) && (flow->protos.stun_ssl.ssl.ssl_version != 0)) { flow->guessed_protocol_id = NDPI_PROTOCOL_TLS; diff --git a/src/lib/third_party/include/libinjection.h b/src/lib/third_party/include/libinjection.h new file mode 100644 index 000000000..6b40b1df6 --- /dev/null +++ b/src/lib/third_party/include/libinjection.h @@ -0,0 +1,65 @@ +/** + * Copyright 2012-2016 Nick Galbreath + * nickg@client9.com + * BSD License -- see COPYING.txt for details + * + * https://libinjection.client9.com/ + * + */ + +#ifndef LIBINJECTION_H +#define LIBINJECTION_H + +#ifdef __cplusplus +# define LIBINJECTION_BEGIN_DECLS extern "C" { +# define LIBINJECTION_END_DECLS } +#else +# define LIBINJECTION_BEGIN_DECLS +# define LIBINJECTION_END_DECLS +#endif + +LIBINJECTION_BEGIN_DECLS + +/* + * Pull in size_t + */ +#include <string.h> + +/* + * Version info. + * + * This is moved into a function to allow SWIG and other auto-generated + * binding to not be modified during minor release changes. We change + * change the version number in the c source file, and not regenerated + * the binding + * + * See python's normalized version + * http://www.python.org/dev/peps/pep-0386/#normalizedversion + */ +const char* libinjection_version(void); + +/** + * Simple API for SQLi detection - returns a SQLi fingerprint or NULL + * is benign input + * + * \param[in] s input string, may contain nulls, does not need to be null-terminated + * \param[in] slen input string length + * \param[out] fingerprint buffer of 8+ characters. c-string, + * \return 1 if SQLi, 0 if benign. fingerprint will be set or set to empty string. + */ +int libinjection_sqli(const char* s, size_t slen, char fingerprint[]); + +/** ALPHA version of xss detector. + * + * NOT DONE. + * + * \param[in] s input string, may contain nulls, does not need to be null-terminated + * \param[in] slen input string length + * \return 1 if XSS found, 0 if benign + * + */ +int libinjection_xss(const char* s, size_t slen); + +LIBINJECTION_END_DECLS + +#endif /* LIBINJECTION_H */ diff --git a/src/lib/third_party/include/libinjection_html5.h b/src/lib/third_party/include/libinjection_html5.h new file mode 100644 index 000000000..29a145968 --- /dev/null +++ b/src/lib/third_party/include/libinjection_html5.h @@ -0,0 +1,54 @@ +#ifndef LIBINJECTION_HTML5 +#define LIBINJECTION_HTML5 + +#ifdef __cplusplus +extern "C" { +#endif + +/* pull in size_t */ + +#include <stddef.h> + +enum html5_type { + DATA_TEXT + , TAG_NAME_OPEN + , TAG_NAME_CLOSE + , TAG_NAME_SELFCLOSE + , TAG_DATA + , TAG_CLOSE + , ATTR_NAME + , ATTR_VALUE + , TAG_COMMENT + , DOCTYPE +}; + +enum html5_flags { + DATA_STATE + , VALUE_NO_QUOTE + , VALUE_SINGLE_QUOTE + , VALUE_DOUBLE_QUOTE + , VALUE_BACK_QUOTE +}; + +struct h5_state; +typedef int (*ptr_html5_state)(struct h5_state*); + +typedef struct h5_state { + const char* s; + size_t len; + size_t pos; + int is_close; + ptr_html5_state state; + const char* token_start; + size_t token_len; + enum html5_type token_type; +} h5_state_t; + + +void libinjection_h5_init(h5_state_t* hs, const char* s, size_t len, enum html5_flags); +int libinjection_h5_next(h5_state_t* hs); + +#ifdef __cplusplus +} +#endif +#endif diff --git a/src/lib/third_party/include/libinjection_sqli.h b/src/lib/third_party/include/libinjection_sqli.h new file mode 100644 index 000000000..b9746555a --- /dev/null +++ b/src/lib/third_party/include/libinjection_sqli.h @@ -0,0 +1,294 @@ +/** + * Copyright 2012-2016 Nick Galbreath + * nickg@client9.com + * BSD License -- see `COPYING.txt` for details + * + * https://libinjection.client9.com/ + * + */ + +#ifndef LIBINJECTION_SQLI_H +#define LIBINJECTION_SQLI_H + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Pull in size_t + */ +#include <string.h> + +enum sqli_flags { + FLAG_NONE = 0 + , FLAG_QUOTE_NONE = 1 /* 1 << 0 */ + , FLAG_QUOTE_SINGLE = 2 /* 1 << 1 */ + , FLAG_QUOTE_DOUBLE = 4 /* 1 << 2 */ + + , FLAG_SQL_ANSI = 8 /* 1 << 3 */ + , FLAG_SQL_MYSQL = 16 /* 1 << 4 */ +}; + +enum lookup_type { + LOOKUP_WORD = 1 + , LOOKUP_TYPE = 2 + , LOOKUP_OPERATOR = 3 + , LOOKUP_FINGERPRINT = 4 +}; + +struct libinjection_sqli_token { +#ifdef SWIG +%immutable; +#endif + /* + * position and length of token + * in original string + */ + size_t pos; + size_t len; + + /* count: + * in type 'v', used for number of opening '@' + * but maybe used in other contexts + */ + int count; + + char type; + char str_open; + char str_close; + char val[32]; +}; + +typedef struct libinjection_sqli_token stoken_t; + +/** + * Pointer to function, takes c-string input, + * returns '\0' for no match, else a char + */ +struct libinjection_sqli_state; +typedef char (*ptr_lookup_fn)(struct libinjection_sqli_state*, int lookuptype, const char* word, size_t len); + +struct libinjection_sqli_state { +#ifdef SWIG +%immutable; +#endif + + /* + * input, does not need to be null terminated. + * it is also not modified. + */ + const char *s; + + /* + * input length + */ + size_t slen; + + /* + * How to lookup a word or fingerprint + */ + ptr_lookup_fn lookup; + void* userdata; + + /* + * + */ + int flags; + + /* + * pos is the index in the string during tokenization + */ + size_t pos; + +#ifndef SWIG + /* for SWIG.. don't use this.. use functional API instead */ + + /* MAX TOKENS + 1 since we use one extra token + * to determine the type of the previous token + */ + struct libinjection_sqli_token tokenvec[8]; +#endif + + /* + * Pointer to token position in tokenvec, above + */ + struct libinjection_sqli_token *current; + + /* + * fingerprint pattern c-string + * +1 for ending null + * Minimum of 8 bytes to add gcc's -fstack-protector to work + */ + char fingerprint[8]; + + /* + * Line number of code that said decided if the input was SQLi or + * not. Most of the time it's line that said "it's not a matching + * fingerprint" but there is other logic that sometimes approves + * an input. This is only useful for debugging. + * + */ + int reason; + + /* Number of ddw (dash-dash-white) comments + * These comments are in the form of + * '--[whitespace]' or '--[EOF]' + * + * All databases treat this as a comment. + */ + int stats_comment_ddw; + + /* Number of ddx (dash-dash-[notwhite]) comments + * + * ANSI SQL treats these are comments, MySQL treats this as + * two unary operators '-' '-' + * + * If you are parsing result returns FALSE and + * stats_comment_dd > 0, you should reparse with + * COMMENT_MYSQL + * + */ + int stats_comment_ddx; + + /* + * c-style comments found /x .. x/ + */ + int stats_comment_c; + + /* '#' operators or MySQL EOL comments found + * + */ + int stats_comment_hash; + + /* + * number of tokens folded away + */ + int stats_folds; + + /* + * total tokens processed + */ + int stats_tokens; + +}; + +typedef struct libinjection_sqli_state sfilter; + +struct libinjection_sqli_token* libinjection_sqli_get_token( + struct libinjection_sqli_state* sqlistate, int i); + +/* + * Version info. + * + * This is moved into a function to allow SWIG and other auto-generated + * binding to not be modified during minor release changes. We change + * change the version number in the c source file, and not regenerated + * the binding + * + * See python's normalized version + * http://www.python.org/dev/peps/pep-0386/#normalizedversion + */ +const char* libinjection_version(void); + +/** + * + */ +void libinjection_sqli_init(struct libinjection_sqli_state* sql_state, + const char* s, size_t slen, + int flags); + +/** + * Main API: tests for SQLi in three possible contexts, no quotes, + * single quote and double quote + * + * \param sql_state core data structure + * + * \return 1 (true) if SQLi, 0 (false) if benign + */ +int libinjection_is_sqli(struct libinjection_sqli_state* sql_state); + +/* FOR HACKERS ONLY + * provides deep hooks into the decision making process + */ +void libinjection_sqli_callback(struct libinjection_sqli_state* sql_state, + ptr_lookup_fn fn, + void* userdata); + + +/* + * Resets state, but keeps initial string and callbacks + */ +void libinjection_sqli_reset(struct libinjection_sqli_state* sql_state, + int flags); + +/** + * + */ + +/** + * This detects SQLi in a single context, mostly useful for custom + * logic and debugging. + * + * \param sql_state Main data structure + * \param flags flags to adjust parsing + * + * \returns a pointer to sfilter.fingerprint as convenience + * do not free! + * + */ +const char* libinjection_sqli_fingerprint(struct libinjection_sqli_state* sql_state, + int flags); + +/** + * The default "word" to token-type or fingerprint function. This + * uses a ASCII case-insensitive binary tree. + */ +char libinjection_sqli_lookup_word(struct libinjection_sqli_state* sql_state, + int lookup_type, + const char* s, + size_t slen); + +/* Streaming tokenization interface. + * + * sql_state->current is updated with the current token. + * + * \returns 1, has a token, keep going, or 0 no tokens + * + */ +int libinjection_sqli_tokenize(struct libinjection_sqli_state * sql_state); + +/** + * parses and folds input, up to 5 tokens + * + */ +int libinjection_sqli_fold(struct libinjection_sqli_state * sql_state); + +/** The built-in default function to match fingerprints + * and do false negative/positive analysis. This calls the following + * two functions. With this, you over-ride one part or the other. + * + * return libinjection_sqli_blacklist(sql_state) && + * libinjection_sqli_not_whitelist(sql_state); + * + * \param sql_state should be filled out after libinjection_sqli_fingerprint is called + */ +int libinjection_sqli_check_fingerprint(struct libinjection_sqli_state * sql_state); + +/* Given a pattern determine if it's a SQLi pattern. + * + * \return TRUE if sqli, false otherwise + */ +int libinjection_sqli_blacklist(struct libinjection_sqli_state* sql_state); + +/* Given a positive match for a pattern (i.e. pattern is SQLi), this function + * does additional analysis to reduce false positives. + * + * \return TRUE if SQLi, false otherwise + */ +int libinjection_sqli_not_whitelist(struct libinjection_sqli_state * sql_state); + +#ifdef __cplusplus +} +#endif + +#endif /* LIBINJECTION_SQLI_H */ diff --git a/src/lib/third_party/include/libinjection_sqli_data.h b/src/lib/third_party/include/libinjection_sqli_data.h new file mode 100644 index 000000000..f5e145414 --- /dev/null +++ b/src/lib/third_party/include/libinjection_sqli_data.h @@ -0,0 +1,9652 @@ + +#ifndef LIBINJECTION_SQLI_DATA_H +#define LIBINJECTION_SQLI_DATA_H + +#include "libinjection.h" +#include "libinjection_sqli.h" + +typedef struct { + const char *word; + char type; +} keyword_t; + +static size_t parse_money(sfilter * sf); +static size_t parse_other(sfilter * sf); +static size_t parse_white(sfilter * sf); +static size_t parse_operator1(sfilter *sf); +static size_t parse_char(sfilter *sf); +static size_t parse_hash(sfilter *sf); +static size_t parse_dash(sfilter *sf); +static size_t parse_slash(sfilter *sf); +static size_t parse_backslash(sfilter * sf); +static size_t parse_operator2(sfilter *sf); +static size_t parse_string(sfilter *sf); +static size_t parse_word(sfilter * sf); +static size_t parse_var(sfilter * sf); +static size_t parse_number(sfilter * sf); +static size_t parse_tick(sfilter * sf); +static size_t parse_ustring(sfilter * sf); +static size_t parse_qstring(sfilter * sf); +static size_t parse_nqstring(sfilter * sf); +static size_t parse_xstring(sfilter * sf); +static size_t parse_bstring(sfilter * sf); +static size_t parse_estring(sfilter * sf); +static size_t parse_bword(sfilter * sf); + + +typedef size_t (*pt2Function)(sfilter *sf); +static const pt2Function char_parse_map[] = { + &parse_white, /* 0 */ + &parse_white, /* 1 */ + &parse_white, /* 2 */ + &parse_white, /* 3 */ + &parse_white, /* 4 */ + &parse_white, /* 5 */ + &parse_white, /* 6 */ + &parse_white, /* 7 */ + &parse_white, /* 8 */ + &parse_white, /* 9 */ + &parse_white, /* 10 */ + &parse_white, /* 11 */ + &parse_white, /* 12 */ + &parse_white, /* 13 */ + &parse_white, /* 14 */ + &parse_white, /* 15 */ + &parse_white, /* 16 */ + &parse_white, /* 17 */ + &parse_white, /* 18 */ + &parse_white, /* 19 */ + &parse_white, /* 20 */ + &parse_white, /* 21 */ + &parse_white, /* 22 */ + &parse_white, /* 23 */ + &parse_white, /* 24 */ + &parse_white, /* 25 */ + &parse_white, /* 26 */ + &parse_white, /* 27 */ + &parse_white, /* 28 */ + &parse_white, /* 29 */ + &parse_white, /* 30 */ + &parse_white, /* 31 */ + &parse_white, /* 32 */ + &parse_operator2, /* 33 */ + &parse_string, /* 34 */ + &parse_hash, /* 35 */ + &parse_money, /* 36 */ + &parse_operator1, /* 37 */ + &parse_operator2, /* 38 */ + &parse_string, /* 39 */ + &parse_char, /* 40 */ + &parse_char, /* 41 */ + &parse_operator2, /* 42 */ + &parse_operator1, /* 43 */ + &parse_char, /* 44 */ + &parse_dash, /* 45 */ + &parse_number, /* 46 */ + &parse_slash, /* 47 */ + &parse_number, /* 48 */ + &parse_number, /* 49 */ + &parse_number, /* 50 */ + &parse_number, /* 51 */ + &parse_number, /* 52 */ + &parse_number, /* 53 */ + &parse_number, /* 54 */ + &parse_number, /* 55 */ + &parse_number, /* 56 */ + &parse_number, /* 57 */ + &parse_operator2, /* 58 */ + &parse_char, /* 59 */ + &parse_operator2, /* 60 */ + &parse_operator2, /* 61 */ + &parse_operator2, /* 62 */ + &parse_other, /* 63 */ + &parse_var, /* 64 */ + &parse_word, /* 65 */ + &parse_bstring, /* 66 */ + &parse_word, /* 67 */ + &parse_word, /* 68 */ + &parse_estring, /* 69 */ + &parse_word, /* 70 */ + &parse_word, /* 71 */ + &parse_word, /* 72 */ + &parse_word, /* 73 */ + &parse_word, /* 74 */ + &parse_word, /* 75 */ + &parse_word, /* 76 */ + &parse_word, /* 77 */ + &parse_nqstring, /* 78 */ + &parse_word, /* 79 */ + &parse_word, /* 80 */ + &parse_qstring, /* 81 */ + &parse_word, /* 82 */ + &parse_word, /* 83 */ + &parse_word, /* 84 */ + &parse_ustring, /* 85 */ + &parse_word, /* 86 */ + &parse_word, /* 87 */ + &parse_xstring, /* 88 */ + &parse_word, /* 89 */ + &parse_word, /* 90 */ + &parse_bword, /* 91 */ + &parse_backslash, /* 92 */ + &parse_other, /* 93 */ + &parse_operator1, /* 94 */ + &parse_word, /* 95 */ + &parse_tick, /* 96 */ + &parse_word, /* 97 */ + &parse_bstring, /* 98 */ + &parse_word, /* 99 */ + &parse_word, /* 100 */ + &parse_estring, /* 101 */ + &parse_word, /* 102 */ + &parse_word, /* 103 */ + &parse_word, /* 104 */ + &parse_word, /* 105 */ + &parse_word, /* 106 */ + &parse_word, /* 107 */ + &parse_word, /* 108 */ + &parse_word, /* 109 */ + &parse_nqstring, /* 110 */ + &parse_word, /* 111 */ + &parse_word, /* 112 */ + &parse_qstring, /* 113 */ + &parse_word, /* 114 */ + &parse_word, /* 115 */ + &parse_word, /* 116 */ + &parse_ustring, /* 117 */ + &parse_word, /* 118 */ + &parse_word, /* 119 */ + &parse_xstring, /* 120 */ + &parse_word, /* 121 */ + &parse_word, /* 122 */ + &parse_char, /* 123 */ + &parse_operator2, /* 124 */ + &parse_char, /* 125 */ + &parse_operator1, /* 126 */ + &parse_white, /* 127 */ + &parse_word, /* 128 */ + &parse_word, /* 129 */ + &parse_word, /* 130 */ + &parse_word, /* 131 */ + &parse_word, /* 132 */ + &parse_word, /* 133 */ + &parse_word, /* 134 */ + &parse_word, /* 135 */ + &parse_word, /* 136 */ + &parse_word, /* 137 */ + &parse_word, /* 138 */ + &parse_word, /* 139 */ + &parse_word, /* 140 */ + &parse_word, /* 141 */ + &parse_word, /* 142 */ + &parse_word, /* 143 */ + &parse_word, /* 144 */ + &parse_word, /* 145 */ + &parse_word, /* 146 */ + &parse_word, /* 147 */ + &parse_word, /* 148 */ + &parse_word, /* 149 */ + &parse_word, /* 150 */ + &parse_word, /* 151 */ + &parse_word, /* 152 */ + &parse_word, /* 153 */ + &parse_word, /* 154 */ + &parse_word, /* 155 */ + &parse_word, /* 156 */ + &parse_word, /* 157 */ + &parse_word, /* 158 */ + &parse_word, /* 159 */ + &parse_white, /* 160 */ + &parse_word, /* 161 */ + &parse_word, /* 162 */ + &parse_word, /* 163 */ + &parse_word, /* 164 */ + &parse_word, /* 165 */ + &parse_word, /* 166 */ + &parse_word, /* 167 */ + &parse_word, /* 168 */ + &parse_word, /* 169 */ + &parse_word, /* 170 */ + &parse_word, /* 171 */ + &parse_word, /* 172 */ + &parse_word, /* 173 */ + &parse_word, /* 174 */ + &parse_word, /* 175 */ + &parse_word, /* 176 */ + &parse_word, /* 177 */ + &parse_word, /* 178 */ + &parse_word, /* 179 */ + &parse_word, /* 180 */ + &parse_word, /* 181 */ + &parse_word, /* 182 */ + &parse_word, /* 183 */ + &parse_word, /* 184 */ + &parse_word, /* 185 */ + &parse_word, /* 186 */ + &parse_word, /* 187 */ + &parse_word, /* 188 */ + &parse_word, /* 189 */ + &parse_word, /* 190 */ + &parse_word, /* 191 */ + &parse_word, /* 192 */ + &parse_word, /* 193 */ + &parse_word, /* 194 */ + &parse_word, /* 195 */ + &parse_word, /* 196 */ + &parse_word, /* 197 */ + &parse_word, /* 198 */ + &parse_word, /* 199 */ + &parse_word, /* 200 */ + &parse_word, /* 201 */ + &parse_word, /* 202 */ + &parse_word, /* 203 */ + &parse_word, /* 204 */ + &parse_word, /* 205 */ + &parse_word, /* 206 */ + &parse_word, /* 207 */ + &parse_word, /* 208 */ + &parse_word, /* 209 */ + &parse_word, /* 210 */ + &parse_word, /* 211 */ + &parse_word, /* 212 */ + &parse_word, /* 213 */ + &parse_word, /* 214 */ + &parse_word, /* 215 */ + &parse_word, /* 216 */ + &parse_word, /* 217 */ + &parse_word, /* 218 */ + &parse_word, /* 219 */ + &parse_word, /* 220 */ + &parse_word, /* 221 */ + &parse_word, /* 222 */ + &parse_word, /* 223 */ + &parse_word, /* 224 */ + &parse_word, /* 225 */ + &parse_word, /* 226 */ + &parse_word, /* 227 */ + &parse_word, /* 228 */ + &parse_word, /* 229 */ + &parse_word, /* 230 */ + &parse_word, /* 231 */ + &parse_word, /* 232 */ + &parse_word, /* 233 */ + &parse_word, /* 234 */ + &parse_word, /* 235 */ + &parse_word, /* 236 */ + &parse_word, /* 237 */ + &parse_word, /* 238 */ + &parse_word, /* 239 */ + &parse_word, /* 240 */ + &parse_word, /* 241 */ + &parse_word, /* 242 */ + &parse_word, /* 243 */ + &parse_word, /* 244 */ + &parse_word, /* 245 */ + &parse_word, /* 246 */ + &parse_word, /* 247 */ + &parse_word, /* 248 */ + &parse_word, /* 249 */ + &parse_word, /* 250 */ + &parse_word, /* 251 */ + &parse_word, /* 252 */ + &parse_word, /* 253 */ + &parse_word, /* 254 */ + &parse_word, /* 255 */ +}; + +static const keyword_t sql_keywords[] = { + {"!!", 'o'}, + {"!<", 'o'}, + {"!=", 'o'}, + {"!>", 'o'}, + {"%=", 'o'}, + {"&&", '&'}, + {"&=", 'o'}, + {"*=", 'o'}, + {"+=", 'o'}, + {"-=", 'o'}, + {"/=", 'o'}, + {"0&(1)O", 'F'}, + {"0&(1)U", 'F'}, + {"0&(1O(", 'F'}, + {"0&(1OF", 'F'}, + {"0&(1OS", 'F'}, + {"0&(1OV", 'F'}, + {"0&(F()", 'F'}, + {"0&(F(1", 'F'}, + {"0&(F(F", 'F'}, + {"0&(F(N", 'F'}, + {"0&(F(S", 'F'}, + {"0&(F(V", 'F'}, + {"0&(N)O", 'F'}, + {"0&(N)U", 'F'}, + {"0&(NO(", 'F'}, + {"0&(NOF", 'F'}, + {"0&(NOS", 'F'}, + {"0&(NOV", 'F'}, + {"0&(S)O", 'F'}, + {"0&(S)U", 'F'}, + {"0&(SO(", 'F'}, + {"0&(SO1", 'F'}, + {"0&(SOF", 'F'}, + {"0&(SON", 'F'}, + {"0&(SOS", 'F'}, + {"0&(SOV", 'F'}, + {"0&(V)O", 'F'}, + {"0&(V)U", 'F'}, + {"0&(VO(", 'F'}, + {"0&(VOF", 'F'}, + {"0&(VOS", 'F'}, + {"0&1O(1", 'F'}, + {"0&1O(F", 'F'}, + {"0&1O(N", 'F'}, + {"0&1O(S", 'F'}, + {"0&1O(V", 'F'}, + {"0&1OF(", 'F'}, + {"0&1OS(", 'F'}, + {"0&1OS1", 'F'}, + {"0&1OSF", 'F'}, + {"0&1OSU", 'F'}, + {"0&1OSV", 'F'}, + {"0&1OV(", 'F'}, + {"0&1OVF", 'F'}, + {"0&1OVO", 'F'}, + {"0&1OVS", 'F'}, + {"0&1OVU", 'F'}, + {"0&1UE(", 'F'}, + {"0&1UE1", 'F'}, + {"0&1UEF", 'F'}, + {"0&1UEK", 'F'}, + {"0&1UEN", 'F'}, + {"0&1UES", 'F'}, + {"0&1UEV", 'F'}, + {"0&F()O", 'F'}, + {"0&F()U", 'F'}, + {"0&F(1)", 'F'}, + {"0&F(1O", 'F'}, + {"0&F(F(", 'F'}, + {"0&F(N)", 'F'}, + {"0&F(NO", 'F'}, + {"0&F(S)", 'F'}, + {"0&F(SO", 'F'}, + {"0&F(V)", 'F'}, + {"0&F(VO", 'F'}, + {"0&NO(1", 'F'}, + {"0&NO(F", 'F'}, + {"0&NO(N", 'F'}, + {"0&NO(S", 'F'}, + {"0&NO(V", 'F'}, + {"0&NOF(", 'F'}, + {"0&NOS(", 'F'}, + {"0&NOS1", 'F'}, + {"0&NOSF", 'F'}, + {"0&NOSU", 'F'}, + {"0&NOSV", 'F'}, + {"0&NOV(", 'F'}, + {"0&NOVF", 'F'}, + {"0&NOVO", 'F'}, + {"0&NOVS", 'F'}, + {"0&NOVU", 'F'}, + {"0&NUE(", 'F'}, + {"0&NUE1", 'F'}, + {"0&NUEF", 'F'}, + {"0&NUEK", 'F'}, + {"0&NUEN", 'F'}, + {"0&NUES", 'F'}, + {"0&NUEV", 'F'}, + {"0&SO(1", 'F'}, + {"0&SO(F", 'F'}, + {"0&SO(N", 'F'}, + {"0&SO(S", 'F'}, + {"0&SO(V", 'F'}, + {"0&SO1(", 'F'}, + {"0&SO1F", 'F'}, + {"0&SO1N", 'F'}, + {"0&SO1S", 'F'}, + {"0&SO1U", 'F'}, + {"0&SO1V", 'F'}, + {"0&SOF(", 'F'}, + {"0&SON(", 'F'}, + {"0&SON1", 'F'}, + {"0&SONF", 'F'}, + {"0&SONU", 'F'}, + {"0&SOS(", 'F'}, + {"0&SOS1", 'F'}, + {"0&SOSF", 'F'}, + {"0&SOSU", 'F'}, + {"0&SOSV", 'F'}, + {"0&SOV(", 'F'}, + {"0&SOVF", 'F'}, + {"0&SOVO", 'F'}, + {"0&SOVS", 'F'}, + {"0&SOVU", 'F'}, + {"0&SUE(", 'F'}, + {"0&SUE1", 'F'}, + {"0&SUEF", 'F'}, + {"0&SUEK", 'F'}, + {"0&SUEN", 'F'}, + {"0&SUES", 'F'}, + {"0&SUEV", 'F'}, + {"0&VO(1", 'F'}, + {"0&VO(F", 'F'}, + {"0&VO(N", 'F'}, + {"0&VO(S", 'F'}, + {"0&VO(V", 'F'}, + {"0&VOF(", 'F'}, + {"0&VOS(", 'F'}, + {"0&VOS1", 'F'}, + {"0&VOSF", 'F'}, + {"0&VOSU", 'F'}, + {"0&VOSV", 'F'}, + {"0&VUE(", 'F'}, + {"0&VUE1", 'F'}, + {"0&VUEF", 'F'}, + {"0&VUEK", 'F'}, + {"0&VUEN", 'F'}, + {"0&VUES", 'F'}, + {"0&VUEV", 'F'}, + {"0)&(EK", 'F'}, + {"0)&(EN", 'F'}, + {"0)UE(1", 'F'}, + {"0)UE(F", 'F'}, + {"0)UE(N", 'F'}, + {"0)UE(S", 'F'}, + {"0)UE(V", 'F'}, + {"0)UE1K", 'F'}, + {"0)UE1O", 'F'}, + {"0)UEF(", 'F'}, + {"0)UEK(", 'F'}, + {"0)UEK1", 'F'}, + {"0)UEKF", 'F'}, + {"0)UEKN", 'F'}, + {"0)UEKS", 'F'}, + {"0)UEKV", 'F'}, + {"0)UENK", 'F'}, + {"0)UENO", 'F'}, + {"0)UESK", 'F'}, + {"0)UESO", 'F'}, + {"0)UEVK", 'F'}, + {"0)UEVO", 'F'}, + {"01&(1&", 'F'}, + {"01&(1)", 'F'}, + {"01&(1,", 'F'}, + {"01&(1O", 'F'}, + {"01&(E(", 'F'}, + {"01&(E1", 'F'}, + {"01&(EF", 'F'}, + {"01&(EK", 'F'}, + {"01&(EN", 'F'}, + {"01&(EO", 'F'}, + {"01&(ES", 'F'}, + {"01&(EV", 'F'}, + {"01&(F(", 'F'}, + {"01&(N&", 'F'}, + {"01&(N)", 'F'}, + {"01&(N,", 'F'}, + {"01&(NO", 'F'}, + {"01&(S&", 'F'}, + {"01&(S)", 'F'}, + {"01&(S,", 'F'}, + {"01&(SO", 'F'}, + {"01&(V&", 'F'}, + {"01&(V)", 'F'}, + {"01&(V,", 'F'}, + {"01&(VO", 'F'}, + {"01&1", 'F'}, + {"01&1&(", 'F'}, + {"01&1&1", 'F'}, + {"01&1&F", 'F'}, + {"01&1&N", 'F'}, + {"01&1&S", 'F'}, + {"01&1&V", 'F'}, + {"01&1)&", 'F'}, + {"01&1)C", 'F'}, + {"01&1)O", 'F'}, + {"01&1)U", 'F'}, + {"01&1;", 'F'}, + {"01&1;C", 'F'}, + {"01&1;E", 'F'}, + {"01&1;T", 'F'}, + {"01&1B(", 'F'}, + {"01&1B1", 'F'}, + {"01&1BF", 'F'}, + {"01&1BN", 'F'}, + {"01&1BS", 'F'}, + {"01&1BV", 'F'}, + {"01&1C", 'F'}, + {"01&1EK", 'F'}, + {"01&1EN", 'F'}, + {"01&1F(", 'F'}, + {"01&1K(", 'F'}, + {"01&1K1", 'F'}, + {"01&1KF", 'F'}, + {"01&1KN", 'F'}, + {"01&1KS", 'F'}, + {"01&1KV", 'F'}, + {"01&1O(", 'F'}, + {"01&1OF", 'F'}, + {"01&1OS", 'F'}, + {"01&1OV", 'F'}, + {"01&1TN", 'F'}, + {"01&1U", 'F'}, + {"01&1U(", 'F'}, + {"01&1U;", 'F'}, + {"01&1UC", 'F'}, + {"01&1UE", 'F'}, + {"01&E(1", 'F'}, + {"01&E(F", 'F'}, + {"01&E(N", 'F'}, + {"01&E(O", 'F'}, + {"01&E(S", 'F'}, + {"01&E(V", 'F'}, + {"01&E1", 'F'}, + {"01&E1;", 'F'}, + {"01&E1C", 'F'}, + {"01&E1K", 'F'}, + {"01&E1O", 'F'}, + {"01&EF(", 'F'}, + {"01&EK(", 'F'}, + {"01&EK1", 'F'}, + {"01&EKF", 'F'}, + {"01&EKN", 'F'}, + {"01&EKS", 'F'}, + {"01&EKU", 'F'}, + {"01&EKV", 'F'}, + {"01&EN", 'F'}, + {"01&EN;", 'F'}, + {"01&ENC", 'F'}, + {"01&ENK", 'F'}, + {"01&ENO", 'F'}, + {"01&ES", 'F'}, + {"01&ES;", 'F'}, + {"01&ESC", 'F'}, + {"01&ESK", 'F'}, + {"01&ESO", 'F'}, + {"01&EUE", 'F'}, + {"01&EV", 'F'}, + {"01&EV;", 'F'}, + {"01&EVC", 'F'}, + {"01&EVK", 'F'}, + {"01&EVO", 'F'}, + {"01&F()", 'F'}, + {"01&F(1", 'F'}, + {"01&F(E", 'F'}, + {"01&F(F", 'F'}, + {"01&F(N", 'F'}, + {"01&F(S", 'F'}, + {"01&F(V", 'F'}, + {"01&K&(", 'F'}, + {"01&K&1", 'F'}, + {"01&K&F", 'F'}, + {"01&K&N", 'F'}, + {"01&K&S", 'F'}, + {"01&K&V", 'F'}, + {"01&K(1", 'F'}, + {"01&K(F", 'F'}, + {"01&K(N", 'F'}, + {"01&K(S", 'F'}, + {"01&K(V", 'F'}, + {"01&K1O", 'F'}, + {"01&KC", 'F'}, + {"01&KF(", 'F'}, + {"01&KNK", 'F'}, + {"01&KO(", 'F'}, + {"01&KO1", 'F'}, + {"01&KOF", 'F'}, + {"01&KOK", 'F'}, + {"01&KON", 'F'}, + {"01&KOS", 'F'}, + {"01&KOV", 'F'}, + {"01&KSO", 'F'}, + {"01&KVO", 'F'}, + {"01&N&(", 'F'}, + {"01&N&1", 'F'}, + {"01&N&F", 'F'}, + {"01&N&N", 'F'}, + {"01&N&S", 'F'}, + {"01&N&V", 'F'}, + {"01&N)&", 'F'}, + {"01&N)C", 'F'}, + {"01&N)O", 'F'}, + {"01&N)U", 'F'}, + {"01&N;", 'F'}, + {"01&N;C", 'F'}, + {"01&N;E", 'F'}, + {"01&N;T", 'F'}, + {"01&NB(", 'F'}, + {"01&NB1", 'F'}, + {"01&NBF", 'F'}, + {"01&NBN", 'F'}, + {"01&NBS", 'F'}, + {"01&NBV", 'F'}, + {"01&NC", 'F'}, + {"01&NEN", 'F'}, + {"01&NF(", 'F'}, + {"01&NK(", 'F'}, + {"01&NK1", 'F'}, + {"01&NKF", 'F'}, + {"01&NKN", 'F'}, + {"01&NKS", 'F'}, + {"01&NKV", 'F'}, + {"01&NO(", 'F'}, + {"01&NOF", 'F'}, + {"01&NOS", 'F'}, + {"01&NOV", 'F'}, + {"01&NTN", 'F'}, + {"01&NU", 'F'}, + {"01&NU(", 'F'}, + {"01&NU;", 'F'}, + {"01&NUC", 'F'}, + {"01&NUE", 'F'}, + {"01&S", 'F'}, + {"01&S&(", 'F'}, + {"01&S&1", 'F'}, + {"01&S&F", 'F'}, + {"01&S&N", 'F'}, + {"01&S&S", 'F'}, + {"01&S&V", 'F'}, + {"01&S)&", 'F'}, + {"01&S)C", 'F'}, + {"01&S)O", 'F'}, + {"01&S)U", 'F'}, + {"01&S1", 'F'}, + {"01&S1;", 'F'}, + {"01&S1C", 'F'}, + {"01&S;", 'F'}, + {"01&S;C", 'F'}, + {"01&S;E", 'F'}, + {"01&S;T", 'F'}, + {"01&SB(", 'F'}, + {"01&SB1", 'F'}, + {"01&SBF", 'F'}, + {"01&SBN", 'F'}, + {"01&SBS", 'F'}, + {"01&SBV", 'F'}, + {"01&SC", 'F'}, + {"01&SEK", 'F'}, + {"01&SEN", 'F'}, + {"01&SF(", 'F'}, + {"01&SK(", 'F'}, + {"01&SK1", 'F'}, + {"01&SKF", 'F'}, + {"01&SKN", 'F'}, + {"01&SKS", 'F'}, + {"01&SKV", 'F'}, + {"01&SO(", 'F'}, + {"01&SO1", 'F'}, + {"01&SOF", 'F'}, + {"01&SON", 'F'}, + {"01&SOS", 'F'}, + {"01&SOV", 'F'}, + {"01&STN", 'F'}, + {"01&SU", 'F'}, + {"01&SU(", 'F'}, + {"01&SU;", 'F'}, + {"01&SUC", 'F'}, + {"01&SUE", 'F'}, + {"01&SV", 'F'}, + {"01&SV;", 'F'}, + {"01&SVC", 'F'}, + {"01&SVO", 'F'}, + {"01&V", 'F'}, + {"01&V&(", 'F'}, + {"01&V&1", 'F'}, + {"01&V&F", 'F'}, + {"01&V&N", 'F'}, + {"01&V&S", 'F'}, + {"01&V&V", 'F'}, + {"01&V)&", 'F'}, + {"01&V)C", 'F'}, + {"01&V)O", 'F'}, + {"01&V)U", 'F'}, + {"01&V;", 'F'}, + {"01&V;C", 'F'}, + {"01&V;E", 'F'}, + {"01&V;T", 'F'}, + {"01&VB(", 'F'}, + {"01&VB1", 'F'}, + {"01&VBF", 'F'}, + {"01&VBN", 'F'}, + {"01&VBS", 'F'}, + {"01&VBV", 'F'}, + {"01&VC", 'F'}, + {"01&VEK", 'F'}, + {"01&VEN", 'F'}, + {"01&VF(", 'F'}, + {"01&VK(", 'F'}, + {"01&VK1", 'F'}, + {"01&VKF", 'F'}, + {"01&VKN", 'F'}, + {"01&VKS", 'F'}, + {"01&VKV", 'F'}, + {"01&VO(", 'F'}, + {"01&VOF", 'F'}, + {"01&VOS", 'F'}, + {"01&VS", 'F'}, + {"01&VS;", 'F'}, + {"01&VSC", 'F'}, + {"01&VSO", 'F'}, + {"01&VTN", 'F'}, + {"01&VU", 'F'}, + {"01&VU(", 'F'}, + {"01&VU;", 'F'}, + {"01&VUC", 'F'}, + {"01&VUE", 'F'}, + {"01(EF(", 'F'}, + {"01(EKF", 'F'}, + {"01(EKN", 'F'}, + {"01(ENK", 'F'}, + {"01(U(E", 'F'}, + {"01)&(1", 'F'}, + {"01)&(E", 'F'}, + {"01)&(F", 'F'}, + {"01)&(N", 'F'}, + {"01)&(S", 'F'}, + {"01)&(V", 'F'}, + {"01)&1", 'F'}, + {"01)&1&", 'F'}, + {"01)&1)", 'F'}, + {"01)&1;", 'F'}, + {"01)&1B", 'F'}, + {"01)&1C", 'F'}, + {"01)&1F", 'F'}, + {"01)&1O", 'F'}, + {"01)&1U", 'F'}, + {"01)&F(", 'F'}, + {"01)&N", 'F'}, + {"01)&N&", 'F'}, + {"01)&N)", 'F'}, + {"01)&N;", 'F'}, + {"01)&NB", 'F'}, + {"01)&NC", 'F'}, + {"01)&NF", 'F'}, + {"01)&NO", 'F'}, + {"01)&NU", 'F'}, + {"01)&S", 'F'}, + {"01)&S&", 'F'}, + {"01)&S)", 'F'}, + {"01)&S;", 'F'}, + {"01)&SB", 'F'}, + {"01)&SC", 'F'}, + {"01)&SF", 'F'}, + {"01)&SO", 'F'}, + {"01)&SU", 'F'}, + {"01)&V", 'F'}, + {"01)&V&", 'F'}, + {"01)&V)", 'F'}, + {"01)&V;", 'F'}, + {"01)&VB", 'F'}, + {"01)&VC", 'F'}, + {"01)&VF", 'F'}, + {"01)&VO", 'F'}, + {"01)&VU", 'F'}, + {"01),(1", 'F'}, + {"01),(F", 'F'}, + {"01),(N", 'F'}, + {"01),(S", 'F'}, + {"01),(V", 'F'}, + {"01);E(", 'F'}, + {"01);E1", 'F'}, + {"01);EF", 'F'}, + {"01);EK", 'F'}, + {"01);EN", 'F'}, + {"01);EO", 'F'}, + {"01);ES", 'F'}, + {"01);EV", 'F'}, + {"01);T(", 'F'}, + {"01);T1", 'F'}, + {"01);TF", 'F'}, + {"01);TK", 'F'}, + {"01);TN", 'F'}, + {"01);TO", 'F'}, + {"01);TS", 'F'}, + {"01);TV", 'F'}, + {"01)B(1", 'F'}, + {"01)B(F", 'F'}, + {"01)B(N", 'F'}, + {"01)B(S", 'F'}, + {"01)B(V", 'F'}, + {"01)B1", 'F'}, + {"01)B1&", 'F'}, + {"01)B1;", 'F'}, + {"01)B1C", 'F'}, + {"01)B1K", 'F'}, + {"01)B1N", 'F'}, + {"01)B1O", 'F'}, + {"01)B1U", 'F'}, + {"01)BF(", 'F'}, + {"01)BN", 'F'}, + {"01)BN&", 'F'}, + {"01)BN;", 'F'}, + {"01)BNC", 'F'}, + {"01)BNK", 'F'}, + {"01)BNO", 'F'}, + {"01)BNU", 'F'}, + {"01)BS", 'F'}, + {"01)BS&", 'F'}, + {"01)BS;", 'F'}, + {"01)BSC", 'F'}, + {"01)BSK", 'F'}, + {"01)BSO", 'F'}, + {"01)BSU", 'F'}, + {"01)BV", 'F'}, + {"01)BV&", 'F'}, + {"01)BV;", 'F'}, + {"01)BVC", 'F'}, + {"01)BVK", 'F'}, + {"01)BVO", 'F'}, + {"01)BVU", 'F'}, + {"01)C", 'F'}, + {"01)E(1", 'F'}, + {"01)E(F", 'F'}, + {"01)E(N", 'F'}, + {"01)E(S", 'F'}, + {"01)E(V", 'F'}, + {"01)E1C", 'F'}, + {"01)E1O", 'F'}, + {"01)EF(", 'F'}, + {"01)EK(", 'F'}, + {"01)EK1", 'F'}, + {"01)EKF", 'F'}, + {"01)EKN", 'F'}, + {"01)EKS", 'F'}, + {"01)EKV", 'F'}, + {"01)ENC", 'F'}, + {"01)ENO", 'F'}, + {"01)ESC", 'F'}, + {"01)ESO", 'F'}, + {"01)EVC", 'F'}, + {"01)EVO", 'F'}, + {"01)F(F", 'F'}, + {"01)K(1", 'F'}, + {"01)K(F", 'F'}, + {"01)K(N", 'F'}, + {"01)K(S", 'F'}, + {"01)K(V", 'F'}, + {"01)K1&", 'F'}, + {"01)K1;", 'F'}, + {"01)K1B", 'F'}, + {"01)K1E", 'F'}, + {"01)K1O", 'F'}, + {"01)K1U", 'F'}, + {"01)KB(", 'F'}, + {"01)KB1", 'F'}, + {"01)KBF", 'F'}, + {"01)KBN", 'F'}, + {"01)KBS", 'F'}, + {"01)KBV", 'F'}, + {"01)KF(", 'F'}, + {"01)KN&", 'F'}, + {"01)KN;", 'F'}, + {"01)KNB", 'F'}, + {"01)KNC", 'F'}, + {"01)KNE", 'F'}, + {"01)KNK", 'F'}, + {"01)KNU", 'F'}, + {"01)KS&", 'F'}, + {"01)KS;", 'F'}, + {"01)KSB", 'F'}, + {"01)KSE", 'F'}, + {"01)KSO", 'F'}, + {"01)KSU", 'F'}, + {"01)KUE", 'F'}, + {"01)KV&", 'F'}, + {"01)KV;", 'F'}, + {"01)KVB", 'F'}, + {"01)KVE", 'F'}, + {"01)KVO", 'F'}, + {"01)KVU", 'F'}, + {"01)O(1", 'F'}, + {"01)O(E", 'F'}, + {"01)O(F", 'F'}, + {"01)O(N", 'F'}, + {"01)O(S", 'F'}, + {"01)O(V", 'F'}, + {"01)O1", 'F'}, + {"01)O1&", 'F'}, + {"01)O1)", 'F'}, + {"01)O1;", 'F'}, + {"01)O1B", 'F'}, + {"01)O1C", 'F'}, + {"01)O1K", 'F'}, + {"01)O1U", 'F'}, + {"01)OF(", 'F'}, + {"01)ON&", 'F'}, + {"01)ON)", 'F'}, + {"01)ON;", 'F'}, + {"01)ONB", 'F'}, + {"01)ONC", 'F'}, + {"01)ONK", 'F'}, + {"01)ONU", 'F'}, + {"01)OS", 'F'}, + {"01)OS&", 'F'}, + {"01)OS)", 'F'}, + {"01)OS;", 'F'}, + {"01)OSB", 'F'}, + {"01)OSC", 'F'}, + {"01)OSK", 'F'}, + {"01)OSU", 'F'}, + {"01)OV", 'F'}, + {"01)OV&", 'F'}, + {"01)OV)", 'F'}, + {"01)OV;", 'F'}, + {"01)OVB", 'F'}, + {"01)OVC", 'F'}, + {"01)OVK", 'F'}, + {"01)OVO", 'F'}, + {"01)OVU", 'F'}, + {"01)U(E", 'F'}, + {"01)UE(", 'F'}, + {"01)UE1", 'F'}, + {"01)UEF", 'F'}, + {"01)UEK", 'F'}, + {"01)UEN", 'F'}, + {"01)UES", 'F'}, + {"01)UEV", 'F'}, + {"01,(1)", 'F'}, + {"01,(1O", 'F'}, + {"01,(E(", 'F'}, + {"01,(E1", 'F'}, + {"01,(EF", 'F'}, + {"01,(EK", 'F'}, + {"01,(EN", 'F'}, + {"01,(ES", 'F'}, + {"01,(EV", 'F'}, + {"01,(F(", 'F'}, + {"01,(N)", 'F'}, + {"01,(NO", 'F'}, + {"01,(S)", 'F'}, + {"01,(SO", 'F'}, + {"01,(V)", 'F'}, + {"01,(VO", 'F'}, + {"01,F()", 'F'}, + {"01,F(1", 'F'}, + {"01,F(F", 'F'}, + {"01,F(N", 'F'}, + {"01,F(S", 'F'}, + {"01,F(V", 'F'}, + {"01;E(1", 'F'}, + {"01;E(E", 'F'}, + {"01;E(F", 'F'}, + {"01;E(N", 'F'}, + {"01;E(S", 'F'}, + {"01;E(V", 'F'}, + {"01;E1,", 'F'}, + {"01;E1;", 'F'}, + {"01;E1C", 'F'}, + {"01;E1K", 'F'}, + {"01;E1O", 'F'}, + {"01;E1T", 'F'}, + {"01;EF(", 'F'}, + {"01;EK(", 'F'}, + {"01;EK1", 'F'}, + {"01;EKF", 'F'}, + {"01;EKN", 'F'}, + {"01;EKO", 'F'}, + {"01;EKS", 'F'}, + {"01;EKV", 'F'}, + {"01;EN,", 'F'}, + {"01;EN;", 'F'}, + {"01;ENC", 'F'}, + {"01;ENE", 'F'}, + {"01;ENK", 'F'}, + {"01;ENO", 'F'}, + {"01;ENT", 'F'}, + {"01;ES,", 'F'}, + {"01;ES;", 'F'}, + {"01;ESC", 'F'}, + {"01;ESK", 'F'}, + {"01;ESO", 'F'}, + {"01;EST", 'F'}, + {"01;EV,", 'F'}, + {"01;EV;", 'F'}, + {"01;EVC", 'F'}, + {"01;EVK", 'F'}, + {"01;EVO", 'F'}, + {"01;EVT", 'F'}, + {"01;N:T", 'F'}, + {"01;T(1", 'F'}, + {"01;T(C", 'F'}, + {"01;T(E", 'F'}, + {"01;T(F", 'F'}, + {"01;T(N", 'F'}, + {"01;T(S", 'F'}, + {"01;T(V", 'F'}, + {"01;T1(", 'F'}, + {"01;T1,", 'F'}, + {"01;T1;", 'F'}, + {"01;T1C", 'F'}, + {"01;T1F", 'F'}, + {"01;T1K", 'F'}, + {"01;T1O", 'F'}, + {"01;T1T", 'F'}, + {"01;T;", 'F'}, + {"01;T;C", 'F'}, + {"01;TF(", 'F'}, + {"01;TK(", 'F'}, + {"01;TK1", 'F'}, + {"01;TKF", 'F'}, + {"01;TKK", 'F'}, + {"01;TKN", 'F'}, + {"01;TKO", 'F'}, + {"01;TKS", 'F'}, + {"01;TKV", 'F'}, + {"01;TN(", 'F'}, + {"01;TN,", 'F'}, + {"01;TN1", 'F'}, + {"01;TN;", 'F'}, + {"01;TNC", 'F'}, + {"01;TNF", 'F'}, + {"01;TNK", 'F'}, + {"01;TNN", 'F'}, + {"01;TNO", 'F'}, + {"01;TNS", 'F'}, + {"01;TNT", 'F'}, + {"01;TNV", 'F'}, + {"01;TO(", 'F'}, + {"01;TS(", 'F'}, + {"01;TS,", 'F'}, + {"01;TS;", 'F'}, + {"01;TSC", 'F'}, + {"01;TSF", 'F'}, + {"01;TSK", 'F'}, + {"01;TSO", 'F'}, + {"01;TST", 'F'}, + {"01;TTN", 'F'}, + {"01;TV(", 'F'}, + {"01;TV,", 'F'}, + {"01;TV;", 'F'}, + {"01;TVC", 'F'}, + {"01;TVF", 'F'}, + {"01;TVK", 'F'}, + {"01;TVO", 'F'}, + {"01;TVT", 'F'}, + {"01A(F(", 'F'}, + {"01A(N)", 'F'}, + {"01A(NO", 'F'}, + {"01A(S)", 'F'}, + {"01A(SO", 'F'}, + {"01A(V)", 'F'}, + {"01A(VO", 'F'}, + {"01AF()", 'F'}, + {"01AF(1", 'F'}, + {"01AF(F", 'F'}, + {"01AF(N", 'F'}, + {"01AF(S", 'F'}, + {"01AF(V", 'F'}, + {"01ASO(", 'F'}, + {"01ASO1", 'F'}, + {"01ASOF", 'F'}, + {"01ASON", 'F'}, + {"01ASOS", 'F'}, + {"01ASOV", 'F'}, + {"01ASUE", 'F'}, + {"01ATO(", 'F'}, + {"01ATO1", 'F'}, + {"01ATOF", 'F'}, + {"01ATON", 'F'}, + {"01ATOS", 'F'}, + {"01ATOV", 'F'}, + {"01ATUE", 'F'}, + {"01AVO(", 'F'}, + {"01AVOF", 'F'}, + {"01AVOS", 'F'}, + {"01AVUE", 'F'}, + {"01B(1)", 'F'}, + {"01B(1O", 'F'}, + {"01B(F(", 'F'}, + {"01B(NO", 'F'}, + {"01B(S)", 'F'}, + {"01B(SO", 'F'}, + {"01B(V)", 'F'}, + {"01B(VO", 'F'}, + {"01B1", 'F'}, + {"01B1&(", 'F'}, + {"01B1&1", 'F'}, + {"01B1&F", 'F'}, + {"01B1&N", 'F'}, + {"01B1&S", 'F'}, + {"01B1&V", 'F'}, + {"01B1,(", 'F'}, + {"01B1,F", 'F'}, + {"01B1;", 'F'}, + {"01B1;C", 'F'}, + {"01B1B(", 'F'}, + {"01B1B1", 'F'}, + {"01B1BF", 'F'}, + {"01B1BN", 'F'}, + {"01B1BS", 'F'}, + {"01B1BV", 'F'}, + {"01B1C", 'F'}, + {"01B1K(", 'F'}, + {"01B1K1", 'F'}, + {"01B1KF", 'F'}, + {"01B1KN", 'F'}, + {"01B1KS", 'F'}, + {"01B1KV", 'F'}, + {"01B1O(", 'F'}, + {"01B1OF", 'F'}, + {"01B1OS", 'F'}, + {"01B1OV", 'F'}, + {"01B1U(", 'F'}, + {"01B1UE", 'F'}, + {"01BE(1", 'F'}, + {"01BE(F", 'F'}, + {"01BE(N", 'F'}, + {"01BE(S", 'F'}, + {"01BE(V", 'F'}, + {"01BEK(", 'F'}, + {"01BF()", 'F'}, + {"01BF(1", 'F'}, + {"01BF(F", 'F'}, + {"01BF(N", 'F'}, + {"01BF(S", 'F'}, + {"01BF(V", 'F'}, + {"01BN", 'F'}, + {"01BN&(", 'F'}, + {"01BN&1", 'F'}, + {"01BN&F", 'F'}, + {"01BN&N", 'F'}, + {"01BN&S", 'F'}, + {"01BN&V", 'F'}, + {"01BN,(", 'F'}, + {"01BN,F", 'F'}, + {"01BN;", 'F'}, + {"01BN;C", 'F'}, + {"01BNB(", 'F'}, + {"01BNB1", 'F'}, + {"01BNBF", 'F'}, + {"01BNBN", 'F'}, + {"01BNBS", 'F'}, + {"01BNBV", 'F'}, + {"01BNC", 'F'}, + {"01BNK(", 'F'}, + {"01BNK1", 'F'}, + {"01BNKF", 'F'}, + {"01BNKN", 'F'}, + {"01BNKS", 'F'}, + {"01BNKV", 'F'}, + {"01BNO(", 'F'}, + {"01BNOF", 'F'}, + {"01BNOS", 'F'}, + {"01BNOV", 'F'}, + {"01BNU(", 'F'}, + {"01BNUE", 'F'}, + {"01BS", 'F'}, + {"01BS&(", 'F'}, + {"01BS&1", 'F'}, + {"01BS&F", 'F'}, + {"01BS&N", 'F'}, + {"01BS&S", 'F'}, + {"01BS&V", 'F'}, + {"01BS,(", 'F'}, + {"01BS,F", 'F'}, + {"01BS;", 'F'}, + {"01BS;C", 'F'}, + {"01BSB(", 'F'}, + {"01BSB1", 'F'}, + {"01BSBF", 'F'}, + {"01BSBN", 'F'}, + {"01BSBS", 'F'}, + {"01BSBV", 'F'}, + {"01BSC", 'F'}, + {"01BSK(", 'F'}, + {"01BSK1", 'F'}, + {"01BSKF", 'F'}, + {"01BSKN", 'F'}, + {"01BSKS", 'F'}, + {"01BSKV", 'F'}, + {"01BSO(", 'F'}, + {"01BSO1", 'F'}, + {"01BSOF", 'F'}, + {"01BSON", 'F'}, + {"01BSOS", 'F'}, + {"01BSOV", 'F'}, + {"01BSU(", 'F'}, + {"01BSUE", 'F'}, + {"01BV", 'F'}, + {"01BV&(", 'F'}, + {"01BV&1", 'F'}, + {"01BV&F", 'F'}, + {"01BV&N", 'F'}, + {"01BV&S", 'F'}, + {"01BV&V", 'F'}, + {"01BV,(", 'F'}, + {"01BV,F", 'F'}, + {"01BV;", 'F'}, + {"01BV;C", 'F'}, + {"01BVB(", 'F'}, + {"01BVB1", 'F'}, + {"01BVBF", 'F'}, + {"01BVBN", 'F'}, + {"01BVBS", 'F'}, + {"01BVBV", 'F'}, + {"01BVC", 'F'}, + {"01BVK(", 'F'}, + {"01BVK1", 'F'}, + {"01BVKF", 'F'}, + {"01BVKN", 'F'}, + {"01BVKS", 'F'}, + {"01BVKV", 'F'}, + {"01BVO(", 'F'}, + {"01BVOF", 'F'}, + {"01BVOS", 'F'}, + {"01BVU(", 'F'}, + {"01BVUE", 'F'}, + {"01C", 'F'}, + {"01E(1)", 'F'}, + {"01E(1O", 'F'}, + {"01E(F(", 'F'}, + {"01E(N)", 'F'}, + {"01E(NO", 'F'}, + {"01E(S)", 'F'}, + {"01E(SO", 'F'}, + {"01E(V)", 'F'}, + {"01E(VO", 'F'}, + {"01E1;T", 'F'}, + {"01E1C", 'F'}, + {"01E1O(", 'F'}, + {"01E1OF", 'F'}, + {"01E1OS", 'F'}, + {"01E1OV", 'F'}, + {"01E1T(", 'F'}, + {"01E1T1", 'F'}, + {"01E1TF", 'F'}, + {"01E1TN", 'F'}, + {"01E1TS", 'F'}, + {"01E1TV", 'F'}, + {"01E1UE", 'F'}, + {"01EF()", 'F'}, + {"01EF(1", 'F'}, + {"01EF(F", 'F'}, + {"01EF(N", 'F'}, + {"01EF(S", 'F'}, + {"01EF(V", 'F'}, + {"01EK(1", 'F'}, + {"01EK(E", 'F'}, + {"01EK(F", 'F'}, + {"01EK(N", 'F'}, + {"01EK(S", 'F'}, + {"01EK(V", 'F'}, + {"01EK1;", 'F'}, + {"01EK1C", 'F'}, + {"01EK1O", 'F'}, + {"01EK1T", 'F'}, + {"01EK1U", 'F'}, + {"01EKF(", 'F'}, + {"01EKN;", 'F'}, + {"01EKNC", 'F'}, + {"01EKNE", 'F'}, + {"01EKNT", 'F'}, + {"01EKNU", 'F'}, + {"01EKOK", 'F'}, + {"01EKS;", 'F'}, + {"01EKSC", 'F'}, + {"01EKSO", 'F'}, + {"01EKST", 'F'}, + {"01EKSU", 'F'}, + {"01EKU(", 'F'}, + {"01EKU1", 'F'}, + {"01EKUE", 'F'}, + {"01EKUF", 'F'}, + {"01EKUS", 'F'}, + {"01EKUV", 'F'}, + {"01EKV;", 'F'}, + {"01EKVC", 'F'}, + {"01EKVO", 'F'}, + {"01EKVT", 'F'}, + {"01EKVU", 'F'}, + {"01EN;T", 'F'}, + {"01ENC", 'F'}, + {"01ENEN", 'F'}, + {"01ENO(", 'F'}, + {"01ENOF", 'F'}, + {"01ENOS", 'F'}, + {"01ENOV", 'F'}, + {"01ENT(", 'F'}, + {"01ENT1", 'F'}, + {"01ENTF", 'F'}, + {"01ENTN", 'F'}, + {"01ENTS", 'F'}, + {"01ENTV", 'F'}, + {"01ENUE", 'F'}, + {"01EOKN", 'F'}, + {"01ES;T", 'F'}, + {"01ESC", 'F'}, + {"01ESO(", 'F'}, + {"01ESO1", 'F'}, + {"01ESOF", 'F'}, + {"01ESON", 'F'}, + {"01ESOS", 'F'}, + {"01ESOV", 'F'}, + {"01EST(", 'F'}, + {"01EST1", 'F'}, + {"01ESTF", 'F'}, + {"01ESTN", 'F'}, + {"01ESTS", 'F'}, + {"01ESTV", 'F'}, + {"01ESUE", 'F'}, + {"01EU(1", 'F'}, + {"01EU(F", 'F'}, + {"01EU(N", 'F'}, + {"01EU(S", 'F'}, + {"01EU(V", 'F'}, + {"01EU1,", 'F'}, + {"01EU1C", 'F'}, + {"01EU1O", 'F'}, + {"01EUEF", 'F'}, + {"01EUEK", 'F'}, + {"01EUF(", 'F'}, + {"01EUS,", 'F'}, + {"01EUSC", 'F'}, + {"01EUSO", 'F'}, + {"01EUV,", 'F'}, + {"01EUVC", 'F'}, + {"01EUVO", 'F'}, + {"01EV;T", 'F'}, + {"01EVC", 'F'}, + {"01EVO(", 'F'}, + {"01EVOF", 'F'}, + {"01EVOS", 'F'}, + {"01EVT(", 'F'}, + {"01EVT1", 'F'}, + {"01EVTF", 'F'}, + {"01EVTN", 'F'}, + {"01EVTS", 'F'}, + {"01EVTV", 'F'}, + {"01EVUE", 'F'}, + {"01F()1", 'F'}, + {"01F()F", 'F'}, + {"01F()K", 'F'}, + {"01F()N", 'F'}, + {"01F()O", 'F'}, + {"01F()S", 'F'}, + {"01F()U", 'F'}, + {"01F()V", 'F'}, + {"01F(1)", 'F'}, + {"01F(1N", 'F'}, + {"01F(1O", 'F'}, + {"01F(E(", 'F'}, + {"01F(E1", 'F'}, + {"01F(EF", 'F'}, + {"01F(EK", 'F'}, + {"01F(EN", 'F'}, + {"01F(ES", 'F'}, + {"01F(EV", 'F'}, + {"01F(F(", 'F'}, + {"01F(N)", 'F'}, + {"01F(N,", 'F'}, + {"01F(NO", 'F'}, + {"01F(S)", 'F'}, + {"01F(SO", 'F'}, + {"01F(V)", 'F'}, + {"01F(VO", 'F'}, + {"01K(1O", 'F'}, + {"01K(F(", 'F'}, + {"01K(N)", 'F'}, + {"01K(NO", 'F'}, + {"01K(S)", 'F'}, + {"01K(SO", 'F'}, + {"01K(V)", 'F'}, + {"01K(VO", 'F'}, + {"01K)&(", 'F'}, + {"01K)&1", 'F'}, + {"01K)&F", 'F'}, + {"01K)&N", 'F'}, + {"01K)&S", 'F'}, + {"01K)&V", 'F'}, + {"01K);E", 'F'}, + {"01K);T", 'F'}, + {"01K)B(", 'F'}, + {"01K)B1", 'F'}, + {"01K)BF", 'F'}, + {"01K)BN", 'F'}, + {"01K)BS", 'F'}, + {"01K)BV", 'F'}, + {"01K)E(", 'F'}, + {"01K)E1", 'F'}, + {"01K)EF", 'F'}, + {"01K)EK", 'F'}, + {"01K)EN", 'F'}, + {"01K)ES", 'F'}, + {"01K)EV", 'F'}, + {"01K)F(", 'F'}, + {"01K)O(", 'F'}, + {"01K)OF", 'F'}, + {"01K)UE", 'F'}, + {"01K1", 'F'}, + {"01K1&(", 'F'}, + {"01K1&1", 'F'}, + {"01K1&F", 'F'}, + {"01K1&N", 'F'}, + {"01K1&S", 'F'}, + {"01K1&V", 'F'}, + {"01K1;", 'F'}, + {"01K1;C", 'F'}, + {"01K1;E", 'F'}, + {"01K1;T", 'F'}, + {"01K1B(", 'F'}, + {"01K1B1", 'F'}, + {"01K1BF", 'F'}, + {"01K1BN", 'F'}, + {"01K1BS", 'F'}, + {"01K1BV", 'F'}, + {"01K1C", 'F'}, + {"01K1E(", 'F'}, + {"01K1E1", 'F'}, + {"01K1EF", 'F'}, + {"01K1EK", 'F'}, + {"01K1EN", 'F'}, + {"01K1ES", 'F'}, + {"01K1EV", 'F'}, + {"01K1O(", 'F'}, + {"01K1OF", 'F'}, + {"01K1OS", 'F'}, + {"01K1OV", 'F'}, + {"01K1U(", 'F'}, + {"01K1UE", 'F'}, + {"01KF()", 'F'}, + {"01KF(1", 'F'}, + {"01KF(F", 'F'}, + {"01KF(N", 'F'}, + {"01KF(S", 'F'}, + {"01KF(V", 'F'}, + {"01KN", 'F'}, + {"01KN&(", 'F'}, + {"01KN&1", 'F'}, + {"01KN&F", 'F'}, + {"01KN&N", 'F'}, + {"01KN&S", 'F'}, + {"01KN&V", 'F'}, + {"01KN;", 'F'}, + {"01KN;C", 'F'}, + {"01KN;E", 'F'}, + {"01KN;T", 'F'}, + {"01KNB(", 'F'}, + {"01KNB1", 'F'}, + {"01KNBF", 'F'}, + {"01KNBN", 'F'}, + {"01KNBS", 'F'}, + {"01KNBV", 'F'}, + {"01KNC", 'F'}, + {"01KNE(", 'F'}, + {"01KNE1", 'F'}, + {"01KNEF", 'F'}, + {"01KNEN", 'F'}, + {"01KNES", 'F'}, + {"01KNEV", 'F'}, + {"01KNU(", 'F'}, + {"01KNUE", 'F'}, + {"01KS", 'F'}, + {"01KS&(", 'F'}, + {"01KS&1", 'F'}, + {"01KS&F", 'F'}, + {"01KS&N", 'F'}, + {"01KS&S", 'F'}, + {"01KS&V", 'F'}, + {"01KS;", 'F'}, + {"01KS;C", 'F'}, + {"01KS;E", 'F'}, + {"01KS;T", 'F'}, + {"01KSB(", 'F'}, + {"01KSB1", 'F'}, + {"01KSBF", 'F'}, + {"01KSBN", 'F'}, + {"01KSBS", 'F'}, + {"01KSBV", 'F'}, + {"01KSC", 'F'}, + {"01KSE(", 'F'}, + {"01KSE1", 'F'}, + {"01KSEF", 'F'}, + {"01KSEK", 'F'}, + {"01KSEN", 'F'}, + {"01KSES", 'F'}, + {"01KSEV", 'F'}, + {"01KSO(", 'F'}, + {"01KSO1", 'F'}, + {"01KSOF", 'F'}, + {"01KSON", 'F'}, + {"01KSOS", 'F'}, + {"01KSOV", 'F'}, + {"01KSU(", 'F'}, + {"01KSUE", 'F'}, + {"01KUE(", 'F'}, + {"01KUE1", 'F'}, + {"01KUEF", 'F'}, + {"01KUEK", 'F'}, + {"01KUEN", 'F'}, + {"01KUES", 'F'}, + {"01KUEV", 'F'}, + {"01KV", 'F'}, + {"01KV&(", 'F'}, + {"01KV&1", 'F'}, + {"01KV&F", 'F'}, + {"01KV&N", 'F'}, + {"01KV&S", 'F'}, + {"01KV&V", 'F'}, + {"01KV;", 'F'}, + {"01KV;C", 'F'}, + {"01KV;E", 'F'}, + {"01KV;T", 'F'}, + {"01KVB(", 'F'}, + {"01KVB1", 'F'}, + {"01KVBF", 'F'}, + {"01KVBN", 'F'}, + {"01KVBS", 'F'}, + {"01KVBV", 'F'}, + {"01KVC", 'F'}, + {"01KVE(", 'F'}, + {"01KVE1", 'F'}, + {"01KVEF", 'F'}, + {"01KVEK", 'F'}, + {"01KVEN", 'F'}, + {"01KVES", 'F'}, + {"01KVEV", 'F'}, + {"01KVO(", 'F'}, + {"01KVOF", 'F'}, + {"01KVOS", 'F'}, + {"01KVU(", 'F'}, + {"01KVUE", 'F'}, + {"01N&F(", 'F'}, + {"01N(1O", 'F'}, + {"01N(F(", 'F'}, + {"01N(S)", 'F'}, + {"01N(SO", 'F'}, + {"01N(V)", 'F'}, + {"01N(VO", 'F'}, + {"01N)UE", 'F'}, + {"01N,F(", 'F'}, + {"01NE(1", 'F'}, + {"01NE(F", 'F'}, + {"01NE(N", 'F'}, + {"01NE(S", 'F'}, + {"01NE(V", 'F'}, + {"01NE1C", 'F'}, + {"01NE1O", 'F'}, + {"01NEF(", 'F'}, + {"01NENC", 'F'}, + {"01NENO", 'F'}, + {"01NESC", 'F'}, + {"01NESO", 'F'}, + {"01NEVC", 'F'}, + {"01NEVO", 'F'}, + {"01NU(E", 'F'}, + {"01NUE", 'F'}, + {"01NUE(", 'F'}, + {"01NUE1", 'F'}, + {"01NUE;", 'F'}, + {"01NUEC", 'F'}, + {"01NUEF", 'F'}, + {"01NUEK", 'F'}, + {"01NUEN", 'F'}, + {"01NUES", 'F'}, + {"01NUEV", 'F'}, + {"01O(1&", 'F'}, + {"01O(1)", 'F'}, + {"01O(1,", 'F'}, + {"01O(1O", 'F'}, + {"01O(E(", 'F'}, + {"01O(E1", 'F'}, + {"01O(EE", 'F'}, + {"01O(EF", 'F'}, + {"01O(EK", 'F'}, + {"01O(EN", 'F'}, + {"01O(EO", 'F'}, + {"01O(ES", 'F'}, + {"01O(EV", 'F'}, + {"01O(F(", 'F'}, + {"01O(N&", 'F'}, + {"01O(N)", 'F'}, + {"01O(N,", 'F'}, + {"01O(NO", 'F'}, + {"01O(S&", 'F'}, + {"01O(S)", 'F'}, + {"01O(S,", 'F'}, + {"01O(SO", 'F'}, + {"01O(V&", 'F'}, + {"01O(V)", 'F'}, + {"01O(V,", 'F'}, + {"01O(VO", 'F'}, + {"01OF()", 'F'}, + {"01OF(1", 'F'}, + {"01OF(E", 'F'}, + {"01OF(F", 'F'}, + {"01OF(N", 'F'}, + {"01OF(S", 'F'}, + {"01OF(V", 'F'}, + {"01OK&(", 'F'}, + {"01OK&1", 'F'}, + {"01OK&F", 'F'}, + {"01OK&N", 'F'}, + {"01OK&S", 'F'}, + {"01OK&V", 'F'}, + {"01OK(1", 'F'}, + {"01OK(F", 'F'}, + {"01OK(N", 'F'}, + {"01OK(S", 'F'}, + {"01OK(V", 'F'}, + {"01OK1C", 'F'}, + {"01OK1O", 'F'}, + {"01OKF(", 'F'}, + {"01OKNC", 'F'}, + {"01OKO(", 'F'}, + {"01OKO1", 'F'}, + {"01OKOF", 'F'}, + {"01OKON", 'F'}, + {"01OKOS", 'F'}, + {"01OKOV", 'F'}, + {"01OKSC", 'F'}, + {"01OKSO", 'F'}, + {"01OKVC", 'F'}, + {"01OKVO", 'F'}, + {"01ONSU", 'F'}, + {"01OS&(", 'F'}, + {"01OS&1", 'F'}, + {"01OS&E", 'F'}, + {"01OS&F", 'F'}, + {"01OS&K", 'F'}, + {"01OS&N", 'F'}, + {"01OS&S", 'F'}, + {"01OS&U", 'F'}, + {"01OS&V", 'F'}, + {"01OS(E", 'F'}, + {"01OS(U", 'F'}, + {"01OS)&", 'F'}, + {"01OS),", 'F'}, + {"01OS);", 'F'}, + {"01OS)B", 'F'}, + {"01OS)C", 'F'}, + {"01OS)E", 'F'}, + {"01OS)F", 'F'}, + {"01OS)K", 'F'}, + {"01OS)O", 'F'}, + {"01OS)U", 'F'}, + {"01OS,(", 'F'}, + {"01OS,F", 'F'}, + {"01OS1(", 'F'}, + {"01OS1F", 'F'}, + {"01OS1N", 'F'}, + {"01OS1S", 'F'}, + {"01OS1U", 'F'}, + {"01OS1V", 'F'}, + {"01OS;", 'F'}, + {"01OS;C", 'F'}, + {"01OS;E", 'F'}, + {"01OS;N", 'F'}, + {"01OS;T", 'F'}, + {"01OSA(", 'F'}, + {"01OSAF", 'F'}, + {"01OSAS", 'F'}, + {"01OSAT", 'F'}, + {"01OSAV", 'F'}, + {"01OSB(", 'F'}, + {"01OSB1", 'F'}, + {"01OSBE", 'F'}, + {"01OSBF", 'F'}, + {"01OSBN", 'F'}, + {"01OSBS", 'F'}, + {"01OSBV", 'F'}, + {"01OSC", 'F'}, + {"01OSE(", 'F'}, + {"01OSE1", 'F'}, + {"01OSEF", 'F'}, + {"01OSEK", 'F'}, + {"01OSEN", 'F'}, + {"01OSEO", 'F'}, + {"01OSES", 'F'}, + {"01OSEU", 'F'}, + {"01OSEV", 'F'}, + {"01OSF(", 'F'}, + {"01OSK(", 'F'}, + {"01OSK)", 'F'}, + {"01OSK1", 'F'}, + {"01OSKB", 'F'}, + {"01OSKF", 'F'}, + {"01OSKN", 'F'}, + {"01OSKS", 'F'}, + {"01OSKU", 'F'}, + {"01OSKV", 'F'}, + {"01OST(", 'F'}, + {"01OST1", 'F'}, + {"01OSTE", 'F'}, + {"01OSTF", 'F'}, + {"01OSTN", 'F'}, + {"01OSTS", 'F'}, + {"01OSTT", 'F'}, + {"01OSTV", 'F'}, + {"01OSU", 'F'}, + {"01OSU(", 'F'}, + {"01OSU1", 'F'}, + {"01OSU;", 'F'}, + {"01OSUC", 'F'}, + {"01OSUE", 'F'}, + {"01OSUF", 'F'}, + {"01OSUK", 'F'}, + {"01OSUO", 'F'}, + {"01OSUS", 'F'}, + {"01OSUT", 'F'}, + {"01OSUV", 'F'}, + {"01OSV(", 'F'}, + {"01OSVF", 'F'}, + {"01OSVO", 'F'}, + {"01OSVS", 'F'}, + {"01OSVU", 'F'}, + {"01OU(E", 'F'}, + {"01OUEK", 'F'}, + {"01OUEN", 'F'}, + {"01OV", 'F'}, + {"01OV&(", 'F'}, + {"01OV&1", 'F'}, + {"01OV&E", 'F'}, + {"01OV&F", 'F'}, + {"01OV&K", 'F'}, + {"01OV&N", 'F'}, + {"01OV&S", 'F'}, + {"01OV&U", 'F'}, + {"01OV&V", 'F'}, + {"01OV(E", 'F'}, + {"01OV(U", 'F'}, + {"01OV)&", 'F'}, + {"01OV),", 'F'}, + {"01OV);", 'F'}, + {"01OV)B", 'F'}, + {"01OV)C", 'F'}, + {"01OV)E", 'F'}, + {"01OV)F", 'F'}, + {"01OV)K", 'F'}, + {"01OV)O", 'F'}, + {"01OV)U", 'F'}, + {"01OV,(", 'F'}, + {"01OV,F", 'F'}, + {"01OV;", 'F'}, + {"01OV;C", 'F'}, + {"01OV;E", 'F'}, + {"01OV;N", 'F'}, + {"01OV;T", 'F'}, + {"01OVA(", 'F'}, + {"01OVAF", 'F'}, + {"01OVAS", 'F'}, + {"01OVAT", 'F'}, + {"01OVAV", 'F'}, + {"01OVB(", 'F'}, + {"01OVB1", 'F'}, + {"01OVBE", 'F'}, + {"01OVBF", 'F'}, + {"01OVBN", 'F'}, + {"01OVBS", 'F'}, + {"01OVBV", 'F'}, + {"01OVC", 'F'}, + {"01OVE(", 'F'}, + {"01OVE1", 'F'}, + {"01OVEF", 'F'}, + {"01OVEK", 'F'}, + {"01OVEN", 'F'}, + {"01OVEO", 'F'}, + {"01OVES", 'F'}, + {"01OVEU", 'F'}, + {"01OVEV", 'F'}, + {"01OVF(", 'F'}, + {"01OVK(", 'F'}, + {"01OVK)", 'F'}, + {"01OVK1", 'F'}, + {"01OVKB", 'F'}, + {"01OVKF", 'F'}, + {"01OVKN", 'F'}, + {"01OVKS", 'F'}, + {"01OVKU", 'F'}, + {"01OVKV", 'F'}, + {"01OVO(", 'F'}, + {"01OVOF", 'F'}, + {"01OVOK", 'F'}, + {"01OVOS", 'F'}, + {"01OVOU", 'F'}, + {"01OVS(", 'F'}, + {"01OVS1", 'F'}, + {"01OVSF", 'F'}, + {"01OVSO", 'F'}, + {"01OVSU", 'F'}, + {"01OVSV", 'F'}, + {"01OVT(", 'F'}, + {"01OVT1", 'F'}, + {"01OVTE", 'F'}, + {"01OVTF", 'F'}, + {"01OVTN", 'F'}, + {"01OVTS", 'F'}, + {"01OVTT", 'F'}, + {"01OVTV", 'F'}, + {"01OVU", 'F'}, + {"01OVU(", 'F'}, + {"01OVU1", 'F'}, + {"01OVU;", 'F'}, + {"01OVUC", 'F'}, + {"01OVUE", 'F'}, + {"01OVUF", 'F'}, + {"01OVUK", 'F'}, + {"01OVUO", 'F'}, + {"01OVUS", 'F'}, + {"01OVUT", 'F'}, + {"01OVUV", 'F'}, + {"01SF()", 'F'}, + {"01SF(1", 'F'}, + {"01SF(F", 'F'}, + {"01SF(N", 'F'}, + {"01SF(S", 'F'}, + {"01SF(V", 'F'}, + {"01SUE", 'F'}, + {"01SUE;", 'F'}, + {"01SUEC", 'F'}, + {"01SUEK", 'F'}, + {"01SV", 'F'}, + {"01SV;", 'F'}, + {"01SV;C", 'F'}, + {"01SVC", 'F'}, + {"01SVO(", 'F'}, + {"01SVOF", 'F'}, + {"01SVOS", 'F'}, + {"01T(1)", 'F'}, + {"01T(1O", 'F'}, + {"01T(F(", 'F'}, + {"01T(N)", 'F'}, + {"01T(NO", 'F'}, + {"01T(S)", 'F'}, + {"01T(SO", 'F'}, + {"01T(V)", 'F'}, + {"01T(VO", 'F'}, + {"01T1(F", 'F'}, + {"01T1O(", 'F'}, + {"01T1OF", 'F'}, + {"01T1OS", 'F'}, + {"01T1OV", 'F'}, + {"01TE(1", 'F'}, + {"01TE(F", 'F'}, + {"01TE(N", 'F'}, + {"01TE(S", 'F'}, + {"01TE(V", 'F'}, + {"01TE1N", 'F'}, + {"01TE1O", 'F'}, + {"01TEF(", 'F'}, + {"01TEK(", 'F'}, + {"01TEK1", 'F'}, + {"01TEKF", 'F'}, + {"01TEKN", 'F'}, + {"01TEKS", 'F'}, + {"01TEKV", 'F'}, + {"01TENN", 'F'}, + {"01TENO", 'F'}, + {"01TESN", 'F'}, + {"01TESO", 'F'}, + {"01TEVN", 'F'}, + {"01TEVO", 'F'}, + {"01TF()", 'F'}, + {"01TF(1", 'F'}, + {"01TF(F", 'F'}, + {"01TF(N", 'F'}, + {"01TF(S", 'F'}, + {"01TF(V", 'F'}, + {"01TN(1", 'F'}, + {"01TN(F", 'F'}, + {"01TN(S", 'F'}, + {"01TN(V", 'F'}, + {"01TN1C", 'F'}, + {"01TN1O", 'F'}, + {"01TN;E", 'F'}, + {"01TN;N", 'F'}, + {"01TN;T", 'F'}, + {"01TNE(", 'F'}, + {"01TNE1", 'F'}, + {"01TNEF", 'F'}, + {"01TNEN", 'F'}, + {"01TNES", 'F'}, + {"01TNEV", 'F'}, + {"01TNF(", 'F'}, + {"01TNKN", 'F'}, + {"01TNN:", 'F'}, + {"01TNNC", 'F'}, + {"01TNNO", 'F'}, + {"01TNO(", 'F'}, + {"01TNOF", 'F'}, + {"01TNOS", 'F'}, + {"01TNOV", 'F'}, + {"01TNSC", 'F'}, + {"01TNSO", 'F'}, + {"01TNT(", 'F'}, + {"01TNT1", 'F'}, + {"01TNTF", 'F'}, + {"01TNTN", 'F'}, + {"01TNTS", 'F'}, + {"01TNTV", 'F'}, + {"01TNVC", 'F'}, + {"01TNVO", 'F'}, + {"01TS(F", 'F'}, + {"01TSO(", 'F'}, + {"01TSO1", 'F'}, + {"01TSOF", 'F'}, + {"01TSON", 'F'}, + {"01TSOS", 'F'}, + {"01TSOV", 'F'}, + {"01TTNE", 'F'}, + {"01TTNK", 'F'}, + {"01TTNN", 'F'}, + {"01TTNT", 'F'}, + {"01TV(1", 'F'}, + {"01TV(F", 'F'}, + {"01TVO(", 'F'}, + {"01TVOF", 'F'}, + {"01TVOS", 'F'}, + {"01U", 'F'}, + {"01U(1)", 'F'}, + {"01U(1O", 'F'}, + {"01U(E(", 'F'}, + {"01U(E1", 'F'}, + {"01U(EF", 'F'}, + {"01U(EK", 'F'}, + {"01U(EN", 'F'}, + {"01U(ES", 'F'}, + {"01U(EV", 'F'}, + {"01U(F(", 'F'}, + {"01U(N)", 'F'}, + {"01U(NO", 'F'}, + {"01U(S)", 'F'}, + {"01U(SO", 'F'}, + {"01U(V)", 'F'}, + {"01U(VO", 'F'}, + {"01U1,(", 'F'}, + {"01U1,F", 'F'}, + {"01U1C", 'F'}, + {"01U1O(", 'F'}, + {"01U1OF", 'F'}, + {"01U1OS", 'F'}, + {"01U1OV", 'F'}, + {"01U;", 'F'}, + {"01U;C", 'F'}, + {"01UC", 'F'}, + {"01UE", 'F'}, + {"01UE(1", 'F'}, + {"01UE(E", 'F'}, + {"01UE(F", 'F'}, + {"01UE(N", 'F'}, + {"01UE(O", 'F'}, + {"01UE(S", 'F'}, + {"01UE(V", 'F'}, + {"01UE1", 'F'}, + {"01UE1&", 'F'}, + {"01UE1(", 'F'}, + {"01UE1)", 'F'}, + {"01UE1,", 'F'}, + {"01UE1;", 'F'}, + {"01UE1B", 'F'}, + {"01UE1C", 'F'}, + {"01UE1F", 'F'}, + {"01UE1K", 'F'}, + {"01UE1N", 'F'}, + {"01UE1O", 'F'}, + {"01UE1S", 'F'}, + {"01UE1U", 'F'}, + {"01UE1V", 'F'}, + {"01UE;", 'F'}, + {"01UE;C", 'F'}, + {"01UEC", 'F'}, + {"01UEF", 'F'}, + {"01UEF(", 'F'}, + {"01UEF,", 'F'}, + {"01UEF;", 'F'}, + {"01UEFC", 'F'}, + {"01UEK", 'F'}, + {"01UEK(", 'F'}, + {"01UEK1", 'F'}, + {"01UEK;", 'F'}, + {"01UEKC", 'F'}, + {"01UEKF", 'F'}, + {"01UEKN", 'F'}, + {"01UEKO", 'F'}, + {"01UEKS", 'F'}, + {"01UEKV", 'F'}, + {"01UEN", 'F'}, + {"01UEN&", 'F'}, + {"01UEN(", 'F'}, + {"01UEN)", 'F'}, + {"01UEN,", 'F'}, + {"01UEN1", 'F'}, + {"01UEN;", 'F'}, + {"01UENB", 'F'}, + {"01UENC", 'F'}, + {"01UENF", 'F'}, + {"01UENK", 'F'}, + {"01UENN", 'F'}, + {"01UENO", 'F'}, + {"01UENS", 'F'}, + {"01UENU", 'F'}, + {"01UEOK", 'F'}, + {"01UEON", 'F'}, + {"01UES", 'F'}, + {"01UES&", 'F'}, + {"01UES(", 'F'}, + {"01UES)", 'F'}, + {"01UES,", 'F'}, + {"01UES1", 'F'}, + {"01UES;", 'F'}, + {"01UESB", 'F'}, + {"01UESC", 'F'}, + {"01UESF", 'F'}, + {"01UESK", 'F'}, + {"01UESO", 'F'}, + {"01UESU", 'F'}, + {"01UESV", 'F'}, + {"01UEV", 'F'}, + {"01UEV&", 'F'}, + {"01UEV(", 'F'}, + {"01UEV)", 'F'}, + {"01UEV,", 'F'}, + {"01UEV;", 'F'}, + {"01UEVB", 'F'}, + {"01UEVC", 'F'}, + {"01UEVF", 'F'}, + {"01UEVK", 'F'}, + {"01UEVN", 'F'}, + {"01UEVO", 'F'}, + {"01UEVS", 'F'}, + {"01UEVU", 'F'}, + {"01UF()", 'F'}, + {"01UF(1", 'F'}, + {"01UF(F", 'F'}, + {"01UF(N", 'F'}, + {"01UF(S", 'F'}, + {"01UF(V", 'F'}, + {"01UK(E", 'F'}, + {"01UO(E", 'F'}, + {"01UON(", 'F'}, + {"01UON1", 'F'}, + {"01UONF", 'F'}, + {"01UONS", 'F'}, + {"01US,(", 'F'}, + {"01US,F", 'F'}, + {"01USC", 'F'}, + {"01USO(", 'F'}, + {"01USO1", 'F'}, + {"01USOF", 'F'}, + {"01USON", 'F'}, + {"01USOS", 'F'}, + {"01USOV", 'F'}, + {"01UTN(", 'F'}, + {"01UTN1", 'F'}, + {"01UTNF", 'F'}, + {"01UTNN", 'F'}, + {"01UTNS", 'F'}, + {"01UTNV", 'F'}, + {"01UV,(", 'F'}, + {"01UV,F", 'F'}, + {"01UVC", 'F'}, + {"01UVO(", 'F'}, + {"01UVOF", 'F'}, + {"01UVOS", 'F'}, + {"01VF()", 'F'}, + {"01VF(1", 'F'}, + {"01VF(F", 'F'}, + {"01VF(N", 'F'}, + {"01VF(S", 'F'}, + {"01VF(V", 'F'}, + {"01VO(1", 'F'}, + {"01VO(F", 'F'}, + {"01VO(N", 'F'}, + {"01VO(S", 'F'}, + {"01VO(V", 'F'}, + {"01VOF(", 'F'}, + {"01VOS(", 'F'}, + {"01VOS1", 'F'}, + {"01VOSF", 'F'}, + {"01VOSU", 'F'}, + {"01VOSV", 'F'}, + {"01VS", 'F'}, + {"01VS;", 'F'}, + {"01VS;C", 'F'}, + {"01VSC", 'F'}, + {"01VSO(", 'F'}, + {"01VSO1", 'F'}, + {"01VSOF", 'F'}, + {"01VSON", 'F'}, + {"01VSOS", 'F'}, + {"01VSOV", 'F'}, + {"01VUE", 'F'}, + {"01VUE;", 'F'}, + {"01VUEC", 'F'}, + {"01VUEK", 'F'}, + {"0;T(EF", 'F'}, + {"0;T(EK", 'F'}, + {"0;TKNC", 'F'}, + {"0E(1&(", 'F'}, + {"0E(1&1", 'F'}, + {"0E(1&F", 'F'}, + {"0E(1&N", 'F'}, + {"0E(1&S", 'F'}, + {"0E(1&V", 'F'}, + {"0E(1)&", 'F'}, + {"0E(1),", 'F'}, + {"0E(1)1", 'F'}, + {"0E(1);", 'F'}, + {"0E(1)B", 'F'}, + {"0E(1)C", 'F'}, + {"0E(1)F", 'F'}, + {"0E(1)K", 'F'}, + {"0E(1)N", 'F'}, + {"0E(1)O", 'F'}, + {"0E(1)S", 'F'}, + {"0E(1)U", 'F'}, + {"0E(1)V", 'F'}, + {"0E(1,F", 'F'}, + {"0E(1F(", 'F'}, + {"0E(1N)", 'F'}, + {"0E(1O(", 'F'}, + {"0E(1OF", 'F'}, + {"0E(1OS", 'F'}, + {"0E(1OV", 'F'}, + {"0E(1S)", 'F'}, + {"0E(1V)", 'F'}, + {"0E(1VO", 'F'}, + {"0E(E(1", 'F'}, + {"0E(E(E", 'F'}, + {"0E(E(F", 'F'}, + {"0E(E(N", 'F'}, + {"0E(E(S", 'F'}, + {"0E(E(V", 'F'}, + {"0E(E1&", 'F'}, + {"0E(E1)", 'F'}, + {"0E(E1O", 'F'}, + {"0E(EF(", 'F'}, + {"0E(EK(", 'F'}, + {"0E(EK1", 'F'}, + {"0E(EKF", 'F'}, + {"0E(EKN", 'F'}, + {"0E(EKS", 'F'}, + {"0E(EKV", 'F'}, + {"0E(EN&", 'F'}, + {"0E(EN)", 'F'}, + {"0E(ENO", 'F'}, + {"0E(ES&", 'F'}, + {"0E(ES)", 'F'}, + {"0E(ESO", 'F'}, + {"0E(EV&", 'F'}, + {"0E(EV)", 'F'}, + {"0E(EVO", 'F'}, + {"0E(F()", 'F'}, + {"0E(F(1", 'F'}, + {"0E(F(E", 'F'}, + {"0E(F(F", 'F'}, + {"0E(F(N", 'F'}, + {"0E(F(S", 'F'}, + {"0E(F(V", 'F'}, + {"0E(N&(", 'F'}, + {"0E(N&1", 'F'}, + {"0E(N&F", 'F'}, + {"0E(N&N", 'F'}, + {"0E(N&S", 'F'}, + {"0E(N&V", 'F'}, + {"0E(N(1", 'F'}, + {"0E(N(F", 'F'}, + {"0E(N(S", 'F'}, + {"0E(N(V", 'F'}, + {"0E(N)&", 'F'}, + {"0E(N),", 'F'}, + {"0E(N)1", 'F'}, + {"0E(N);", 'F'}, + {"0E(N)B", 'F'}, + {"0E(N)C", 'F'}, + {"0E(N)F", 'F'}, + {"0E(N)K", 'F'}, + {"0E(N)N", 'F'}, + {"0E(N)O", 'F'}, + {"0E(N)S", 'F'}, + {"0E(N)U", 'F'}, + {"0E(N)V", 'F'}, + {"0E(N,F", 'F'}, + {"0E(N1)", 'F'}, + {"0E(N1O", 'F'}, + {"0E(NF(", 'F'}, + {"0E(NO(", 'F'}, + {"0E(NOF", 'F'}, + {"0E(NOS", 'F'}, + {"0E(NOV", 'F'}, + {"0E(S&(", 'F'}, + {"0E(S&1", 'F'}, + {"0E(S&F", 'F'}, + {"0E(S&N", 'F'}, + {"0E(S&S", 'F'}, + {"0E(S&V", 'F'}, + {"0E(S)&", 'F'}, + {"0E(S),", 'F'}, + {"0E(S)1", 'F'}, + {"0E(S);", 'F'}, + {"0E(S)B", 'F'}, + {"0E(S)C", 'F'}, + {"0E(S)F", 'F'}, + {"0E(S)K", 'F'}, + {"0E(S)N", 'F'}, + {"0E(S)O", 'F'}, + {"0E(S)S", 'F'}, + {"0E(S)U", 'F'}, + {"0E(S)V", 'F'}, + {"0E(S,F", 'F'}, + {"0E(S1)", 'F'}, + {"0E(SF(", 'F'}, + {"0E(SO(", 'F'}, + {"0E(SO1", 'F'}, + {"0E(SOF", 'F'}, + {"0E(SON", 'F'}, + {"0E(SOS", 'F'}, + {"0E(SOV", 'F'}, + {"0E(SV)", 'F'}, + {"0E(SVO", 'F'}, + {"0E(V&(", 'F'}, + {"0E(V&1", 'F'}, + {"0E(V&F", 'F'}, + {"0E(V&N", 'F'}, + {"0E(V&S", 'F'}, + {"0E(V&V", 'F'}, + {"0E(V)&", 'F'}, + {"0E(V),", 'F'}, + {"0E(V)1", 'F'}, + {"0E(V);", 'F'}, + {"0E(V)B", 'F'}, + {"0E(V)C", 'F'}, + {"0E(V)F", 'F'}, + {"0E(V)K", 'F'}, + {"0E(V)N", 'F'}, + {"0E(V)O", 'F'}, + {"0E(V)S", 'F'}, + {"0E(V)U", 'F'}, + {"0E(V)V", 'F'}, + {"0E(V,F", 'F'}, + {"0E(VF(", 'F'}, + {"0E(VO(", 'F'}, + {"0E(VOF", 'F'}, + {"0E(VOS", 'F'}, + {"0E(VS)", 'F'}, + {"0E(VSO", 'F'}, + {"0E1&(1", 'F'}, + {"0E1&(E", 'F'}, + {"0E1&(F", 'F'}, + {"0E1&(N", 'F'}, + {"0E1&(S", 'F'}, + {"0E1&(V", 'F'}, + {"0E1&1)", 'F'}, + {"0E1&1O", 'F'}, + {"0E1&F(", 'F'}, + {"0E1&N)", 'F'}, + {"0E1&NO", 'F'}, + {"0E1&S)", 'F'}, + {"0E1&SO", 'F'}, + {"0E1&V)", 'F'}, + {"0E1&VO", 'F'}, + {"0E1)", 'F'}, + {"0E1)&(", 'F'}, + {"0E1)&1", 'F'}, + {"0E1)&F", 'F'}, + {"0E1)&N", 'F'}, + {"0E1)&S", 'F'}, + {"0E1)&V", 'F'}, + {"0E1);", 'F'}, + {"0E1);(", 'F'}, + {"0E1);C", 'F'}, + {"0E1);E", 'F'}, + {"0E1);T", 'F'}, + {"0E1)C", 'F'}, + {"0E1)KN", 'F'}, + {"0E1)O(", 'F'}, + {"0E1)O1", 'F'}, + {"0E1)OF", 'F'}, + {"0E1)ON", 'F'}, + {"0E1)OS", 'F'}, + {"0E1)OV", 'F'}, + {"0E1)UE", 'F'}, + {"0E1,(1", 'F'}, + {"0E1,(F", 'F'}, + {"0E1,(N", 'F'}, + {"0E1,(S", 'F'}, + {"0E1,(V", 'F'}, + {"0E1,F(", 'F'}, + {"0E1;(E", 'F'}, + {"0E1B(1", 'F'}, + {"0E1B(F", 'F'}, + {"0E1B(N", 'F'}, + {"0E1B(S", 'F'}, + {"0E1B(V", 'F'}, + {"0E1B1)", 'F'}, + {"0E1B1O", 'F'}, + {"0E1BF(", 'F'}, + {"0E1BN)", 'F'}, + {"0E1BNO", 'F'}, + {"0E1BS)", 'F'}, + {"0E1BSO", 'F'}, + {"0E1BV)", 'F'}, + {"0E1BVO", 'F'}, + {"0E1F()", 'F'}, + {"0E1F(1", 'F'}, + {"0E1F(F", 'F'}, + {"0E1F(N", 'F'}, + {"0E1F(S", 'F'}, + {"0E1F(V", 'F'}, + {"0E1K(1", 'F'}, + {"0E1K(E", 'F'}, + {"0E1K(F", 'F'}, + {"0E1K(N", 'F'}, + {"0E1K(S", 'F'}, + {"0E1K(V", 'F'}, + {"0E1K1)", 'F'}, + {"0E1K1K", 'F'}, + {"0E1K1O", 'F'}, + {"0E1KF(", 'F'}, + {"0E1KN", 'F'}, + {"0E1KN)", 'F'}, + {"0E1KN;", 'F'}, + {"0E1KNC", 'F'}, + {"0E1KNK", 'F'}, + {"0E1KNU", 'F'}, + {"0E1KS)", 'F'}, + {"0E1KSK", 'F'}, + {"0E1KSO", 'F'}, + {"0E1KV)", 'F'}, + {"0E1KVK", 'F'}, + {"0E1KVO", 'F'}, + {"0E1N)U", 'F'}, + {"0E1N;", 'F'}, + {"0E1N;C", 'F'}, + {"0E1NC", 'F'}, + {"0E1NKN", 'F'}, + {"0E1O(1", 'F'}, + {"0E1O(E", 'F'}, + {"0E1O(F", 'F'}, + {"0E1O(N", 'F'}, + {"0E1O(S", 'F'}, + {"0E1O(V", 'F'}, + {"0E1OF(", 'F'}, + {"0E1OS&", 'F'}, + {"0E1OS(", 'F'}, + {"0E1OS)", 'F'}, + {"0E1OS,", 'F'}, + {"0E1OS1", 'F'}, + {"0E1OS;", 'F'}, + {"0E1OSB", 'F'}, + {"0E1OSF", 'F'}, + {"0E1OSK", 'F'}, + {"0E1OSU", 'F'}, + {"0E1OSV", 'F'}, + {"0E1OV&", 'F'}, + {"0E1OV(", 'F'}, + {"0E1OV)", 'F'}, + {"0E1OV,", 'F'}, + {"0E1OV;", 'F'}, + {"0E1OVB", 'F'}, + {"0E1OVF", 'F'}, + {"0E1OVK", 'F'}, + {"0E1OVO", 'F'}, + {"0E1OVS", 'F'}, + {"0E1OVU", 'F'}, + {"0E1S;", 'F'}, + {"0E1S;C", 'F'}, + {"0E1SC", 'F'}, + {"0E1U(E", 'F'}, + {"0E1UE(", 'F'}, + {"0E1UE1", 'F'}, + {"0E1UEF", 'F'}, + {"0E1UEK", 'F'}, + {"0E1UEN", 'F'}, + {"0E1UES", 'F'}, + {"0E1UEV", 'F'}, + {"0E1V", 'F'}, + {"0E1V;", 'F'}, + {"0E1V;C", 'F'}, + {"0E1VC", 'F'}, + {"0E1VO(", 'F'}, + {"0E1VOF", 'F'}, + {"0E1VOS", 'F'}, + {"0EE(F(", 'F'}, + {"0EEK(F", 'F'}, + {"0EF()&", 'F'}, + {"0EF(),", 'F'}, + {"0EF()1", 'F'}, + {"0EF();", 'F'}, + {"0EF()B", 'F'}, + {"0EF()F", 'F'}, + {"0EF()K", 'F'}, + {"0EF()N", 'F'}, + {"0EF()O", 'F'}, + {"0EF()S", 'F'}, + {"0EF()U", 'F'}, + {"0EF()V", 'F'}, + {"0EF(1&", 'F'}, + {"0EF(1)", 'F'}, + {"0EF(1,", 'F'}, + {"0EF(1O", 'F'}, + {"0EF(E(", 'F'}, + {"0EF(E1", 'F'}, + {"0EF(EF", 'F'}, + {"0EF(EK", 'F'}, + {"0EF(EN", 'F'}, + {"0EF(ES", 'F'}, + {"0EF(EV", 'F'}, + {"0EF(F(", 'F'}, + {"0EF(N&", 'F'}, + {"0EF(N)", 'F'}, + {"0EF(N,", 'F'}, + {"0EF(NO", 'F'}, + {"0EF(O)", 'F'}, + {"0EF(S&", 'F'}, + {"0EF(S)", 'F'}, + {"0EF(S,", 'F'}, + {"0EF(SO", 'F'}, + {"0EF(V&", 'F'}, + {"0EF(V)", 'F'}, + {"0EF(V,", 'F'}, + {"0EF(VO", 'F'}, + {"0EK(1&", 'F'}, + {"0EK(1(", 'F'}, + {"0EK(1)", 'F'}, + {"0EK(1,", 'F'}, + {"0EK(1F", 'F'}, + {"0EK(1N", 'F'}, + {"0EK(1O", 'F'}, + {"0EK(1S", 'F'}, + {"0EK(1V", 'F'}, + {"0EK(E(", 'F'}, + {"0EK(E1", 'F'}, + {"0EK(EF", 'F'}, + {"0EK(EK", 'F'}, + {"0EK(EN", 'F'}, + {"0EK(ES", 'F'}, + {"0EK(EV", 'F'}, + {"0EK(F(", 'F'}, + {"0EK(N&", 'F'}, + {"0EK(N(", 'F'}, + {"0EK(N)", 'F'}, + {"0EK(N,", 'F'}, + {"0EK(N1", 'F'}, + {"0EK(NF", 'F'}, + {"0EK(NO", 'F'}, + {"0EK(S&", 'F'}, + {"0EK(S(", 'F'}, + {"0EK(S)", 'F'}, + {"0EK(S,", 'F'}, + {"0EK(S1", 'F'}, + {"0EK(SF", 'F'}, + {"0EK(SO", 'F'}, + {"0EK(SV", 'F'}, + {"0EK(V&", 'F'}, + {"0EK(V(", 'F'}, + {"0EK(V)", 'F'}, + {"0EK(V,", 'F'}, + {"0EK(VF", 'F'}, + {"0EK(VO", 'F'}, + {"0EK(VS", 'F'}, + {"0EK1&(", 'F'}, + {"0EK1&1", 'F'}, + {"0EK1&F", 'F'}, + {"0EK1&N", 'F'}, + {"0EK1&S", 'F'}, + {"0EK1&V", 'F'}, + {"0EK1)", 'F'}, + {"0EK1)&", 'F'}, + {"0EK1);", 'F'}, + {"0EK1)C", 'F'}, + {"0EK1)K", 'F'}, + {"0EK1)O", 'F'}, + {"0EK1)U", 'F'}, + {"0EK1,(", 'F'}, + {"0EK1,F", 'F'}, + {"0EK1;(", 'F'}, + {"0EK1B(", 'F'}, + {"0EK1B1", 'F'}, + {"0EK1BF", 'F'}, + {"0EK1BN", 'F'}, + {"0EK1BS", 'F'}, + {"0EK1BV", 'F'}, + {"0EK1F(", 'F'}, + {"0EK1K(", 'F'}, + {"0EK1K1", 'F'}, + {"0EK1KF", 'F'}, + {"0EK1KN", 'F'}, + {"0EK1KS", 'F'}, + {"0EK1KV", 'F'}, + {"0EK1N", 'F'}, + {"0EK1N)", 'F'}, + {"0EK1N;", 'F'}, + {"0EK1NC", 'F'}, + {"0EK1NK", 'F'}, + {"0EK1O(", 'F'}, + {"0EK1OF", 'F'}, + {"0EK1OS", 'F'}, + {"0EK1OV", 'F'}, + {"0EK1S", 'F'}, + {"0EK1S;", 'F'}, + {"0EK1SC", 'F'}, + {"0EK1SF", 'F'}, + {"0EK1SK", 'F'}, + {"0EK1U(", 'F'}, + {"0EK1UE", 'F'}, + {"0EK1V", 'F'}, + {"0EK1V;", 'F'}, + {"0EK1VC", 'F'}, + {"0EK1VF", 'F'}, + {"0EK1VK", 'F'}, + {"0EK1VO", 'F'}, + {"0EKE(F", 'F'}, + {"0EKEK(", 'F'}, + {"0EKF()", 'F'}, + {"0EKF(1", 'F'}, + {"0EKF(E", 'F'}, + {"0EKF(F", 'F'}, + {"0EKF(N", 'F'}, + {"0EKF(O", 'F'}, + {"0EKF(S", 'F'}, + {"0EKF(V", 'F'}, + {"0EKN&(", 'F'}, + {"0EKN&1", 'F'}, + {"0EKN&F", 'F'}, + {"0EKN&N", 'F'}, + {"0EKN&S", 'F'}, + {"0EKN&V", 'F'}, + {"0EKN(1", 'F'}, + {"0EKN(F", 'F'}, + {"0EKN(S", 'F'}, + {"0EKN(V", 'F'}, + {"0EKN)", 'F'}, + {"0EKN)&", 'F'}, + {"0EKN);", 'F'}, + {"0EKN)C", 'F'}, + {"0EKN)K", 'F'}, + {"0EKN)O", 'F'}, + {"0EKN)U", 'F'}, + {"0EKN,(", 'F'}, + {"0EKN,F", 'F'}, + {"0EKN1", 'F'}, + {"0EKN1;", 'F'}, + {"0EKN1C", 'F'}, + {"0EKN1K", 'F'}, + {"0EKN1O", 'F'}, + {"0EKN;(", 'F'}, + {"0EKNB(", 'F'}, + {"0EKNB1", 'F'}, + {"0EKNBF", 'F'}, + {"0EKNBN", 'F'}, + {"0EKNBS", 'F'}, + {"0EKNBV", 'F'}, + {"0EKNF(", 'F'}, + {"0EKNK(", 'F'}, + {"0EKNK1", 'F'}, + {"0EKNKF", 'F'}, + {"0EKNKN", 'F'}, + {"0EKNKS", 'F'}, + {"0EKNKV", 'F'}, + {"0EKNU(", 'F'}, + {"0EKNUE", 'F'}, + {"0EKO(1", 'F'}, + {"0EKO(F", 'F'}, + {"0EKO(N", 'F'}, + {"0EKO(S", 'F'}, + {"0EKO(V", 'F'}, + {"0EKOK(", 'F'}, + {"0EKOKN", 'F'}, + {"0EKS&(", 'F'}, + {"0EKS&1", 'F'}, + {"0EKS&F", 'F'}, + {"0EKS&N", 'F'}, + {"0EKS&S", 'F'}, + {"0EKS&V", 'F'}, + {"0EKS)", 'F'}, + {"0EKS)&", 'F'}, + {"0EKS);", 'F'}, + {"0EKS)C", 'F'}, + {"0EKS)K", 'F'}, + {"0EKS)O", 'F'}, + {"0EKS)U", 'F'}, + {"0EKS,(", 'F'}, + {"0EKS,F", 'F'}, + {"0EKS1", 'F'}, + {"0EKS1;", 'F'}, + {"0EKS1C", 'F'}, + {"0EKS1F", 'F'}, + {"0EKS1K", 'F'}, + {"0EKS;(", 'F'}, + {"0EKSB(", 'F'}, + {"0EKSB1", 'F'}, + {"0EKSBF", 'F'}, + {"0EKSBN", 'F'}, + {"0EKSBS", 'F'}, + {"0EKSBV", 'F'}, + {"0EKSF(", 'F'}, + {"0EKSK(", 'F'}, + {"0EKSK1", 'F'}, + {"0EKSKF", 'F'}, + {"0EKSKN", 'F'}, + {"0EKSKS", 'F'}, + {"0EKSKV", 'F'}, + {"0EKSO(", 'F'}, + {"0EKSO1", 'F'}, + {"0EKSOF", 'F'}, + {"0EKSON", 'F'}, + {"0EKSOS", 'F'}, + {"0EKSOV", 'F'}, + {"0EKSU(", 'F'}, + {"0EKSUE", 'F'}, + {"0EKSV", 'F'}, + {"0EKSV;", 'F'}, + {"0EKSVC", 'F'}, + {"0EKSVF", 'F'}, + {"0EKSVK", 'F'}, + {"0EKSVO", 'F'}, + {"0EKV&(", 'F'}, + {"0EKV&1", 'F'}, + {"0EKV&F", 'F'}, + {"0EKV&N", 'F'}, + {"0EKV&S", 'F'}, + {"0EKV&V", 'F'}, + {"0EKV)", 'F'}, + {"0EKV)&", 'F'}, + {"0EKV);", 'F'}, + {"0EKV)C", 'F'}, + {"0EKV)K", 'F'}, + {"0EKV)O", 'F'}, + {"0EKV)U", 'F'}, + {"0EKV,(", 'F'}, + {"0EKV,F", 'F'}, + {"0EKV;(", 'F'}, + {"0EKVB(", 'F'}, + {"0EKVB1", 'F'}, + {"0EKVBF", 'F'}, + {"0EKVBN", 'F'}, + {"0EKVBS", 'F'}, + {"0EKVBV", 'F'}, + {"0EKVF(", 'F'}, + {"0EKVK(", 'F'}, + {"0EKVK1", 'F'}, + {"0EKVKF", 'F'}, + {"0EKVKN", 'F'}, + {"0EKVKS", 'F'}, + {"0EKVKV", 'F'}, + {"0EKVO(", 'F'}, + {"0EKVOF", 'F'}, + {"0EKVOS", 'F'}, + {"0EKVS", 'F'}, + {"0EKVS;", 'F'}, + {"0EKVSC", 'F'}, + {"0EKVSF", 'F'}, + {"0EKVSK", 'F'}, + {"0EKVSO", 'F'}, + {"0EKVU(", 'F'}, + {"0EKVUE", 'F'}, + {"0EN&(1", 'F'}, + {"0EN&(E", 'F'}, + {"0EN&(F", 'F'}, + {"0EN&(N", 'F'}, + {"0EN&(S", 'F'}, + {"0EN&(V", 'F'}, + {"0EN&1)", 'F'}, + {"0EN&1O", 'F'}, + {"0EN&F(", 'F'}, + {"0EN&N)", 'F'}, + {"0EN&NO", 'F'}, + {"0EN&S)", 'F'}, + {"0EN&SO", 'F'}, + {"0EN&V)", 'F'}, + {"0EN&VO", 'F'}, + {"0EN(1O", 'F'}, + {"0EN(F(", 'F'}, + {"0EN(S)", 'F'}, + {"0EN(SO", 'F'}, + {"0EN(V)", 'F'}, + {"0EN(VO", 'F'}, + {"0EN)", 'F'}, + {"0EN)&(", 'F'}, + {"0EN)&1", 'F'}, + {"0EN)&F", 'F'}, + {"0EN)&N", 'F'}, + {"0EN)&S", 'F'}, + {"0EN)&V", 'F'}, + {"0EN);", 'F'}, + {"0EN);(", 'F'}, + {"0EN);C", 'F'}, + {"0EN);E", 'F'}, + {"0EN);T", 'F'}, + {"0EN)C", 'F'}, + {"0EN)KN", 'F'}, + {"0EN)O(", 'F'}, + {"0EN)O1", 'F'}, + {"0EN)OF", 'F'}, + {"0EN)ON", 'F'}, + {"0EN)OS", 'F'}, + {"0EN)OV", 'F'}, + {"0EN)UE", 'F'}, + {"0EN,(1", 'F'}, + {"0EN,(F", 'F'}, + {"0EN,(N", 'F'}, + {"0EN,(S", 'F'}, + {"0EN,(V", 'F'}, + {"0EN,F(", 'F'}, + {"0EN1;", 'F'}, + {"0EN1;C", 'F'}, + {"0EN1O(", 'F'}, + {"0EN1OF", 'F'}, + {"0EN1OS", 'F'}, + {"0EN1OV", 'F'}, + {"0EN;(E", 'F'}, + {"0ENB(1", 'F'}, + {"0ENB(F", 'F'}, + {"0ENB(N", 'F'}, + {"0ENB(S", 'F'}, + {"0ENB(V", 'F'}, + {"0ENB1)", 'F'}, + {"0ENB1O", 'F'}, + {"0ENBF(", 'F'}, + {"0ENBN)", 'F'}, + {"0ENBNO", 'F'}, + {"0ENBS)", 'F'}, + {"0ENBSO", 'F'}, + {"0ENBV)", 'F'}, + {"0ENBVO", 'F'}, + {"0ENF()", 'F'}, + {"0ENF(1", 'F'}, + {"0ENF(F", 'F'}, + {"0ENF(N", 'F'}, + {"0ENF(S", 'F'}, + {"0ENF(V", 'F'}, + {"0ENK(1", 'F'}, + {"0ENK(E", 'F'}, + {"0ENK(F", 'F'}, + {"0ENK(N", 'F'}, + {"0ENK(S", 'F'}, + {"0ENK(V", 'F'}, + {"0ENK1)", 'F'}, + {"0ENK1K", 'F'}, + {"0ENK1O", 'F'}, + {"0ENKF(", 'F'}, + {"0ENKN)", 'F'}, + {"0ENKN,", 'F'}, + {"0ENKN;", 'F'}, + {"0ENKNB", 'F'}, + {"0ENKNC", 'F'}, + {"0ENKNK", 'F'}, + {"0ENKNU", 'F'}, + {"0ENKS)", 'F'}, + {"0ENKSK", 'F'}, + {"0ENKSO", 'F'}, + {"0ENKV)", 'F'}, + {"0ENKVK", 'F'}, + {"0ENKVO", 'F'}, + {"0ENO(1", 'F'}, + {"0ENO(E", 'F'}, + {"0ENO(F", 'F'}, + {"0ENO(N", 'F'}, + {"0ENO(S", 'F'}, + {"0ENO(V", 'F'}, + {"0ENOF(", 'F'}, + {"0ENOS&", 'F'}, + {"0ENOS(", 'F'}, + {"0ENOS)", 'F'}, + {"0ENOS,", 'F'}, + {"0ENOS1", 'F'}, + {"0ENOS;", 'F'}, + {"0ENOSB", 'F'}, + {"0ENOSF", 'F'}, + {"0ENOSK", 'F'}, + {"0ENOSU", 'F'}, + {"0ENOSV", 'F'}, + {"0ENOV&", 'F'}, + {"0ENOV(", 'F'}, + {"0ENOV)", 'F'}, + {"0ENOV,", 'F'}, + {"0ENOV;", 'F'}, + {"0ENOVB", 'F'}, + {"0ENOVF", 'F'}, + {"0ENOVK", 'F'}, + {"0ENOVO", 'F'}, + {"0ENOVS", 'F'}, + {"0ENOVU", 'F'}, + {"0ENU(E", 'F'}, + {"0ENUE(", 'F'}, + {"0ENUE1", 'F'}, + {"0ENUEF", 'F'}, + {"0ENUEK", 'F'}, + {"0ENUEN", 'F'}, + {"0ENUES", 'F'}, + {"0ENUEV", 'F'}, + {"0EOK(E", 'F'}, + {"0EOKNK", 'F'}, + {"0ES&(1", 'F'}, + {"0ES&(E", 'F'}, + {"0ES&(F", 'F'}, + {"0ES&(N", 'F'}, + {"0ES&(S", 'F'}, + {"0ES&(V", 'F'}, + {"0ES&1)", 'F'}, + {"0ES&1O", 'F'}, + {"0ES&F(", 'F'}, + {"0ES&N)", 'F'}, + {"0ES&NO", 'F'}, + {"0ES&S)", 'F'}, + {"0ES&SO", 'F'}, + {"0ES&V)", 'F'}, + {"0ES&VO", 'F'}, + {"0ES)", 'F'}, + {"0ES)&(", 'F'}, + {"0ES)&1", 'F'}, + {"0ES)&F", 'F'}, + {"0ES)&N", 'F'}, + {"0ES)&S", 'F'}, + {"0ES)&V", 'F'}, + {"0ES);", 'F'}, + {"0ES);(", 'F'}, + {"0ES);C", 'F'}, + {"0ES);E", 'F'}, + {"0ES);T", 'F'}, + {"0ES)C", 'F'}, + {"0ES)KN", 'F'}, + {"0ES)O(", 'F'}, + {"0ES)O1", 'F'}, + {"0ES)OF", 'F'}, + {"0ES)ON", 'F'}, + {"0ES)OS", 'F'}, + {"0ES)OV", 'F'}, + {"0ES)UE", 'F'}, + {"0ES,(1", 'F'}, + {"0ES,(F", 'F'}, + {"0ES,(N", 'F'}, + {"0ES,(S", 'F'}, + {"0ES,(V", 'F'}, + {"0ES,F(", 'F'}, + {"0ES1", 'F'}, + {"0ES1;", 'F'}, + {"0ES1;C", 'F'}, + {"0ES1C", 'F'}, + {"0ES;(E", 'F'}, + {"0ESB(1", 'F'}, + {"0ESB(F", 'F'}, + {"0ESB(N", 'F'}, + {"0ESB(S", 'F'}, + {"0ESB(V", 'F'}, + {"0ESB1)", 'F'}, + {"0ESB1O", 'F'}, + {"0ESBF(", 'F'}, + {"0ESBN)", 'F'}, + {"0ESBNO", 'F'}, + {"0ESBS)", 'F'}, + {"0ESBSO", 'F'}, + {"0ESBV)", 'F'}, + {"0ESBVO", 'F'}, + {"0ESF()", 'F'}, + {"0ESF(1", 'F'}, + {"0ESF(F", 'F'}, + {"0ESF(N", 'F'}, + {"0ESF(S", 'F'}, + {"0ESF(V", 'F'}, + {"0ESK(1", 'F'}, + {"0ESK(E", 'F'}, + {"0ESK(F", 'F'}, + {"0ESK(N", 'F'}, + {"0ESK(S", 'F'}, + {"0ESK(V", 'F'}, + {"0ESK1)", 'F'}, + {"0ESK1K", 'F'}, + {"0ESK1O", 'F'}, + {"0ESKF(", 'F'}, + {"0ESKN", 'F'}, + {"0ESKN)", 'F'}, + {"0ESKN;", 'F'}, + {"0ESKNC", 'F'}, + {"0ESKNK", 'F'}, + {"0ESKNU", 'F'}, + {"0ESKS)", 'F'}, + {"0ESKSK", 'F'}, + {"0ESKSO", 'F'}, + {"0ESKV)", 'F'}, + {"0ESKVK", 'F'}, + {"0ESKVO", 'F'}, + {"0ESO(1", 'F'}, + {"0ESO(E", 'F'}, + {"0ESO(F", 'F'}, + {"0ESO(N", 'F'}, + {"0ESO(S", 'F'}, + {"0ESO(V", 'F'}, + {"0ESO1&", 'F'}, + {"0ESO1(", 'F'}, + {"0ESO1)", 'F'}, + {"0ESO1,", 'F'}, + {"0ESO1;", 'F'}, + {"0ESO1B", 'F'}, + {"0ESO1F", 'F'}, + {"0ESO1K", 'F'}, + {"0ESO1N", 'F'}, + {"0ESO1S", 'F'}, + {"0ESO1U", 'F'}, + {"0ESO1V", 'F'}, + {"0ESOF(", 'F'}, + {"0ESON&", 'F'}, + {"0ESON(", 'F'}, + {"0ESON)", 'F'}, + {"0ESON,", 'F'}, + {"0ESON1", 'F'}, + {"0ESON;", 'F'}, + {"0ESONB", 'F'}, + {"0ESONF", 'F'}, + {"0ESONK", 'F'}, + {"0ESONU", 'F'}, + {"0ESOS&", 'F'}, + {"0ESOS(", 'F'}, + {"0ESOS)", 'F'}, + {"0ESOS,", 'F'}, + {"0ESOS1", 'F'}, + {"0ESOS;", 'F'}, + {"0ESOSB", 'F'}, + {"0ESOSF", 'F'}, + {"0ESOSK", 'F'}, + {"0ESOSU", 'F'}, + {"0ESOSV", 'F'}, + {"0ESOV&", 'F'}, + {"0ESOV(", 'F'}, + {"0ESOV)", 'F'}, + {"0ESOV,", 'F'}, + {"0ESOV;", 'F'}, + {"0ESOVB", 'F'}, + {"0ESOVF", 'F'}, + {"0ESOVK", 'F'}, + {"0ESOVO", 'F'}, + {"0ESOVS", 'F'}, + {"0ESOVU", 'F'}, + {"0ESU(E", 'F'}, + {"0ESUE(", 'F'}, + {"0ESUE1", 'F'}, + {"0ESUEF", 'F'}, + {"0ESUEK", 'F'}, + {"0ESUEN", 'F'}, + {"0ESUES", 'F'}, + {"0ESUEV", 'F'}, + {"0ESV", 'F'}, + {"0ESV;", 'F'}, + {"0ESV;C", 'F'}, + {"0ESVC", 'F'}, + {"0ESVO(", 'F'}, + {"0ESVOF", 'F'}, + {"0ESVOS", 'F'}, + {"0EV&(1", 'F'}, + {"0EV&(E", 'F'}, + {"0EV&(F", 'F'}, + {"0EV&(N", 'F'}, + {"0EV&(S", 'F'}, + {"0EV&(V", 'F'}, + {"0EV&1)", 'F'}, + {"0EV&1O", 'F'}, + {"0EV&F(", 'F'}, + {"0EV&N)", 'F'}, + {"0EV&NO", 'F'}, + {"0EV&S)", 'F'}, + {"0EV&SO", 'F'}, + {"0EV&V)", 'F'}, + {"0EV&VO", 'F'}, + {"0EV)", 'F'}, + {"0EV)&(", 'F'}, + {"0EV)&1", 'F'}, + {"0EV)&F", 'F'}, + {"0EV)&N", 'F'}, + {"0EV)&S", 'F'}, + {"0EV)&V", 'F'}, + {"0EV);", 'F'}, + {"0EV);(", 'F'}, + {"0EV);C", 'F'}, + {"0EV);E", 'F'}, + {"0EV);T", 'F'}, + {"0EV)C", 'F'}, + {"0EV)KN", 'F'}, + {"0EV)O(", 'F'}, + {"0EV)O1", 'F'}, + {"0EV)OF", 'F'}, + {"0EV)ON", 'F'}, + {"0EV)OS", 'F'}, + {"0EV)OV", 'F'}, + {"0EV)UE", 'F'}, + {"0EV,(1", 'F'}, + {"0EV,(F", 'F'}, + {"0EV,(N", 'F'}, + {"0EV,(S", 'F'}, + {"0EV,(V", 'F'}, + {"0EV,F(", 'F'}, + {"0EV;(E", 'F'}, + {"0EVB(1", 'F'}, + {"0EVB(F", 'F'}, + {"0EVB(N", 'F'}, + {"0EVB(S", 'F'}, + {"0EVB(V", 'F'}, + {"0EVB1)", 'F'}, + {"0EVB1O", 'F'}, + {"0EVBF(", 'F'}, + {"0EVBN)", 'F'}, + {"0EVBNO", 'F'}, + {"0EVBS)", 'F'}, + {"0EVBSO", 'F'}, + {"0EVBV)", 'F'}, + {"0EVBVO", 'F'}, + {"0EVF()", 'F'}, + {"0EVF(1", 'F'}, + {"0EVF(F", 'F'}, + {"0EVF(N", 'F'}, + {"0EVF(S", 'F'}, + {"0EVF(V", 'F'}, + {"0EVK(1", 'F'}, + {"0EVK(E", 'F'}, + {"0EVK(F", 'F'}, + {"0EVK(N", 'F'}, + {"0EVK(S", 'F'}, + {"0EVK(V", 'F'}, + {"0EVK1)", 'F'}, + {"0EVK1K", 'F'}, + {"0EVK1O", 'F'}, + {"0EVKF(", 'F'}, + {"0EVKN", 'F'}, + {"0EVKN)", 'F'}, + {"0EVKN;", 'F'}, + {"0EVKNC", 'F'}, + {"0EVKNK", 'F'}, + {"0EVKNU", 'F'}, + {"0EVKS)", 'F'}, + {"0EVKSK", 'F'}, + {"0EVKSO", 'F'}, + {"0EVKV)", 'F'}, + {"0EVKVK", 'F'}, + {"0EVKVO", 'F'}, + {"0EVN", 'F'}, + {"0EVN)U", 'F'}, + {"0EVN;", 'F'}, + {"0EVN;C", 'F'}, + {"0EVNC", 'F'}, + {"0EVNKN", 'F'}, + {"0EVNO(", 'F'}, + {"0EVNOF", 'F'}, + {"0EVNOS", 'F'}, + {"0EVNOV", 'F'}, + {"0EVO(1", 'F'}, + {"0EVO(E", 'F'}, + {"0EVO(F", 'F'}, + {"0EVO(N", 'F'}, + {"0EVO(S", 'F'}, + {"0EVO(V", 'F'}, + {"0EVOF(", 'F'}, + {"0EVOS&", 'F'}, + {"0EVOS(", 'F'}, + {"0EVOS)", 'F'}, + {"0EVOS,", 'F'}, + {"0EVOS1", 'F'}, + {"0EVOS;", 'F'}, + {"0EVOSB", 'F'}, + {"0EVOSF", 'F'}, + {"0EVOSK", 'F'}, + {"0EVOSU", 'F'}, + {"0EVOSV", 'F'}, + {"0EVS", 'F'}, + {"0EVS;", 'F'}, + {"0EVS;C", 'F'}, + {"0EVSC", 'F'}, + {"0EVSO(", 'F'}, + {"0EVSO1", 'F'}, + {"0EVSOF", 'F'}, + {"0EVSON", 'F'}, + {"0EVSOS", 'F'}, + {"0EVSOV", 'F'}, + {"0EVU(E", 'F'}, + {"0EVUE(", 'F'}, + {"0EVUE1", 'F'}, + {"0EVUEF", 'F'}, + {"0EVUEK", 'F'}, + {"0EVUEN", 'F'}, + {"0EVUES", 'F'}, + {"0EVUEV", 'F'}, + {"0F()&(", 'F'}, + {"0F()&1", 'F'}, + {"0F()&E", 'F'}, + {"0F()&F", 'F'}, + {"0F()&K", 'F'}, + {"0F()&N", 'F'}, + {"0F()&S", 'F'}, + {"0F()&V", 'F'}, + {"0F(),(", 'F'}, + {"0F(),1", 'F'}, + {"0F(),F", 'F'}, + {"0F(),N", 'F'}, + {"0F(),S", 'F'}, + {"0F(),V", 'F'}, + {"0F()1(", 'F'}, + {"0F()1F", 'F'}, + {"0F()1N", 'F'}, + {"0F()1O", 'F'}, + {"0F()1S", 'F'}, + {"0F()1U", 'F'}, + {"0F()1V", 'F'}, + {"0F();E", 'F'}, + {"0F();N", 'F'}, + {"0F();T", 'F'}, + {"0F()A(", 'F'}, + {"0F()AF", 'F'}, + {"0F()AS", 'F'}, + {"0F()AT", 'F'}, + {"0F()AV", 'F'}, + {"0F()B(", 'F'}, + {"0F()B1", 'F'}, + {"0F()BE", 'F'}, + {"0F()BF", 'F'}, + {"0F()BN", 'F'}, + {"0F()BS", 'F'}, + {"0F()BV", 'F'}, + {"0F()C", 'F'}, + {"0F()E(", 'F'}, + {"0F()E1", 'F'}, + {"0F()EF", 'F'}, + {"0F()EK", 'F'}, + {"0F()EN", 'F'}, + {"0F()EO", 'F'}, + {"0F()ES", 'F'}, + {"0F()EU", 'F'}, + {"0F()EV", 'F'}, + {"0F()F(", 'F'}, + {"0F()K(", 'F'}, + {"0F()K)", 'F'}, + {"0F()K1", 'F'}, + {"0F()KF", 'F'}, + {"0F()KN", 'F'}, + {"0F()KS", 'F'}, + {"0F()KU", 'F'}, + {"0F()KV", 'F'}, + {"0F()N&", 'F'}, + {"0F()N(", 'F'}, + {"0F()N)", 'F'}, + {"0F()N,", 'F'}, + {"0F()N1", 'F'}, + {"0F()NE", 'F'}, + {"0F()NF", 'F'}, + {"0F()NO", 'F'}, + {"0F()NU", 'F'}, + {"0F()O(", 'F'}, + {"0F()O1", 'F'}, + {"0F()OF", 'F'}, + {"0F()OK", 'F'}, + {"0F()ON", 'F'}, + {"0F()OS", 'F'}, + {"0F()OU", 'F'}, + {"0F()OV", 'F'}, + {"0F()S(", 'F'}, + {"0F()S1", 'F'}, + {"0F()SF", 'F'}, + {"0F()SO", 'F'}, + {"0F()SU", 'F'}, + {"0F()SV", 'F'}, + {"0F()T(", 'F'}, + {"0F()T1", 'F'}, + {"0F()TE", 'F'}, + {"0F()TF", 'F'}, + {"0F()TN", 'F'}, + {"0F()TS", 'F'}, + {"0F()TT", 'F'}, + {"0F()TV", 'F'}, + {"0F()U", 'F'}, + {"0F()U(", 'F'}, + {"0F()U1", 'F'}, + {"0F()U;", 'F'}, + {"0F()UC", 'F'}, + {"0F()UE", 'F'}, + {"0F()UF", 'F'}, + {"0F()UK", 'F'}, + {"0F()UO", 'F'}, + {"0F()US", 'F'}, + {"0F()UT", 'F'}, + {"0F()UV", 'F'}, + {"0F()V(", 'F'}, + {"0F()VF", 'F'}, + {"0F()VO", 'F'}, + {"0F()VS", 'F'}, + {"0F()VU", 'F'}, + {"0F(1&(", 'F'}, + {"0F(1&1", 'F'}, + {"0F(1&F", 'F'}, + {"0F(1&N", 'F'}, + {"0F(1&S", 'F'}, + {"0F(1&V", 'F'}, + {"0F(1)", 'F'}, + {"0F(1)&", 'F'}, + {"0F(1),", 'F'}, + {"0F(1)1", 'F'}, + {"0F(1);", 'F'}, + {"0F(1)A", 'F'}, + {"0F(1)B", 'F'}, + {"0F(1)C", 'F'}, + {"0F(1)E", 'F'}, + {"0F(1)F", 'F'}, + {"0F(1)K", 'F'}, + {"0F(1)N", 'F'}, + {"0F(1)O", 'F'}, + {"0F(1)S", 'F'}, + {"0F(1)T", 'F'}, + {"0F(1)U", 'F'}, + {"0F(1)V", 'F'}, + {"0F(1,(", 'F'}, + {"0F(1,F", 'F'}, + {"0F(1O(", 'F'}, + {"0F(1OF", 'F'}, + {"0F(1OS", 'F'}, + {"0F(1OV", 'F'}, + {"0F(E(1", 'F'}, + {"0F(E(E", 'F'}, + {"0F(E(F", 'F'}, + {"0F(E(N", 'F'}, + {"0F(E(S", 'F'}, + {"0F(E(V", 'F'}, + {"0F(E1&", 'F'}, + {"0F(E1)", 'F'}, + {"0F(E1K", 'F'}, + {"0F(E1O", 'F'}, + {"0F(EF(", 'F'}, + {"0F(EK(", 'F'}, + {"0F(EK1", 'F'}, + {"0F(EKF", 'F'}, + {"0F(EKN", 'F'}, + {"0F(EKO", 'F'}, + {"0F(EKS", 'F'}, + {"0F(EKV", 'F'}, + {"0F(EN&", 'F'}, + {"0F(EN)", 'F'}, + {"0F(ENK", 'F'}, + {"0F(ENO", 'F'}, + {"0F(EOK", 'F'}, + {"0F(ES&", 'F'}, + {"0F(ES)", 'F'}, + {"0F(ESK", 'F'}, + {"0F(ESO", 'F'}, + {"0F(EV&", 'F'}, + {"0F(EV)", 'F'}, + {"0F(EVK", 'F'}, + {"0F(EVO", 'F'}, + {"0F(F()", 'F'}, + {"0F(F(1", 'F'}, + {"0F(F(E", 'F'}, + {"0F(F(F", 'F'}, + {"0F(F(N", 'F'}, + {"0F(F(S", 'F'}, + {"0F(F(V", 'F'}, + {"0F(K()", 'F'}, + {"0F(K,(", 'F'}, + {"0F(K,F", 'F'}, + {"0F(N&(", 'F'}, + {"0F(N&1", 'F'}, + {"0F(N&F", 'F'}, + {"0F(N&N", 'F'}, + {"0F(N&S", 'F'}, + {"0F(N&V", 'F'}, + {"0F(N)", 'F'}, + {"0F(N)&", 'F'}, + {"0F(N),", 'F'}, + {"0F(N)1", 'F'}, + {"0F(N);", 'F'}, + {"0F(N)A", 'F'}, + {"0F(N)B", 'F'}, + {"0F(N)C", 'F'}, + {"0F(N)E", 'F'}, + {"0F(N)F", 'F'}, + {"0F(N)K", 'F'}, + {"0F(N)N", 'F'}, + {"0F(N)O", 'F'}, + {"0F(N)S", 'F'}, + {"0F(N)T", 'F'}, + {"0F(N)U", 'F'}, + {"0F(N)V", 'F'}, + {"0F(N,(", 'F'}, + {"0F(N,F", 'F'}, + {"0F(NO(", 'F'}, + {"0F(NOF", 'F'}, + {"0F(NOS", 'F'}, + {"0F(NOV", 'F'}, + {"0F(S&(", 'F'}, + {"0F(S&1", 'F'}, + {"0F(S&F", 'F'}, + {"0F(S&N", 'F'}, + {"0F(S&S", 'F'}, + {"0F(S&V", 'F'}, + {"0F(S)", 'F'}, + {"0F(S)&", 'F'}, + {"0F(S),", 'F'}, + {"0F(S)1", 'F'}, + {"0F(S);", 'F'}, + {"0F(S)A", 'F'}, + {"0F(S)B", 'F'}, + {"0F(S)C", 'F'}, + {"0F(S)E", 'F'}, + {"0F(S)F", 'F'}, + {"0F(S)K", 'F'}, + {"0F(S)N", 'F'}, + {"0F(S)O", 'F'}, + {"0F(S)S", 'F'}, + {"0F(S)T", 'F'}, + {"0F(S)U", 'F'}, + {"0F(S)V", 'F'}, + {"0F(S,(", 'F'}, + {"0F(S,F", 'F'}, + {"0F(SO(", 'F'}, + {"0F(SO1", 'F'}, + {"0F(SOF", 'F'}, + {"0F(SON", 'F'}, + {"0F(SOS", 'F'}, + {"0F(SOV", 'F'}, + {"0F(T,(", 'F'}, + {"0F(T,F", 'F'}, + {"0F(V&(", 'F'}, + {"0F(V&1", 'F'}, + {"0F(V&F", 'F'}, + {"0F(V&N", 'F'}, + {"0F(V&S", 'F'}, + {"0F(V&V", 'F'}, + {"0F(V)", 'F'}, + {"0F(V)&", 'F'}, + {"0F(V),", 'F'}, + {"0F(V)1", 'F'}, + {"0F(V);", 'F'}, + {"0F(V)A", 'F'}, + {"0F(V)B", 'F'}, + {"0F(V)C", 'F'}, + {"0F(V)E", 'F'}, + {"0F(V)F", 'F'}, + {"0F(V)K", 'F'}, + {"0F(V)N", 'F'}, + {"0F(V)O", 'F'}, + {"0F(V)S", 'F'}, + {"0F(V)T", 'F'}, + {"0F(V)U", 'F'}, + {"0F(V)V", 'F'}, + {"0F(V,(", 'F'}, + {"0F(V,F", 'F'}, + {"0F(VO(", 'F'}, + {"0F(VOF", 'F'}, + {"0F(VOS", 'F'}, + {"0K(1),", 'F'}, + {"0K(1)A", 'F'}, + {"0K(1)K", 'F'}, + {"0K(1)O", 'F'}, + {"0K(1O(", 'F'}, + {"0K(1OF", 'F'}, + {"0K(1OS", 'F'}, + {"0K(1OV", 'F'}, + {"0K(F()", 'F'}, + {"0K(F(1", 'F'}, + {"0K(F(F", 'F'}, + {"0K(F(N", 'F'}, + {"0K(F(S", 'F'}, + {"0K(F(V", 'F'}, + {"0K(N),", 'F'}, + {"0K(N)A", 'F'}, + {"0K(N)K", 'F'}, + {"0K(N)O", 'F'}, + {"0K(NO(", 'F'}, + {"0K(NOF", 'F'}, + {"0K(NOS", 'F'}, + {"0K(NOV", 'F'}, + {"0K(S),", 'F'}, + {"0K(S)A", 'F'}, + {"0K(S)K", 'F'}, + {"0K(S)O", 'F'}, + {"0K(SO(", 'F'}, + {"0K(SO1", 'F'}, + {"0K(SOF", 'F'}, + {"0K(SON", 'F'}, + {"0K(SOS", 'F'}, + {"0K(SOV", 'F'}, + {"0K(V),", 'F'}, + {"0K(V)A", 'F'}, + {"0K(V)K", 'F'}, + {"0K(V)O", 'F'}, + {"0K(VO(", 'F'}, + {"0K(VOF", 'F'}, + {"0K(VOS", 'F'}, + {"0K1,(1", 'F'}, + {"0K1,(F", 'F'}, + {"0K1,(N", 'F'}, + {"0K1,(S", 'F'}, + {"0K1,(V", 'F'}, + {"0K1,F(", 'F'}, + {"0K1A(F", 'F'}, + {"0K1A(N", 'F'}, + {"0K1A(S", 'F'}, + {"0K1A(V", 'F'}, + {"0K1AF(", 'F'}, + {"0K1ASO", 'F'}, + {"0K1AVO", 'F'}, + {"0K1K(1", 'F'}, + {"0K1K(F", 'F'}, + {"0K1K(N", 'F'}, + {"0K1K(S", 'F'}, + {"0K1K(V", 'F'}, + {"0K1K1O", 'F'}, + {"0K1K1U", 'F'}, + {"0K1KF(", 'F'}, + {"0K1KNU", 'F'}, + {"0K1KSO", 'F'}, + {"0K1KSU", 'F'}, + {"0K1KVO", 'F'}, + {"0K1KVU", 'F'}, + {"0K1O(1", 'F'}, + {"0K1O(F", 'F'}, + {"0K1O(N", 'F'}, + {"0K1O(S", 'F'}, + {"0K1O(V", 'F'}, + {"0K1OF(", 'F'}, + {"0K1OS(", 'F'}, + {"0K1OS,", 'F'}, + {"0K1OS1", 'F'}, + {"0K1OSA", 'F'}, + {"0K1OSF", 'F'}, + {"0K1OSK", 'F'}, + {"0K1OSV", 'F'}, + {"0K1OV(", 'F'}, + {"0K1OV,", 'F'}, + {"0K1OVA", 'F'}, + {"0K1OVF", 'F'}, + {"0K1OVK", 'F'}, + {"0K1OVO", 'F'}, + {"0K1OVS", 'F'}, + {"0KF(),", 'F'}, + {"0KF()A", 'F'}, + {"0KF()K", 'F'}, + {"0KF()O", 'F'}, + {"0KF(1)", 'F'}, + {"0KF(1O", 'F'}, + {"0KF(F(", 'F'}, + {"0KF(N)", 'F'}, + {"0KF(NO", 'F'}, + {"0KF(S)", 'F'}, + {"0KF(SO", 'F'}, + {"0KF(V)", 'F'}, + {"0KF(VO", 'F'}, + {"0KN,(1", 'F'}, + {"0KN,(F", 'F'}, + {"0KN,(N", 'F'}, + {"0KN,(S", 'F'}, + {"0KN,(V", 'F'}, + {"0KN,F(", 'F'}, + {"0KNA(F", 'F'}, + {"0KNA(N", 'F'}, + {"0KNA(S", 'F'}, + {"0KNA(V", 'F'}, + {"0KNAF(", 'F'}, + {"0KNASO", 'F'}, + {"0KNAVO", 'F'}, + {"0KNK(1", 'F'}, + {"0KNK(F", 'F'}, + {"0KNK(N", 'F'}, + {"0KNK(S", 'F'}, + {"0KNK(V", 'F'}, + {"0KNK1O", 'F'}, + {"0KNK1U", 'F'}, + {"0KNKF(", 'F'}, + {"0KNKNU", 'F'}, + {"0KNKSO", 'F'}, + {"0KNKSU", 'F'}, + {"0KNKVO", 'F'}, + {"0KNKVU", 'F'}, + {"0KS,(1", 'F'}, + {"0KS,(F", 'F'}, + {"0KS,(N", 'F'}, + {"0KS,(S", 'F'}, + {"0KS,(V", 'F'}, + {"0KS,F(", 'F'}, + {"0KSA(F", 'F'}, + {"0KSA(N", 'F'}, + {"0KSA(S", 'F'}, + {"0KSA(V", 'F'}, + {"0KSAF(", 'F'}, + {"0KSASO", 'F'}, + {"0KSAVO", 'F'}, + {"0KSK(1", 'F'}, + {"0KSK(F", 'F'}, + {"0KSK(N", 'F'}, + {"0KSK(S", 'F'}, + {"0KSK(V", 'F'}, + {"0KSK1O", 'F'}, + {"0KSK1U", 'F'}, + {"0KSKF(", 'F'}, + {"0KSKNU", 'F'}, + {"0KSKSO", 'F'}, + {"0KSKSU", 'F'}, + {"0KSKVO", 'F'}, + {"0KSKVU", 'F'}, + {"0KSO(1", 'F'}, + {"0KSO(F", 'F'}, + {"0KSO(N", 'F'}, + {"0KSO(S", 'F'}, + {"0KSO(V", 'F'}, + {"0KSO1(", 'F'}, + {"0KSO1,", 'F'}, + {"0KSO1A", 'F'}, + {"0KSO1F", 'F'}, + {"0KSO1K", 'F'}, + {"0KSO1N", 'F'}, + {"0KSO1S", 'F'}, + {"0KSO1V", 'F'}, + {"0KSOF(", 'F'}, + {"0KSON(", 'F'}, + {"0KSON,", 'F'}, + {"0KSON1", 'F'}, + {"0KSONA", 'F'}, + {"0KSONF", 'F'}, + {"0KSONK", 'F'}, + {"0KSOS(", 'F'}, + {"0KSOS,", 'F'}, + {"0KSOS1", 'F'}, + {"0KSOSA", 'F'}, + {"0KSOSF", 'F'}, + {"0KSOSK", 'F'}, + {"0KSOSV", 'F'}, + {"0KSOV(", 'F'}, + {"0KSOV,", 'F'}, + {"0KSOVA", 'F'}, + {"0KSOVF", 'F'}, + {"0KSOVK", 'F'}, + {"0KSOVO", 'F'}, + {"0KSOVS", 'F'}, + {"0KV,(1", 'F'}, + {"0KV,(F", 'F'}, + {"0KV,(N", 'F'}, + {"0KV,(S", 'F'}, + {"0KV,(V", 'F'}, + {"0KV,F(", 'F'}, + {"0KVA(F", 'F'}, + {"0KVA(N", 'F'}, + {"0KVA(S", 'F'}, + {"0KVA(V", 'F'}, + {"0KVAF(", 'F'}, + {"0KVASO", 'F'}, + {"0KVAVO", 'F'}, + {"0KVK(1", 'F'}, + {"0KVK(F", 'F'}, + {"0KVK(N", 'F'}, + {"0KVK(S", 'F'}, + {"0KVK(V", 'F'}, + {"0KVK1O", 'F'}, + {"0KVK1U", 'F'}, + {"0KVKF(", 'F'}, + {"0KVKNU", 'F'}, + {"0KVKSO", 'F'}, + {"0KVKSU", 'F'}, + {"0KVKVO", 'F'}, + {"0KVKVU", 'F'}, + {"0KVO(1", 'F'}, + {"0KVO(F", 'F'}, + {"0KVO(N", 'F'}, + {"0KVO(S", 'F'}, + {"0KVO(V", 'F'}, + {"0KVOF(", 'F'}, + {"0KVOS(", 'F'}, + {"0KVOS,", 'F'}, + {"0KVOS1", 'F'}, + {"0KVOSA", 'F'}, + {"0KVOSF", 'F'}, + {"0KVOSK", 'F'}, + {"0KVOSV", 'F'}, + {"0N&(1&", 'F'}, + {"0N&(1)", 'F'}, + {"0N&(1,", 'F'}, + {"0N&(1O", 'F'}, + {"0N&(E(", 'F'}, + {"0N&(E1", 'F'}, + {"0N&(EF", 'F'}, + {"0N&(EK", 'F'}, + {"0N&(EN", 'F'}, + {"0N&(EO", 'F'}, + {"0N&(ES", 'F'}, + {"0N&(EV", 'F'}, + {"0N&(F(", 'F'}, + {"0N&(N&", 'F'}, + {"0N&(N)", 'F'}, + {"0N&(N,", 'F'}, + {"0N&(NO", 'F'}, + {"0N&(S&", 'F'}, + {"0N&(S)", 'F'}, + {"0N&(S,", 'F'}, + {"0N&(SO", 'F'}, + {"0N&(V&", 'F'}, + {"0N&(V)", 'F'}, + {"0N&(V,", 'F'}, + {"0N&(VO", 'F'}, + {"0N&1", 'F'}, + {"0N&1&(", 'F'}, + {"0N&1&1", 'F'}, + {"0N&1&F", 'F'}, + {"0N&1&N", 'F'}, + {"0N&1&S", 'F'}, + {"0N&1&V", 'F'}, + {"0N&1)&", 'F'}, + {"0N&1)C", 'F'}, + {"0N&1)O", 'F'}, + {"0N&1)U", 'F'}, + {"0N&1;", 'F'}, + {"0N&1;C", 'F'}, + {"0N&1;E", 'F'}, + {"0N&1;T", 'F'}, + {"0N&1B(", 'F'}, + {"0N&1B1", 'F'}, + {"0N&1BF", 'F'}, + {"0N&1BN", 'F'}, + {"0N&1BS", 'F'}, + {"0N&1BV", 'F'}, + {"0N&1C", 'F'}, + {"0N&1EK", 'F'}, + {"0N&1EN", 'F'}, + {"0N&1F(", 'F'}, + {"0N&1K(", 'F'}, + {"0N&1K1", 'F'}, + {"0N&1KF", 'F'}, + {"0N&1KN", 'F'}, + {"0N&1KS", 'F'}, + {"0N&1KV", 'F'}, + {"0N&1O(", 'F'}, + {"0N&1OF", 'F'}, + {"0N&1OS", 'F'}, + {"0N&1OV", 'F'}, + {"0N&1TN", 'F'}, + {"0N&1U", 'F'}, + {"0N&1U(", 'F'}, + {"0N&1U;", 'F'}, + {"0N&1UC", 'F'}, + {"0N&1UE", 'F'}, + {"0N&E(1", 'F'}, + {"0N&E(F", 'F'}, + {"0N&E(N", 'F'}, + {"0N&E(O", 'F'}, + {"0N&E(S", 'F'}, + {"0N&E(V", 'F'}, + {"0N&E1", 'F'}, + {"0N&E1;", 'F'}, + {"0N&E1C", 'F'}, + {"0N&E1K", 'F'}, + {"0N&E1O", 'F'}, + {"0N&EF(", 'F'}, + {"0N&EK(", 'F'}, + {"0N&EK1", 'F'}, + {"0N&EKF", 'F'}, + {"0N&EKN", 'F'}, + {"0N&EKS", 'F'}, + {"0N&EKV", 'F'}, + {"0N&EN;", 'F'}, + {"0N&ENC", 'F'}, + {"0N&ENK", 'F'}, + {"0N&ENO", 'F'}, + {"0N&ES", 'F'}, + {"0N&ES;", 'F'}, + {"0N&ESC", 'F'}, + {"0N&ESK", 'F'}, + {"0N&ESO", 'F'}, + {"0N&EV", 'F'}, + {"0N&EV;", 'F'}, + {"0N&EVC", 'F'}, + {"0N&EVK", 'F'}, + {"0N&EVO", 'F'}, + {"0N&F()", 'F'}, + {"0N&F(1", 'F'}, + {"0N&F(E", 'F'}, + {"0N&F(F", 'F'}, + {"0N&F(N", 'F'}, + {"0N&F(S", 'F'}, + {"0N&F(V", 'F'}, + {"0N&K&(", 'F'}, + {"0N&K&1", 'F'}, + {"0N&K&F", 'F'}, + {"0N&K&N", 'F'}, + {"0N&K&S", 'F'}, + {"0N&K&V", 'F'}, + {"0N&K(1", 'F'}, + {"0N&K(F", 'F'}, + {"0N&K(N", 'F'}, + {"0N&K(S", 'F'}, + {"0N&K(V", 'F'}, + {"0N&K1O", 'F'}, + {"0N&KC", 'F'}, + {"0N&KF(", 'F'}, + {"0N&KNK", 'F'}, + {"0N&KO(", 'F'}, + {"0N&KO1", 'F'}, + {"0N&KOF", 'F'}, + {"0N&KOK", 'F'}, + {"0N&KON", 'F'}, + {"0N&KOS", 'F'}, + {"0N&KOV", 'F'}, + {"0N&KSO", 'F'}, + {"0N&KVO", 'F'}, + {"0N&N&(", 'F'}, + {"0N&N&1", 'F'}, + {"0N&N&F", 'F'}, + {"0N&N&S", 'F'}, + {"0N&N&V", 'F'}, + {"0N&N)&", 'F'}, + {"0N&N)C", 'F'}, + {"0N&N)O", 'F'}, + {"0N&N)U", 'F'}, + {"0N&N;C", 'F'}, + {"0N&N;E", 'F'}, + {"0N&N;T", 'F'}, + {"0N&NB(", 'F'}, + {"0N&NB1", 'F'}, + {"0N&NBF", 'F'}, + {"0N&NBS", 'F'}, + {"0N&NBV", 'F'}, + {"0N&NF(", 'F'}, + {"0N&NK(", 'F'}, + {"0N&NK1", 'F'}, + {"0N&NKF", 'F'}, + {"0N&NKS", 'F'}, + {"0N&NKV", 'F'}, + {"0N&NO(", 'F'}, + {"0N&NOF", 'F'}, + {"0N&NOS", 'F'}, + {"0N&NOV", 'F'}, + {"0N&NU", 'F'}, + {"0N&NU(", 'F'}, + {"0N&NU;", 'F'}, + {"0N&NUC", 'F'}, + {"0N&NUE", 'F'}, + {"0N&S&(", 'F'}, + {"0N&S&1", 'F'}, + {"0N&S&F", 'F'}, + {"0N&S&N", 'F'}, + {"0N&S&S", 'F'}, + {"0N&S&V", 'F'}, + {"0N&S)&", 'F'}, + {"0N&S)C", 'F'}, + {"0N&S)O", 'F'}, + {"0N&S)U", 'F'}, + {"0N&S1", 'F'}, + {"0N&S1;", 'F'}, + {"0N&S1C", 'F'}, + {"0N&S;", 'F'}, + {"0N&S;C", 'F'}, + {"0N&S;E", 'F'}, + {"0N&S;T", 'F'}, + {"0N&SB(", 'F'}, + {"0N&SB1", 'F'}, + {"0N&SBF", 'F'}, + {"0N&SBN", 'F'}, + {"0N&SBS", 'F'}, + {"0N&SBV", 'F'}, + {"0N&SC", 'F'}, + {"0N&SEK", 'F'}, + {"0N&SEN", 'F'}, + {"0N&SF(", 'F'}, + {"0N&SK(", 'F'}, + {"0N&SK1", 'F'}, + {"0N&SKF", 'F'}, + {"0N&SKN", 'F'}, + {"0N&SKS", 'F'}, + {"0N&SKV", 'F'}, + {"0N&SO(", 'F'}, + {"0N&SO1", 'F'}, + {"0N&SOF", 'F'}, + {"0N&SON", 'F'}, + {"0N&SOS", 'F'}, + {"0N&SOV", 'F'}, + {"0N&STN", 'F'}, + {"0N&SU", 'F'}, + {"0N&SU(", 'F'}, + {"0N&SU;", 'F'}, + {"0N&SUC", 'F'}, + {"0N&SUE", 'F'}, + {"0N&SV", 'F'}, + {"0N&SV;", 'F'}, + {"0N&SVC", 'F'}, + {"0N&SVO", 'F'}, + {"0N&V", 'F'}, + {"0N&V&(", 'F'}, + {"0N&V&1", 'F'}, + {"0N&V&F", 'F'}, + {"0N&V&N", 'F'}, + {"0N&V&S", 'F'}, + {"0N&V&V", 'F'}, + {"0N&V)&", 'F'}, + {"0N&V)C", 'F'}, + {"0N&V)O", 'F'}, + {"0N&V)U", 'F'}, + {"0N&V;", 'F'}, + {"0N&V;C", 'F'}, + {"0N&V;E", 'F'}, + {"0N&V;T", 'F'}, + {"0N&VB(", 'F'}, + {"0N&VB1", 'F'}, + {"0N&VBF", 'F'}, + {"0N&VBN", 'F'}, + {"0N&VBS", 'F'}, + {"0N&VBV", 'F'}, + {"0N&VC", 'F'}, + {"0N&VEK", 'F'}, + {"0N&VEN", 'F'}, + {"0N&VF(", 'F'}, + {"0N&VK(", 'F'}, + {"0N&VK1", 'F'}, + {"0N&VKF", 'F'}, + {"0N&VKN", 'F'}, + {"0N&VKS", 'F'}, + {"0N&VKV", 'F'}, + {"0N&VO(", 'F'}, + {"0N&VOF", 'F'}, + {"0N&VOS", 'F'}, + {"0N&VS", 'F'}, + {"0N&VS;", 'F'}, + {"0N&VSC", 'F'}, + {"0N&VSO", 'F'}, + {"0N&VTN", 'F'}, + {"0N&VU", 'F'}, + {"0N&VU(", 'F'}, + {"0N&VU;", 'F'}, + {"0N&VUC", 'F'}, + {"0N&VUE", 'F'}, + {"0N)&(1", 'F'}, + {"0N)&(E", 'F'}, + {"0N)&(F", 'F'}, + {"0N)&(N", 'F'}, + {"0N)&(S", 'F'}, + {"0N)&(V", 'F'}, + {"0N)&1", 'F'}, + {"0N)&1&", 'F'}, + {"0N)&1)", 'F'}, + {"0N)&1;", 'F'}, + {"0N)&1B", 'F'}, + {"0N)&1C", 'F'}, + {"0N)&1F", 'F'}, + {"0N)&1O", 'F'}, + {"0N)&1U", 'F'}, + {"0N)&F(", 'F'}, + {"0N)&N", 'F'}, + {"0N)&N&", 'F'}, + {"0N)&N)", 'F'}, + {"0N)&N;", 'F'}, + {"0N)&NB", 'F'}, + {"0N)&NC", 'F'}, + {"0N)&NF", 'F'}, + {"0N)&NO", 'F'}, + {"0N)&NU", 'F'}, + {"0N)&S", 'F'}, + {"0N)&S&", 'F'}, + {"0N)&S)", 'F'}, + {"0N)&S;", 'F'}, + {"0N)&SB", 'F'}, + {"0N)&SC", 'F'}, + {"0N)&SF", 'F'}, + {"0N)&SO", 'F'}, + {"0N)&SU", 'F'}, + {"0N)&V", 'F'}, + {"0N)&V&", 'F'}, + {"0N)&V)", 'F'}, + {"0N)&V;", 'F'}, + {"0N)&VB", 'F'}, + {"0N)&VC", 'F'}, + {"0N)&VF", 'F'}, + {"0N)&VO", 'F'}, + {"0N)&VU", 'F'}, + {"0N),(1", 'F'}, + {"0N),(F", 'F'}, + {"0N),(N", 'F'}, + {"0N),(S", 'F'}, + {"0N),(V", 'F'}, + {"0N);E(", 'F'}, + {"0N);E1", 'F'}, + {"0N);EF", 'F'}, + {"0N);EK", 'F'}, + {"0N);EN", 'F'}, + {"0N);EO", 'F'}, + {"0N);ES", 'F'}, + {"0N);EV", 'F'}, + {"0N);T(", 'F'}, + {"0N);T1", 'F'}, + {"0N);TF", 'F'}, + {"0N);TK", 'F'}, + {"0N);TN", 'F'}, + {"0N);TO", 'F'}, + {"0N);TS", 'F'}, + {"0N);TV", 'F'}, + {"0N)B(1", 'F'}, + {"0N)B(F", 'F'}, + {"0N)B(N", 'F'}, + {"0N)B(S", 'F'}, + {"0N)B(V", 'F'}, + {"0N)B1", 'F'}, + {"0N)B1&", 'F'}, + {"0N)B1;", 'F'}, + {"0N)B1C", 'F'}, + {"0N)B1K", 'F'}, + {"0N)B1N", 'F'}, + {"0N)B1O", 'F'}, + {"0N)B1U", 'F'}, + {"0N)BF(", 'F'}, + {"0N)BN", 'F'}, + {"0N)BN&", 'F'}, + {"0N)BN;", 'F'}, + {"0N)BNC", 'F'}, + {"0N)BNK", 'F'}, + {"0N)BNO", 'F'}, + {"0N)BNU", 'F'}, + {"0N)BS", 'F'}, + {"0N)BS&", 'F'}, + {"0N)BS;", 'F'}, + {"0N)BSC", 'F'}, + {"0N)BSK", 'F'}, + {"0N)BSO", 'F'}, + {"0N)BSU", 'F'}, + {"0N)BV", 'F'}, + {"0N)BV&", 'F'}, + {"0N)BV;", 'F'}, + {"0N)BVC", 'F'}, + {"0N)BVK", 'F'}, + {"0N)BVO", 'F'}, + {"0N)BVU", 'F'}, + {"0N)E(1", 'F'}, + {"0N)E(F", 'F'}, + {"0N)E(N", 'F'}, + {"0N)E(S", 'F'}, + {"0N)E(V", 'F'}, + {"0N)E1C", 'F'}, + {"0N)E1O", 'F'}, + {"0N)EF(", 'F'}, + {"0N)EK(", 'F'}, + {"0N)EK1", 'F'}, + {"0N)EKF", 'F'}, + {"0N)EKN", 'F'}, + {"0N)EKS", 'F'}, + {"0N)EKV", 'F'}, + {"0N)ENC", 'F'}, + {"0N)ENO", 'F'}, + {"0N)ESC", 'F'}, + {"0N)ESO", 'F'}, + {"0N)EVC", 'F'}, + {"0N)EVO", 'F'}, + {"0N)F(F", 'F'}, + {"0N)K(1", 'F'}, + {"0N)K(F", 'F'}, + {"0N)K(N", 'F'}, + {"0N)K(S", 'F'}, + {"0N)K(V", 'F'}, + {"0N)K1&", 'F'}, + {"0N)K1;", 'F'}, + {"0N)K1B", 'F'}, + {"0N)K1E", 'F'}, + {"0N)K1O", 'F'}, + {"0N)K1U", 'F'}, + {"0N)KB(", 'F'}, + {"0N)KB1", 'F'}, + {"0N)KBF", 'F'}, + {"0N)KBN", 'F'}, + {"0N)KBS", 'F'}, + {"0N)KBV", 'F'}, + {"0N)KF(", 'F'}, + {"0N)KN&", 'F'}, + {"0N)KN;", 'F'}, + {"0N)KNB", 'F'}, + {"0N)KNC", 'F'}, + {"0N)KNE", 'F'}, + {"0N)KNK", 'F'}, + {"0N)KNU", 'F'}, + {"0N)KS&", 'F'}, + {"0N)KS;", 'F'}, + {"0N)KSB", 'F'}, + {"0N)KSE", 'F'}, + {"0N)KSO", 'F'}, + {"0N)KSU", 'F'}, + {"0N)KUE", 'F'}, + {"0N)KV&", 'F'}, + {"0N)KV;", 'F'}, + {"0N)KVB", 'F'}, + {"0N)KVE", 'F'}, + {"0N)KVO", 'F'}, + {"0N)KVU", 'F'}, + {"0N)O(1", 'F'}, + {"0N)O(E", 'F'}, + {"0N)O(F", 'F'}, + {"0N)O(N", 'F'}, + {"0N)O(S", 'F'}, + {"0N)O(V", 'F'}, + {"0N)O1&", 'F'}, + {"0N)O1)", 'F'}, + {"0N)O1;", 'F'}, + {"0N)O1B", 'F'}, + {"0N)O1C", 'F'}, + {"0N)O1K", 'F'}, + {"0N)O1U", 'F'}, + {"0N)OF(", 'F'}, + {"0N)ON&", 'F'}, + {"0N)ON)", 'F'}, + {"0N)ON;", 'F'}, + {"0N)ONB", 'F'}, + {"0N)ONC", 'F'}, + {"0N)ONK", 'F'}, + {"0N)ONU", 'F'}, + {"0N)OS", 'F'}, + {"0N)OS&", 'F'}, + {"0N)OS)", 'F'}, + {"0N)OS;", 'F'}, + {"0N)OSB", 'F'}, + {"0N)OSC", 'F'}, + {"0N)OSK", 'F'}, + {"0N)OSU", 'F'}, + {"0N)OV", 'F'}, + {"0N)OV&", 'F'}, + {"0N)OV)", 'F'}, + {"0N)OV;", 'F'}, + {"0N)OVB", 'F'}, + {"0N)OVC", 'F'}, + {"0N)OVK", 'F'}, + {"0N)OVO", 'F'}, + {"0N)OVU", 'F'}, + {"0N)U(E", 'F'}, + {"0N)UE(", 'F'}, + {"0N)UE1", 'F'}, + {"0N)UEF", 'F'}, + {"0N)UEK", 'F'}, + {"0N)UEN", 'F'}, + {"0N)UES", 'F'}, + {"0N)UEV", 'F'}, + {"0N,(1)", 'F'}, + {"0N,(1O", 'F'}, + {"0N,(E(", 'F'}, + {"0N,(E1", 'F'}, + {"0N,(EF", 'F'}, + {"0N,(EK", 'F'}, + {"0N,(EN", 'F'}, + {"0N,(ES", 'F'}, + {"0N,(EV", 'F'}, + {"0N,(F(", 'F'}, + {"0N,(NO", 'F'}, + {"0N,(S)", 'F'}, + {"0N,(SO", 'F'}, + {"0N,(V)", 'F'}, + {"0N,(VO", 'F'}, + {"0N,F()", 'F'}, + {"0N,F(1", 'F'}, + {"0N,F(F", 'F'}, + {"0N,F(N", 'F'}, + {"0N,F(S", 'F'}, + {"0N,F(V", 'F'}, + {"0N1O(1", 'F'}, + {"0N1O(F", 'F'}, + {"0N1O(N", 'F'}, + {"0N1O(S", 'F'}, + {"0N1O(V", 'F'}, + {"0N1OF(", 'F'}, + {"0N1OS(", 'F'}, + {"0N1OS1", 'F'}, + {"0N1OSF", 'F'}, + {"0N1OSU", 'F'}, + {"0N1OSV", 'F'}, + {"0N1OV(", 'F'}, + {"0N1OVF", 'F'}, + {"0N1OVO", 'F'}, + {"0N1OVS", 'F'}, + {"0N1OVU", 'F'}, + {"0N1S;", 'F'}, + {"0N1S;C", 'F'}, + {"0N1SC", 'F'}, + {"0N1UE", 'F'}, + {"0N1UE;", 'F'}, + {"0N1UEC", 'F'}, + {"0N1UEK", 'F'}, + {"0N1V;", 'F'}, + {"0N1V;C", 'F'}, + {"0N1VC", 'F'}, + {"0N1VO(", 'F'}, + {"0N1VOF", 'F'}, + {"0N1VOS", 'F'}, + {"0N;E(1", 'F'}, + {"0N;E(E", 'F'}, + {"0N;E(F", 'F'}, + {"0N;E(N", 'F'}, + {"0N;E(S", 'F'}, + {"0N;E(V", 'F'}, + {"0N;E1,", 'F'}, + {"0N;E1;", 'F'}, + {"0N;E1C", 'F'}, + {"0N;E1K", 'F'}, + {"0N;E1O", 'F'}, + {"0N;E1T", 'F'}, + {"0N;EF(", 'F'}, + {"0N;EK(", 'F'}, + {"0N;EK1", 'F'}, + {"0N;EKF", 'F'}, + {"0N;EKN", 'F'}, + {"0N;EKO", 'F'}, + {"0N;EKS", 'F'}, + {"0N;EKV", 'F'}, + {"0N;EN,", 'F'}, + {"0N;EN;", 'F'}, + {"0N;ENC", 'F'}, + {"0N;ENE", 'F'}, + {"0N;ENK", 'F'}, + {"0N;ENO", 'F'}, + {"0N;ENT", 'F'}, + {"0N;ES,", 'F'}, + {"0N;ES;", 'F'}, + {"0N;ESC", 'F'}, + {"0N;ESK", 'F'}, + {"0N;ESO", 'F'}, + {"0N;EST", 'F'}, + {"0N;EV,", 'F'}, + {"0N;EV;", 'F'}, + {"0N;EVC", 'F'}, + {"0N;EVK", 'F'}, + {"0N;EVO", 'F'}, + {"0N;EVT", 'F'}, + {"0N;N:T", 'F'}, + {"0N;T(1", 'F'}, + {"0N;T(C", 'F'}, + {"0N;T(E", 'F'}, + {"0N;T(F", 'F'}, + {"0N;T(N", 'F'}, + {"0N;T(S", 'F'}, + {"0N;T(V", 'F'}, + {"0N;T1(", 'F'}, + {"0N;T1,", 'F'}, + {"0N;T1;", 'F'}, + {"0N;T1C", 'F'}, + {"0N;T1F", 'F'}, + {"0N;T1K", 'F'}, + {"0N;T1O", 'F'}, + {"0N;T1T", 'F'}, + {"0N;T;", 'F'}, + {"0N;T;C", 'F'}, + {"0N;TF(", 'F'}, + {"0N;TK(", 'F'}, + {"0N;TK1", 'F'}, + {"0N;TKF", 'F'}, + {"0N;TKK", 'F'}, + {"0N;TKO", 'F'}, + {"0N;TKS", 'F'}, + {"0N;TKV", 'F'}, + {"0N;TN(", 'F'}, + {"0N;TN,", 'F'}, + {"0N;TN1", 'F'}, + {"0N;TN;", 'F'}, + {"0N;TNC", 'F'}, + {"0N;TNE", 'F'}, + {"0N;TNF", 'F'}, + {"0N;TNK", 'F'}, + {"0N;TNN", 'F'}, + {"0N;TNO", 'F'}, + {"0N;TNS", 'F'}, + {"0N;TNT", 'F'}, + {"0N;TNV", 'F'}, + {"0N;TO(", 'F'}, + {"0N;TS(", 'F'}, + {"0N;TS,", 'F'}, + {"0N;TS;", 'F'}, + {"0N;TSC", 'F'}, + {"0N;TSF", 'F'}, + {"0N;TSK", 'F'}, + {"0N;TSO", 'F'}, + {"0N;TST", 'F'}, + {"0N;TTN", 'F'}, + {"0N;TV(", 'F'}, + {"0N;TV,", 'F'}, + {"0N;TV;", 'F'}, + {"0N;TVC", 'F'}, + {"0N;TVF", 'F'}, + {"0N;TVK", 'F'}, + {"0N;TVO", 'F'}, + {"0N;TVT", 'F'}, + {"0NA(F(", 'F'}, + {"0NA(N)", 'F'}, + {"0NA(NO", 'F'}, + {"0NA(S)", 'F'}, + {"0NA(SO", 'F'}, + {"0NA(V)", 'F'}, + {"0NA(VO", 'F'}, + {"0NAF()", 'F'}, + {"0NAF(1", 'F'}, + {"0NAF(F", 'F'}, + {"0NAF(N", 'F'}, + {"0NAF(S", 'F'}, + {"0NAF(V", 'F'}, + {"0NASO(", 'F'}, + {"0NASO1", 'F'}, + {"0NASOF", 'F'}, + {"0NASON", 'F'}, + {"0NASOS", 'F'}, + {"0NASOV", 'F'}, + {"0NASUE", 'F'}, + {"0NATO(", 'F'}, + {"0NATO1", 'F'}, + {"0NATOF", 'F'}, + {"0NATON", 'F'}, + {"0NATOS", 'F'}, + {"0NATOV", 'F'}, + {"0NATUE", 'F'}, + {"0NAVO(", 'F'}, + {"0NAVOF", 'F'}, + {"0NAVOS", 'F'}, + {"0NAVUE", 'F'}, + {"0NB(1&", 'F'}, + {"0NB(1)", 'F'}, + {"0NB(1O", 'F'}, + {"0NB(F(", 'F'}, + {"0NB(N&", 'F'}, + {"0NB(NO", 'F'}, + {"0NB(S&", 'F'}, + {"0NB(S)", 'F'}, + {"0NB(SO", 'F'}, + {"0NB(V&", 'F'}, + {"0NB(V)", 'F'}, + {"0NB(VO", 'F'}, + {"0NB1", 'F'}, + {"0NB1&(", 'F'}, + {"0NB1&1", 'F'}, + {"0NB1&F", 'F'}, + {"0NB1&N", 'F'}, + {"0NB1&S", 'F'}, + {"0NB1&V", 'F'}, + {"0NB1,(", 'F'}, + {"0NB1,F", 'F'}, + {"0NB1;", 'F'}, + {"0NB1;C", 'F'}, + {"0NB1B(", 'F'}, + {"0NB1B1", 'F'}, + {"0NB1BF", 'F'}, + {"0NB1BN", 'F'}, + {"0NB1BS", 'F'}, + {"0NB1BV", 'F'}, + {"0NB1C", 'F'}, + {"0NB1K(", 'F'}, + {"0NB1K1", 'F'}, + {"0NB1KF", 'F'}, + {"0NB1KN", 'F'}, + {"0NB1KS", 'F'}, + {"0NB1KV", 'F'}, + {"0NB1O(", 'F'}, + {"0NB1OF", 'F'}, + {"0NB1OS", 'F'}, + {"0NB1OV", 'F'}, + {"0NB1U(", 'F'}, + {"0NB1UE", 'F'}, + {"0NBE(1", 'F'}, + {"0NBE(F", 'F'}, + {"0NBE(N", 'F'}, + {"0NBE(S", 'F'}, + {"0NBE(V", 'F'}, + {"0NBEK(", 'F'}, + {"0NBF()", 'F'}, + {"0NBF(1", 'F'}, + {"0NBF(F", 'F'}, + {"0NBF(N", 'F'}, + {"0NBF(S", 'F'}, + {"0NBF(V", 'F'}, + {"0NBN&(", 'F'}, + {"0NBN&1", 'F'}, + {"0NBN&F", 'F'}, + {"0NBN&N", 'F'}, + {"0NBN&S", 'F'}, + {"0NBN&V", 'F'}, + {"0NBN,(", 'F'}, + {"0NBN,F", 'F'}, + {"0NBN;", 'F'}, + {"0NBN;C", 'F'}, + {"0NBNB(", 'F'}, + {"0NBNB1", 'F'}, + {"0NBNBF", 'F'}, + {"0NBNBN", 'F'}, + {"0NBNBS", 'F'}, + {"0NBNBV", 'F'}, + {"0NBNC", 'F'}, + {"0NBNK(", 'F'}, + {"0NBNK1", 'F'}, + {"0NBNKF", 'F'}, + {"0NBNKN", 'F'}, + {"0NBNKS", 'F'}, + {"0NBNKV", 'F'}, + {"0NBNO(", 'F'}, + {"0NBNOF", 'F'}, + {"0NBNOS", 'F'}, + {"0NBNOV", 'F'}, + {"0NBNU(", 'F'}, + {"0NBNUE", 'F'}, + {"0NBS", 'F'}, + {"0NBS&(", 'F'}, + {"0NBS&1", 'F'}, + {"0NBS&F", 'F'}, + {"0NBS&N", 'F'}, + {"0NBS&S", 'F'}, + {"0NBS&V", 'F'}, + {"0NBS,(", 'F'}, + {"0NBS,F", 'F'}, + {"0NBS;", 'F'}, + {"0NBS;C", 'F'}, + {"0NBSB(", 'F'}, + {"0NBSB1", 'F'}, + {"0NBSBF", 'F'}, + {"0NBSBN", 'F'}, + {"0NBSBS", 'F'}, + {"0NBSBV", 'F'}, + {"0NBSC", 'F'}, + {"0NBSK(", 'F'}, + {"0NBSK1", 'F'}, + {"0NBSKF", 'F'}, + {"0NBSKN", 'F'}, + {"0NBSKS", 'F'}, + {"0NBSKV", 'F'}, + {"0NBSO(", 'F'}, + {"0NBSO1", 'F'}, + {"0NBSOF", 'F'}, + {"0NBSON", 'F'}, + {"0NBSOS", 'F'}, + {"0NBSOV", 'F'}, + {"0NBSU(", 'F'}, + {"0NBSUE", 'F'}, + {"0NBV", 'F'}, + {"0NBV&(", 'F'}, + {"0NBV&1", 'F'}, + {"0NBV&F", 'F'}, + {"0NBV&N", 'F'}, + {"0NBV&S", 'F'}, + {"0NBV&V", 'F'}, + {"0NBV,(", 'F'}, + {"0NBV,F", 'F'}, + {"0NBV;", 'F'}, + {"0NBV;C", 'F'}, + {"0NBVB(", 'F'}, + {"0NBVB1", 'F'}, + {"0NBVBF", 'F'}, + {"0NBVBN", 'F'}, + {"0NBVBS", 'F'}, + {"0NBVBV", 'F'}, + {"0NBVC", 'F'}, + {"0NBVK(", 'F'}, + {"0NBVK1", 'F'}, + {"0NBVKF", 'F'}, + {"0NBVKN", 'F'}, + {"0NBVKS", 'F'}, + {"0NBVKV", 'F'}, + {"0NBVO(", 'F'}, + {"0NBVOF", 'F'}, + {"0NBVOS", 'F'}, + {"0NBVU(", 'F'}, + {"0NBVUE", 'F'}, + {"0NC", 'F'}, + {"0NE(1)", 'F'}, + {"0NE(1O", 'F'}, + {"0NE(F(", 'F'}, + {"0NE(N)", 'F'}, + {"0NE(NO", 'F'}, + {"0NE(S)", 'F'}, + {"0NE(SO", 'F'}, + {"0NE(V)", 'F'}, + {"0NE(VO", 'F'}, + {"0NE1;T", 'F'}, + {"0NE1C", 'F'}, + {"0NE1O(", 'F'}, + {"0NE1OF", 'F'}, + {"0NE1OS", 'F'}, + {"0NE1OV", 'F'}, + {"0NE1T(", 'F'}, + {"0NE1T1", 'F'}, + {"0NE1TF", 'F'}, + {"0NE1TN", 'F'}, + {"0NE1TS", 'F'}, + {"0NE1TV", 'F'}, + {"0NE1UE", 'F'}, + {"0NEF()", 'F'}, + {"0NEF(1", 'F'}, + {"0NEF(F", 'F'}, + {"0NEF(N", 'F'}, + {"0NEF(S", 'F'}, + {"0NEF(V", 'F'}, + {"0NEN;T", 'F'}, + {"0NENO(", 'F'}, + {"0NENOF", 'F'}, + {"0NENOS", 'F'}, + {"0NENOV", 'F'}, + {"0NENT(", 'F'}, + {"0NENT1", 'F'}, + {"0NENTF", 'F'}, + {"0NENTN", 'F'}, + {"0NENTS", 'F'}, + {"0NENTV", 'F'}, + {"0NENUE", 'F'}, + {"0NEOKN", 'F'}, + {"0NES;T", 'F'}, + {"0NESC", 'F'}, + {"0NESO(", 'F'}, + {"0NESO1", 'F'}, + {"0NESOF", 'F'}, + {"0NESON", 'F'}, + {"0NESOS", 'F'}, + {"0NESOV", 'F'}, + {"0NEST(", 'F'}, + {"0NEST1", 'F'}, + {"0NESTF", 'F'}, + {"0NESTN", 'F'}, + {"0NESTS", 'F'}, + {"0NESTV", 'F'}, + {"0NESUE", 'F'}, + {"0NEU(1", 'F'}, + {"0NEU(F", 'F'}, + {"0NEU(N", 'F'}, + {"0NEU(S", 'F'}, + {"0NEU(V", 'F'}, + {"0NEU1,", 'F'}, + {"0NEU1C", 'F'}, + {"0NEU1O", 'F'}, + {"0NEUEF", 'F'}, + {"0NEUEK", 'F'}, + {"0NEUF(", 'F'}, + {"0NEUS,", 'F'}, + {"0NEUSC", 'F'}, + {"0NEUSO", 'F'}, + {"0NEUV,", 'F'}, + {"0NEUVC", 'F'}, + {"0NEUVO", 'F'}, + {"0NEV;T", 'F'}, + {"0NEVC", 'F'}, + {"0NEVO(", 'F'}, + {"0NEVOF", 'F'}, + {"0NEVOS", 'F'}, + {"0NEVT(", 'F'}, + {"0NEVT1", 'F'}, + {"0NEVTF", 'F'}, + {"0NEVTN", 'F'}, + {"0NEVTS", 'F'}, + {"0NEVTV", 'F'}, + {"0NEVUE", 'F'}, + {"0NF()1", 'F'}, + {"0NF()F", 'F'}, + {"0NF()K", 'F'}, + {"0NF()N", 'F'}, + {"0NF()O", 'F'}, + {"0NF()S", 'F'}, + {"0NF()U", 'F'}, + {"0NF()V", 'F'}, + {"0NF(1)", 'F'}, + {"0NF(1O", 'F'}, + {"0NF(E(", 'F'}, + {"0NF(E1", 'F'}, + {"0NF(EF", 'F'}, + {"0NF(EK", 'F'}, + {"0NF(EN", 'F'}, + {"0NF(ES", 'F'}, + {"0NF(EV", 'F'}, + {"0NF(F(", 'F'}, + {"0NF(N,", 'F'}, + {"0NF(NO", 'F'}, + {"0NF(S)", 'F'}, + {"0NF(SO", 'F'}, + {"0NF(V)", 'F'}, + {"0NF(VO", 'F'}, + {"0NK(1)", 'F'}, + {"0NK(1O", 'F'}, + {"0NK(F(", 'F'}, + {"0NK(NO", 'F'}, + {"0NK(S)", 'F'}, + {"0NK(SO", 'F'}, + {"0NK(V)", 'F'}, + {"0NK(VO", 'F'}, + {"0NK)&(", 'F'}, + {"0NK)&1", 'F'}, + {"0NK)&F", 'F'}, + {"0NK)&N", 'F'}, + {"0NK)&S", 'F'}, + {"0NK)&V", 'F'}, + {"0NK);E", 'F'}, + {"0NK);T", 'F'}, + {"0NK)B(", 'F'}, + {"0NK)B1", 'F'}, + {"0NK)BF", 'F'}, + {"0NK)BN", 'F'}, + {"0NK)BS", 'F'}, + {"0NK)BV", 'F'}, + {"0NK)E(", 'F'}, + {"0NK)E1", 'F'}, + {"0NK)EF", 'F'}, + {"0NK)EK", 'F'}, + {"0NK)EN", 'F'}, + {"0NK)ES", 'F'}, + {"0NK)EV", 'F'}, + {"0NK)F(", 'F'}, + {"0NK)O(", 'F'}, + {"0NK)OF", 'F'}, + {"0NK)UE", 'F'}, + {"0NK1", 'F'}, + {"0NK1&(", 'F'}, + {"0NK1&1", 'F'}, + {"0NK1&F", 'F'}, + {"0NK1&N", 'F'}, + {"0NK1&S", 'F'}, + {"0NK1&V", 'F'}, + {"0NK1;C", 'F'}, + {"0NK1;E", 'F'}, + {"0NK1;T", 'F'}, + {"0NK1B(", 'F'}, + {"0NK1B1", 'F'}, + {"0NK1BF", 'F'}, + {"0NK1BN", 'F'}, + {"0NK1BS", 'F'}, + {"0NK1BV", 'F'}, + {"0NK1C", 'F'}, + {"0NK1E(", 'F'}, + {"0NK1E1", 'F'}, + {"0NK1EF", 'F'}, + {"0NK1EK", 'F'}, + {"0NK1EN", 'F'}, + {"0NK1ES", 'F'}, + {"0NK1EV", 'F'}, + {"0NK1O(", 'F'}, + {"0NK1OF", 'F'}, + {"0NK1OS", 'F'}, + {"0NK1OV", 'F'}, + {"0NK1U(", 'F'}, + {"0NK1UE", 'F'}, + {"0NKF()", 'F'}, + {"0NKF(1", 'F'}, + {"0NKF(F", 'F'}, + {"0NKF(N", 'F'}, + {"0NKF(S", 'F'}, + {"0NKF(V", 'F'}, + {"0NKN", 'F'}, + {"0NKN&(", 'F'}, + {"0NKN&1", 'F'}, + {"0NKN&F", 'F'}, + {"0NKN&S", 'F'}, + {"0NKN&V", 'F'}, + {"0NKN;C", 'F'}, + {"0NKN;E", 'F'}, + {"0NKN;T", 'F'}, + {"0NKNB(", 'F'}, + {"0NKNB1", 'F'}, + {"0NKNBF", 'F'}, + {"0NKNBN", 'F'}, + {"0NKNBS", 'F'}, + {"0NKNBV", 'F'}, + {"0NKNE(", 'F'}, + {"0NKNE1", 'F'}, + {"0NKNEF", 'F'}, + {"0NKNES", 'F'}, + {"0NKNEV", 'F'}, + {"0NKNU(", 'F'}, + {"0NKNUE", 'F'}, + {"0NKS", 'F'}, + {"0NKS&(", 'F'}, + {"0NKS&1", 'F'}, + {"0NKS&F", 'F'}, + {"0NKS&N", 'F'}, + {"0NKS&S", 'F'}, + {"0NKS&V", 'F'}, + {"0NKS;", 'F'}, + {"0NKS;C", 'F'}, + {"0NKS;E", 'F'}, + {"0NKS;T", 'F'}, + {"0NKSB(", 'F'}, + {"0NKSB1", 'F'}, + {"0NKSBF", 'F'}, + {"0NKSBN", 'F'}, + {"0NKSBS", 'F'}, + {"0NKSBV", 'F'}, + {"0NKSC", 'F'}, + {"0NKSE(", 'F'}, + {"0NKSE1", 'F'}, + {"0NKSEF", 'F'}, + {"0NKSEK", 'F'}, + {"0NKSEN", 'F'}, + {"0NKSES", 'F'}, + {"0NKSEV", 'F'}, + {"0NKSO(", 'F'}, + {"0NKSO1", 'F'}, + {"0NKSOF", 'F'}, + {"0NKSON", 'F'}, + {"0NKSOS", 'F'}, + {"0NKSOV", 'F'}, + {"0NKSU(", 'F'}, + {"0NKSUE", 'F'}, + {"0NKUE(", 'F'}, + {"0NKUE1", 'F'}, + {"0NKUEF", 'F'}, + {"0NKUEK", 'F'}, + {"0NKUEN", 'F'}, + {"0NKUES", 'F'}, + {"0NKUEV", 'F'}, + {"0NKV", 'F'}, + {"0NKV&(", 'F'}, + {"0NKV&1", 'F'}, + {"0NKV&F", 'F'}, + {"0NKV&N", 'F'}, + {"0NKV&S", 'F'}, + {"0NKV&V", 'F'}, + {"0NKV;", 'F'}, + {"0NKV;C", 'F'}, + {"0NKV;E", 'F'}, + {"0NKV;T", 'F'}, + {"0NKVB(", 'F'}, + {"0NKVB1", 'F'}, + {"0NKVBF", 'F'}, + {"0NKVBN", 'F'}, + {"0NKVBS", 'F'}, + {"0NKVBV", 'F'}, + {"0NKVC", 'F'}, + {"0NKVE(", 'F'}, + {"0NKVE1", 'F'}, + {"0NKVEF", 'F'}, + {"0NKVEK", 'F'}, + {"0NKVEN", 'F'}, + {"0NKVES", 'F'}, + {"0NKVEV", 'F'}, + {"0NKVO(", 'F'}, + {"0NKVOF", 'F'}, + {"0NKVOS", 'F'}, + {"0NKVU(", 'F'}, + {"0NKVUE", 'F'}, + {"0NO(1&", 'F'}, + {"0NO(1)", 'F'}, + {"0NO(1,", 'F'}, + {"0NO(1O", 'F'}, + {"0NO(E(", 'F'}, + {"0NO(E1", 'F'}, + {"0NO(EE", 'F'}, + {"0NO(EF", 'F'}, + {"0NO(EK", 'F'}, + {"0NO(EN", 'F'}, + {"0NO(EO", 'F'}, + {"0NO(ES", 'F'}, + {"0NO(EV", 'F'}, + {"0NO(F(", 'F'}, + {"0NO(N&", 'F'}, + {"0NO(N)", 'F'}, + {"0NO(N,", 'F'}, + {"0NO(NO", 'F'}, + {"0NO(S&", 'F'}, + {"0NO(S)", 'F'}, + {"0NO(S,", 'F'}, + {"0NO(SO", 'F'}, + {"0NO(V&", 'F'}, + {"0NO(V)", 'F'}, + {"0NO(V,", 'F'}, + {"0NO(VO", 'F'}, + {"0NOF()", 'F'}, + {"0NOF(1", 'F'}, + {"0NOF(E", 'F'}, + {"0NOF(F", 'F'}, + {"0NOF(N", 'F'}, + {"0NOF(S", 'F'}, + {"0NOF(V", 'F'}, + {"0NOK&(", 'F'}, + {"0NOK(1", 'F'}, + {"0NOK(F", 'F'}, + {"0NOK(N", 'F'}, + {"0NOK(S", 'F'}, + {"0NOK(V", 'F'}, + {"0NOK1C", 'F'}, + {"0NOK1O", 'F'}, + {"0NOKF(", 'F'}, + {"0NOKNC", 'F'}, + {"0NOKO(", 'F'}, + {"0NOKO1", 'F'}, + {"0NOKOF", 'F'}, + {"0NOKON", 'F'}, + {"0NOKOS", 'F'}, + {"0NOKOV", 'F'}, + {"0NOKSC", 'F'}, + {"0NOKSO", 'F'}, + {"0NOKVC", 'F'}, + {"0NOKVO", 'F'}, + {"0NONSU", 'F'}, + {"0NOS&(", 'F'}, + {"0NOS&1", 'F'}, + {"0NOS&E", 'F'}, + {"0NOS&F", 'F'}, + {"0NOS&K", 'F'}, + {"0NOS&N", 'F'}, + {"0NOS&S", 'F'}, + {"0NOS&U", 'F'}, + {"0NOS&V", 'F'}, + {"0NOS(E", 'F'}, + {"0NOS(U", 'F'}, + {"0NOS)&", 'F'}, + {"0NOS),", 'F'}, + {"0NOS);", 'F'}, + {"0NOS)B", 'F'}, + {"0NOS)C", 'F'}, + {"0NOS)E", 'F'}, + {"0NOS)F", 'F'}, + {"0NOS)K", 'F'}, + {"0NOS)O", 'F'}, + {"0NOS)U", 'F'}, + {"0NOS,(", 'F'}, + {"0NOS,F", 'F'}, + {"0NOS1(", 'F'}, + {"0NOS1F", 'F'}, + {"0NOS1N", 'F'}, + {"0NOS1S", 'F'}, + {"0NOS1U", 'F'}, + {"0NOS1V", 'F'}, + {"0NOS;", 'F'}, + {"0NOS;C", 'F'}, + {"0NOS;E", 'F'}, + {"0NOS;T", 'F'}, + {"0NOSA(", 'F'}, + {"0NOSAF", 'F'}, + {"0NOSAS", 'F'}, + {"0NOSAT", 'F'}, + {"0NOSAV", 'F'}, + {"0NOSB(", 'F'}, + {"0NOSB1", 'F'}, + {"0NOSBE", 'F'}, + {"0NOSBF", 'F'}, + {"0NOSBN", 'F'}, + {"0NOSBS", 'F'}, + {"0NOSBV", 'F'}, + {"0NOSC", 'F'}, + {"0NOSE(", 'F'}, + {"0NOSE1", 'F'}, + {"0NOSEF", 'F'}, + {"0NOSEK", 'F'}, + {"0NOSEN", 'F'}, + {"0NOSEO", 'F'}, + {"0NOSES", 'F'}, + {"0NOSEU", 'F'}, + {"0NOSEV", 'F'}, + {"0NOSF(", 'F'}, + {"0NOSK(", 'F'}, + {"0NOSK)", 'F'}, + {"0NOSK1", 'F'}, + {"0NOSKB", 'F'}, + {"0NOSKF", 'F'}, + {"0NOSKN", 'F'}, + {"0NOSKS", 'F'}, + {"0NOSKU", 'F'}, + {"0NOSKV", 'F'}, + {"0NOST(", 'F'}, + {"0NOST1", 'F'}, + {"0NOSTE", 'F'}, + {"0NOSTF", 'F'}, + {"0NOSTN", 'F'}, + {"0NOSTS", 'F'}, + {"0NOSTT", 'F'}, + {"0NOSTV", 'F'}, + {"0NOSU", 'F'}, + {"0NOSU(", 'F'}, + {"0NOSU1", 'F'}, + {"0NOSU;", 'F'}, + {"0NOSUC", 'F'}, + {"0NOSUE", 'F'}, + {"0NOSUF", 'F'}, + {"0NOSUK", 'F'}, + {"0NOSUO", 'F'}, + {"0NOSUS", 'F'}, + {"0NOSUT", 'F'}, + {"0NOSUV", 'F'}, + {"0NOSV(", 'F'}, + {"0NOSVF", 'F'}, + {"0NOSVO", 'F'}, + {"0NOSVS", 'F'}, + {"0NOSVU", 'F'}, + {"0NOU(E", 'F'}, + {"0NOUEK", 'F'}, + {"0NOUEN", 'F'}, + {"0NOV&(", 'F'}, + {"0NOV&1", 'F'}, + {"0NOV&E", 'F'}, + {"0NOV&F", 'F'}, + {"0NOV&K", 'F'}, + {"0NOV&N", 'F'}, + {"0NOV&S", 'F'}, + {"0NOV&U", 'F'}, + {"0NOV&V", 'F'}, + {"0NOV(E", 'F'}, + {"0NOV(U", 'F'}, + {"0NOV)&", 'F'}, + {"0NOV),", 'F'}, + {"0NOV);", 'F'}, + {"0NOV)B", 'F'}, + {"0NOV)C", 'F'}, + {"0NOV)E", 'F'}, + {"0NOV)F", 'F'}, + {"0NOV)K", 'F'}, + {"0NOV)O", 'F'}, + {"0NOV)U", 'F'}, + {"0NOV,(", 'F'}, + {"0NOV,F", 'F'}, + {"0NOV;", 'F'}, + {"0NOV;C", 'F'}, + {"0NOV;E", 'F'}, + {"0NOV;N", 'F'}, + {"0NOV;T", 'F'}, + {"0NOVA(", 'F'}, + {"0NOVAF", 'F'}, + {"0NOVAS", 'F'}, + {"0NOVAT", 'F'}, + {"0NOVAV", 'F'}, + {"0NOVB(", 'F'}, + {"0NOVB1", 'F'}, + {"0NOVBE", 'F'}, + {"0NOVBF", 'F'}, + {"0NOVBN", 'F'}, + {"0NOVBS", 'F'}, + {"0NOVBV", 'F'}, + {"0NOVC", 'F'}, + {"0NOVE(", 'F'}, + {"0NOVE1", 'F'}, + {"0NOVEF", 'F'}, + {"0NOVEK", 'F'}, + {"0NOVEN", 'F'}, + {"0NOVEO", 'F'}, + {"0NOVES", 'F'}, + {"0NOVEU", 'F'}, + {"0NOVEV", 'F'}, + {"0NOVF(", 'F'}, + {"0NOVK(", 'F'}, + {"0NOVK)", 'F'}, + {"0NOVK1", 'F'}, + {"0NOVKB", 'F'}, + {"0NOVKF", 'F'}, + {"0NOVKN", 'F'}, + {"0NOVKS", 'F'}, + {"0NOVKU", 'F'}, + {"0NOVKV", 'F'}, + {"0NOVO(", 'F'}, + {"0NOVOF", 'F'}, + {"0NOVOK", 'F'}, + {"0NOVOS", 'F'}, + {"0NOVOU", 'F'}, + {"0NOVS(", 'F'}, + {"0NOVS1", 'F'}, + {"0NOVSF", 'F'}, + {"0NOVSO", 'F'}, + {"0NOVSU", 'F'}, + {"0NOVSV", 'F'}, + {"0NOVT(", 'F'}, + {"0NOVT1", 'F'}, + {"0NOVTE", 'F'}, + {"0NOVTF", 'F'}, + {"0NOVTN", 'F'}, + {"0NOVTS", 'F'}, + {"0NOVTT", 'F'}, + {"0NOVTV", 'F'}, + {"0NOVU", 'F'}, + {"0NOVU(", 'F'}, + {"0NOVU1", 'F'}, + {"0NOVU;", 'F'}, + {"0NOVUC", 'F'}, + {"0NOVUE", 'F'}, + {"0NOVUF", 'F'}, + {"0NOVUK", 'F'}, + {"0NOVUO", 'F'}, + {"0NOVUS", 'F'}, + {"0NOVUT", 'F'}, + {"0NOVUV", 'F'}, + {"0NSO1U", 'F'}, + {"0NSONU", 'F'}, + {"0NSOSU", 'F'}, + {"0NSOVU", 'F'}, + {"0NSUE", 'F'}, + {"0NSUE;", 'F'}, + {"0NSUEC", 'F'}, + {"0NSUEK", 'F'}, + {"0NT(1)", 'F'}, + {"0NT(1O", 'F'}, + {"0NT(F(", 'F'}, + {"0NT(N)", 'F'}, + {"0NT(NO", 'F'}, + {"0NT(S)", 'F'}, + {"0NT(SO", 'F'}, + {"0NT(V)", 'F'}, + {"0NT(VO", 'F'}, + {"0NT1(F", 'F'}, + {"0NT1O(", 'F'}, + {"0NT1OF", 'F'}, + {"0NT1OS", 'F'}, + {"0NT1OV", 'F'}, + {"0NTE(1", 'F'}, + {"0NTE(F", 'F'}, + {"0NTE(N", 'F'}, + {"0NTE(S", 'F'}, + {"0NTE(V", 'F'}, + {"0NTE1N", 'F'}, + {"0NTE1O", 'F'}, + {"0NTEF(", 'F'}, + {"0NTEK(", 'F'}, + {"0NTEK1", 'F'}, + {"0NTEKF", 'F'}, + {"0NTEKN", 'F'}, + {"0NTEKS", 'F'}, + {"0NTEKV", 'F'}, + {"0NTENN", 'F'}, + {"0NTENO", 'F'}, + {"0NTESN", 'F'}, + {"0NTESO", 'F'}, + {"0NTEVN", 'F'}, + {"0NTEVO", 'F'}, + {"0NTF()", 'F'}, + {"0NTF(1", 'F'}, + {"0NTF(F", 'F'}, + {"0NTF(N", 'F'}, + {"0NTF(S", 'F'}, + {"0NTF(V", 'F'}, + {"0NTN(1", 'F'}, + {"0NTN(F", 'F'}, + {"0NTN(S", 'F'}, + {"0NTN(V", 'F'}, + {"0NTN1C", 'F'}, + {"0NTN1O", 'F'}, + {"0NTN;E", 'F'}, + {"0NTN;N", 'F'}, + {"0NTN;T", 'F'}, + {"0NTNE(", 'F'}, + {"0NTNE1", 'F'}, + {"0NTNEF", 'F'}, + {"0NTNEN", 'F'}, + {"0NTNES", 'F'}, + {"0NTNEV", 'F'}, + {"0NTNF(", 'F'}, + {"0NTNKN", 'F'}, + {"0NTNN:", 'F'}, + {"0NTNNC", 'F'}, + {"0NTNNO", 'F'}, + {"0NTNO(", 'F'}, + {"0NTNOF", 'F'}, + {"0NTNOS", 'F'}, + {"0NTNOV", 'F'}, + {"0NTNSC", 'F'}, + {"0NTNSO", 'F'}, + {"0NTNT(", 'F'}, + {"0NTNT1", 'F'}, + {"0NTNTF", 'F'}, + {"0NTNTN", 'F'}, + {"0NTNTS", 'F'}, + {"0NTNTV", 'F'}, + {"0NTNVC", 'F'}, + {"0NTNVO", 'F'}, + {"0NTS(F", 'F'}, + {"0NTSO(", 'F'}, + {"0NTSO1", 'F'}, + {"0NTSOF", 'F'}, + {"0NTSON", 'F'}, + {"0NTSOS", 'F'}, + {"0NTSOV", 'F'}, + {"0NTTNE", 'F'}, + {"0NTTNK", 'F'}, + {"0NTTNN", 'F'}, + {"0NTTNT", 'F'}, + {"0NTV(1", 'F'}, + {"0NTV(F", 'F'}, + {"0NTVO(", 'F'}, + {"0NTVOF", 'F'}, + {"0NTVOS", 'F'}, + {"0NU(1)", 'F'}, + {"0NU(1O", 'F'}, + {"0NU(E(", 'F'}, + {"0NU(E1", 'F'}, + {"0NU(EF", 'F'}, + {"0NU(EK", 'F'}, + {"0NU(EN", 'F'}, + {"0NU(ES", 'F'}, + {"0NU(EV", 'F'}, + {"0NU(F(", 'F'}, + {"0NU(N)", 'F'}, + {"0NU(NO", 'F'}, + {"0NU(S)", 'F'}, + {"0NU(SO", 'F'}, + {"0NU(V)", 'F'}, + {"0NU(VO", 'F'}, + {"0NU1,(", 'F'}, + {"0NU1,F", 'F'}, + {"0NU1C", 'F'}, + {"0NU1O(", 'F'}, + {"0NU1OF", 'F'}, + {"0NU1OS", 'F'}, + {"0NU1OV", 'F'}, + {"0NU;", 'F'}, + {"0NU;C", 'F'}, + {"0NUC", 'F'}, + {"0NUE", 'F'}, + {"0NUE(1", 'F'}, + {"0NUE(E", 'F'}, + {"0NUE(F", 'F'}, + {"0NUE(N", 'F'}, + {"0NUE(O", 'F'}, + {"0NUE(S", 'F'}, + {"0NUE(V", 'F'}, + {"0NUE1", 'F'}, + {"0NUE1&", 'F'}, + {"0NUE1(", 'F'}, + {"0NUE1)", 'F'}, + {"0NUE1,", 'F'}, + {"0NUE1;", 'F'}, + {"0NUE1B", 'F'}, + {"0NUE1C", 'F'}, + {"0NUE1F", 'F'}, + {"0NUE1K", 'F'}, + {"0NUE1N", 'F'}, + {"0NUE1O", 'F'}, + {"0NUE1S", 'F'}, + {"0NUE1U", 'F'}, + {"0NUE1V", 'F'}, + {"0NUE;", 'F'}, + {"0NUE;C", 'F'}, + {"0NUEC", 'F'}, + {"0NUEF", 'F'}, + {"0NUEF(", 'F'}, + {"0NUEF,", 'F'}, + {"0NUEF;", 'F'}, + {"0NUEFC", 'F'}, + {"0NUEK", 'F'}, + {"0NUEK(", 'F'}, + {"0NUEK1", 'F'}, + {"0NUEK;", 'F'}, + {"0NUEKC", 'F'}, + {"0NUEKF", 'F'}, + {"0NUEKN", 'F'}, + {"0NUEKO", 'F'}, + {"0NUEKS", 'F'}, + {"0NUEKV", 'F'}, + {"0NUEN", 'F'}, + {"0NUEN&", 'F'}, + {"0NUEN(", 'F'}, + {"0NUEN)", 'F'}, + {"0NUEN,", 'F'}, + {"0NUEN1", 'F'}, + {"0NUEN;", 'F'}, + {"0NUENB", 'F'}, + {"0NUENC", 'F'}, + {"0NUENF", 'F'}, + {"0NUENK", 'F'}, + {"0NUENO", 'F'}, + {"0NUENS", 'F'}, + {"0NUENU", 'F'}, + {"0NUEOK", 'F'}, + {"0NUEON", 'F'}, + {"0NUES", 'F'}, + {"0NUES&", 'F'}, + {"0NUES(", 'F'}, + {"0NUES)", 'F'}, + {"0NUES,", 'F'}, + {"0NUES1", 'F'}, + {"0NUES;", 'F'}, + {"0NUESB", 'F'}, + {"0NUESC", 'F'}, + {"0NUESF", 'F'}, + {"0NUESK", 'F'}, + {"0NUESO", 'F'}, + {"0NUESU", 'F'}, + {"0NUESV", 'F'}, + {"0NUEV", 'F'}, + {"0NUEV&", 'F'}, + {"0NUEV(", 'F'}, + {"0NUEV)", 'F'}, + {"0NUEV,", 'F'}, + {"0NUEV;", 'F'}, + {"0NUEVB", 'F'}, + {"0NUEVC", 'F'}, + {"0NUEVF", 'F'}, + {"0NUEVK", 'F'}, + {"0NUEVN", 'F'}, + {"0NUEVO", 'F'}, + {"0NUEVS", 'F'}, + {"0NUEVU", 'F'}, + {"0NUF()", 'F'}, + {"0NUF(1", 'F'}, + {"0NUF(F", 'F'}, + {"0NUF(N", 'F'}, + {"0NUF(S", 'F'}, + {"0NUF(V", 'F'}, + {"0NUK(E", 'F'}, + {"0NUO(E", 'F'}, + {"0NUON(", 'F'}, + {"0NUON1", 'F'}, + {"0NUONF", 'F'}, + {"0NUONS", 'F'}, + {"0NUS,(", 'F'}, + {"0NUS,F", 'F'}, + {"0NUSC", 'F'}, + {"0NUSO(", 'F'}, + {"0NUSO1", 'F'}, + {"0NUSOF", 'F'}, + {"0NUSON", 'F'}, + {"0NUSOS", 'F'}, + {"0NUSOV", 'F'}, + {"0NUTN(", 'F'}, + {"0NUTN1", 'F'}, + {"0NUTNF", 'F'}, + {"0NUTNN", 'F'}, + {"0NUTNS", 'F'}, + {"0NUTNV", 'F'}, + {"0NUV,(", 'F'}, + {"0NUV,F", 'F'}, + {"0NUVC", 'F'}, + {"0NUVO(", 'F'}, + {"0NUVOF", 'F'}, + {"0NUVOS", 'F'}, + {"0S&(1&", 'F'}, + {"0S&(1)", 'F'}, + {"0S&(1,", 'F'}, + {"0S&(1O", 'F'}, + {"0S&(E(", 'F'}, + {"0S&(E1", 'F'}, + {"0S&(EF", 'F'}, + {"0S&(EK", 'F'}, + {"0S&(EN", 'F'}, + {"0S&(EO", 'F'}, + {"0S&(ES", 'F'}, + {"0S&(EV", 'F'}, + {"0S&(F(", 'F'}, + {"0S&(N&", 'F'}, + {"0S&(N)", 'F'}, + {"0S&(N,", 'F'}, + {"0S&(NO", 'F'}, + {"0S&(S&", 'F'}, + {"0S&(S)", 'F'}, + {"0S&(S,", 'F'}, + {"0S&(SO", 'F'}, + {"0S&(V&", 'F'}, + {"0S&(V)", 'F'}, + {"0S&(V,", 'F'}, + {"0S&(VO", 'F'}, + {"0S&1", 'F'}, + {"0S&1&(", 'F'}, + {"0S&1&1", 'F'}, + {"0S&1&F", 'F'}, + {"0S&1&N", 'F'}, + {"0S&1&S", 'F'}, + {"0S&1&V", 'F'}, + {"0S&1)&", 'F'}, + {"0S&1)C", 'F'}, + {"0S&1)O", 'F'}, + {"0S&1)U", 'F'}, + {"0S&1;", 'F'}, + {"0S&1;C", 'F'}, + {"0S&1;E", 'F'}, + {"0S&1;T", 'F'}, + {"0S&1B(", 'F'}, + {"0S&1B1", 'F'}, + {"0S&1BF", 'F'}, + {"0S&1BN", 'F'}, + {"0S&1BS", 'F'}, + {"0S&1BV", 'F'}, + {"0S&1C", 'F'}, + {"0S&1EK", 'F'}, + {"0S&1EN", 'F'}, + {"0S&1F(", 'F'}, + {"0S&1K(", 'F'}, + {"0S&1K1", 'F'}, + {"0S&1KF", 'F'}, + {"0S&1KN", 'F'}, + {"0S&1KS", 'F'}, + {"0S&1KV", 'F'}, + {"0S&1O(", 'F'}, + {"0S&1OF", 'F'}, + {"0S&1OS", 'F'}, + {"0S&1OV", 'F'}, + {"0S&1TN", 'F'}, + {"0S&1U", 'F'}, + {"0S&1U(", 'F'}, + {"0S&1U;", 'F'}, + {"0S&1UC", 'F'}, + {"0S&1UE", 'F'}, + {"0S&E(1", 'F'}, + {"0S&E(F", 'F'}, + {"0S&E(N", 'F'}, + {"0S&E(O", 'F'}, + {"0S&E(S", 'F'}, + {"0S&E(V", 'F'}, + {"0S&E1", 'F'}, + {"0S&E1;", 'F'}, + {"0S&E1C", 'F'}, + {"0S&E1K", 'F'}, + {"0S&E1O", 'F'}, + {"0S&EF(", 'F'}, + {"0S&EK(", 'F'}, + {"0S&EK1", 'F'}, + {"0S&EKF", 'F'}, + {"0S&EKN", 'F'}, + {"0S&EKS", 'F'}, + {"0S&EKV", 'F'}, + {"0S&EN", 'F'}, + {"0S&EN;", 'F'}, + {"0S&ENC", 'F'}, + {"0S&ENK", 'F'}, + {"0S&ENO", 'F'}, + {"0S&ES", 'F'}, + {"0S&ES;", 'F'}, + {"0S&ESC", 'F'}, + {"0S&ESK", 'F'}, + {"0S&ESO", 'F'}, + {"0S&EV", 'F'}, + {"0S&EV;", 'F'}, + {"0S&EVC", 'F'}, + {"0S&EVK", 'F'}, + {"0S&EVO", 'F'}, + {"0S&F()", 'F'}, + {"0S&F(1", 'F'}, + {"0S&F(E", 'F'}, + {"0S&F(F", 'F'}, + {"0S&F(N", 'F'}, + {"0S&F(S", 'F'}, + {"0S&F(V", 'F'}, + {"0S&K&(", 'F'}, + {"0S&K&1", 'F'}, + {"0S&K&F", 'F'}, + {"0S&K&N", 'F'}, + {"0S&K&S", 'F'}, + {"0S&K&V", 'F'}, + {"0S&K(1", 'F'}, + {"0S&K(F", 'F'}, + {"0S&K(N", 'F'}, + {"0S&K(S", 'F'}, + {"0S&K(V", 'F'}, + {"0S&K1O", 'F'}, + {"0S&KC", 'F'}, + {"0S&KF(", 'F'}, + {"0S&KNK", 'F'}, + {"0S&KO(", 'F'}, + {"0S&KO1", 'F'}, + {"0S&KOF", 'F'}, + {"0S&KOK", 'F'}, + {"0S&KON", 'F'}, + {"0S&KOS", 'F'}, + {"0S&KOV", 'F'}, + {"0S&KSO", 'F'}, + {"0S&KVO", 'F'}, + {"0S&N", 'F'}, + {"0S&N&(", 'F'}, + {"0S&N&1", 'F'}, + {"0S&N&F", 'F'}, + {"0S&N&N", 'F'}, + {"0S&N&S", 'F'}, + {"0S&N&V", 'F'}, + {"0S&N)&", 'F'}, + {"0S&N)C", 'F'}, + {"0S&N)O", 'F'}, + {"0S&N)U", 'F'}, + {"0S&N;", 'F'}, + {"0S&N;C", 'F'}, + {"0S&N;E", 'F'}, + {"0S&N;T", 'F'}, + {"0S&NB(", 'F'}, + {"0S&NB1", 'F'}, + {"0S&NBF", 'F'}, + {"0S&NBN", 'F'}, + {"0S&NBS", 'F'}, + {"0S&NBV", 'F'}, + {"0S&NC", 'F'}, + {"0S&NEN", 'F'}, + {"0S&NF(", 'F'}, + {"0S&NK(", 'F'}, + {"0S&NK1", 'F'}, + {"0S&NKF", 'F'}, + {"0S&NKN", 'F'}, + {"0S&NKS", 'F'}, + {"0S&NKV", 'F'}, + {"0S&NO(", 'F'}, + {"0S&NOF", 'F'}, + {"0S&NOS", 'F'}, + {"0S&NOV", 'F'}, + {"0S&NTN", 'F'}, + {"0S&NU", 'F'}, + {"0S&NU(", 'F'}, + {"0S&NU;", 'F'}, + {"0S&NUC", 'F'}, + {"0S&NUE", 'F'}, + {"0S&S", 'F'}, + {"0S&S&(", 'F'}, + {"0S&S&1", 'F'}, + {"0S&S&F", 'F'}, + {"0S&S&N", 'F'}, + {"0S&S&S", 'F'}, + {"0S&S&V", 'F'}, + {"0S&S)&", 'F'}, + {"0S&S)C", 'F'}, + {"0S&S)O", 'F'}, + {"0S&S)U", 'F'}, + {"0S&S1", 'F'}, + {"0S&S1;", 'F'}, + {"0S&S1C", 'F'}, + {"0S&S;", 'F'}, + {"0S&S;C", 'F'}, + {"0S&S;E", 'F'}, + {"0S&S;T", 'F'}, + {"0S&SB(", 'F'}, + {"0S&SB1", 'F'}, + {"0S&SBF", 'F'}, + {"0S&SBN", 'F'}, + {"0S&SBS", 'F'}, + {"0S&SBV", 'F'}, + {"0S&SC", 'F'}, + {"0S&SEK", 'F'}, + {"0S&SEN", 'F'}, + {"0S&SF(", 'F'}, + {"0S&SK(", 'F'}, + {"0S&SK1", 'F'}, + {"0S&SKF", 'F'}, + {"0S&SKN", 'F'}, + {"0S&SKS", 'F'}, + {"0S&SKV", 'F'}, + {"0S&SO(", 'F'}, + {"0S&SO1", 'F'}, + {"0S&SOF", 'F'}, + {"0S&SON", 'F'}, + {"0S&SOS", 'F'}, + {"0S&SOV", 'F'}, + {"0S&STN", 'F'}, + {"0S&SU", 'F'}, + {"0S&SU(", 'F'}, + {"0S&SU;", 'F'}, + {"0S&SUC", 'F'}, + {"0S&SUE", 'F'}, + {"0S&SV", 'F'}, + {"0S&SV;", 'F'}, + {"0S&SVC", 'F'}, + {"0S&SVO", 'F'}, + {"0S&V", 'F'}, + {"0S&V&(", 'F'}, + {"0S&V&1", 'F'}, + {"0S&V&F", 'F'}, + {"0S&V&N", 'F'}, + {"0S&V&S", 'F'}, + {"0S&V&V", 'F'}, + {"0S&V)&", 'F'}, + {"0S&V)C", 'F'}, + {"0S&V)O", 'F'}, + {"0S&V)U", 'F'}, + {"0S&V;", 'F'}, + {"0S&V;C", 'F'}, + {"0S&V;E", 'F'}, + {"0S&V;T", 'F'}, + {"0S&VB(", 'F'}, + {"0S&VB1", 'F'}, + {"0S&VBF", 'F'}, + {"0S&VBN", 'F'}, + {"0S&VBS", 'F'}, + {"0S&VBV", 'F'}, + {"0S&VC", 'F'}, + {"0S&VEK", 'F'}, + {"0S&VEN", 'F'}, + {"0S&VF(", 'F'}, + {"0S&VK(", 'F'}, + {"0S&VK1", 'F'}, + {"0S&VKF", 'F'}, + {"0S&VKN", 'F'}, + {"0S&VKS", 'F'}, + {"0S&VKV", 'F'}, + {"0S&VO(", 'F'}, + {"0S&VOF", 'F'}, + {"0S&VOS", 'F'}, + {"0S&VS", 'F'}, + {"0S&VS;", 'F'}, + {"0S&VSC", 'F'}, + {"0S&VSO", 'F'}, + {"0S&VTN", 'F'}, + {"0S&VU", 'F'}, + {"0S&VU(", 'F'}, + {"0S&VU;", 'F'}, + {"0S&VUC", 'F'}, + {"0S&VUE", 'F'}, + {"0S(EF(", 'F'}, + {"0S(EKF", 'F'}, + {"0S(EKN", 'F'}, + {"0S(ENK", 'F'}, + {"0S(U(E", 'F'}, + {"0S)&(1", 'F'}, + {"0S)&(E", 'F'}, + {"0S)&(F", 'F'}, + {"0S)&(N", 'F'}, + {"0S)&(S", 'F'}, + {"0S)&(V", 'F'}, + {"0S)&1", 'F'}, + {"0S)&1&", 'F'}, + {"0S)&1)", 'F'}, + {"0S)&1;", 'F'}, + {"0S)&1B", 'F'}, + {"0S)&1C", 'F'}, + {"0S)&1F", 'F'}, + {"0S)&1O", 'F'}, + {"0S)&1U", 'F'}, + {"0S)&F(", 'F'}, + {"0S)&N", 'F'}, + {"0S)&N&", 'F'}, + {"0S)&N)", 'F'}, + {"0S)&N;", 'F'}, + {"0S)&NB", 'F'}, + {"0S)&NC", 'F'}, + {"0S)&NF", 'F'}, + {"0S)&NO", 'F'}, + {"0S)&NU", 'F'}, + {"0S)&S", 'F'}, + {"0S)&S&", 'F'}, + {"0S)&S)", 'F'}, + {"0S)&S;", 'F'}, + {"0S)&SB", 'F'}, + {"0S)&SC", 'F'}, + {"0S)&SF", 'F'}, + {"0S)&SO", 'F'}, + {"0S)&SU", 'F'}, + {"0S)&V", 'F'}, + {"0S)&V&", 'F'}, + {"0S)&V)", 'F'}, + {"0S)&V;", 'F'}, + {"0S)&VB", 'F'}, + {"0S)&VC", 'F'}, + {"0S)&VF", 'F'}, + {"0S)&VO", 'F'}, + {"0S)&VU", 'F'}, + {"0S),(1", 'F'}, + {"0S),(F", 'F'}, + {"0S),(N", 'F'}, + {"0S),(S", 'F'}, + {"0S),(V", 'F'}, + {"0S);E(", 'F'}, + {"0S);E1", 'F'}, + {"0S);EF", 'F'}, + {"0S);EK", 'F'}, + {"0S);EN", 'F'}, + {"0S);EO", 'F'}, + {"0S);ES", 'F'}, + {"0S);EV", 'F'}, + {"0S);T(", 'F'}, + {"0S);T1", 'F'}, + {"0S);TF", 'F'}, + {"0S);TK", 'F'}, + {"0S);TN", 'F'}, + {"0S);TO", 'F'}, + {"0S);TS", 'F'}, + {"0S);TV", 'F'}, + {"0S)B(1", 'F'}, + {"0S)B(F", 'F'}, + {"0S)B(N", 'F'}, + {"0S)B(S", 'F'}, + {"0S)B(V", 'F'}, + {"0S)B1", 'F'}, + {"0S)B1&", 'F'}, + {"0S)B1;", 'F'}, + {"0S)B1C", 'F'}, + {"0S)B1K", 'F'}, + {"0S)B1N", 'F'}, + {"0S)B1O", 'F'}, + {"0S)B1U", 'F'}, + {"0S)BF(", 'F'}, + {"0S)BN", 'F'}, + {"0S)BN&", 'F'}, + {"0S)BN;", 'F'}, + {"0S)BNC", 'F'}, + {"0S)BNK", 'F'}, + {"0S)BNO", 'F'}, + {"0S)BNU", 'F'}, + {"0S)BS", 'F'}, + {"0S)BS&", 'F'}, + {"0S)BS;", 'F'}, + {"0S)BSC", 'F'}, + {"0S)BSK", 'F'}, + {"0S)BSO", 'F'}, + {"0S)BSU", 'F'}, + {"0S)BV", 'F'}, + {"0S)BV&", 'F'}, + {"0S)BV;", 'F'}, + {"0S)BVC", 'F'}, + {"0S)BVK", 'F'}, + {"0S)BVO", 'F'}, + {"0S)BVU", 'F'}, + {"0S)C", 'F'}, + {"0S)E(1", 'F'}, + {"0S)E(F", 'F'}, + {"0S)E(N", 'F'}, + {"0S)E(S", 'F'}, + {"0S)E(V", 'F'}, + {"0S)E1C", 'F'}, + {"0S)E1O", 'F'}, + {"0S)EF(", 'F'}, + {"0S)EK(", 'F'}, + {"0S)EK1", 'F'}, + {"0S)EKF", 'F'}, + {"0S)EKN", 'F'}, + {"0S)EKS", 'F'}, + {"0S)EKV", 'F'}, + {"0S)ENC", 'F'}, + {"0S)ENO", 'F'}, + {"0S)ESC", 'F'}, + {"0S)ESO", 'F'}, + {"0S)EVC", 'F'}, + {"0S)EVO", 'F'}, + {"0S)F(F", 'F'}, + {"0S)K(1", 'F'}, + {"0S)K(F", 'F'}, + {"0S)K(N", 'F'}, + {"0S)K(S", 'F'}, + {"0S)K(V", 'F'}, + {"0S)K1&", 'F'}, + {"0S)K1;", 'F'}, + {"0S)K1B", 'F'}, + {"0S)K1E", 'F'}, + {"0S)K1O", 'F'}, + {"0S)K1U", 'F'}, + {"0S)KB(", 'F'}, + {"0S)KB1", 'F'}, + {"0S)KBF", 'F'}, + {"0S)KBN", 'F'}, + {"0S)KBS", 'F'}, + {"0S)KBV", 'F'}, + {"0S)KF(", 'F'}, + {"0S)KN&", 'F'}, + {"0S)KN;", 'F'}, + {"0S)KNB", 'F'}, + {"0S)KNC", 'F'}, + {"0S)KNE", 'F'}, + {"0S)KNK", 'F'}, + {"0S)KNU", 'F'}, + {"0S)KS&", 'F'}, + {"0S)KS;", 'F'}, + {"0S)KSB", 'F'}, + {"0S)KSE", 'F'}, + {"0S)KSO", 'F'}, + {"0S)KSU", 'F'}, + {"0S)KUE", 'F'}, + {"0S)KV&", 'F'}, + {"0S)KV;", 'F'}, + {"0S)KVB", 'F'}, + {"0S)KVE", 'F'}, + {"0S)KVO", 'F'}, + {"0S)KVU", 'F'}, + {"0S)O(1", 'F'}, + {"0S)O(E", 'F'}, + {"0S)O(F", 'F'}, + {"0S)O(N", 'F'}, + {"0S)O(S", 'F'}, + {"0S)O(V", 'F'}, + {"0S)O1", 'F'}, + {"0S)O1&", 'F'}, + {"0S)O1)", 'F'}, + {"0S)O1;", 'F'}, + {"0S)O1B", 'F'}, + {"0S)O1C", 'F'}, + {"0S)O1K", 'F'}, + {"0S)O1U", 'F'}, + {"0S)OF(", 'F'}, + {"0S)ON&", 'F'}, + {"0S)ON)", 'F'}, + {"0S)ON;", 'F'}, + {"0S)ONB", 'F'}, + {"0S)ONC", 'F'}, + {"0S)ONK", 'F'}, + {"0S)ONU", 'F'}, + {"0S)OS", 'F'}, + {"0S)OS&", 'F'}, + {"0S)OS)", 'F'}, + {"0S)OS;", 'F'}, + {"0S)OSB", 'F'}, + {"0S)OSC", 'F'}, + {"0S)OSK", 'F'}, + {"0S)OSU", 'F'}, + {"0S)OV", 'F'}, + {"0S)OV&", 'F'}, + {"0S)OV)", 'F'}, + {"0S)OV;", 'F'}, + {"0S)OVB", 'F'}, + {"0S)OVC", 'F'}, + {"0S)OVK", 'F'}, + {"0S)OVO", 'F'}, + {"0S)OVU", 'F'}, + {"0S)U(E", 'F'}, + {"0S)UE(", 'F'}, + {"0S)UE1", 'F'}, + {"0S)UEF", 'F'}, + {"0S)UEK", 'F'}, + {"0S)UEN", 'F'}, + {"0S)UES", 'F'}, + {"0S)UEV", 'F'}, + {"0S,(1)", 'F'}, + {"0S,(1O", 'F'}, + {"0S,(E(", 'F'}, + {"0S,(E1", 'F'}, + {"0S,(EF", 'F'}, + {"0S,(EK", 'F'}, + {"0S,(EN", 'F'}, + {"0S,(ES", 'F'}, + {"0S,(EV", 'F'}, + {"0S,(F(", 'F'}, + {"0S,(N)", 'F'}, + {"0S,(NO", 'F'}, + {"0S,(S)", 'F'}, + {"0S,(SO", 'F'}, + {"0S,(V)", 'F'}, + {"0S,(VO", 'F'}, + {"0S,F()", 'F'}, + {"0S,F(1", 'F'}, + {"0S,F(F", 'F'}, + {"0S,F(N", 'F'}, + {"0S,F(S", 'F'}, + {"0S,F(V", 'F'}, + {"0S1F()", 'F'}, + {"0S1F(1", 'F'}, + {"0S1F(F", 'F'}, + {"0S1F(N", 'F'}, + {"0S1F(S", 'F'}, + {"0S1F(V", 'F'}, + {"0S1NC", 'F'}, + {"0S1S;", 'F'}, + {"0S1S;C", 'F'}, + {"0S1SC", 'F'}, + {"0S1UE", 'F'}, + {"0S1UE;", 'F'}, + {"0S1UEC", 'F'}, + {"0S1UEK", 'F'}, + {"0S1V", 'F'}, + {"0S1V;", 'F'}, + {"0S1V;C", 'F'}, + {"0S1VC", 'F'}, + {"0S1VO(", 'F'}, + {"0S1VOF", 'F'}, + {"0S1VOS", 'F'}, + {"0S;E(1", 'F'}, + {"0S;E(E", 'F'}, + {"0S;E(F", 'F'}, + {"0S;E(N", 'F'}, + {"0S;E(S", 'F'}, + {"0S;E(V", 'F'}, + {"0S;E1,", 'F'}, + {"0S;E1;", 'F'}, + {"0S;E1C", 'F'}, + {"0S;E1K", 'F'}, + {"0S;E1O", 'F'}, + {"0S;E1T", 'F'}, + {"0S;EF(", 'F'}, + {"0S;EK(", 'F'}, + {"0S;EK1", 'F'}, + {"0S;EKF", 'F'}, + {"0S;EKN", 'F'}, + {"0S;EKO", 'F'}, + {"0S;EKS", 'F'}, + {"0S;EKV", 'F'}, + {"0S;EN,", 'F'}, + {"0S;EN;", 'F'}, + {"0S;ENC", 'F'}, + {"0S;ENE", 'F'}, + {"0S;ENK", 'F'}, + {"0S;ENO", 'F'}, + {"0S;ENT", 'F'}, + {"0S;ES,", 'F'}, + {"0S;ES;", 'F'}, + {"0S;ESC", 'F'}, + {"0S;ESK", 'F'}, + {"0S;ESO", 'F'}, + {"0S;EST", 'F'}, + {"0S;EV,", 'F'}, + {"0S;EV;", 'F'}, + {"0S;EVC", 'F'}, + {"0S;EVK", 'F'}, + {"0S;EVO", 'F'}, + {"0S;EVT", 'F'}, + {"0S;N:T", 'F'}, + {"0S;T(1", 'F'}, + {"0S;T(C", 'F'}, + {"0S;T(E", 'F'}, + {"0S;T(F", 'F'}, + {"0S;T(N", 'F'}, + {"0S;T(S", 'F'}, + {"0S;T(V", 'F'}, + {"0S;T1(", 'F'}, + {"0S;T1,", 'F'}, + {"0S;T1;", 'F'}, + {"0S;T1C", 'F'}, + {"0S;T1F", 'F'}, + {"0S;T1K", 'F'}, + {"0S;T1O", 'F'}, + {"0S;T1T", 'F'}, + {"0S;T;", 'F'}, + {"0S;T;C", 'F'}, + {"0S;TF(", 'F'}, + {"0S;TK(", 'F'}, + {"0S;TK1", 'F'}, + {"0S;TKF", 'F'}, + {"0S;TKK", 'F'}, + {"0S;TKN", 'F'}, + {"0S;TKO", 'F'}, + {"0S;TKS", 'F'}, + {"0S;TKV", 'F'}, + {"0S;TN(", 'F'}, + {"0S;TN,", 'F'}, + {"0S;TN1", 'F'}, + {"0S;TN;", 'F'}, + {"0S;TNC", 'F'}, + {"0S;TNE", 'F'}, + {"0S;TNF", 'F'}, + {"0S;TNK", 'F'}, + {"0S;TNN", 'F'}, + {"0S;TNO", 'F'}, + {"0S;TNS", 'F'}, + {"0S;TNT", 'F'}, + {"0S;TNV", 'F'}, + {"0S;TO(", 'F'}, + {"0S;TS(", 'F'}, + {"0S;TS,", 'F'}, + {"0S;TS;", 'F'}, + {"0S;TSC", 'F'}, + {"0S;TSF", 'F'}, + {"0S;TSK", 'F'}, + {"0S;TSO", 'F'}, + {"0S;TST", 'F'}, + {"0S;TTN", 'F'}, + {"0S;TV(", 'F'}, + {"0S;TV,", 'F'}, + {"0S;TV;", 'F'}, + {"0S;TVC", 'F'}, + {"0S;TVF", 'F'}, + {"0S;TVK", 'F'}, + {"0S;TVO", 'F'}, + {"0S;TVT", 'F'}, + {"0SA(F(", 'F'}, + {"0SA(N)", 'F'}, + {"0SA(NO", 'F'}, + {"0SA(S)", 'F'}, + {"0SA(SO", 'F'}, + {"0SA(V)", 'F'}, + {"0SA(VO", 'F'}, + {"0SAF()", 'F'}, + {"0SAF(1", 'F'}, + {"0SAF(F", 'F'}, + {"0SAF(N", 'F'}, + {"0SAF(S", 'F'}, + {"0SAF(V", 'F'}, + {"0SASO(", 'F'}, + {"0SASO1", 'F'}, + {"0SASOF", 'F'}, + {"0SASON", 'F'}, + {"0SASOS", 'F'}, + {"0SASOV", 'F'}, + {"0SASUE", 'F'}, + {"0SATO(", 'F'}, + {"0SATO1", 'F'}, + {"0SATOF", 'F'}, + {"0SATON", 'F'}, + {"0SATOS", 'F'}, + {"0SATOV", 'F'}, + {"0SATUE", 'F'}, + {"0SAVO(", 'F'}, + {"0SAVOF", 'F'}, + {"0SAVOS", 'F'}, + {"0SAVUE", 'F'}, + {"0SB(1)", 'F'}, + {"0SB(1O", 'F'}, + {"0SB(F(", 'F'}, + {"0SB(NO", 'F'}, + {"0SB(S)", 'F'}, + {"0SB(SO", 'F'}, + {"0SB(V)", 'F'}, + {"0SB(VO", 'F'}, + {"0SB1", 'F'}, + {"0SB1&(", 'F'}, + {"0SB1&1", 'F'}, + {"0SB1&F", 'F'}, + {"0SB1&N", 'F'}, + {"0SB1&S", 'F'}, + {"0SB1&V", 'F'}, + {"0SB1,(", 'F'}, + {"0SB1,F", 'F'}, + {"0SB1;", 'F'}, + {"0SB1;C", 'F'}, + {"0SB1B(", 'F'}, + {"0SB1B1", 'F'}, + {"0SB1BF", 'F'}, + {"0SB1BN", 'F'}, + {"0SB1BS", 'F'}, + {"0SB1BV", 'F'}, + {"0SB1C", 'F'}, + {"0SB1K(", 'F'}, + {"0SB1K1", 'F'}, + {"0SB1KF", 'F'}, + {"0SB1KN", 'F'}, + {"0SB1KS", 'F'}, + {"0SB1KV", 'F'}, + {"0SB1O(", 'F'}, + {"0SB1OF", 'F'}, + {"0SB1OS", 'F'}, + {"0SB1OV", 'F'}, + {"0SB1U(", 'F'}, + {"0SB1UE", 'F'}, + {"0SBE(1", 'F'}, + {"0SBE(F", 'F'}, + {"0SBE(N", 'F'}, + {"0SBE(S", 'F'}, + {"0SBE(V", 'F'}, + {"0SBEK(", 'F'}, + {"0SBF()", 'F'}, + {"0SBF(1", 'F'}, + {"0SBF(F", 'F'}, + {"0SBF(N", 'F'}, + {"0SBF(S", 'F'}, + {"0SBF(V", 'F'}, + {"0SBN", 'F'}, + {"0SBN&(", 'F'}, + {"0SBN&1", 'F'}, + {"0SBN&F", 'F'}, + {"0SBN&N", 'F'}, + {"0SBN&S", 'F'}, + {"0SBN&V", 'F'}, + {"0SBN,(", 'F'}, + {"0SBN,F", 'F'}, + {"0SBN;", 'F'}, + {"0SBN;C", 'F'}, + {"0SBNB(", 'F'}, + {"0SBNB1", 'F'}, + {"0SBNBF", 'F'}, + {"0SBNBN", 'F'}, + {"0SBNBS", 'F'}, + {"0SBNBV", 'F'}, + {"0SBNC", 'F'}, + {"0SBNK(", 'F'}, + {"0SBNK1", 'F'}, + {"0SBNKF", 'F'}, + {"0SBNKN", 'F'}, + {"0SBNKS", 'F'}, + {"0SBNKV", 'F'}, + {"0SBNO(", 'F'}, + {"0SBNOF", 'F'}, + {"0SBNOS", 'F'}, + {"0SBNOV", 'F'}, + {"0SBNU(", 'F'}, + {"0SBNUE", 'F'}, + {"0SBS", 'F'}, + {"0SBS&(", 'F'}, + {"0SBS&1", 'F'}, + {"0SBS&F", 'F'}, + {"0SBS&N", 'F'}, + {"0SBS&S", 'F'}, + {"0SBS&V", 'F'}, + {"0SBS,(", 'F'}, + {"0SBS,F", 'F'}, + {"0SBS;", 'F'}, + {"0SBS;C", 'F'}, + {"0SBSB(", 'F'}, + {"0SBSB1", 'F'}, + {"0SBSBF", 'F'}, + {"0SBSBN", 'F'}, + {"0SBSBS", 'F'}, + {"0SBSBV", 'F'}, + {"0SBSC", 'F'}, + {"0SBSK(", 'F'}, + {"0SBSK1", 'F'}, + {"0SBSKF", 'F'}, + {"0SBSKN", 'F'}, + {"0SBSKS", 'F'}, + {"0SBSKV", 'F'}, + {"0SBSO(", 'F'}, + {"0SBSO1", 'F'}, + {"0SBSOF", 'F'}, + {"0SBSON", 'F'}, + {"0SBSOS", 'F'}, + {"0SBSOV", 'F'}, + {"0SBSU(", 'F'}, + {"0SBSUE", 'F'}, + {"0SBV", 'F'}, + {"0SBV&(", 'F'}, + {"0SBV&1", 'F'}, + {"0SBV&F", 'F'}, + {"0SBV&N", 'F'}, + {"0SBV&S", 'F'}, + {"0SBV&V", 'F'}, + {"0SBV,(", 'F'}, + {"0SBV,F", 'F'}, + {"0SBV;", 'F'}, + {"0SBV;C", 'F'}, + {"0SBVB(", 'F'}, + {"0SBVB1", 'F'}, + {"0SBVBF", 'F'}, + {"0SBVBN", 'F'}, + {"0SBVBS", 'F'}, + {"0SBVBV", 'F'}, + {"0SBVC", 'F'}, + {"0SBVK(", 'F'}, + {"0SBVK1", 'F'}, + {"0SBVKF", 'F'}, + {"0SBVKN", 'F'}, + {"0SBVKS", 'F'}, + {"0SBVKV", 'F'}, + {"0SBVO(", 'F'}, + {"0SBVOF", 'F'}, + {"0SBVOS", 'F'}, + {"0SBVU(", 'F'}, + {"0SBVUE", 'F'}, + {"0SC", 'F'}, + {"0SE(1)", 'F'}, + {"0SE(1O", 'F'}, + {"0SE(F(", 'F'}, + {"0SE(N)", 'F'}, + {"0SE(NO", 'F'}, + {"0SE(S)", 'F'}, + {"0SE(SO", 'F'}, + {"0SE(V)", 'F'}, + {"0SE(VO", 'F'}, + {"0SE1;T", 'F'}, + {"0SE1C", 'F'}, + {"0SE1O(", 'F'}, + {"0SE1OF", 'F'}, + {"0SE1OS", 'F'}, + {"0SE1OV", 'F'}, + {"0SE1T(", 'F'}, + {"0SE1T1", 'F'}, + {"0SE1TF", 'F'}, + {"0SE1TN", 'F'}, + {"0SE1TS", 'F'}, + {"0SE1TV", 'F'}, + {"0SE1UE", 'F'}, + {"0SEF()", 'F'}, + {"0SEF(1", 'F'}, + {"0SEF(F", 'F'}, + {"0SEF(N", 'F'}, + {"0SEF(S", 'F'}, + {"0SEF(V", 'F'}, + {"0SEK(1", 'F'}, + {"0SEK(E", 'F'}, + {"0SEK(F", 'F'}, + {"0SEK(N", 'F'}, + {"0SEK(S", 'F'}, + {"0SEK(V", 'F'}, + {"0SEK1;", 'F'}, + {"0SEK1C", 'F'}, + {"0SEK1O", 'F'}, + {"0SEK1T", 'F'}, + {"0SEK1U", 'F'}, + {"0SEKF(", 'F'}, + {"0SEKN;", 'F'}, + {"0SEKNC", 'F'}, + {"0SEKNE", 'F'}, + {"0SEKNT", 'F'}, + {"0SEKNU", 'F'}, + {"0SEKOK", 'F'}, + {"0SEKS;", 'F'}, + {"0SEKSC", 'F'}, + {"0SEKSO", 'F'}, + {"0SEKST", 'F'}, + {"0SEKSU", 'F'}, + {"0SEKU(", 'F'}, + {"0SEKU1", 'F'}, + {"0SEKUE", 'F'}, + {"0SEKUF", 'F'}, + {"0SEKUS", 'F'}, + {"0SEKUV", 'F'}, + {"0SEKV;", 'F'}, + {"0SEKVC", 'F'}, + {"0SEKVO", 'F'}, + {"0SEKVT", 'F'}, + {"0SEKVU", 'F'}, + {"0SEN;T", 'F'}, + {"0SENC", 'F'}, + {"0SENEN", 'F'}, + {"0SENO(", 'F'}, + {"0SENOF", 'F'}, + {"0SENOS", 'F'}, + {"0SENOV", 'F'}, + {"0SENT(", 'F'}, + {"0SENT1", 'F'}, + {"0SENTF", 'F'}, + {"0SENTN", 'F'}, + {"0SENTS", 'F'}, + {"0SENTV", 'F'}, + {"0SENUE", 'F'}, + {"0SEOKN", 'F'}, + {"0SES;T", 'F'}, + {"0SESC", 'F'}, + {"0SESO(", 'F'}, + {"0SESO1", 'F'}, + {"0SESOF", 'F'}, + {"0SESON", 'F'}, + {"0SESOS", 'F'}, + {"0SESOV", 'F'}, + {"0SEST(", 'F'}, + {"0SEST1", 'F'}, + {"0SESTF", 'F'}, + {"0SESTN", 'F'}, + {"0SESTS", 'F'}, + {"0SESTV", 'F'}, + {"0SESUE", 'F'}, + {"0SEU(1", 'F'}, + {"0SEU(F", 'F'}, + {"0SEU(N", 'F'}, + {"0SEU(S", 'F'}, + {"0SEU(V", 'F'}, + {"0SEU1,", 'F'}, + {"0SEU1C", 'F'}, + {"0SEU1O", 'F'}, + {"0SEUEF", 'F'}, + {"0SEUEK", 'F'}, + {"0SEUF(", 'F'}, + {"0SEUS,", 'F'}, + {"0SEUSC", 'F'}, + {"0SEUSO", 'F'}, + {"0SEUV,", 'F'}, + {"0SEUVC", 'F'}, + {"0SEUVO", 'F'}, + {"0SEV;T", 'F'}, + {"0SEVC", 'F'}, + {"0SEVO(", 'F'}, + {"0SEVOF", 'F'}, + {"0SEVOS", 'F'}, + {"0SEVT(", 'F'}, + {"0SEVT1", 'F'}, + {"0SEVTF", 'F'}, + {"0SEVTN", 'F'}, + {"0SEVTS", 'F'}, + {"0SEVTV", 'F'}, + {"0SEVUE", 'F'}, + {"0SF()1", 'F'}, + {"0SF()F", 'F'}, + {"0SF()K", 'F'}, + {"0SF()N", 'F'}, + {"0SF()O", 'F'}, + {"0SF()S", 'F'}, + {"0SF()U", 'F'}, + {"0SF()V", 'F'}, + {"0SF(1)", 'F'}, + {"0SF(1N", 'F'}, + {"0SF(1O", 'F'}, + {"0SF(E(", 'F'}, + {"0SF(E1", 'F'}, + {"0SF(EF", 'F'}, + {"0SF(EK", 'F'}, + {"0SF(EN", 'F'}, + {"0SF(ES", 'F'}, + {"0SF(EV", 'F'}, + {"0SF(F(", 'F'}, + {"0SF(N)", 'F'}, + {"0SF(N,", 'F'}, + {"0SF(NO", 'F'}, + {"0SF(S)", 'F'}, + {"0SF(SO", 'F'}, + {"0SF(V)", 'F'}, + {"0SF(VO", 'F'}, + {"0SK(1)", 'F'}, + {"0SK(1O", 'F'}, + {"0SK(F(", 'F'}, + {"0SK(N)", 'F'}, + {"0SK(NO", 'F'}, + {"0SK(S)", 'F'}, + {"0SK(SO", 'F'}, + {"0SK(V)", 'F'}, + {"0SK(VO", 'F'}, + {"0SK)&(", 'F'}, + {"0SK)&1", 'F'}, + {"0SK)&F", 'F'}, + {"0SK)&N", 'F'}, + {"0SK)&S", 'F'}, + {"0SK)&V", 'F'}, + {"0SK);E", 'F'}, + {"0SK);T", 'F'}, + {"0SK)B(", 'F'}, + {"0SK)B1", 'F'}, + {"0SK)BF", 'F'}, + {"0SK)BN", 'F'}, + {"0SK)BS", 'F'}, + {"0SK)BV", 'F'}, + {"0SK)E(", 'F'}, + {"0SK)E1", 'F'}, + {"0SK)EF", 'F'}, + {"0SK)EK", 'F'}, + {"0SK)EN", 'F'}, + {"0SK)ES", 'F'}, + {"0SK)EV", 'F'}, + {"0SK)F(", 'F'}, + {"0SK)O(", 'F'}, + {"0SK)OF", 'F'}, + {"0SK)UE", 'F'}, + {"0SK1", 'F'}, + {"0SK1&(", 'F'}, + {"0SK1&1", 'F'}, + {"0SK1&F", 'F'}, + {"0SK1&N", 'F'}, + {"0SK1&S", 'F'}, + {"0SK1&V", 'F'}, + {"0SK1;", 'F'}, + {"0SK1;C", 'F'}, + {"0SK1;E", 'F'}, + {"0SK1;T", 'F'}, + {"0SK1B(", 'F'}, + {"0SK1B1", 'F'}, + {"0SK1BF", 'F'}, + {"0SK1BN", 'F'}, + {"0SK1BS", 'F'}, + {"0SK1BV", 'F'}, + {"0SK1C", 'F'}, + {"0SK1E(", 'F'}, + {"0SK1E1", 'F'}, + {"0SK1EF", 'F'}, + {"0SK1EK", 'F'}, + {"0SK1EN", 'F'}, + {"0SK1ES", 'F'}, + {"0SK1EV", 'F'}, + {"0SK1O(", 'F'}, + {"0SK1OF", 'F'}, + {"0SK1OS", 'F'}, + {"0SK1OV", 'F'}, + {"0SK1U(", 'F'}, + {"0SK1UE", 'F'}, + {"0SKF()", 'F'}, + {"0SKF(1", 'F'}, + {"0SKF(F", 'F'}, + {"0SKF(N", 'F'}, + {"0SKF(S", 'F'}, + {"0SKF(V", 'F'}, + {"0SKN", 'F'}, + {"0SKN&(", 'F'}, + {"0SKN&1", 'F'}, + {"0SKN&F", 'F'}, + {"0SKN&N", 'F'}, + {"0SKN&S", 'F'}, + {"0SKN&V", 'F'}, + {"0SKN;", 'F'}, + {"0SKN;C", 'F'}, + {"0SKN;E", 'F'}, + {"0SKN;T", 'F'}, + {"0SKNB(", 'F'}, + {"0SKNB1", 'F'}, + {"0SKNBF", 'F'}, + {"0SKNBN", 'F'}, + {"0SKNBS", 'F'}, + {"0SKNBV", 'F'}, + {"0SKNC", 'F'}, + {"0SKNE(", 'F'}, + {"0SKNE1", 'F'}, + {"0SKNEF", 'F'}, + {"0SKNEN", 'F'}, + {"0SKNES", 'F'}, + {"0SKNEV", 'F'}, + {"0SKNU(", 'F'}, + {"0SKNUE", 'F'}, + {"0SKS", 'F'}, + {"0SKS&(", 'F'}, + {"0SKS&1", 'F'}, + {"0SKS&F", 'F'}, + {"0SKS&N", 'F'}, + {"0SKS&S", 'F'}, + {"0SKS&V", 'F'}, + {"0SKS;", 'F'}, + {"0SKS;C", 'F'}, + {"0SKS;E", 'F'}, + {"0SKS;T", 'F'}, + {"0SKSB(", 'F'}, + {"0SKSB1", 'F'}, + {"0SKSBF", 'F'}, + {"0SKSBN", 'F'}, + {"0SKSBS", 'F'}, + {"0SKSBV", 'F'}, + {"0SKSC", 'F'}, + {"0SKSE(", 'F'}, + {"0SKSE1", 'F'}, + {"0SKSEF", 'F'}, + {"0SKSEK", 'F'}, + {"0SKSEN", 'F'}, + {"0SKSES", 'F'}, + {"0SKSEV", 'F'}, + {"0SKSO(", 'F'}, + {"0SKSO1", 'F'}, + {"0SKSOF", 'F'}, + {"0SKSON", 'F'}, + {"0SKSOS", 'F'}, + {"0SKSOV", 'F'}, + {"0SKSU(", 'F'}, + {"0SKSUE", 'F'}, + {"0SKUE(", 'F'}, + {"0SKUE1", 'F'}, + {"0SKUEF", 'F'}, + {"0SKUEK", 'F'}, + {"0SKUEN", 'F'}, + {"0SKUES", 'F'}, + {"0SKUEV", 'F'}, + {"0SKV", 'F'}, + {"0SKV&(", 'F'}, + {"0SKV&1", 'F'}, + {"0SKV&F", 'F'}, + {"0SKV&N", 'F'}, + {"0SKV&S", 'F'}, + {"0SKV&V", 'F'}, + {"0SKV;", 'F'}, + {"0SKV;C", 'F'}, + {"0SKV;E", 'F'}, + {"0SKV;T", 'F'}, + {"0SKVB(", 'F'}, + {"0SKVB1", 'F'}, + {"0SKVBF", 'F'}, + {"0SKVBN", 'F'}, + {"0SKVBS", 'F'}, + {"0SKVBV", 'F'}, + {"0SKVC", 'F'}, + {"0SKVE(", 'F'}, + {"0SKVE1", 'F'}, + {"0SKVEF", 'F'}, + {"0SKVEK", 'F'}, + {"0SKVEN", 'F'}, + {"0SKVES", 'F'}, + {"0SKVEV", 'F'}, + {"0SKVO(", 'F'}, + {"0SKVOF", 'F'}, + {"0SKVOS", 'F'}, + {"0SKVU(", 'F'}, + {"0SKVUE", 'F'}, + {"0SO(1&", 'F'}, + {"0SO(1)", 'F'}, + {"0SO(1,", 'F'}, + {"0SO(1O", 'F'}, + {"0SO(E(", 'F'}, + {"0SO(E1", 'F'}, + {"0SO(EE", 'F'}, + {"0SO(EF", 'F'}, + {"0SO(EK", 'F'}, + {"0SO(EN", 'F'}, + {"0SO(EO", 'F'}, + {"0SO(ES", 'F'}, + {"0SO(EV", 'F'}, + {"0SO(F(", 'F'}, + {"0SO(N&", 'F'}, + {"0SO(N)", 'F'}, + {"0SO(N,", 'F'}, + {"0SO(NO", 'F'}, + {"0SO(S&", 'F'}, + {"0SO(S)", 'F'}, + {"0SO(S,", 'F'}, + {"0SO(SO", 'F'}, + {"0SO(V&", 'F'}, + {"0SO(V)", 'F'}, + {"0SO(V,", 'F'}, + {"0SO(VO", 'F'}, + {"0SO1&(", 'F'}, + {"0SO1&1", 'F'}, + {"0SO1&E", 'F'}, + {"0SO1&F", 'F'}, + {"0SO1&K", 'F'}, + {"0SO1&N", 'F'}, + {"0SO1&S", 'F'}, + {"0SO1&U", 'F'}, + {"0SO1&V", 'F'}, + {"0SO1(E", 'F'}, + {"0SO1(U", 'F'}, + {"0SO1)&", 'F'}, + {"0SO1),", 'F'}, + {"0SO1);", 'F'}, + {"0SO1)B", 'F'}, + {"0SO1)C", 'F'}, + {"0SO1)E", 'F'}, + {"0SO1)F", 'F'}, + {"0SO1)K", 'F'}, + {"0SO1)O", 'F'}, + {"0SO1)U", 'F'}, + {"0SO1,(", 'F'}, + {"0SO1,F", 'F'}, + {"0SO1;", 'F'}, + {"0SO1;C", 'F'}, + {"0SO1;E", 'F'}, + {"0SO1;N", 'F'}, + {"0SO1;T", 'F'}, + {"0SO1A(", 'F'}, + {"0SO1AF", 'F'}, + {"0SO1AS", 'F'}, + {"0SO1AT", 'F'}, + {"0SO1AV", 'F'}, + {"0SO1B(", 'F'}, + {"0SO1B1", 'F'}, + {"0SO1BE", 'F'}, + {"0SO1BF", 'F'}, + {"0SO1BN", 'F'}, + {"0SO1BS", 'F'}, + {"0SO1BV", 'F'}, + {"0SO1C", 'F'}, + {"0SO1E(", 'F'}, + {"0SO1E1", 'F'}, + {"0SO1EF", 'F'}, + {"0SO1EK", 'F'}, + {"0SO1EN", 'F'}, + {"0SO1EO", 'F'}, + {"0SO1ES", 'F'}, + {"0SO1EU", 'F'}, + {"0SO1EV", 'F'}, + {"0SO1F(", 'F'}, + {"0SO1K(", 'F'}, + {"0SO1K)", 'F'}, + {"0SO1K1", 'F'}, + {"0SO1KB", 'F'}, + {"0SO1KF", 'F'}, + {"0SO1KN", 'F'}, + {"0SO1KS", 'F'}, + {"0SO1KU", 'F'}, + {"0SO1KV", 'F'}, + {"0SO1N&", 'F'}, + {"0SO1N(", 'F'}, + {"0SO1N,", 'F'}, + {"0SO1NE", 'F'}, + {"0SO1NU", 'F'}, + {"0SO1SU", 'F'}, + {"0SO1SV", 'F'}, + {"0SO1T(", 'F'}, + {"0SO1T1", 'F'}, + {"0SO1TE", 'F'}, + {"0SO1TF", 'F'}, + {"0SO1TN", 'F'}, + {"0SO1TS", 'F'}, + {"0SO1TT", 'F'}, + {"0SO1TV", 'F'}, + {"0SO1U", 'F'}, + {"0SO1U(", 'F'}, + {"0SO1U1", 'F'}, + {"0SO1U;", 'F'}, + {"0SO1UC", 'F'}, + {"0SO1UE", 'F'}, + {"0SO1UF", 'F'}, + {"0SO1UK", 'F'}, + {"0SO1UO", 'F'}, + {"0SO1US", 'F'}, + {"0SO1UT", 'F'}, + {"0SO1UV", 'F'}, + {"0SO1V(", 'F'}, + {"0SO1VF", 'F'}, + {"0SO1VO", 'F'}, + {"0SO1VS", 'F'}, + {"0SO1VU", 'F'}, + {"0SOF()", 'F'}, + {"0SOF(1", 'F'}, + {"0SOF(E", 'F'}, + {"0SOF(F", 'F'}, + {"0SOF(N", 'F'}, + {"0SOF(S", 'F'}, + {"0SOF(V", 'F'}, + {"0SOK&(", 'F'}, + {"0SOK&1", 'F'}, + {"0SOK&F", 'F'}, + {"0SOK&N", 'F'}, + {"0SOK&S", 'F'}, + {"0SOK&V", 'F'}, + {"0SOK(1", 'F'}, + {"0SOK(F", 'F'}, + {"0SOK(N", 'F'}, + {"0SOK(S", 'F'}, + {"0SOK(V", 'F'}, + {"0SOK1C", 'F'}, + {"0SOK1O", 'F'}, + {"0SOKF(", 'F'}, + {"0SOKNC", 'F'}, + {"0SOKO(", 'F'}, + {"0SOKO1", 'F'}, + {"0SOKOF", 'F'}, + {"0SOKON", 'F'}, + {"0SOKOS", 'F'}, + {"0SOKOV", 'F'}, + {"0SOKSC", 'F'}, + {"0SOKSO", 'F'}, + {"0SOKVC", 'F'}, + {"0SOKVO", 'F'}, + {"0SON&(", 'F'}, + {"0SON&1", 'F'}, + {"0SON&E", 'F'}, + {"0SON&F", 'F'}, + {"0SON&K", 'F'}, + {"0SON&N", 'F'}, + {"0SON&S", 'F'}, + {"0SON&U", 'F'}, + {"0SON&V", 'F'}, + {"0SON(1", 'F'}, + {"0SON(E", 'F'}, + {"0SON(F", 'F'}, + {"0SON(S", 'F'}, + {"0SON(U", 'F'}, + {"0SON(V", 'F'}, + {"0SON)&", 'F'}, + {"0SON),", 'F'}, + {"0SON);", 'F'}, + {"0SON)B", 'F'}, + {"0SON)C", 'F'}, + {"0SON)E", 'F'}, + {"0SON)F", 'F'}, + {"0SON)K", 'F'}, + {"0SON)O", 'F'}, + {"0SON)U", 'F'}, + {"0SON,(", 'F'}, + {"0SON,F", 'F'}, + {"0SON1(", 'F'}, + {"0SON1O", 'F'}, + {"0SON1U", 'F'}, + {"0SON1V", 'F'}, + {"0SON;", 'F'}, + {"0SON;C", 'F'}, + {"0SON;E", 'F'}, + {"0SON;N", 'F'}, + {"0SON;T", 'F'}, + {"0SONA(", 'F'}, + {"0SONAF", 'F'}, + {"0SONAS", 'F'}, + {"0SONAT", 'F'}, + {"0SONAV", 'F'}, + {"0SONB(", 'F'}, + {"0SONB1", 'F'}, + {"0SONBE", 'F'}, + {"0SONBF", 'F'}, + {"0SONBN", 'F'}, + {"0SONBS", 'F'}, + {"0SONBV", 'F'}, + {"0SONE(", 'F'}, + {"0SONE1", 'F'}, + {"0SONEF", 'F'}, + {"0SONEN", 'F'}, + {"0SONEO", 'F'}, + {"0SONES", 'F'}, + {"0SONEU", 'F'}, + {"0SONEV", 'F'}, + {"0SONF(", 'F'}, + {"0SONK(", 'F'}, + {"0SONK)", 'F'}, + {"0SONK1", 'F'}, + {"0SONKB", 'F'}, + {"0SONKF", 'F'}, + {"0SONKS", 'F'}, + {"0SONKU", 'F'}, + {"0SONKV", 'F'}, + {"0SONSU", 'F'}, + {"0SONT(", 'F'}, + {"0SONT1", 'F'}, + {"0SONTE", 'F'}, + {"0SONTF", 'F'}, + {"0SONTN", 'F'}, + {"0SONTS", 'F'}, + {"0SONTT", 'F'}, + {"0SONTV", 'F'}, + {"0SONU", 'F'}, + {"0SONU(", 'F'}, + {"0SONU1", 'F'}, + {"0SONU;", 'F'}, + {"0SONUC", 'F'}, + {"0SONUE", 'F'}, + {"0SONUF", 'F'}, + {"0SONUK", 'F'}, + {"0SONUO", 'F'}, + {"0SONUS", 'F'}, + {"0SONUT", 'F'}, + {"0SONUV", 'F'}, + {"0SOS", 'F'}, + {"0SOS&(", 'F'}, + {"0SOS&1", 'F'}, + {"0SOS&E", 'F'}, + {"0SOS&F", 'F'}, + {"0SOS&K", 'F'}, + {"0SOS&N", 'F'}, + {"0SOS&S", 'F'}, + {"0SOS&U", 'F'}, + {"0SOS&V", 'F'}, + {"0SOS(E", 'F'}, + {"0SOS(U", 'F'}, + {"0SOS)&", 'F'}, + {"0SOS),", 'F'}, + {"0SOS);", 'F'}, + {"0SOS)B", 'F'}, + {"0SOS)C", 'F'}, + {"0SOS)E", 'F'}, + {"0SOS)F", 'F'}, + {"0SOS)K", 'F'}, + {"0SOS)O", 'F'}, + {"0SOS)U", 'F'}, + {"0SOS,(", 'F'}, + {"0SOS,F", 'F'}, + {"0SOS1(", 'F'}, + {"0SOS1F", 'F'}, + {"0SOS1N", 'F'}, + {"0SOS1S", 'F'}, + {"0SOS1U", 'F'}, + {"0SOS1V", 'F'}, + {"0SOS;", 'F'}, + {"0SOS;C", 'F'}, + {"0SOS;E", 'F'}, + {"0SOS;N", 'F'}, + {"0SOS;T", 'F'}, + {"0SOSA(", 'F'}, + {"0SOSAF", 'F'}, + {"0SOSAS", 'F'}, + {"0SOSAT", 'F'}, + {"0SOSAV", 'F'}, + {"0SOSB(", 'F'}, + {"0SOSB1", 'F'}, + {"0SOSBE", 'F'}, + {"0SOSBF", 'F'}, + {"0SOSBN", 'F'}, + {"0SOSBS", 'F'}, + {"0SOSBV", 'F'}, + {"0SOSC", 'F'}, + {"0SOSE(", 'F'}, + {"0SOSE1", 'F'}, + {"0SOSEF", 'F'}, + {"0SOSEK", 'F'}, + {"0SOSEN", 'F'}, + {"0SOSEO", 'F'}, + {"0SOSES", 'F'}, + {"0SOSEU", 'F'}, + {"0SOSEV", 'F'}, + {"0SOSF(", 'F'}, + {"0SOSK(", 'F'}, + {"0SOSK)", 'F'}, + {"0SOSK1", 'F'}, + {"0SOSKB", 'F'}, + {"0SOSKF", 'F'}, + {"0SOSKN", 'F'}, + {"0SOSKS", 'F'}, + {"0SOSKU", 'F'}, + {"0SOSKV", 'F'}, + {"0SOST(", 'F'}, + {"0SOST1", 'F'}, + {"0SOSTE", 'F'}, + {"0SOSTF", 'F'}, + {"0SOSTN", 'F'}, + {"0SOSTS", 'F'}, + {"0SOSTT", 'F'}, + {"0SOSTV", 'F'}, + {"0SOSU", 'F'}, + {"0SOSU(", 'F'}, + {"0SOSU1", 'F'}, + {"0SOSU;", 'F'}, + {"0SOSUC", 'F'}, + {"0SOSUE", 'F'}, + {"0SOSUF", 'F'}, + {"0SOSUK", 'F'}, + {"0SOSUO", 'F'}, + {"0SOSUS", 'F'}, + {"0SOSUT", 'F'}, + {"0SOSUV", 'F'}, + {"0SOSV(", 'F'}, + {"0SOSVF", 'F'}, + {"0SOSVO", 'F'}, + {"0SOSVS", 'F'}, + {"0SOSVU", 'F'}, + {"0SOU(E", 'F'}, + {"0SOUEK", 'F'}, + {"0SOUEN", 'F'}, + {"0SOV", 'F'}, + {"0SOV&(", 'F'}, + {"0SOV&1", 'F'}, + {"0SOV&E", 'F'}, + {"0SOV&F", 'F'}, + {"0SOV&K", 'F'}, + {"0SOV&N", 'F'}, + {"0SOV&S", 'F'}, + {"0SOV&U", 'F'}, + {"0SOV&V", 'F'}, + {"0SOV(E", 'F'}, + {"0SOV(U", 'F'}, + {"0SOV)&", 'F'}, + {"0SOV),", 'F'}, + {"0SOV);", 'F'}, + {"0SOV)B", 'F'}, + {"0SOV)C", 'F'}, + {"0SOV)E", 'F'}, + {"0SOV)F", 'F'}, + {"0SOV)K", 'F'}, + {"0SOV)O", 'F'}, + {"0SOV)U", 'F'}, + {"0SOV,(", 'F'}, + {"0SOV,F", 'F'}, + {"0SOV;", 'F'}, + {"0SOV;C", 'F'}, + {"0SOV;E", 'F'}, + {"0SOV;N", 'F'}, + {"0SOV;T", 'F'}, + {"0SOVA(", 'F'}, + {"0SOVAF", 'F'}, + {"0SOVAS", 'F'}, + {"0SOVAT", 'F'}, + {"0SOVAV", 'F'}, + {"0SOVB(", 'F'}, + {"0SOVB1", 'F'}, + {"0SOVBE", 'F'}, + {"0SOVBF", 'F'}, + {"0SOVBN", 'F'}, + {"0SOVBS", 'F'}, + {"0SOVBV", 'F'}, + {"0SOVC", 'F'}, + {"0SOVE(", 'F'}, + {"0SOVE1", 'F'}, + {"0SOVEF", 'F'}, + {"0SOVEK", 'F'}, + {"0SOVEN", 'F'}, + {"0SOVEO", 'F'}, + {"0SOVES", 'F'}, + {"0SOVEU", 'F'}, + {"0SOVEV", 'F'}, + {"0SOVF(", 'F'}, + {"0SOVK(", 'F'}, + {"0SOVK)", 'F'}, + {"0SOVK1", 'F'}, + {"0SOVKB", 'F'}, + {"0SOVKF", 'F'}, + {"0SOVKN", 'F'}, + {"0SOVKS", 'F'}, + {"0SOVKU", 'F'}, + {"0SOVKV", 'F'}, + {"0SOVO(", 'F'}, + {"0SOVOF", 'F'}, + {"0SOVOK", 'F'}, + {"0SOVOS", 'F'}, + {"0SOVOU", 'F'}, + {"0SOVS(", 'F'}, + {"0SOVS1", 'F'}, + {"0SOVSF", 'F'}, + {"0SOVSO", 'F'}, + {"0SOVSU", 'F'}, + {"0SOVSV", 'F'}, + {"0SOVT(", 'F'}, + {"0SOVT1", 'F'}, + {"0SOVTE", 'F'}, + {"0SOVTF", 'F'}, + {"0SOVTN", 'F'}, + {"0SOVTS", 'F'}, + {"0SOVTT", 'F'}, + {"0SOVTV", 'F'}, + {"0SOVU", 'F'}, + {"0SOVU(", 'F'}, + {"0SOVU1", 'F'}, + {"0SOVU;", 'F'}, + {"0SOVUC", 'F'}, + {"0SOVUE", 'F'}, + {"0SOVUF", 'F'}, + {"0SOVUK", 'F'}, + {"0SOVUO", 'F'}, + {"0SOVUS", 'F'}, + {"0SOVUT", 'F'}, + {"0SOVUV", 'F'}, + {"0ST(1)", 'F'}, + {"0ST(1O", 'F'}, + {"0ST(F(", 'F'}, + {"0ST(N)", 'F'}, + {"0ST(NO", 'F'}, + {"0ST(S)", 'F'}, + {"0ST(SO", 'F'}, + {"0ST(V)", 'F'}, + {"0ST(VO", 'F'}, + {"0ST1(F", 'F'}, + {"0ST1O(", 'F'}, + {"0ST1OF", 'F'}, + {"0ST1OS", 'F'}, + {"0ST1OV", 'F'}, + {"0STE(1", 'F'}, + {"0STE(F", 'F'}, + {"0STE(N", 'F'}, + {"0STE(S", 'F'}, + {"0STE(V", 'F'}, + {"0STE1N", 'F'}, + {"0STE1O", 'F'}, + {"0STEF(", 'F'}, + {"0STEK(", 'F'}, + {"0STEK1", 'F'}, + {"0STEKF", 'F'}, + {"0STEKN", 'F'}, + {"0STEKS", 'F'}, + {"0STEKV", 'F'}, + {"0STENN", 'F'}, + {"0STENO", 'F'}, + {"0STESN", 'F'}, + {"0STESO", 'F'}, + {"0STEVN", 'F'}, + {"0STEVO", 'F'}, + {"0STF()", 'F'}, + {"0STF(1", 'F'}, + {"0STF(F", 'F'}, + {"0STF(N", 'F'}, + {"0STF(S", 'F'}, + {"0STF(V", 'F'}, + {"0STN(1", 'F'}, + {"0STN(F", 'F'}, + {"0STN(S", 'F'}, + {"0STN(V", 'F'}, + {"0STN1C", 'F'}, + {"0STN1O", 'F'}, + {"0STN;E", 'F'}, + {"0STN;N", 'F'}, + {"0STN;T", 'F'}, + {"0STNE(", 'F'}, + {"0STNE1", 'F'}, + {"0STNEF", 'F'}, + {"0STNEN", 'F'}, + {"0STNES", 'F'}, + {"0STNEV", 'F'}, + {"0STNF(", 'F'}, + {"0STNKN", 'F'}, + {"0STNN:", 'F'}, + {"0STNNC", 'F'}, + {"0STNNO", 'F'}, + {"0STNO(", 'F'}, + {"0STNOF", 'F'}, + {"0STNOS", 'F'}, + {"0STNOV", 'F'}, + {"0STNSC", 'F'}, + {"0STNSO", 'F'}, + {"0STNT(", 'F'}, + {"0STNT1", 'F'}, + {"0STNTF", 'F'}, + {"0STNTN", 'F'}, + {"0STNTS", 'F'}, + {"0STNTV", 'F'}, + {"0STNVC", 'F'}, + {"0STNVO", 'F'}, + {"0STS(F", 'F'}, + {"0STSO(", 'F'}, + {"0STSO1", 'F'}, + {"0STSOF", 'F'}, + {"0STSON", 'F'}, + {"0STSOS", 'F'}, + {"0STSOV", 'F'}, + {"0STTNE", 'F'}, + {"0STTNK", 'F'}, + {"0STTNN", 'F'}, + {"0STTNT", 'F'}, + {"0STV(1", 'F'}, + {"0STV(F", 'F'}, + {"0STVO(", 'F'}, + {"0STVOF", 'F'}, + {"0STVOS", 'F'}, + {"0SU(1)", 'F'}, + {"0SU(1O", 'F'}, + {"0SU(E(", 'F'}, + {"0SU(E1", 'F'}, + {"0SU(EF", 'F'}, + {"0SU(EK", 'F'}, + {"0SU(EN", 'F'}, + {"0SU(ES", 'F'}, + {"0SU(EV", 'F'}, + {"0SU(F(", 'F'}, + {"0SU(N)", 'F'}, + {"0SU(NO", 'F'}, + {"0SU(S)", 'F'}, + {"0SU(SO", 'F'}, + {"0SU(V)", 'F'}, + {"0SU(VO", 'F'}, + {"0SU1,(", 'F'}, + {"0SU1,F", 'F'}, + {"0SU1C", 'F'}, + {"0SU1O(", 'F'}, + {"0SU1OF", 'F'}, + {"0SU1OS", 'F'}, + {"0SU1OV", 'F'}, + {"0SU;", 'F'}, + {"0SU;C", 'F'}, + {"0SUC", 'F'}, + {"0SUE", 'F'}, + {"0SUE(1", 'F'}, + {"0SUE(E", 'F'}, + {"0SUE(F", 'F'}, + {"0SUE(N", 'F'}, + {"0SUE(O", 'F'}, + {"0SUE(S", 'F'}, + {"0SUE(V", 'F'}, + {"0SUE1", 'F'}, + {"0SUE1&", 'F'}, + {"0SUE1(", 'F'}, + {"0SUE1)", 'F'}, + {"0SUE1,", 'F'}, + {"0SUE1;", 'F'}, + {"0SUE1B", 'F'}, + {"0SUE1C", 'F'}, + {"0SUE1F", 'F'}, + {"0SUE1K", 'F'}, + {"0SUE1N", 'F'}, + {"0SUE1O", 'F'}, + {"0SUE1S", 'F'}, + {"0SUE1U", 'F'}, + {"0SUE1V", 'F'}, + {"0SUE;", 'F'}, + {"0SUE;C", 'F'}, + {"0SUEC", 'F'}, + {"0SUEF", 'F'}, + {"0SUEF(", 'F'}, + {"0SUEF,", 'F'}, + {"0SUEF;", 'F'}, + {"0SUEFC", 'F'}, + {"0SUEK", 'F'}, + {"0SUEK(", 'F'}, + {"0SUEK1", 'F'}, + {"0SUEK;", 'F'}, + {"0SUEKC", 'F'}, + {"0SUEKF", 'F'}, + {"0SUEKN", 'F'}, + {"0SUEKO", 'F'}, + {"0SUEKS", 'F'}, + {"0SUEKV", 'F'}, + {"0SUEN", 'F'}, + {"0SUEN&", 'F'}, + {"0SUEN(", 'F'}, + {"0SUEN)", 'F'}, + {"0SUEN,", 'F'}, + {"0SUEN1", 'F'}, + {"0SUEN;", 'F'}, + {"0SUENB", 'F'}, + {"0SUENC", 'F'}, + {"0SUENF", 'F'}, + {"0SUENK", 'F'}, + {"0SUENO", 'F'}, + {"0SUENS", 'F'}, + {"0SUENU", 'F'}, + {"0SUEOK", 'F'}, + {"0SUEON", 'F'}, + {"0SUES", 'F'}, + {"0SUES&", 'F'}, + {"0SUES(", 'F'}, + {"0SUES)", 'F'}, + {"0SUES,", 'F'}, + {"0SUES1", 'F'}, + {"0SUES;", 'F'}, + {"0SUESB", 'F'}, + {"0SUESC", 'F'}, + {"0SUESF", 'F'}, + {"0SUESK", 'F'}, + {"0SUESO", 'F'}, + {"0SUESU", 'F'}, + {"0SUESV", 'F'}, + {"0SUEV", 'F'}, + {"0SUEV&", 'F'}, + {"0SUEV(", 'F'}, + {"0SUEV)", 'F'}, + {"0SUEV,", 'F'}, + {"0SUEV;", 'F'}, + {"0SUEVB", 'F'}, + {"0SUEVC", 'F'}, + {"0SUEVF", 'F'}, + {"0SUEVK", 'F'}, + {"0SUEVN", 'F'}, + {"0SUEVO", 'F'}, + {"0SUEVS", 'F'}, + {"0SUEVU", 'F'}, + {"0SUF()", 'F'}, + {"0SUF(1", 'F'}, + {"0SUF(F", 'F'}, + {"0SUF(N", 'F'}, + {"0SUF(S", 'F'}, + {"0SUF(V", 'F'}, + {"0SUK(E", 'F'}, + {"0SUO(E", 'F'}, + {"0SUON(", 'F'}, + {"0SUON1", 'F'}, + {"0SUONF", 'F'}, + {"0SUONS", 'F'}, + {"0SUS,(", 'F'}, + {"0SUS,F", 'F'}, + {"0SUSC", 'F'}, + {"0SUSO(", 'F'}, + {"0SUSO1", 'F'}, + {"0SUSOF", 'F'}, + {"0SUSON", 'F'}, + {"0SUSOS", 'F'}, + {"0SUSOV", 'F'}, + {"0SUTN(", 'F'}, + {"0SUTN1", 'F'}, + {"0SUTNF", 'F'}, + {"0SUTNN", 'F'}, + {"0SUTNS", 'F'}, + {"0SUTNV", 'F'}, + {"0SUV,(", 'F'}, + {"0SUV,F", 'F'}, + {"0SUVC", 'F'}, + {"0SUVO(", 'F'}, + {"0SUVOF", 'F'}, + {"0SUVOS", 'F'}, + {"0SVF()", 'F'}, + {"0SVF(1", 'F'}, + {"0SVF(F", 'F'}, + {"0SVF(N", 'F'}, + {"0SVF(S", 'F'}, + {"0SVF(V", 'F'}, + {"0SVO(1", 'F'}, + {"0SVO(F", 'F'}, + {"0SVO(N", 'F'}, + {"0SVO(S", 'F'}, + {"0SVO(V", 'F'}, + {"0SVOF(", 'F'}, + {"0SVOS(", 'F'}, + {"0SVOS1", 'F'}, + {"0SVOSF", 'F'}, + {"0SVOSU", 'F'}, + {"0SVOSV", 'F'}, + {"0SVS;", 'F'}, + {"0SVS;C", 'F'}, + {"0SVSC", 'F'}, + {"0SVSO(", 'F'}, + {"0SVSO1", 'F'}, + {"0SVSOF", 'F'}, + {"0SVSON", 'F'}, + {"0SVSOS", 'F'}, + {"0SVSOV", 'F'}, + {"0SVUE", 'F'}, + {"0SVUE;", 'F'}, + {"0SVUEC", 'F'}, + {"0SVUEK", 'F'}, + {"0T(1)F", 'F'}, + {"0T(1)O", 'F'}, + {"0T(1F(", 'F'}, + {"0T(1N)", 'F'}, + {"0T(1O(", 'F'}, + {"0T(1OF", 'F'}, + {"0T(1OS", 'F'}, + {"0T(1OV", 'F'}, + {"0T(1S)", 'F'}, + {"0T(1V)", 'F'}, + {"0T(1VO", 'F'}, + {"0T(F()", 'F'}, + {"0T(F(1", 'F'}, + {"0T(F(F", 'F'}, + {"0T(F(N", 'F'}, + {"0T(F(S", 'F'}, + {"0T(F(V", 'F'}, + {"0T(N(1", 'F'}, + {"0T(N(F", 'F'}, + {"0T(N(S", 'F'}, + {"0T(N(V", 'F'}, + {"0T(N)F", 'F'}, + {"0T(N)O", 'F'}, + {"0T(N1)", 'F'}, + {"0T(N1O", 'F'}, + {"0T(NF(", 'F'}, + {"0T(NN)", 'F'}, + {"0T(NNO", 'F'}, + {"0T(NO(", 'F'}, + {"0T(NOF", 'F'}, + {"0T(NOS", 'F'}, + {"0T(NOV", 'F'}, + {"0T(NS)", 'F'}, + {"0T(NSO", 'F'}, + {"0T(NV)", 'F'}, + {"0T(NVO", 'F'}, + {"0T(S)F", 'F'}, + {"0T(S)O", 'F'}, + {"0T(S1)", 'F'}, + {"0T(SF(", 'F'}, + {"0T(SN)", 'F'}, + {"0T(SNO", 'F'}, + {"0T(SO(", 'F'}, + {"0T(SO1", 'F'}, + {"0T(SOF", 'F'}, + {"0T(SON", 'F'}, + {"0T(SOS", 'F'}, + {"0T(SOV", 'F'}, + {"0T(SV)", 'F'}, + {"0T(SVO", 'F'}, + {"0T(V)F", 'F'}, + {"0T(V)O", 'F'}, + {"0T(VF(", 'F'}, + {"0T(VO(", 'F'}, + {"0T(VOF", 'F'}, + {"0T(VOS", 'F'}, + {"0T(VS)", 'F'}, + {"0T(VSO", 'F'}, + {"0T(VV)", 'F'}, + {"0T1F(1", 'F'}, + {"0T1F(F", 'F'}, + {"0T1F(N", 'F'}, + {"0T1F(S", 'F'}, + {"0T1F(V", 'F'}, + {"0T1O(1", 'F'}, + {"0T1O(F", 'F'}, + {"0T1O(N", 'F'}, + {"0T1O(S", 'F'}, + {"0T1O(V", 'F'}, + {"0T1OF(", 'F'}, + {"0T1OSF", 'F'}, + {"0T1OVF", 'F'}, + {"0T1OVO", 'F'}, + {"0TF()F", 'F'}, + {"0TF()O", 'F'}, + {"0TF(1)", 'F'}, + {"0TF(1O", 'F'}, + {"0TF(F(", 'F'}, + {"0TF(N)", 'F'}, + {"0TF(NO", 'F'}, + {"0TF(S)", 'F'}, + {"0TF(SO", 'F'}, + {"0TF(V)", 'F'}, + {"0TF(VO", 'F'}, + {"0TN(1)", 'F'}, + {"0TN(1O", 'F'}, + {"0TN(F(", 'F'}, + {"0TN(S)", 'F'}, + {"0TN(SO", 'F'}, + {"0TN(V)", 'F'}, + {"0TN(VO", 'F'}, + {"0TN1;", 'F'}, + {"0TN1;C", 'F'}, + {"0TN1O(", 'F'}, + {"0TN1OF", 'F'}, + {"0TN1OS", 'F'}, + {"0TN1OV", 'F'}, + {"0TNF()", 'F'}, + {"0TNF(1", 'F'}, + {"0TNF(F", 'F'}, + {"0TNF(N", 'F'}, + {"0TNF(S", 'F'}, + {"0TNF(V", 'F'}, + {"0TNN;", 'F'}, + {"0TNN;C", 'F'}, + {"0TNNO(", 'F'}, + {"0TNNOF", 'F'}, + {"0TNNOS", 'F'}, + {"0TNNOV", 'F'}, + {"0TNO(1", 'F'}, + {"0TNO(F", 'F'}, + {"0TNO(N", 'F'}, + {"0TNO(S", 'F'}, + {"0TNO(V", 'F'}, + {"0TNOF(", 'F'}, + {"0TNOSF", 'F'}, + {"0TNOVF", 'F'}, + {"0TNOVO", 'F'}, + {"0TNS;", 'F'}, + {"0TNS;C", 'F'}, + {"0TNSO(", 'F'}, + {"0TNSO1", 'F'}, + {"0TNSOF", 'F'}, + {"0TNSON", 'F'}, + {"0TNSOS", 'F'}, + {"0TNSOV", 'F'}, + {"0TNV;", 'F'}, + {"0TNV;C", 'F'}, + {"0TNVO(", 'F'}, + {"0TNVOF", 'F'}, + {"0TNVOS", 'F'}, + {"0TSF(1", 'F'}, + {"0TSF(F", 'F'}, + {"0TSF(N", 'F'}, + {"0TSF(S", 'F'}, + {"0TSF(V", 'F'}, + {"0TSO(1", 'F'}, + {"0TSO(F", 'F'}, + {"0TSO(N", 'F'}, + {"0TSO(S", 'F'}, + {"0TSO(V", 'F'}, + {"0TSO1F", 'F'}, + {"0TSOF(", 'F'}, + {"0TSONF", 'F'}, + {"0TSOSF", 'F'}, + {"0TSOVF", 'F'}, + {"0TSOVO", 'F'}, + {"0TVF(1", 'F'}, + {"0TVF(F", 'F'}, + {"0TVF(N", 'F'}, + {"0TVF(S", 'F'}, + {"0TVF(V", 'F'}, + {"0TVO(1", 'F'}, + {"0TVO(F", 'F'}, + {"0TVO(N", 'F'}, + {"0TVO(S", 'F'}, + {"0TVO(V", 'F'}, + {"0TVOF(", 'F'}, + {"0TVOSF", 'F'}, + {"0U(E(1", 'F'}, + {"0U(E(F", 'F'}, + {"0U(E(K", 'F'}, + {"0U(E(N", 'F'}, + {"0U(E(S", 'F'}, + {"0U(E(V", 'F'}, + {"0U(E1)", 'F'}, + {"0U(E1O", 'F'}, + {"0U(EF(", 'F'}, + {"0U(EK(", 'F'}, + {"0U(EK1", 'F'}, + {"0U(EKF", 'F'}, + {"0U(EKN", 'F'}, + {"0U(EKO", 'F'}, + {"0U(EKS", 'F'}, + {"0U(EKV", 'F'}, + {"0U(EN)", 'F'}, + {"0U(ENK", 'F'}, + {"0U(ENO", 'F'}, + {"0U(EOK", 'F'}, + {"0U(ES)", 'F'}, + {"0U(ESO", 'F'}, + {"0U(EV)", 'F'}, + {"0U(EVO", 'F'}, + {"0UE(1)", 'F'}, + {"0UE(1,", 'F'}, + {"0UE(1O", 'F'}, + {"0UE(F(", 'F'}, + {"0UE(N)", 'F'}, + {"0UE(N,", 'F'}, + {"0UE(NO", 'F'}, + {"0UE(S)", 'F'}, + {"0UE(S,", 'F'}, + {"0UE(SO", 'F'}, + {"0UE(V)", 'F'}, + {"0UE(V,", 'F'}, + {"0UE(VO", 'F'}, + {"0UE1", 'F'}, + {"0UE1,(", 'F'}, + {"0UE1,F", 'F'}, + {"0UE1;", 'F'}, + {"0UE1;C", 'F'}, + {"0UE1C", 'F'}, + {"0UE1K(", 'F'}, + {"0UE1K1", 'F'}, + {"0UE1KF", 'F'}, + {"0UE1KN", 'F'}, + {"0UE1KS", 'F'}, + {"0UE1KV", 'F'}, + {"0UE1O(", 'F'}, + {"0UE1OF", 'F'}, + {"0UE1OS", 'F'}, + {"0UE1OV", 'F'}, + {"0UEF()", 'F'}, + {"0UEF(1", 'F'}, + {"0UEF(F", 'F'}, + {"0UEF(N", 'F'}, + {"0UEF(S", 'F'}, + {"0UEF(V", 'F'}, + {"0UEK(1", 'F'}, + {"0UEK(F", 'F'}, + {"0UEK(N", 'F'}, + {"0UEK(S", 'F'}, + {"0UEK(V", 'F'}, + {"0UEK1", 'F'}, + {"0UEK1,", 'F'}, + {"0UEK1;", 'F'}, + {"0UEK1C", 'F'}, + {"0UEK1K", 'F'}, + {"0UEK1O", 'F'}, + {"0UEKF(", 'F'}, + {"0UEKN", 'F'}, + {"0UEKN(", 'F'}, + {"0UEKN,", 'F'}, + {"0UEKN;", 'F'}, + {"0UEKNC", 'F'}, + {"0UEKNK", 'F'}, + {"0UEKS", 'F'}, + {"0UEKS,", 'F'}, + {"0UEKS;", 'F'}, + {"0UEKSC", 'F'}, + {"0UEKSK", 'F'}, + {"0UEKSO", 'F'}, + {"0UEKV", 'F'}, + {"0UEKV,", 'F'}, + {"0UEKV;", 'F'}, + {"0UEKVC", 'F'}, + {"0UEKVK", 'F'}, + {"0UEKVO", 'F'}, + {"0UEN()", 'F'}, + {"0UEN,(", 'F'}, + {"0UEN,F", 'F'}, + {"0UEN;", 'F'}, + {"0UEN;C", 'F'}, + {"0UENC", 'F'}, + {"0UENK(", 'F'}, + {"0UENK1", 'F'}, + {"0UENKF", 'F'}, + {"0UENKN", 'F'}, + {"0UENKS", 'F'}, + {"0UENKV", 'F'}, + {"0UENO(", 'F'}, + {"0UENOF", 'F'}, + {"0UENOS", 'F'}, + {"0UENOV", 'F'}, + {"0UES", 'F'}, + {"0UES,(", 'F'}, + {"0UES,F", 'F'}, + {"0UES;", 'F'}, + {"0UES;C", 'F'}, + {"0UESC", 'F'}, + {"0UESK(", 'F'}, + {"0UESK1", 'F'}, + {"0UESKF", 'F'}, + {"0UESKN", 'F'}, + {"0UESKS", 'F'}, + {"0UESKV", 'F'}, + {"0UESO(", 'F'}, + {"0UESO1", 'F'}, + {"0UESOF", 'F'}, + {"0UESON", 'F'}, + {"0UESOS", 'F'}, + {"0UESOV", 'F'}, + {"0UEV", 'F'}, + {"0UEV,(", 'F'}, + {"0UEV,F", 'F'}, + {"0UEV;", 'F'}, + {"0UEV;C", 'F'}, + {"0UEVC", 'F'}, + {"0UEVK(", 'F'}, + {"0UEVK1", 'F'}, + {"0UEVKF", 'F'}, + {"0UEVKN", 'F'}, + {"0UEVKS", 'F'}, + {"0UEVKV", 'F'}, + {"0UEVO(", 'F'}, + {"0UEVOF", 'F'}, + {"0UEVOS", 'F'}, + {"0UF(1O", 'F'}, + {"0UF(F(", 'F'}, + {"0UF(NO", 'F'}, + {"0UF(SO", 'F'}, + {"0UF(VO", 'F'}, + {"0V&(1&", 'F'}, + {"0V&(1)", 'F'}, + {"0V&(1,", 'F'}, + {"0V&(1O", 'F'}, + {"0V&(E(", 'F'}, + {"0V&(E1", 'F'}, + {"0V&(EF", 'F'}, + {"0V&(EK", 'F'}, + {"0V&(EN", 'F'}, + {"0V&(EO", 'F'}, + {"0V&(ES", 'F'}, + {"0V&(EV", 'F'}, + {"0V&(F(", 'F'}, + {"0V&(N&", 'F'}, + {"0V&(N)", 'F'}, + {"0V&(N,", 'F'}, + {"0V&(NO", 'F'}, + {"0V&(S&", 'F'}, + {"0V&(S)", 'F'}, + {"0V&(S,", 'F'}, + {"0V&(SO", 'F'}, + {"0V&(V&", 'F'}, + {"0V&(V)", 'F'}, + {"0V&(V,", 'F'}, + {"0V&(VO", 'F'}, + {"0V&1", 'F'}, + {"0V&1&(", 'F'}, + {"0V&1&1", 'F'}, + {"0V&1&F", 'F'}, + {"0V&1&N", 'F'}, + {"0V&1&S", 'F'}, + {"0V&1&V", 'F'}, + {"0V&1)&", 'F'}, + {"0V&1)C", 'F'}, + {"0V&1)O", 'F'}, + {"0V&1)U", 'F'}, + {"0V&1;", 'F'}, + {"0V&1;C", 'F'}, + {"0V&1;E", 'F'}, + {"0V&1;T", 'F'}, + {"0V&1B(", 'F'}, + {"0V&1B1", 'F'}, + {"0V&1BF", 'F'}, + {"0V&1BN", 'F'}, + {"0V&1BS", 'F'}, + {"0V&1BV", 'F'}, + {"0V&1C", 'F'}, + {"0V&1EK", 'F'}, + {"0V&1EN", 'F'}, + {"0V&1F(", 'F'}, + {"0V&1K(", 'F'}, + {"0V&1K1", 'F'}, + {"0V&1KF", 'F'}, + {"0V&1KN", 'F'}, + {"0V&1KS", 'F'}, + {"0V&1KV", 'F'}, + {"0V&1O(", 'F'}, + {"0V&1OF", 'F'}, + {"0V&1OS", 'F'}, + {"0V&1OV", 'F'}, + {"0V&1TN", 'F'}, + {"0V&1U", 'F'}, + {"0V&1U(", 'F'}, + {"0V&1U;", 'F'}, + {"0V&1UC", 'F'}, + {"0V&1UE", 'F'}, + {"0V&E(1", 'F'}, + {"0V&E(F", 'F'}, + {"0V&E(N", 'F'}, + {"0V&E(O", 'F'}, + {"0V&E(S", 'F'}, + {"0V&E(V", 'F'}, + {"0V&E1", 'F'}, + {"0V&E1;", 'F'}, + {"0V&E1C", 'F'}, + {"0V&E1K", 'F'}, + {"0V&E1O", 'F'}, + {"0V&EF(", 'F'}, + {"0V&EK(", 'F'}, + {"0V&EK1", 'F'}, + {"0V&EKF", 'F'}, + {"0V&EKN", 'F'}, + {"0V&EKS", 'F'}, + {"0V&EKV", 'F'}, + {"0V&EN", 'F'}, + {"0V&EN;", 'F'}, + {"0V&ENC", 'F'}, + {"0V&ENK", 'F'}, + {"0V&ENO", 'F'}, + {"0V&ES", 'F'}, + {"0V&ES;", 'F'}, + {"0V&ESC", 'F'}, + {"0V&ESK", 'F'}, + {"0V&ESO", 'F'}, + {"0V&EV", 'F'}, + {"0V&EV;", 'F'}, + {"0V&EVC", 'F'}, + {"0V&EVK", 'F'}, + {"0V&EVO", 'F'}, + {"0V&F()", 'F'}, + {"0V&F(1", 'F'}, + {"0V&F(E", 'F'}, + {"0V&F(F", 'F'}, + {"0V&F(N", 'F'}, + {"0V&F(S", 'F'}, + {"0V&F(V", 'F'}, + {"0V&K&(", 'F'}, + {"0V&K&1", 'F'}, + {"0V&K&F", 'F'}, + {"0V&K&N", 'F'}, + {"0V&K&S", 'F'}, + {"0V&K&V", 'F'}, + {"0V&K(1", 'F'}, + {"0V&K(F", 'F'}, + {"0V&K(N", 'F'}, + {"0V&K(S", 'F'}, + {"0V&K(V", 'F'}, + {"0V&K1O", 'F'}, + {"0V&KC", 'F'}, + {"0V&KF(", 'F'}, + {"0V&KNK", 'F'}, + {"0V&KO(", 'F'}, + {"0V&KO1", 'F'}, + {"0V&KOF", 'F'}, + {"0V&KOK", 'F'}, + {"0V&KON", 'F'}, + {"0V&KOS", 'F'}, + {"0V&KOV", 'F'}, + {"0V&KSO", 'F'}, + {"0V&KVO", 'F'}, + {"0V&N", 'F'}, + {"0V&N&(", 'F'}, + {"0V&N&1", 'F'}, + {"0V&N&F", 'F'}, + {"0V&N&N", 'F'}, + {"0V&N&S", 'F'}, + {"0V&N&V", 'F'}, + {"0V&N)&", 'F'}, + {"0V&N)C", 'F'}, + {"0V&N)O", 'F'}, + {"0V&N)U", 'F'}, + {"0V&N;", 'F'}, + {"0V&N;C", 'F'}, + {"0V&N;E", 'F'}, + {"0V&N;T", 'F'}, + {"0V&NB(", 'F'}, + {"0V&NB1", 'F'}, + {"0V&NBF", 'F'}, + {"0V&NBN", 'F'}, + {"0V&NBS", 'F'}, + {"0V&NBV", 'F'}, + {"0V&NC", 'F'}, + {"0V&NEN", 'F'}, + {"0V&NF(", 'F'}, + {"0V&NK(", 'F'}, + {"0V&NK1", 'F'}, + {"0V&NKF", 'F'}, + {"0V&NKN", 'F'}, + {"0V&NKS", 'F'}, + {"0V&NKV", 'F'}, + {"0V&NO(", 'F'}, + {"0V&NOF", 'F'}, + {"0V&NOS", 'F'}, + {"0V&NOV", 'F'}, + {"0V&NTN", 'F'}, + {"0V&NU", 'F'}, + {"0V&NU(", 'F'}, + {"0V&NU;", 'F'}, + {"0V&NUC", 'F'}, + {"0V&NUE", 'F'}, + {"0V&S", 'F'}, + {"0V&S&(", 'F'}, + {"0V&S&1", 'F'}, + {"0V&S&F", 'F'}, + {"0V&S&N", 'F'}, + {"0V&S&S", 'F'}, + {"0V&S&V", 'F'}, + {"0V&S)&", 'F'}, + {"0V&S)C", 'F'}, + {"0V&S)O", 'F'}, + {"0V&S)U", 'F'}, + {"0V&S1", 'F'}, + {"0V&S1;", 'F'}, + {"0V&S1C", 'F'}, + {"0V&S;", 'F'}, + {"0V&S;C", 'F'}, + {"0V&S;E", 'F'}, + {"0V&S;T", 'F'}, + {"0V&SB(", 'F'}, + {"0V&SB1", 'F'}, + {"0V&SBF", 'F'}, + {"0V&SBN", 'F'}, + {"0V&SBS", 'F'}, + {"0V&SBV", 'F'}, + {"0V&SC", 'F'}, + {"0V&SEK", 'F'}, + {"0V&SEN", 'F'}, + {"0V&SF(", 'F'}, + {"0V&SK(", 'F'}, + {"0V&SK1", 'F'}, + {"0V&SKF", 'F'}, + {"0V&SKN", 'F'}, + {"0V&SKS", 'F'}, + {"0V&SKV", 'F'}, + {"0V&SO(", 'F'}, + {"0V&SO1", 'F'}, + {"0V&SOF", 'F'}, + {"0V&SON", 'F'}, + {"0V&SOS", 'F'}, + {"0V&SOV", 'F'}, + {"0V&STN", 'F'}, + {"0V&SU", 'F'}, + {"0V&SU(", 'F'}, + {"0V&SU;", 'F'}, + {"0V&SUC", 'F'}, + {"0V&SUE", 'F'}, + {"0V&SV", 'F'}, + {"0V&SV;", 'F'}, + {"0V&SVC", 'F'}, + {"0V&SVO", 'F'}, + {"0V&V", 'F'}, + {"0V&V&(", 'F'}, + {"0V&V&1", 'F'}, + {"0V&V&F", 'F'}, + {"0V&V&N", 'F'}, + {"0V&V&S", 'F'}, + {"0V&V&V", 'F'}, + {"0V&V)&", 'F'}, + {"0V&V)C", 'F'}, + {"0V&V)O", 'F'}, + {"0V&V)U", 'F'}, + {"0V&V;", 'F'}, + {"0V&V;C", 'F'}, + {"0V&V;E", 'F'}, + {"0V&V;T", 'F'}, + {"0V&VB(", 'F'}, + {"0V&VB1", 'F'}, + {"0V&VBF", 'F'}, + {"0V&VBN", 'F'}, + {"0V&VBS", 'F'}, + {"0V&VBV", 'F'}, + {"0V&VC", 'F'}, + {"0V&VEK", 'F'}, + {"0V&VEN", 'F'}, + {"0V&VF(", 'F'}, + {"0V&VK(", 'F'}, + {"0V&VK1", 'F'}, + {"0V&VKF", 'F'}, + {"0V&VKN", 'F'}, + {"0V&VKS", 'F'}, + {"0V&VKV", 'F'}, + {"0V&VO(", 'F'}, + {"0V&VOF", 'F'}, + {"0V&VOS", 'F'}, + {"0V&VS", 'F'}, + {"0V&VS;", 'F'}, + {"0V&VSC", 'F'}, + {"0V&VSO", 'F'}, + {"0V&VTN", 'F'}, + {"0V&VU", 'F'}, + {"0V&VU(", 'F'}, + {"0V&VU;", 'F'}, + {"0V&VUC", 'F'}, + {"0V&VUE", 'F'}, + {"0V(EF(", 'F'}, + {"0V(EKF", 'F'}, + {"0V(EKN", 'F'}, + {"0V(ENK", 'F'}, + {"0V(U(E", 'F'}, + {"0V)&(1", 'F'}, + {"0V)&(E", 'F'}, + {"0V)&(F", 'F'}, + {"0V)&(N", 'F'}, + {"0V)&(S", 'F'}, + {"0V)&(V", 'F'}, + {"0V)&1", 'F'}, + {"0V)&1&", 'F'}, + {"0V)&1)", 'F'}, + {"0V)&1;", 'F'}, + {"0V)&1B", 'F'}, + {"0V)&1C", 'F'}, + {"0V)&1F", 'F'}, + {"0V)&1O", 'F'}, + {"0V)&1U", 'F'}, + {"0V)&F(", 'F'}, + {"0V)&N", 'F'}, + {"0V)&N&", 'F'}, + {"0V)&N)", 'F'}, + {"0V)&N;", 'F'}, + {"0V)&NB", 'F'}, + {"0V)&NC", 'F'}, + {"0V)&NF", 'F'}, + {"0V)&NO", 'F'}, + {"0V)&NU", 'F'}, + {"0V)&S", 'F'}, + {"0V)&S&", 'F'}, + {"0V)&S)", 'F'}, + {"0V)&S;", 'F'}, + {"0V)&SB", 'F'}, + {"0V)&SC", 'F'}, + {"0V)&SF", 'F'}, + {"0V)&SO", 'F'}, + {"0V)&SU", 'F'}, + {"0V)&V", 'F'}, + {"0V)&V&", 'F'}, + {"0V)&V)", 'F'}, + {"0V)&V;", 'F'}, + {"0V)&VB", 'F'}, + {"0V)&VC", 'F'}, + {"0V)&VF", 'F'}, + {"0V)&VO", 'F'}, + {"0V)&VU", 'F'}, + {"0V),(1", 'F'}, + {"0V),(F", 'F'}, + {"0V),(N", 'F'}, + {"0V),(S", 'F'}, + {"0V),(V", 'F'}, + {"0V);E(", 'F'}, + {"0V);E1", 'F'}, + {"0V);EF", 'F'}, + {"0V);EK", 'F'}, + {"0V);EN", 'F'}, + {"0V);EO", 'F'}, + {"0V);ES", 'F'}, + {"0V);EV", 'F'}, + {"0V);T(", 'F'}, + {"0V);T1", 'F'}, + {"0V);TF", 'F'}, + {"0V);TK", 'F'}, + {"0V);TN", 'F'}, + {"0V);TO", 'F'}, + {"0V);TS", 'F'}, + {"0V);TV", 'F'}, + {"0V)B(1", 'F'}, + {"0V)B(F", 'F'}, + {"0V)B(N", 'F'}, + {"0V)B(S", 'F'}, + {"0V)B(V", 'F'}, + {"0V)B1", 'F'}, + {"0V)B1&", 'F'}, + {"0V)B1;", 'F'}, + {"0V)B1C", 'F'}, + {"0V)B1K", 'F'}, + {"0V)B1N", 'F'}, + {"0V)B1O", 'F'}, + {"0V)B1U", 'F'}, + {"0V)BF(", 'F'}, + {"0V)BN", 'F'}, + {"0V)BN&", 'F'}, + {"0V)BN;", 'F'}, + {"0V)BNC", 'F'}, + {"0V)BNK", 'F'}, + {"0V)BNO", 'F'}, + {"0V)BNU", 'F'}, + {"0V)BS", 'F'}, + {"0V)BS&", 'F'}, + {"0V)BS;", 'F'}, + {"0V)BSC", 'F'}, + {"0V)BSK", 'F'}, + {"0V)BSO", 'F'}, + {"0V)BSU", 'F'}, + {"0V)BV", 'F'}, + {"0V)BV&", 'F'}, + {"0V)BV;", 'F'}, + {"0V)BVC", 'F'}, + {"0V)BVK", 'F'}, + {"0V)BVO", 'F'}, + {"0V)BVU", 'F'}, + {"0V)C", 'F'}, + {"0V)E(1", 'F'}, + {"0V)E(F", 'F'}, + {"0V)E(N", 'F'}, + {"0V)E(S", 'F'}, + {"0V)E(V", 'F'}, + {"0V)E1C", 'F'}, + {"0V)E1O", 'F'}, + {"0V)EF(", 'F'}, + {"0V)EK(", 'F'}, + {"0V)EK1", 'F'}, + {"0V)EKF", 'F'}, + {"0V)EKN", 'F'}, + {"0V)EKS", 'F'}, + {"0V)EKV", 'F'}, + {"0V)ENC", 'F'}, + {"0V)ENO", 'F'}, + {"0V)ESC", 'F'}, + {"0V)ESO", 'F'}, + {"0V)EVC", 'F'}, + {"0V)EVO", 'F'}, + {"0V)F(F", 'F'}, + {"0V)K(1", 'F'}, + {"0V)K(F", 'F'}, + {"0V)K(N", 'F'}, + {"0V)K(S", 'F'}, + {"0V)K(V", 'F'}, + {"0V)K1&", 'F'}, + {"0V)K1;", 'F'}, + {"0V)K1B", 'F'}, + {"0V)K1E", 'F'}, + {"0V)K1O", 'F'}, + {"0V)K1U", 'F'}, + {"0V)KB(", 'F'}, + {"0V)KB1", 'F'}, + {"0V)KBF", 'F'}, + {"0V)KBN", 'F'}, + {"0V)KBS", 'F'}, + {"0V)KBV", 'F'}, + {"0V)KF(", 'F'}, + {"0V)KN&", 'F'}, + {"0V)KN;", 'F'}, + {"0V)KNB", 'F'}, + {"0V)KNC", 'F'}, + {"0V)KNE", 'F'}, + {"0V)KNK", 'F'}, + {"0V)KNU", 'F'}, + {"0V)KS&", 'F'}, + {"0V)KS;", 'F'}, + {"0V)KSB", 'F'}, + {"0V)KSE", 'F'}, + {"0V)KSO", 'F'}, + {"0V)KSU", 'F'}, + {"0V)KUE", 'F'}, + {"0V)KV&", 'F'}, + {"0V)KV;", 'F'}, + {"0V)KVB", 'F'}, + {"0V)KVE", 'F'}, + {"0V)KVO", 'F'}, + {"0V)KVU", 'F'}, + {"0V)O(1", 'F'}, + {"0V)O(E", 'F'}, + {"0V)O(F", 'F'}, + {"0V)O(N", 'F'}, + {"0V)O(S", 'F'}, + {"0V)O(V", 'F'}, + {"0V)O1", 'F'}, + {"0V)O1&", 'F'}, + {"0V)O1)", 'F'}, + {"0V)O1;", 'F'}, + {"0V)O1B", 'F'}, + {"0V)O1C", 'F'}, + {"0V)O1K", 'F'}, + {"0V)O1U", 'F'}, + {"0V)OF(", 'F'}, + {"0V)ON", 'F'}, + {"0V)ON&", 'F'}, + {"0V)ON)", 'F'}, + {"0V)ON;", 'F'}, + {"0V)ONB", 'F'}, + {"0V)ONC", 'F'}, + {"0V)ONK", 'F'}, + {"0V)ONU", 'F'}, + {"0V)OS", 'F'}, + {"0V)OS&", 'F'}, + {"0V)OS)", 'F'}, + {"0V)OS;", 'F'}, + {"0V)OSB", 'F'}, + {"0V)OSC", 'F'}, + {"0V)OSK", 'F'}, + {"0V)OSU", 'F'}, + {"0V)OV", 'F'}, + {"0V)OV&", 'F'}, + {"0V)OV)", 'F'}, + {"0V)OV;", 'F'}, + {"0V)OVB", 'F'}, + {"0V)OVC", 'F'}, + {"0V)OVK", 'F'}, + {"0V)OVO", 'F'}, + {"0V)OVU", 'F'}, + {"0V)U(E", 'F'}, + {"0V)UE(", 'F'}, + {"0V)UE1", 'F'}, + {"0V)UEF", 'F'}, + {"0V)UEK", 'F'}, + {"0V)UEN", 'F'}, + {"0V)UES", 'F'}, + {"0V)UEV", 'F'}, + {"0V,(1)", 'F'}, + {"0V,(1O", 'F'}, + {"0V,(E(", 'F'}, + {"0V,(E1", 'F'}, + {"0V,(EF", 'F'}, + {"0V,(EK", 'F'}, + {"0V,(EN", 'F'}, + {"0V,(ES", 'F'}, + {"0V,(EV", 'F'}, + {"0V,(F(", 'F'}, + {"0V,(N)", 'F'}, + {"0V,(NO", 'F'}, + {"0V,(S)", 'F'}, + {"0V,(SO", 'F'}, + {"0V,(V)", 'F'}, + {"0V,(VO", 'F'}, + {"0V,F()", 'F'}, + {"0V,F(1", 'F'}, + {"0V,F(F", 'F'}, + {"0V,F(N", 'F'}, + {"0V,F(S", 'F'}, + {"0V,F(V", 'F'}, + {"0V;E(1", 'F'}, + {"0V;E(E", 'F'}, + {"0V;E(F", 'F'}, + {"0V;E(N", 'F'}, + {"0V;E(S", 'F'}, + {"0V;E(V", 'F'}, + {"0V;E1,", 'F'}, + {"0V;E1;", 'F'}, + {"0V;E1C", 'F'}, + {"0V;E1K", 'F'}, + {"0V;E1O", 'F'}, + {"0V;E1T", 'F'}, + {"0V;EF(", 'F'}, + {"0V;EK(", 'F'}, + {"0V;EK1", 'F'}, + {"0V;EKF", 'F'}, + {"0V;EKN", 'F'}, + {"0V;EKO", 'F'}, + {"0V;EKS", 'F'}, + {"0V;EKV", 'F'}, + {"0V;EN,", 'F'}, + {"0V;EN;", 'F'}, + {"0V;ENC", 'F'}, + {"0V;ENE", 'F'}, + {"0V;ENK", 'F'}, + {"0V;ENO", 'F'}, + {"0V;ENT", 'F'}, + {"0V;ES,", 'F'}, + {"0V;ES;", 'F'}, + {"0V;ESC", 'F'}, + {"0V;ESK", 'F'}, + {"0V;ESO", 'F'}, + {"0V;EST", 'F'}, + {"0V;EV,", 'F'}, + {"0V;EV;", 'F'}, + {"0V;EVC", 'F'}, + {"0V;EVK", 'F'}, + {"0V;EVO", 'F'}, + {"0V;EVT", 'F'}, + {"0V;N:T", 'F'}, + {"0V;T(1", 'F'}, + {"0V;T(C", 'F'}, + {"0V;T(E", 'F'}, + {"0V;T(F", 'F'}, + {"0V;T(N", 'F'}, + {"0V;T(S", 'F'}, + {"0V;T(V", 'F'}, + {"0V;T1(", 'F'}, + {"0V;T1,", 'F'}, + {"0V;T1;", 'F'}, + {"0V;T1C", 'F'}, + {"0V;T1F", 'F'}, + {"0V;T1K", 'F'}, + {"0V;T1O", 'F'}, + {"0V;T1T", 'F'}, + {"0V;T;", 'F'}, + {"0V;T;C", 'F'}, + {"0V;TF(", 'F'}, + {"0V;TK(", 'F'}, + {"0V;TK1", 'F'}, + {"0V;TKF", 'F'}, + {"0V;TKK", 'F'}, + {"0V;TKN", 'F'}, + {"0V;TKO", 'F'}, + {"0V;TKS", 'F'}, + {"0V;TKV", 'F'}, + {"0V;TN(", 'F'}, + {"0V;TN,", 'F'}, + {"0V;TN1", 'F'}, + {"0V;TN;", 'F'}, + {"0V;TNC", 'F'}, + {"0V;TNE", 'F'}, + {"0V;TNF", 'F'}, + {"0V;TNK", 'F'}, + {"0V;TNN", 'F'}, + {"0V;TNO", 'F'}, + {"0V;TNS", 'F'}, + {"0V;TNT", 'F'}, + {"0V;TNV", 'F'}, + {"0V;TO(", 'F'}, + {"0V;TS(", 'F'}, + {"0V;TS,", 'F'}, + {"0V;TS;", 'F'}, + {"0V;TSC", 'F'}, + {"0V;TSF", 'F'}, + {"0V;TSK", 'F'}, + {"0V;TSO", 'F'}, + {"0V;TST", 'F'}, + {"0V;TTN", 'F'}, + {"0V;TV(", 'F'}, + {"0V;TV,", 'F'}, + {"0V;TV;", 'F'}, + {"0V;TVC", 'F'}, + {"0V;TVF", 'F'}, + {"0V;TVK", 'F'}, + {"0V;TVO", 'F'}, + {"0V;TVT", 'F'}, + {"0VA(F(", 'F'}, + {"0VA(N)", 'F'}, + {"0VA(NO", 'F'}, + {"0VA(S)", 'F'}, + {"0VA(SO", 'F'}, + {"0VA(V)", 'F'}, + {"0VA(VO", 'F'}, + {"0VAF()", 'F'}, + {"0VAF(1", 'F'}, + {"0VAF(F", 'F'}, + {"0VAF(N", 'F'}, + {"0VAF(S", 'F'}, + {"0VAF(V", 'F'}, + {"0VASO(", 'F'}, + {"0VASO1", 'F'}, + {"0VASOF", 'F'}, + {"0VASON", 'F'}, + {"0VASOS", 'F'}, + {"0VASOV", 'F'}, + {"0VASUE", 'F'}, + {"0VATO(", 'F'}, + {"0VATO1", 'F'}, + {"0VATOF", 'F'}, + {"0VATON", 'F'}, + {"0VATOS", 'F'}, + {"0VATOV", 'F'}, + {"0VATUE", 'F'}, + {"0VAVO(", 'F'}, + {"0VAVOF", 'F'}, + {"0VAVOS", 'F'}, + {"0VAVUE", 'F'}, + {"0VB(1)", 'F'}, + {"0VB(1O", 'F'}, + {"0VB(F(", 'F'}, + {"0VB(NO", 'F'}, + {"0VB(S)", 'F'}, + {"0VB(SO", 'F'}, + {"0VB(V)", 'F'}, + {"0VB(VO", 'F'}, + {"0VB1", 'F'}, + {"0VB1&(", 'F'}, + {"0VB1&1", 'F'}, + {"0VB1&F", 'F'}, + {"0VB1&N", 'F'}, + {"0VB1&S", 'F'}, + {"0VB1&V", 'F'}, + {"0VB1,(", 'F'}, + {"0VB1,F", 'F'}, + {"0VB1;", 'F'}, + {"0VB1;C", 'F'}, + {"0VB1B(", 'F'}, + {"0VB1B1", 'F'}, + {"0VB1BF", 'F'}, + {"0VB1BN", 'F'}, + {"0VB1BS", 'F'}, + {"0VB1BV", 'F'}, + {"0VB1C", 'F'}, + {"0VB1K(", 'F'}, + {"0VB1K1", 'F'}, + {"0VB1KF", 'F'}, + {"0VB1KN", 'F'}, + {"0VB1KS", 'F'}, + {"0VB1KV", 'F'}, + {"0VB1O(", 'F'}, + {"0VB1OF", 'F'}, + {"0VB1OS", 'F'}, + {"0VB1OV", 'F'}, + {"0VB1U(", 'F'}, + {"0VB1UE", 'F'}, + {"0VBE(1", 'F'}, + {"0VBE(F", 'F'}, + {"0VBE(N", 'F'}, + {"0VBE(S", 'F'}, + {"0VBE(V", 'F'}, + {"0VBEK(", 'F'}, + {"0VBF()", 'F'}, + {"0VBF(1", 'F'}, + {"0VBF(F", 'F'}, + {"0VBF(N", 'F'}, + {"0VBF(S", 'F'}, + {"0VBF(V", 'F'}, + {"0VBN", 'F'}, + {"0VBN&(", 'F'}, + {"0VBN&1", 'F'}, + {"0VBN&F", 'F'}, + {"0VBN&N", 'F'}, + {"0VBN&S", 'F'}, + {"0VBN&V", 'F'}, + {"0VBN,(", 'F'}, + {"0VBN,F", 'F'}, + {"0VBN;", 'F'}, + {"0VBN;C", 'F'}, + {"0VBNB(", 'F'}, + {"0VBNB1", 'F'}, + {"0VBNBF", 'F'}, + {"0VBNBN", 'F'}, + {"0VBNBS", 'F'}, + {"0VBNBV", 'F'}, + {"0VBNC", 'F'}, + {"0VBNK(", 'F'}, + {"0VBNK1", 'F'}, + {"0VBNKF", 'F'}, + {"0VBNKN", 'F'}, + {"0VBNKS", 'F'}, + {"0VBNKV", 'F'}, + {"0VBNO(", 'F'}, + {"0VBNOF", 'F'}, + {"0VBNOS", 'F'}, + {"0VBNOV", 'F'}, + {"0VBNU(", 'F'}, + {"0VBNUE", 'F'}, + {"0VBS", 'F'}, + {"0VBS&(", 'F'}, + {"0VBS&1", 'F'}, + {"0VBS&F", 'F'}, + {"0VBS&N", 'F'}, + {"0VBS&S", 'F'}, + {"0VBS&V", 'F'}, + {"0VBS,(", 'F'}, + {"0VBS,F", 'F'}, + {"0VBS;", 'F'}, + {"0VBS;C", 'F'}, + {"0VBSB(", 'F'}, + {"0VBSB1", 'F'}, + {"0VBSBF", 'F'}, + {"0VBSBN", 'F'}, + {"0VBSBS", 'F'}, + {"0VBSBV", 'F'}, + {"0VBSC", 'F'}, + {"0VBSK(", 'F'}, + {"0VBSK1", 'F'}, + {"0VBSKF", 'F'}, + {"0VBSKN", 'F'}, + {"0VBSKS", 'F'}, + {"0VBSKV", 'F'}, + {"0VBSO(", 'F'}, + {"0VBSO1", 'F'}, + {"0VBSOF", 'F'}, + {"0VBSON", 'F'}, + {"0VBSOS", 'F'}, + {"0VBSOV", 'F'}, + {"0VBSU(", 'F'}, + {"0VBSUE", 'F'}, + {"0VBV", 'F'}, + {"0VBV&(", 'F'}, + {"0VBV&1", 'F'}, + {"0VBV&F", 'F'}, + {"0VBV&N", 'F'}, + {"0VBV&S", 'F'}, + {"0VBV&V", 'F'}, + {"0VBV,(", 'F'}, + {"0VBV,F", 'F'}, + {"0VBV;", 'F'}, + {"0VBV;C", 'F'}, + {"0VBVB(", 'F'}, + {"0VBVB1", 'F'}, + {"0VBVBF", 'F'}, + {"0VBVBN", 'F'}, + {"0VBVBS", 'F'}, + {"0VBVBV", 'F'}, + {"0VBVC", 'F'}, + {"0VBVK(", 'F'}, + {"0VBVK1", 'F'}, + {"0VBVKF", 'F'}, + {"0VBVKN", 'F'}, + {"0VBVKS", 'F'}, + {"0VBVKV", 'F'}, + {"0VBVO(", 'F'}, + {"0VBVOF", 'F'}, + {"0VBVOS", 'F'}, + {"0VBVU(", 'F'}, + {"0VBVUE", 'F'}, + {"0VC", 'F'}, + {"0VE(1)", 'F'}, + {"0VE(1O", 'F'}, + {"0VE(F(", 'F'}, + {"0VE(N)", 'F'}, + {"0VE(NO", 'F'}, + {"0VE(S)", 'F'}, + {"0VE(SO", 'F'}, + {"0VE(V)", 'F'}, + {"0VE(VO", 'F'}, + {"0VE1;T", 'F'}, + {"0VE1C", 'F'}, + {"0VE1O(", 'F'}, + {"0VE1OF", 'F'}, + {"0VE1OS", 'F'}, + {"0VE1OV", 'F'}, + {"0VE1T(", 'F'}, + {"0VE1T1", 'F'}, + {"0VE1TF", 'F'}, + {"0VE1TN", 'F'}, + {"0VE1TS", 'F'}, + {"0VE1TV", 'F'}, + {"0VE1UE", 'F'}, + {"0VEF()", 'F'}, + {"0VEF(1", 'F'}, + {"0VEF(F", 'F'}, + {"0VEF(N", 'F'}, + {"0VEF(S", 'F'}, + {"0VEF(V", 'F'}, + {"0VEK(1", 'F'}, + {"0VEK(E", 'F'}, + {"0VEK(F", 'F'}, + {"0VEK(N", 'F'}, + {"0VEK(S", 'F'}, + {"0VEK(V", 'F'}, + {"0VEK1;", 'F'}, + {"0VEK1C", 'F'}, + {"0VEK1O", 'F'}, + {"0VEK1T", 'F'}, + {"0VEK1U", 'F'}, + {"0VEKF(", 'F'}, + {"0VEKN;", 'F'}, + {"0VEKNC", 'F'}, + {"0VEKNE", 'F'}, + {"0VEKNT", 'F'}, + {"0VEKNU", 'F'}, + {"0VEKOK", 'F'}, + {"0VEKS;", 'F'}, + {"0VEKSC", 'F'}, + {"0VEKSO", 'F'}, + {"0VEKST", 'F'}, + {"0VEKSU", 'F'}, + {"0VEKU(", 'F'}, + {"0VEKU1", 'F'}, + {"0VEKUE", 'F'}, + {"0VEKUF", 'F'}, + {"0VEKUS", 'F'}, + {"0VEKUV", 'F'}, + {"0VEKV;", 'F'}, + {"0VEKVC", 'F'}, + {"0VEKVO", 'F'}, + {"0VEKVT", 'F'}, + {"0VEKVU", 'F'}, + {"0VEN;T", 'F'}, + {"0VENC", 'F'}, + {"0VENEN", 'F'}, + {"0VENO(", 'F'}, + {"0VENOF", 'F'}, + {"0VENOS", 'F'}, + {"0VENOV", 'F'}, + {"0VENT(", 'F'}, + {"0VENT1", 'F'}, + {"0VENTF", 'F'}, + {"0VENTN", 'F'}, + {"0VENTS", 'F'}, + {"0VENTV", 'F'}, + {"0VENUE", 'F'}, + {"0VEOKN", 'F'}, + {"0VES;T", 'F'}, + {"0VESC", 'F'}, + {"0VESO(", 'F'}, + {"0VESO1", 'F'}, + {"0VESOF", 'F'}, + {"0VESON", 'F'}, + {"0VESOS", 'F'}, + {"0VESOV", 'F'}, + {"0VEST(", 'F'}, + {"0VEST1", 'F'}, + {"0VESTF", 'F'}, + {"0VESTN", 'F'}, + {"0VESTS", 'F'}, + {"0VESTV", 'F'}, + {"0VESUE", 'F'}, + {"0VEU(1", 'F'}, + {"0VEU(F", 'F'}, + {"0VEU(N", 'F'}, + {"0VEU(S", 'F'}, + {"0VEU(V", 'F'}, + {"0VEU1,", 'F'}, + {"0VEU1C", 'F'}, + {"0VEU1O", 'F'}, + {"0VEUEF", 'F'}, + {"0VEUEK", 'F'}, + {"0VEUF(", 'F'}, + {"0VEUS,", 'F'}, + {"0VEUSC", 'F'}, + {"0VEUSO", 'F'}, + {"0VEUV,", 'F'}, + {"0VEUVC", 'F'}, + {"0VEUVO", 'F'}, + {"0VEV;T", 'F'}, + {"0VEVC", 'F'}, + {"0VEVO(", 'F'}, + {"0VEVOF", 'F'}, + {"0VEVOS", 'F'}, + {"0VEVT(", 'F'}, + {"0VEVT1", 'F'}, + {"0VEVTF", 'F'}, + {"0VEVTN", 'F'}, + {"0VEVTS", 'F'}, + {"0VEVTV", 'F'}, + {"0VEVUE", 'F'}, + {"0VF()1", 'F'}, + {"0VF()F", 'F'}, + {"0VF()K", 'F'}, + {"0VF()N", 'F'}, + {"0VF()O", 'F'}, + {"0VF()S", 'F'}, + {"0VF()U", 'F'}, + {"0VF()V", 'F'}, + {"0VF(1)", 'F'}, + {"0VF(1N", 'F'}, + {"0VF(1O", 'F'}, + {"0VF(E(", 'F'}, + {"0VF(E1", 'F'}, + {"0VF(EF", 'F'}, + {"0VF(EK", 'F'}, + {"0VF(EN", 'F'}, + {"0VF(ES", 'F'}, + {"0VF(EV", 'F'}, + {"0VF(F(", 'F'}, + {"0VF(N)", 'F'}, + {"0VF(N,", 'F'}, + {"0VF(NO", 'F'}, + {"0VF(S)", 'F'}, + {"0VF(SO", 'F'}, + {"0VF(V)", 'F'}, + {"0VF(VO", 'F'}, + {"0VK(1)", 'F'}, + {"0VK(1O", 'F'}, + {"0VK(F(", 'F'}, + {"0VK(N)", 'F'}, + {"0VK(NO", 'F'}, + {"0VK(S)", 'F'}, + {"0VK(SO", 'F'}, + {"0VK(V)", 'F'}, + {"0VK(VO", 'F'}, + {"0VK)&(", 'F'}, + {"0VK)&1", 'F'}, + {"0VK)&F", 'F'}, + {"0VK)&N", 'F'}, + {"0VK)&S", 'F'}, + {"0VK)&V", 'F'}, + {"0VK);E", 'F'}, + {"0VK);T", 'F'}, + {"0VK)B(", 'F'}, + {"0VK)B1", 'F'}, + {"0VK)BF", 'F'}, + {"0VK)BN", 'F'}, + {"0VK)BS", 'F'}, + {"0VK)BV", 'F'}, + {"0VK)E(", 'F'}, + {"0VK)E1", 'F'}, + {"0VK)EF", 'F'}, + {"0VK)EK", 'F'}, + {"0VK)EN", 'F'}, + {"0VK)ES", 'F'}, + {"0VK)EV", 'F'}, + {"0VK)F(", 'F'}, + {"0VK)O(", 'F'}, + {"0VK)OF", 'F'}, + {"0VK)UE", 'F'}, + {"0VK1", 'F'}, + {"0VK1&(", 'F'}, + {"0VK1&1", 'F'}, + {"0VK1&F", 'F'}, + {"0VK1&N", 'F'}, + {"0VK1&S", 'F'}, + {"0VK1&V", 'F'}, + {"0VK1;", 'F'}, + {"0VK1;C", 'F'}, + {"0VK1;E", 'F'}, + {"0VK1;T", 'F'}, + {"0VK1B(", 'F'}, + {"0VK1B1", 'F'}, + {"0VK1BF", 'F'}, + {"0VK1BN", 'F'}, + {"0VK1BS", 'F'}, + {"0VK1BV", 'F'}, + {"0VK1C", 'F'}, + {"0VK1E(", 'F'}, + {"0VK1E1", 'F'}, + {"0VK1EF", 'F'}, + {"0VK1EK", 'F'}, + {"0VK1EN", 'F'}, + {"0VK1ES", 'F'}, + {"0VK1EV", 'F'}, + {"0VK1O(", 'F'}, + {"0VK1OF", 'F'}, + {"0VK1OS", 'F'}, + {"0VK1OV", 'F'}, + {"0VK1U(", 'F'}, + {"0VK1UE", 'F'}, + {"0VKF()", 'F'}, + {"0VKF(1", 'F'}, + {"0VKF(F", 'F'}, + {"0VKF(N", 'F'}, + {"0VKF(S", 'F'}, + {"0VKF(V", 'F'}, + {"0VKN", 'F'}, + {"0VKN&(", 'F'}, + {"0VKN&1", 'F'}, + {"0VKN&F", 'F'}, + {"0VKN&N", 'F'}, + {"0VKN&S", 'F'}, + {"0VKN&V", 'F'}, + {"0VKN;", 'F'}, + {"0VKN;C", 'F'}, + {"0VKN;E", 'F'}, + {"0VKN;T", 'F'}, + {"0VKNB(", 'F'}, + {"0VKNB1", 'F'}, + {"0VKNBF", 'F'}, + {"0VKNBN", 'F'}, + {"0VKNBS", 'F'}, + {"0VKNBV", 'F'}, + {"0VKNC", 'F'}, + {"0VKNE(", 'F'}, + {"0VKNE1", 'F'}, + {"0VKNEF", 'F'}, + {"0VKNEN", 'F'}, + {"0VKNES", 'F'}, + {"0VKNEV", 'F'}, + {"0VKNU(", 'F'}, + {"0VKNUE", 'F'}, + {"0VKS", 'F'}, + {"0VKS&(", 'F'}, + {"0VKS&1", 'F'}, + {"0VKS&F", 'F'}, + {"0VKS&N", 'F'}, + {"0VKS&S", 'F'}, + {"0VKS&V", 'F'}, + {"0VKS;", 'F'}, + {"0VKS;C", 'F'}, + {"0VKS;E", 'F'}, + {"0VKS;T", 'F'}, + {"0VKSB(", 'F'}, + {"0VKSB1", 'F'}, + {"0VKSBF", 'F'}, + {"0VKSBN", 'F'}, + {"0VKSBS", 'F'}, + {"0VKSBV", 'F'}, + {"0VKSC", 'F'}, + {"0VKSE(", 'F'}, + {"0VKSE1", 'F'}, + {"0VKSEF", 'F'}, + {"0VKSEK", 'F'}, + {"0VKSEN", 'F'}, + {"0VKSES", 'F'}, + {"0VKSEV", 'F'}, + {"0VKSO(", 'F'}, + {"0VKSO1", 'F'}, + {"0VKSOF", 'F'}, + {"0VKSON", 'F'}, + {"0VKSOS", 'F'}, + {"0VKSOV", 'F'}, + {"0VKSU(", 'F'}, + {"0VKSUE", 'F'}, + {"0VKUE(", 'F'}, + {"0VKUE1", 'F'}, + {"0VKUEF", 'F'}, + {"0VKUEK", 'F'}, + {"0VKUEN", 'F'}, + {"0VKUES", 'F'}, + {"0VKUEV", 'F'}, + {"0VKV", 'F'}, + {"0VKV&(", 'F'}, + {"0VKV&1", 'F'}, + {"0VKV&F", 'F'}, + {"0VKV&N", 'F'}, + {"0VKV&S", 'F'}, + {"0VKV&V", 'F'}, + {"0VKV;", 'F'}, + {"0VKV;C", 'F'}, + {"0VKV;E", 'F'}, + {"0VKV;T", 'F'}, + {"0VKVB(", 'F'}, + {"0VKVB1", 'F'}, + {"0VKVBF", 'F'}, + {"0VKVBN", 'F'}, + {"0VKVBS", 'F'}, + {"0VKVBV", 'F'}, + {"0VKVC", 'F'}, + {"0VKVE(", 'F'}, + {"0VKVE1", 'F'}, + {"0VKVEF", 'F'}, + {"0VKVEK", 'F'}, + {"0VKVEN", 'F'}, + {"0VKVES", 'F'}, + {"0VKVEV", 'F'}, + {"0VKVO(", 'F'}, + {"0VKVOF", 'F'}, + {"0VKVOS", 'F'}, + {"0VKVU(", 'F'}, + {"0VKVUE", 'F'}, + {"0VO(1&", 'F'}, + {"0VO(1)", 'F'}, + {"0VO(1,", 'F'}, + {"0VO(1O", 'F'}, + {"0VO(E(", 'F'}, + {"0VO(E1", 'F'}, + {"0VO(EE", 'F'}, + {"0VO(EF", 'F'}, + {"0VO(EK", 'F'}, + {"0VO(EN", 'F'}, + {"0VO(EO", 'F'}, + {"0VO(ES", 'F'}, + {"0VO(EV", 'F'}, + {"0VO(F(", 'F'}, + {"0VO(N&", 'F'}, + {"0VO(N)", 'F'}, + {"0VO(N,", 'F'}, + {"0VO(NO", 'F'}, + {"0VO(S&", 'F'}, + {"0VO(S)", 'F'}, + {"0VO(S,", 'F'}, + {"0VO(SO", 'F'}, + {"0VO(V&", 'F'}, + {"0VO(V)", 'F'}, + {"0VO(V,", 'F'}, + {"0VO(VO", 'F'}, + {"0VOF()", 'F'}, + {"0VOF(1", 'F'}, + {"0VOF(E", 'F'}, + {"0VOF(F", 'F'}, + {"0VOF(N", 'F'}, + {"0VOF(S", 'F'}, + {"0VOF(V", 'F'}, + {"0VOK&(", 'F'}, + {"0VOK&1", 'F'}, + {"0VOK&F", 'F'}, + {"0VOK&N", 'F'}, + {"0VOK&S", 'F'}, + {"0VOK&V", 'F'}, + {"0VOK(1", 'F'}, + {"0VOK(F", 'F'}, + {"0VOK(N", 'F'}, + {"0VOK(S", 'F'}, + {"0VOK(V", 'F'}, + {"0VOK1C", 'F'}, + {"0VOK1O", 'F'}, + {"0VOKF(", 'F'}, + {"0VOKNC", 'F'}, + {"0VOKO(", 'F'}, + {"0VOKO1", 'F'}, + {"0VOKOF", 'F'}, + {"0VOKON", 'F'}, + {"0VOKOS", 'F'}, + {"0VOKOV", 'F'}, + {"0VOKSC", 'F'}, + {"0VOKSO", 'F'}, + {"0VOKVC", 'F'}, + {"0VOKVO", 'F'}, + {"0VOS", 'F'}, + {"0VOS&(", 'F'}, + {"0VOS&1", 'F'}, + {"0VOS&E", 'F'}, + {"0VOS&F", 'F'}, + {"0VOS&K", 'F'}, + {"0VOS&N", 'F'}, + {"0VOS&S", 'F'}, + {"0VOS&U", 'F'}, + {"0VOS&V", 'F'}, + {"0VOS(E", 'F'}, + {"0VOS(U", 'F'}, + {"0VOS)&", 'F'}, + {"0VOS),", 'F'}, + {"0VOS);", 'F'}, + {"0VOS)B", 'F'}, + {"0VOS)C", 'F'}, + {"0VOS)E", 'F'}, + {"0VOS)F", 'F'}, + {"0VOS)K", 'F'}, + {"0VOS)O", 'F'}, + {"0VOS)U", 'F'}, + {"0VOS,(", 'F'}, + {"0VOS,F", 'F'}, + {"0VOS1(", 'F'}, + {"0VOS1F", 'F'}, + {"0VOS1N", 'F'}, + {"0VOS1S", 'F'}, + {"0VOS1U", 'F'}, + {"0VOS1V", 'F'}, + {"0VOS;", 'F'}, + {"0VOS;C", 'F'}, + {"0VOS;E", 'F'}, + {"0VOS;N", 'F'}, + {"0VOS;T", 'F'}, + {"0VOSA(", 'F'}, + {"0VOSAF", 'F'}, + {"0VOSAS", 'F'}, + {"0VOSAT", 'F'}, + {"0VOSAV", 'F'}, + {"0VOSB(", 'F'}, + {"0VOSB1", 'F'}, + {"0VOSBE", 'F'}, + {"0VOSBF", 'F'}, + {"0VOSBN", 'F'}, + {"0VOSBS", 'F'}, + {"0VOSBV", 'F'}, + {"0VOSC", 'F'}, + {"0VOSE(", 'F'}, + {"0VOSE1", 'F'}, + {"0VOSEF", 'F'}, + {"0VOSEK", 'F'}, + {"0VOSEN", 'F'}, + {"0VOSEO", 'F'}, + {"0VOSES", 'F'}, + {"0VOSEU", 'F'}, + {"0VOSEV", 'F'}, + {"0VOSF(", 'F'}, + {"0VOSK(", 'F'}, + {"0VOSK)", 'F'}, + {"0VOSK1", 'F'}, + {"0VOSKB", 'F'}, + {"0VOSKF", 'F'}, + {"0VOSKN", 'F'}, + {"0VOSKS", 'F'}, + {"0VOSKU", 'F'}, + {"0VOSKV", 'F'}, + {"0VOST(", 'F'}, + {"0VOST1", 'F'}, + {"0VOSTE", 'F'}, + {"0VOSTF", 'F'}, + {"0VOSTN", 'F'}, + {"0VOSTS", 'F'}, + {"0VOSTT", 'F'}, + {"0VOSTV", 'F'}, + {"0VOSU", 'F'}, + {"0VOSU(", 'F'}, + {"0VOSU1", 'F'}, + {"0VOSU;", 'F'}, + {"0VOSUC", 'F'}, + {"0VOSUE", 'F'}, + {"0VOSUF", 'F'}, + {"0VOSUK", 'F'}, + {"0VOSUO", 'F'}, + {"0VOSUS", 'F'}, + {"0VOSUT", 'F'}, + {"0VOSUV", 'F'}, + {"0VOSV(", 'F'}, + {"0VOSVF", 'F'}, + {"0VOSVO", 'F'}, + {"0VOSVS", 'F'}, + {"0VOSVU", 'F'}, + {"0VOU(E", 'F'}, + {"0VOUEK", 'F'}, + {"0VOUEN", 'F'}, + {"0VT(1)", 'F'}, + {"0VT(1O", 'F'}, + {"0VT(F(", 'F'}, + {"0VT(N)", 'F'}, + {"0VT(NO", 'F'}, + {"0VT(S)", 'F'}, + {"0VT(SO", 'F'}, + {"0VT(V)", 'F'}, + {"0VT(VO", 'F'}, + {"0VT1(F", 'F'}, + {"0VT1O(", 'F'}, + {"0VT1OF", 'F'}, + {"0VT1OS", 'F'}, + {"0VT1OV", 'F'}, + {"0VTE(1", 'F'}, + {"0VTE(F", 'F'}, + {"0VTE(N", 'F'}, + {"0VTE(S", 'F'}, + {"0VTE(V", 'F'}, + {"0VTE1N", 'F'}, + {"0VTE1O", 'F'}, + {"0VTEF(", 'F'}, + {"0VTEK(", 'F'}, + {"0VTEK1", 'F'}, + {"0VTEKF", 'F'}, + {"0VTEKN", 'F'}, + {"0VTEKS", 'F'}, + {"0VTEKV", 'F'}, + {"0VTENN", 'F'}, + {"0VTENO", 'F'}, + {"0VTESN", 'F'}, + {"0VTESO", 'F'}, + {"0VTEVN", 'F'}, + {"0VTEVO", 'F'}, + {"0VTF()", 'F'}, + {"0VTF(1", 'F'}, + {"0VTF(F", 'F'}, + {"0VTF(N", 'F'}, + {"0VTF(S", 'F'}, + {"0VTF(V", 'F'}, + {"0VTN(1", 'F'}, + {"0VTN(F", 'F'}, + {"0VTN(S", 'F'}, + {"0VTN(V", 'F'}, + {"0VTN1C", 'F'}, + {"0VTN1O", 'F'}, + {"0VTN;E", 'F'}, + {"0VTN;N", 'F'}, + {"0VTN;T", 'F'}, + {"0VTNE(", 'F'}, + {"0VTNE1", 'F'}, + {"0VTNEF", 'F'}, + {"0VTNEN", 'F'}, + {"0VTNES", 'F'}, + {"0VTNEV", 'F'}, + {"0VTNF(", 'F'}, + {"0VTNKN", 'F'}, + {"0VTNN:", 'F'}, + {"0VTNNC", 'F'}, + {"0VTNNO", 'F'}, + {"0VTNO(", 'F'}, + {"0VTNOF", 'F'}, + {"0VTNOS", 'F'}, + {"0VTNOV", 'F'}, + {"0VTNSC", 'F'}, + {"0VTNSO", 'F'}, + {"0VTNT(", 'F'}, + {"0VTNT1", 'F'}, + {"0VTNTF", 'F'}, + {"0VTNTN", 'F'}, + {"0VTNTS", 'F'}, + {"0VTNTV", 'F'}, + {"0VTNVC", 'F'}, + {"0VTNVO", 'F'}, + {"0VTS(F", 'F'}, + {"0VTSO(", 'F'}, + {"0VTSO1", 'F'}, + {"0VTSOF", 'F'}, + {"0VTSON", 'F'}, + {"0VTSOS", 'F'}, + {"0VTSOV", 'F'}, + {"0VTTNE", 'F'}, + {"0VTTNK", 'F'}, + {"0VTTNN", 'F'}, + {"0VTTNT", 'F'}, + {"0VTV(1", 'F'}, + {"0VTV(F", 'F'}, + {"0VTVO(", 'F'}, + {"0VTVOF", 'F'}, + {"0VTVOS", 'F'}, + {"0VU", 'F'}, + {"0VU(1)", 'F'}, + {"0VU(1O", 'F'}, + {"0VU(E(", 'F'}, + {"0VU(E1", 'F'}, + {"0VU(EF", 'F'}, + {"0VU(EK", 'F'}, + {"0VU(EN", 'F'}, + {"0VU(ES", 'F'}, + {"0VU(EV", 'F'}, + {"0VU(F(", 'F'}, + {"0VU(N)", 'F'}, + {"0VU(NO", 'F'}, + {"0VU(S)", 'F'}, + {"0VU(SO", 'F'}, + {"0VU(V)", 'F'}, + {"0VU(VO", 'F'}, + {"0VU1,(", 'F'}, + {"0VU1,F", 'F'}, + {"0VU1C", 'F'}, + {"0VU1O(", 'F'}, + {"0VU1OF", 'F'}, + {"0VU1OS", 'F'}, + {"0VU1OV", 'F'}, + {"0VU;", 'F'}, + {"0VU;C", 'F'}, + {"0VUC", 'F'}, + {"0VUE", 'F'}, + {"0VUE(1", 'F'}, + {"0VUE(E", 'F'}, + {"0VUE(F", 'F'}, + {"0VUE(N", 'F'}, + {"0VUE(O", 'F'}, + {"0VUE(S", 'F'}, + {"0VUE(V", 'F'}, + {"0VUE1", 'F'}, + {"0VUE1&", 'F'}, + {"0VUE1(", 'F'}, + {"0VUE1)", 'F'}, + {"0VUE1,", 'F'}, + {"0VUE1;", 'F'}, + {"0VUE1B", 'F'}, + {"0VUE1C", 'F'}, + {"0VUE1F", 'F'}, + {"0VUE1K", 'F'}, + {"0VUE1N", 'F'}, + {"0VUE1O", 'F'}, + {"0VUE1S", 'F'}, + {"0VUE1U", 'F'}, + {"0VUE1V", 'F'}, + {"0VUE;", 'F'}, + {"0VUE;C", 'F'}, + {"0VUEC", 'F'}, + {"0VUEF", 'F'}, + {"0VUEF(", 'F'}, + {"0VUEF,", 'F'}, + {"0VUEF;", 'F'}, + {"0VUEFC", 'F'}, + {"0VUEK", 'F'}, + {"0VUEK(", 'F'}, + {"0VUEK1", 'F'}, + {"0VUEK;", 'F'}, + {"0VUEKC", 'F'}, + {"0VUEKF", 'F'}, + {"0VUEKN", 'F'}, + {"0VUEKO", 'F'}, + {"0VUEKS", 'F'}, + {"0VUEKV", 'F'}, + {"0VUEN", 'F'}, + {"0VUEN&", 'F'}, + {"0VUEN(", 'F'}, + {"0VUEN)", 'F'}, + {"0VUEN,", 'F'}, + {"0VUEN1", 'F'}, + {"0VUEN;", 'F'}, + {"0VUENB", 'F'}, + {"0VUENC", 'F'}, + {"0VUENF", 'F'}, + {"0VUENK", 'F'}, + {"0VUENO", 'F'}, + {"0VUENS", 'F'}, + {"0VUENU", 'F'}, + {"0VUEOK", 'F'}, + {"0VUEON", 'F'}, + {"0VUES", 'F'}, + {"0VUES&", 'F'}, + {"0VUES(", 'F'}, + {"0VUES)", 'F'}, + {"0VUES,", 'F'}, + {"0VUES1", 'F'}, + {"0VUES;", 'F'}, + {"0VUESB", 'F'}, + {"0VUESC", 'F'}, + {"0VUESF", 'F'}, + {"0VUESK", 'F'}, + {"0VUESO", 'F'}, + {"0VUESU", 'F'}, + {"0VUESV", 'F'}, + {"0VUEV", 'F'}, + {"0VUEV&", 'F'}, + {"0VUEV(", 'F'}, + {"0VUEV)", 'F'}, + {"0VUEV,", 'F'}, + {"0VUEV;", 'F'}, + {"0VUEVB", 'F'}, + {"0VUEVC", 'F'}, + {"0VUEVF", 'F'}, + {"0VUEVK", 'F'}, + {"0VUEVN", 'F'}, + {"0VUEVO", 'F'}, + {"0VUEVS", 'F'}, + {"0VUEVU", 'F'}, + {"0VUF()", 'F'}, + {"0VUF(1", 'F'}, + {"0VUF(F", 'F'}, + {"0VUF(N", 'F'}, + {"0VUF(S", 'F'}, + {"0VUF(V", 'F'}, + {"0VUK(E", 'F'}, + {"0VUO(E", 'F'}, + {"0VUON(", 'F'}, + {"0VUON1", 'F'}, + {"0VUONF", 'F'}, + {"0VUONS", 'F'}, + {"0VUS,(", 'F'}, + {"0VUS,F", 'F'}, + {"0VUSC", 'F'}, + {"0VUSO(", 'F'}, + {"0VUSO1", 'F'}, + {"0VUSOF", 'F'}, + {"0VUSON", 'F'}, + {"0VUSOS", 'F'}, + {"0VUSOV", 'F'}, + {"0VUTN(", 'F'}, + {"0VUTN1", 'F'}, + {"0VUTNF", 'F'}, + {"0VUTNN", 'F'}, + {"0VUTNS", 'F'}, + {"0VUTNV", 'F'}, + {"0VUV,(", 'F'}, + {"0VUV,F", 'F'}, + {"0VUVC", 'F'}, + {"0VUVO(", 'F'}, + {"0VUVOF", 'F'}, + {"0VUVOS", 'F'}, + {"0X", 'F'}, + {"::", 'o'}, + {":=", 'o'}, + {"<<", 'o'}, + {"<=", 'o'}, + {"<>", 'o'}, + {"<@", 'o'}, + {">=", 'o'}, + {">>", 'o'}, + {"@>", 'o'}, + {"ABORT", 'k'}, + {"ABS", 'f'}, + {"ACCESSIBLE", 'k'}, + {"ACOS", 'f'}, + {"ADDDATE", 'f'}, + {"ADDTIME", 'f'}, + {"AES_DECRYPT", 'f'}, + {"AES_ENCRYPT", 'f'}, + {"AGAINST", 'k'}, + {"AGE", 'f'}, + {"ALL_USERS", 'k'}, + {"ALTER", 'k'}, + {"ALTER DOMAIN", 'k'}, + {"ALTER TABLE", 'k'}, + {"ANALYZE", 'k'}, + {"AND", '&'}, + {"ANY", 'f'}, + {"ANYARRAY", 't'}, + {"ANYELEMENT", 't'}, + {"ANYNONARRY", 't'}, + {"APPLOCK_MODE", 'f'}, + {"APPLOCK_TEST", 'f'}, + {"APP_NAME", 'f'}, + {"ARRAY_AGG", 'f'}, + {"ARRAY_CAT", 'f'}, + {"ARRAY_DIM", 'f'}, + {"ARRAY_FILL", 'f'}, + {"ARRAY_LENGTH", 'f'}, + {"ARRAY_LOWER", 'f'}, + {"ARRAY_NDIMS", 'f'}, + {"ARRAY_PREPEND", 'f'}, + {"ARRAY_TO_JSON", 'f'}, + {"ARRAY_TO_STRING", 'f'}, + {"ARRAY_UPPER", 'f'}, + {"AS", 'k'}, + {"ASC", 'k'}, + {"ASCII", 'f'}, + {"ASENSITIVE", 'k'}, + {"ASIN", 'f'}, + {"ASSEMBLYPROPERTY", 'f'}, + {"ASYMKEY_ID", 'f'}, + {"AT TIME", 'n'}, + {"AT TIME ZONE", 'k'}, + {"ATAN", 'f'}, + {"ATAN2", 'f'}, + {"AUTOINCREMENT", 'k'}, + {"AVG", 'f'}, + {"BEFORE", 'k'}, + {"BEGIN", 'T'}, + {"BEGIN DECLARE", 'T'}, + {"BEGIN GOTO", 'T'}, + {"BEGIN TRY", 'T'}, + {"BEGIN TRY DECLARE", 'T'}, + {"BENCHMARK", 'f'}, + {"BETWEEN", 'o'}, + {"BIGINT", 't'}, + {"BIGSERIAL", 't'}, + {"BIN", 'f'}, + {"BINARY", 't'}, + {"BINARY_DOUBLE_INFINITY", '1'}, + {"BINARY_DOUBLE_NAN", '1'}, + {"BINARY_FLOAT_INFINITY", '1'}, + {"BINARY_FLOAT_NAN", '1'}, + {"BINBINARY", 'f'}, + {"BIT_AND", 'f'}, + {"BIT_COUNT", 'f'}, + {"BIT_LENGTH", 'f'}, + {"BIT_OR", 'f'}, + {"BIT_XOR", 'f'}, + {"BLOB", 'k'}, + {"BOOLEAN", 't'}, + {"BOOL_AND", 'f'}, + {"BOOL_OR", 'f'}, + {"BOTH", 'k'}, + {"BTRIM", 'f'}, + {"BY", 'n'}, + {"BYTEA", 't'}, + {"CALL", 'T'}, + {"CASCADE", 'k'}, + {"CASE", 'E'}, + {"CAST", 'f'}, + {"CBOOL", 'f'}, + {"CBRT", 'f'}, + {"CBYTE", 'f'}, + {"CCUR", 'f'}, + {"CDATE", 'f'}, + {"CDBL", 'f'}, + {"CEIL", 'f'}, + {"CEILING", 'f'}, + {"CERTENCODED", 'f'}, + {"CERTPRIVATEKEY", 'f'}, + {"CERT_ID", 'f'}, + {"CERT_PROPERTY", 'f'}, + {"CHANGE", 'k'}, + {"CHANGES", 'f'}, + {"CHAR", 'f'}, + {"CHARACTER", 't'}, + {"CHARACTER VARYING", 't'}, + {"CHARACTER_LENGTH", 'f'}, + {"CHARINDEX", 'f'}, + {"CHARSET", 'f'}, + {"CHAR_LENGTH", 'f'}, + {"CHDIR", 'f'}, + {"CHDRIVE", 'f'}, + {"CHECK", 'n'}, + {"CHECKSUM_AGG", 'f'}, + {"CHOOSE", 'f'}, + {"CHR", 'f'}, + {"CINT", 'f'}, + {"CLNG", 'f'}, + {"CLOCK_TIMESTAMP", 'f'}, + {"COALESCE", 'f'}, + {"COERCIBILITY", 'f'}, + {"COLLATE", 'A'}, + {"COLLATION", 'f'}, + {"COLLATIONPROPERTY", 'f'}, + {"COLUMN", 'k'}, + {"COLUMNPROPERTY", 'f'}, + {"COLUMNS_UPDATED", 'f'}, + {"COL_LENGTH", 'f'}, + {"COL_NAME", 'f'}, + {"COMPRESS", 'f'}, + {"CONCAT", 'f'}, + {"CONCAT_WS", 'f'}, + {"CONDITION", 'k'}, + {"CONNECTION_ID", 'f'}, + {"CONSTRAINT", 'k'}, + {"CONTINUE", 'k'}, + {"CONV", 'f'}, + {"CONVERT", 'f'}, + {"CONVERT_FROM", 'f'}, + {"CONVERT_TO", 'f'}, + {"CONVERT_TZ", 'f'}, + {"COS", 'f'}, + {"COT", 'f'}, + {"COUNT", 'f'}, + {"COUNT_BIG", 'k'}, + {"CRC32", 'f'}, + {"CREATE", 'E'}, + {"CREATE OR", 'n'}, + {"CREATE OR REPLACE", 'T'}, + {"CROSS", 'n'}, + {"CROSS JOIN", 'k'}, + {"CSNG", 'f'}, + {"CSTRING", 't'}, + {"CTXSYS.DRITHSX.SN", 'f'}, + {"CUME_DIST", 'f'}, + {"CURDATE", 'f'}, + {"CURDIR", 'f'}, + {"CURRENT DATE", 'v'}, + {"CURRENT DEGREE", 'v'}, + {"CURRENT FUNCTION", 'v'}, + {"CURRENT FUNCTION PATH", 'v'}, + {"CURRENT PATH", 'v'}, + {"CURRENT SCHEMA", 'v'}, + {"CURRENT SERVER", 'v'}, + {"CURRENT TIME", 'v'}, + {"CURRENT TIMEZONE", 'v'}, + {"CURRENTUSER", 'f'}, + {"CURRENT_DATABASE", 'f'}, + {"CURRENT_DATE", 'v'}, + {"CURRENT_PATH", 'v'}, + {"CURRENT_QUERY", 'f'}, + {"CURRENT_SCHEMA", 'f'}, + {"CURRENT_SCHEMAS", 'f'}, + {"CURRENT_SERVER", 'v'}, + {"CURRENT_SETTING", 'f'}, + {"CURRENT_TIME", 'v'}, + {"CURRENT_TIMESTAMP", 'v'}, + {"CURRENT_TIMEZONE", 'v'}, + {"CURRENT_USER", 'v'}, + {"CURRVAL", 'f'}, + {"CURSOR", 'k'}, + {"CURSOR_STATUS", 'f'}, + {"CURTIME", 'f'}, + {"CVAR", 'f'}, + {"DATABASE", 'n'}, + {"DATABASEPROPERTYEX", 'f'}, + {"DATABASES", 'k'}, + {"DATABASE_PRINCIPAL_ID", 'f'}, + {"DATALENGTH", 'f'}, + {"DATE", 'f'}, + {"DATEADD", 'f'}, + {"DATEDIFF", 'f'}, + {"DATEFROMPARTS", 'f'}, + {"DATENAME", 'f'}, + {"DATEPART", 'f'}, + {"DATESERIAL", 'f'}, + {"DATETIME2FROMPARTS", 'f'}, + {"DATETIMEFROMPARTS", 'f'}, + {"DATETIMEOFFSETFROMPARTS", 'f'}, + {"DATEVALUE", 'f'}, + {"DATE_ADD", 'f'}, + {"DATE_FORMAT", 'f'}, + {"DATE_PART", 'f'}, + {"DATE_SUB", 'f'}, + {"DATE_TRUNC", 'f'}, + {"DAVG", 'f'}, + {"DAY", 'f'}, + {"DAYNAME", 'f'}, + {"DAYOFMONTH", 'f'}, + {"DAYOFWEEK", 'f'}, + {"DAYOFYEAR", 'f'}, + {"DAY_HOUR", 'k'}, + {"DAY_MICROSECOND", 'k'}, + {"DAY_MINUTE", 'k'}, + {"DAY_SECOND", 'k'}, + {"DBMS_LOCK.SLEEP", 'f'}, + {"DBMS_PIPE.RECEIVE_MESSAGE", 'f'}, + {"DBMS_UTILITY.SQLID_TO_SQLHASH", 'f'}, + {"DB_ID", 'f'}, + {"DB_NAME", 'f'}, + {"DCOUNT", 'f'}, + {"DEC", 'k'}, + {"DECIMAL", 't'}, + {"DECLARE", 'T'}, + {"DECODE", 'f'}, + {"DECRYPTBYASMKEY", 'f'}, + {"DECRYPTBYCERT", 'f'}, + {"DECRYPTBYKEY", 'f'}, + {"DECRYPTBYKEYAUTOCERT", 'f'}, + {"DECRYPTBYPASSPHRASE", 'f'}, + {"DEFAULT", 'k'}, + {"DEGREES", 'f'}, + {"DELAY", 'k'}, + {"DELAYED", 'k'}, + {"DELETE", 'T'}, + {"DENSE_RANK", 'f'}, + {"DESC", 'k'}, + {"DESCRIBE", 'k'}, + {"DES_DECRYPT", 'f'}, + {"DES_ENCRYPT", 'f'}, + {"DETERMINISTIC", 'k'}, + {"DFIRST", 'f'}, + {"DIFFERENCE", 'f'}, + {"DISTINCT", 'k'}, + {"DISTINCTROW", 'k'}, + {"DIV", 'o'}, + {"DLAST", 'f'}, + {"DLOOKUP", 'f'}, + {"DMAX", 'f'}, + {"DMIN", 'f'}, + {"DO", 'n'}, + {"DOUBLE", 't'}, + {"DOUBLE PRECISION", 't'}, + {"DROP", 'T'}, + {"DSUM", 'f'}, + {"DUAL", 'n'}, + {"EACH", 'k'}, + {"ELSE", 'k'}, + {"ELSEIF", 'k'}, + {"ELT", 'f'}, + {"ENCLOSED", 'k'}, + {"ENCODE", 'f'}, + {"ENCRYPT", 'f'}, + {"ENCRYPTBYASMKEY", 'f'}, + {"ENCRYPTBYCERT", 'f'}, + {"ENCRYPTBYKEY", 'f'}, + {"ENCRYPTBYPASSPHRASE", 'f'}, + {"ENUM_FIRST", 'f'}, + {"ENUM_LAST", 'f'}, + {"ENUM_RANGE", 'f'}, + {"EOMONTH", 'f'}, + {"EQV", 'o'}, + {"ESCAPED", 'k'}, + {"EVENTDATA", 'f'}, + {"EXCEPT", 'U'}, + {"EXEC", 'T'}, + {"EXECUTE", 'T'}, + {"EXECUTE AS", 'E'}, + {"EXECUTE AS LOGIN", 'E'}, + {"EXISTS", 'f'}, + {"EXIT", 'k'}, + {"EXP", 'f'}, + {"EXPLAIN", 'k'}, + {"EXPORT_SET", 'f'}, + {"EXTRACT", 'f'}, + {"EXTRACTVALUE", 'f'}, + {"EXTRACT_VALUE", 'f'}, + {"FALSE", '1'}, + {"FETCH", 'k'}, + {"FIELD", 'f'}, + {"FILEDATETIME", 'f'}, + {"FILEGROUPPROPERTY", 'f'}, + {"FILEGROUP_ID", 'f'}, + {"FILEGROUP_NAME", 'f'}, + {"FILELEN", 'f'}, + {"FILEPROPERTY", 'f'}, + {"FILETOBLOB", 'f'}, + {"FILETOCLOB", 'f'}, + {"FILE_ID", 'f'}, + {"FILE_IDEX", 'f'}, + {"FILE_NAME", 'f'}, + {"FIND_IN_SET", 'f'}, + {"FIRST_VALUE", 'f'}, + {"FLOAT", 't'}, + {"FLOAT4", 't'}, + {"FLOAT8", 't'}, + {"FLOOR", 'f'}, + {"FN_VIRTUALFILESTATS", 'f'}, + {"FOR", 'n'}, + {"FOR UPDATE", 'k'}, + {"FOR UPDATE NOWAIT", 'k'}, + {"FOR UPDATE OF", 'k'}, + {"FOR UPDATE SKIP", 'k'}, + {"FOR UPDATE SKIP LOCKED", 'k'}, + {"FOR UPDATE WAIT", 'k'}, + {"FORCE", 'k'}, + {"FOREIGN", 'k'}, + {"FORMAT", 'f'}, + {"FOUND_ROWS", 'f'}, + {"FROM", 'k'}, + {"FROM_BASE64", 'f'}, + {"FROM_DAYS", 'f'}, + {"FROM_UNIXTIME", 'f'}, + {"FULL JOIN", 'k'}, + {"FULL OUTER", 'k'}, + {"FULL OUTER JOIN", 'k'}, + {"FULLTEXT", 'k'}, + {"FULLTEXTCATALOGPROPERTY", 'f'}, + {"FULLTEXTSERVICEPROPERTY", 'f'}, + {"FUNCTION", 'k'}, + {"GENERATE_SERIES", 'f'}, + {"GENERATE_SUBSCRIPTS", 'f'}, + {"GETATTR", 'f'}, + {"GETDATE", 'f'}, + {"GETUTCDATE", 'f'}, + {"GET_BIT", 'f'}, + {"GET_BYTE", 'f'}, + {"GET_FORMAT", 'f'}, + {"GET_LOCK", 'f'}, + {"GO", 'T'}, + {"GOTO", 'T'}, + {"GRANT", 'k'}, + {"GREATEST", 'f'}, + {"GROUP", 'n'}, + {"GROUP BY", 'B'}, + {"GROUPING", 'f'}, + {"GROUPING_ID", 'f'}, + {"GROUP_CONCAT", 'f'}, + {"HANDLER", 'T'}, + {"HASHBYTES", 'f'}, + {"HAS_PERMS_BY_NAME", 'f'}, + {"HAVING", 'B'}, + {"HEX", 'f'}, + {"HIGH_PRIORITY", 'k'}, + {"HOST_NAME", 'f'}, + {"HOUR", 'f'}, + {"HOUR_MICROSECOND", 'k'}, + {"HOUR_MINUTE", 'k'}, + {"HOUR_SECOND", 'k'}, + {"IDENTIFY", 'f'}, + {"IDENT_CURRENT", 'f'}, + {"IDENT_INCR", 'f'}, + {"IDENT_SEED", 'f'}, + {"IF", 'f'}, + {"IF EXISTS", 'f'}, + {"IF NOT", 'f'}, + {"IF NOT EXISTS", 'f'}, + {"IFF", 'f'}, + {"IFNULL", 'f'}, + {"IGNORE", 'k'}, + {"IIF", 'f'}, + {"IN", 'k'}, + {"IN BOOLEAN", 'n'}, + {"IN BOOLEAN MODE", 'k'}, + {"INDEX", 'k'}, + {"INDEXKEY_PROPERTY", 'f'}, + {"INDEXPROPERTY", 'f'}, + {"INDEX_COL", 'f'}, + {"INET_ATON", 'f'}, + {"INET_NTOA", 'f'}, + {"INFILE", 'k'}, + {"INITCAP", 'f'}, + {"INNER", 'k'}, + {"INNER JOIN", 'k'}, + {"INOUT", 'k'}, + {"INSENSITIVE", 'k'}, + {"INSERT", 'E'}, + {"INSERT DELAYED", 'E'}, + {"INSERT DELAYED INTO", 'T'}, + {"INSERT HIGH_PRIORITY", 'E'}, + {"INSERT HIGH_PRIORITY INTO", 'T'}, + {"INSERT IGNORE", 'E'}, + {"INSERT IGNORE INTO", 'T'}, + {"INSERT INTO", 'T'}, + {"INSERT LOW_PRIORITY", 'E'}, + {"INSERT LOW_PRIORITY INTO", 'T'}, + {"INSTR", 'f'}, + {"INSTRREV", 'f'}, + {"INT", 't'}, + {"INT1", 't'}, + {"INT2", 't'}, + {"INT3", 't'}, + {"INT4", 't'}, + {"INT8", 't'}, + {"INTEGER", 't'}, + {"INTERSECT", 'U'}, + {"INTERSECT ALL", 'U'}, + {"INTERVAL", 'k'}, + {"INTO", 'k'}, + {"INTO DUMPFILE", 'k'}, + {"INTO OUTFILE", 'k'}, + {"IS", 'o'}, + {"IS DISTINCT", 'n'}, + {"IS DISTINCT FROM", 'o'}, + {"IS NOT", 'o'}, + {"IS NOT DISTINCT", 'n'}, + {"IS NOT DISTINCT FROM", 'o'}, + {"ISDATE", 'f'}, + {"ISEMPTY", 'f'}, + {"ISFINITE", 'f'}, + {"ISNULL", 'f'}, + {"ISNUMERIC", 'f'}, + {"IS_FREE_LOCK", 'f'}, + {"IS_MEMBER", 'f'}, + {"IS_OBJECTSIGNED", 'f'}, + {"IS_ROLEMEMBER", 'f'}, + {"IS_SRVROLEMEMBER", 'f'}, + {"IS_USED_LOCK", 'f'}, + {"ITERATE", 'k'}, + {"JOIN", 'k'}, + {"JSON_KEYS", 'f'}, + {"JULIANDAY", 'f'}, + {"JUSTIFY_DAYS", 'f'}, + {"JUSTIFY_HOURS", 'f'}, + {"JUSTIFY_INTERVAL", 'f'}, + {"KEYS", 'k'}, + {"KEY_GUID", 'f'}, + {"KEY_ID", 'f'}, + {"KILL", 'k'}, + {"LAG", 'f'}, + {"LASTVAL", 'f'}, + {"LAST_INSERT_ID", 'f'}, + {"LAST_INSERT_ROWID", 'f'}, + {"LAST_VALUE", 'f'}, + {"LCASE", 'f'}, + {"LEAD", 'f'}, + {"LEADING", 'k'}, + {"LEAST", 'f'}, + {"LEAVE", 'k'}, + {"LEFT", 'f'}, + {"LEFT JOIN", 'k'}, + {"LEFT OUTER", 'k'}, + {"LEFT OUTER JOIN", 'k'}, + {"LENGTH", 'f'}, + {"LIKE", 'o'}, + {"LIMIT", 'B'}, + {"LINEAR", 'k'}, + {"LINES", 'k'}, + {"LN", 'f'}, + {"LOAD", 'k'}, + {"LOAD DATA", 'T'}, + {"LOAD XML", 'T'}, + {"LOAD_EXTENSION", 'f'}, + {"LOAD_FILE", 'f'}, + {"LOCALTIME", 'v'}, + {"LOCALTIMESTAMP", 'v'}, + {"LOCATE", 'f'}, + {"LOCK", 'n'}, + {"LOCK IN", 'n'}, + {"LOCK IN SHARE", 'n'}, + {"LOCK IN SHARE MODE", 'k'}, + {"LOCK TABLE", 'k'}, + {"LOCK TABLES", 'k'}, + {"LOG", 'f'}, + {"LOG10", 'f'}, + {"LOG2", 'f'}, + {"LONGBLOB", 'k'}, + {"LONGTEXT", 'k'}, + {"LOOP", 'k'}, + {"LOWER", 'f'}, + {"LOWER_INC", 'f'}, + {"LOWER_INF", 'f'}, + {"LOW_PRIORITY", 'k'}, + {"LPAD", 'f'}, + {"LTRIM", 'f'}, + {"MAKEDATE", 'f'}, + {"MAKE_SET", 'f'}, + {"MASKLEN", 'f'}, + {"MASTER_BIND", 'k'}, + {"MASTER_POS_WAIT", 'f'}, + {"MASTER_SSL_VERIFY_SERVER_CERT", 'k'}, + {"MATCH", 'k'}, + {"MAX", 'f'}, + {"MAXVALUE", 'k'}, + {"MD5", 'f'}, + {"MEDIUMBLOB", 'k'}, + {"MEDIUMINT", 'k'}, + {"MEDIUMTEXT", 'k'}, + {"MERGE", 'k'}, + {"MICROSECOND", 'f'}, + {"MID", 'f'}, + {"MIDDLEINT", 'k'}, + {"MIN", 'f'}, + {"MINUTE", 'f'}, + {"MINUTE_MICROSECOND", 'k'}, + {"MINUTE_SECOND", 'k'}, + {"MKDIR", 'f'}, + {"MOD", 'o'}, + {"MODE", 'n'}, + {"MODIFIES", 'k'}, + {"MONEY", 't'}, + {"MONTH", 'f'}, + {"MONTHNAME", 'f'}, + {"NAME_CONST", 'f'}, + {"NATURAL", 'n'}, + {"NATURAL FULL", 'k'}, + {"NATURAL FULL OUTER JOIN", 'k'}, + {"NATURAL INNER", 'k'}, + {"NATURAL JOIN", 'k'}, + {"NATURAL LEFT", 'k'}, + {"NATURAL LEFT OUTER", 'k'}, + {"NATURAL LEFT OUTER JOIN", 'k'}, + {"NATURAL OUTER", 'k'}, + {"NATURAL RIGHT", 'k'}, + {"NATURAL RIGHT OUTER JOIN", 'k'}, + {"NETMASK", 'f'}, + {"NEXT VALUE", 'n'}, + {"NEXT VALUE FOR", 'k'}, + {"NEXTVAL", 'f'}, + {"NOT", 'o'}, + {"NOT BETWEEN", 'o'}, + {"NOT IN", 'k'}, + {"NOT LIKE", 'o'}, + {"NOT REGEXP", 'o'}, + {"NOT RLIKE", 'o'}, + {"NOT SIMILAR", 'o'}, + {"NOT SIMILAR TO", 'o'}, + {"NOTNULL", 'k'}, + {"NOW", 'f'}, + {"NOWAIT", 'k'}, + {"NO_WRITE_TO_BINLOG", 'k'}, + {"NTH_VALUE", 'f'}, + {"NTILE", 'f'}, + {"NULL", 'v'}, + {"NULLIF", 'f'}, + {"NUMERIC", 't'}, + {"NZ", 'f'}, + {"OBJECTPROPERTY", 'f'}, + {"OBJECTPROPERTYEX", 'f'}, + {"OBJECT_DEFINITION", 'f'}, + {"OBJECT_ID", 'f'}, + {"OBJECT_NAME", 'f'}, + {"OBJECT_SCHEMA_NAME", 'f'}, + {"OCT", 'f'}, + {"OCTET_LENGTH", 'f'}, + {"OFFSET", 'k'}, + {"OID", 't'}, + {"OLD_PASSWORD", 'f'}, + {"ONE_SHOT", 'k'}, + {"OPEN", 'k'}, + {"OPENDATASOURCE", 'f'}, + {"OPENQUERY", 'f'}, + {"OPENROWSET", 'f'}, + {"OPENXML", 'f'}, + {"OPTIMIZE", 'k'}, + {"OPTION", 'k'}, + {"OPTIONALLY", 'k'}, + {"OR", '&'}, + {"ORD", 'f'}, + {"ORDER", 'n'}, + {"ORDER BY", 'B'}, + {"ORIGINAL_DB_NAME", 'f'}, + {"ORIGINAL_LOGIN", 'f'}, + {"OUT", 'n'}, + {"OUTER", 'n'}, + {"OUTFILE", 'k'}, + {"OVERLAPS", 'f'}, + {"OVERLAY", 'f'}, + {"OWN3D", 'k'}, + {"OWN3D BY", 'B'}, + {"PARSENAME", 'f'}, + {"PARTITION", 'k'}, + {"PARTITION BY", 'B'}, + {"PASSWORD", 'n'}, + {"PATHINDEX", 'f'}, + {"PATINDEX", 'f'}, + {"PERCENTILE_COUNT", 'f'}, + {"PERCENTILE_DISC", 'f'}, + {"PERCENTILE_RANK", 'f'}, + {"PERCENT_RANK", 'f'}, + {"PERIOD_ADD", 'f'}, + {"PERIOD_DIFF", 'f'}, + {"PERMISSIONS", 'f'}, + {"PG_ADVISORY_LOCK", 'f'}, + {"PG_BACKEND_PID", 'f'}, + {"PG_CANCEL_BACKEND", 'f'}, + {"PG_CLIENT_ENCODING", 'f'}, + {"PG_CONF_LOAD_TIME", 'f'}, + {"PG_CREATE_RESTORE_POINT", 'f'}, + {"PG_HAS_ROLE", 'f'}, + {"PG_IS_IN_RECOVERY", 'f'}, + {"PG_IS_OTHER_TEMP_SCHEMA", 'f'}, + {"PG_LISTENING_CHANNELS", 'f'}, + {"PG_LS_DIR", 'f'}, + {"PG_MY_TEMP_SCHEMA", 'f'}, + {"PG_POSTMASTER_START_TIME", 'f'}, + {"PG_READ_BINARY_FILE", 'f'}, + {"PG_READ_FILE", 'f'}, + {"PG_RELOAD_CONF", 'f'}, + {"PG_ROTATE_LOGFILE", 'f'}, + {"PG_SLEEP", 'f'}, + {"PG_START_BACKUP", 'f'}, + {"PG_STAT_FILE", 'f'}, + {"PG_STOP_BACKUP", 'f'}, + {"PG_SWITCH_XLOG", 'f'}, + {"PG_TERMINATE_BACKEND", 'f'}, + {"PG_TRIGGER_DEPTH", 'f'}, + {"PI", 'f'}, + {"POSITION", 'f'}, + {"POW", 'f'}, + {"POWER", 'f'}, + {"PRECISION", 'k'}, + {"PREVIOUS VALUE", 'n'}, + {"PREVIOUS VALUE FOR", 'k'}, + {"PRIMARY", 'k'}, + {"PRINT", 'T'}, + {"PROCEDURE", 'k'}, + {"PROCEDURE ANALYSE", 'f'}, + {"PUBLISHINGSERVERNAME", 'f'}, + {"PURGE", 'k'}, + {"PWDCOMPARE", 'f'}, + {"PWDENCRYPT", 'f'}, + {"QUARTER", 'f'}, + {"QUOTE", 'f'}, + {"QUOTENAME", 'f'}, + {"QUOTE_IDENT", 'f'}, + {"QUOTE_LITERAL", 'f'}, + {"QUOTE_NULLABLE", 'f'}, + {"RADIANS", 'f'}, + {"RAISEERROR", 'E'}, + {"RAND", 'f'}, + {"RANDOM", 'f'}, + {"RANDOMBLOB", 'f'}, + {"RANGE", 'k'}, + {"RANK", 'f'}, + {"READ", 'k'}, + {"READ WRITE", 'k'}, + {"READS", 'k'}, + {"READ_WRITE", 'k'}, + {"REAL", 't'}, + {"REFERENCES", 'k'}, + {"REGCLASS", 't'}, + {"REGCONFIG", 't'}, + {"REGDICTIONARY", 't'}, + {"REGEXP", 'o'}, + {"REGEXP_INSTR", 'f'}, + {"REGEXP_MATCHES", 'f'}, + {"REGEXP_REPLACE", 'f'}, + {"REGEXP_SPLIT_TO_ARRAY", 'f'}, + {"REGEXP_SPLIT_TO_TABLE", 'f'}, + {"REGEXP_SUBSTR", 'f'}, + {"REGOPER", 't'}, + {"REGOPERATOR", 't'}, + {"REGPROC", 't'}, + {"REGPROCEDURE", 't'}, + {"REGTYPE", 't'}, + {"RELEASE", 'k'}, + {"RELEASE_LOCK", 'f'}, + {"RENAME", 'k'}, + {"REPEAT", 'k'}, + {"REPLACE", 'k'}, + {"REPLICATE", 'f'}, + {"REQUIRE", 'k'}, + {"RESIGNAL", 'k'}, + {"RESTRICT", 'k'}, + {"RETURN", 'k'}, + {"REVERSE", 'f'}, + {"REVOKE", 'k'}, + {"RIGHT", 'n'}, + {"RIGHT JOIN", 'k'}, + {"RIGHT OUTER", 'k'}, + {"RIGHT OUTER JOIN", 'k'}, + {"RLIKE", 'o'}, + {"ROUND", 'f'}, + {"ROW", 'f'}, + {"ROW_COUNT", 'f'}, + {"ROW_NUMBER", 'f'}, + {"ROW_TO_JSON", 'f'}, + {"RPAD", 'f'}, + {"RTRIM", 'f'}, + {"SCHAMA_NAME", 'f'}, + {"SCHEMA", 'k'}, + {"SCHEMAS", 'k'}, + {"SCHEMA_ID", 'f'}, + {"SCOPE_IDENTITY", 'f'}, + {"SECOND_MICROSECOND", 'k'}, + {"SEC_TO_TIME", 'f'}, + {"SELECT", 'E'}, + {"SELECT ALL", 'E'}, + {"SELECT DISTINCT", 'E'}, + {"SENSITIVE", 'k'}, + {"SEPARATOR", 'k'}, + {"SERIAL", 't'}, + {"SERIAL2", 't'}, + {"SERIAL4", 't'}, + {"SERIAL8", 't'}, + {"SERVERPROPERTY", 'f'}, + {"SESSION_USER", 'f'}, + {"SET", 'E'}, + {"SETATTR", 'f'}, + {"SETSEED", 'f'}, + {"SETVAL", 'f'}, + {"SET_BIT", 'f'}, + {"SET_BYTE", 'f'}, + {"SET_CONFIG", 'f'}, + {"SET_MASKLEN", 'f'}, + {"SHA", 'f'}, + {"SHA1", 'f'}, + {"SHA2", 'f'}, + {"SHOW", 'n'}, + {"SHUTDOWN", 'T'}, + {"SIGN", 'f'}, + {"SIGNAL", 'k'}, + {"SIGNBYASMKEY", 'f'}, + {"SIGNBYCERT", 'f'}, + {"SIMILAR", 'k'}, + {"SIMILAR TO", 'o'}, + {"SIN", 'f'}, + {"SLEEP", 'f'}, + {"SMALLDATETIMEFROMPARTS", 'f'}, + {"SMALLINT", 't'}, + {"SMALLSERIAL", 't'}, + {"SOME", 'f'}, + {"SOUNDEX", 'f'}, + {"SOUNDS", 'o'}, + {"SOUNDS LIKE", 'o'}, + {"SPACE", 'f'}, + {"SPATIAL", 'k'}, + {"SPECIFIC", 'k'}, + {"SPLIT_PART", 'f'}, + {"SQL", 'k'}, + {"SQLEXCEPTION", 'k'}, + {"SQLITE_VERSION", 'f'}, + {"SQLSTATE", 'k'}, + {"SQLWARNING", 'k'}, + {"SQL_BIG_RESULT", 'k'}, + {"SQL_BUFFER_RESULT", 'k'}, + {"SQL_CACHE", 'k'}, + {"SQL_CALC_FOUND_ROWS", 'k'}, + {"SQL_NO_CACHE", 'k'}, + {"SQL_SMALL_RESULT", 'k'}, + {"SQL_VARIANT_PROPERTY", 'f'}, + {"SQRT", 'f'}, + {"SSL", 'k'}, + {"STARTING", 'k'}, + {"STATEMENT_TIMESTAMP", 'f'}, + {"STATS_DATE", 'f'}, + {"STDDEV", 'f'}, + {"STDDEV_POP", 'f'}, + {"STDDEV_SAMP", 'f'}, + {"STRAIGHT_JOIN", 'k'}, + {"STRCMP", 'f'}, + {"STRCOMP", 'f'}, + {"STRCONV", 'f'}, + {"STRING_AGG", 'f'}, + {"STRING_TO_ARRAY", 'f'}, + {"STRPOS", 'f'}, + {"STR_TO_DATE", 'f'}, + {"STUFF", 'f'}, + {"SUBDATE", 'f'}, + {"SUBSTR", 'f'}, + {"SUBSTRING", 'f'}, + {"SUBSTRING_INDEX", 'f'}, + {"SUBTIME", 'f'}, + {"SUM", 'f'}, + {"SUSER_ID", 'f'}, + {"SUSER_NAME", 'f'}, + {"SUSER_SID", 'f'}, + {"SUSER_SNAME", 'f'}, + {"SWITCHOFFET", 'f'}, + {"SYS.DATABASE_NAME", 'n'}, + {"SYS.FN_BUILTIN_PERMISSIONS", 'f'}, + {"SYS.FN_GET_AUDIT_FILE", 'f'}, + {"SYS.FN_MY_PERMISSIONS", 'f'}, + {"SYS.STRAGG", 'f'}, + {"SYSCOLUMNS", 'k'}, + {"SYSDATE", 'f'}, + {"SYSDATETIME", 'f'}, + {"SYSDATETIMEOFFSET", 'f'}, + {"SYSOBJECTS", 'k'}, + {"SYSTEM_USER", 'f'}, + {"SYSUSERS", 'k'}, + {"SYSUTCDATETME", 'f'}, + {"TABLE", 'n'}, + {"TAN", 'f'}, + {"TERMINATED", 'k'}, + {"TERTIARY_WEIGHTS", 'f'}, + {"TEXT", 't'}, + {"TEXTPOS", 'f'}, + {"TEXTPTR", 'f'}, + {"TEXTVALID", 'f'}, + {"THEN", 'k'}, + {"TIME", 'k'}, + {"TIMEDIFF", 'f'}, + {"TIMEFROMPARTS", 'f'}, + {"TIMEOFDAY", 'f'}, + {"TIMESERIAL", 'f'}, + {"TIMESTAMP", 't'}, + {"TIMESTAMPADD", 'f'}, + {"TIMEVALUE", 'f'}, + {"TIME_FORMAT", 'f'}, + {"TIME_TO_SEC", 'f'}, + {"TINYBLOB", 'k'}, + {"TINYINT", 'k'}, + {"TINYTEXT", 'k'}, + {"TODATETIMEOFFSET", 'f'}, + {"TOP", 'k'}, + {"TOTAL", 'f'}, + {"TOTAL_CHANGES", 'f'}, + {"TO_ASCII", 'f'}, + {"TO_BASE64", 'f'}, + {"TO_CHAR", 'f'}, + {"TO_DATE", 'f'}, + {"TO_DAYS", 'f'}, + {"TO_HEX", 'f'}, + {"TO_NUMBER", 'f'}, + {"TO_SECONDS", 'f'}, + {"TO_TIMESTAMP", 'f'}, + {"TRAILING", 'n'}, + {"TRANSACTION_TIMESTAMP", 'f'}, + {"TRANSLATE", 'f'}, + {"TRIGGER", 'k'}, + {"TRIGGER_NESTLEVEL", 'f'}, + {"TRIM", 'f'}, + {"TRUE", '1'}, + {"TRUNC", 'f'}, + {"TRUNCATE", 'f'}, + {"TRY", 'T'}, + {"TRY_CAST", 'f'}, + {"TRY_CONVERT", 'f'}, + {"TRY_PARSE", 'f'}, + {"TYPEOF", 'f'}, + {"TYPEPROPERTY", 'f'}, + {"TYPE_ID", 'f'}, + {"TYPE_NAME", 'f'}, + {"UCASE", 'f'}, + {"UESCAPE", 'o'}, + {"UNCOMPRESS", 'f'}, + {"UNCOMPRESS_LENGTH", 'f'}, + {"UNDO", 'k'}, + {"UNHEX", 'f'}, + {"UNICODE", 'f'}, + {"UNION", 'U'}, + {"UNION ALL", 'U'}, + {"UNION ALL DISTINCT", 'U'}, + {"UNION DISTINCT", 'U'}, + {"UNION DISTINCT ALL", 'U'}, + {"UNIQUE", 'n'}, + {"UNIX_TIMESTAMP", 'f'}, + {"UNI_ON", 'U'}, + {"UNKNOWN", 'v'}, + {"UNLOCK", 'k'}, + {"UNNEST", 'f'}, + {"UNSIGNED", 'k'}, + {"UPDATE", 'E'}, + {"UPDATEXML", 'f'}, + {"UPPER", 'f'}, + {"UPPER_INC", 'f'}, + {"UPPER_INF", 'f'}, + {"USAGE", 'k'}, + {"USE", 'T'}, + {"USER", 'n'}, + {"USER_ID", 'n'}, + {"USER_LOCK.SLEEP", 'f'}, + {"USER_NAME", 'n'}, + {"USING", 'f'}, + {"UTC_DATE", 'k'}, + {"UTC_TIME", 'k'}, + {"UTC_TIMESTAMP", 'k'}, + {"UTL_HTTP.REQUEST", 'f'}, + {"UTL_INADDR.GET_HOST_ADDRESS", 'f'}, + {"UTL_INADDR.GET_HOST_NAME", 'f'}, + {"UUID", 'f'}, + {"UUID_SHORT", 'f'}, + {"VALUES", 'k'}, + {"VAR", 'f'}, + {"VARBINARY", 'k'}, + {"VARCHAR", 't'}, + {"VARCHARACTER", 'k'}, + {"VARIANCE", 'f'}, + {"VARP", 'f'}, + {"VARYING", 'k'}, + {"VAR_POP", 'f'}, + {"VAR_SAMP", 'f'}, + {"VERIFYSIGNEDBYASMKEY", 'f'}, + {"VERIFYSIGNEDBYCERT", 'f'}, + {"VERSION", 'f'}, + {"VOID", 't'}, + {"WAIT", 'k'}, + {"WAITFOR", 'n'}, + {"WAITFOR DELAY", 'E'}, + {"WAITFOR RECEIVE", 'E'}, + {"WAITFOR TIME", 'E'}, + {"WEEK", 'f'}, + {"WEEKDAY", 'f'}, + {"WEEKDAYNAME", 'f'}, + {"WEEKOFYEAR", 'f'}, + {"WHEN", 'k'}, + {"WHERE", 'k'}, + {"WHILE", 'T'}, + {"WIDTH_BUCKET", 'f'}, + {"WITH", 'n'}, + {"WITH ROLLUP", 'k'}, + {"XMLAGG", 'f'}, + {"XMLCOMMENT", 'f'}, + {"XMLCONCAT", 'f'}, + {"XMLELEMENT", 'f'}, + {"XMLEXISTS", 'f'}, + {"XMLFOREST", 'f'}, + {"XMLFORMAT", 'f'}, + {"XMLPI", 'f'}, + {"XMLROOT", 'f'}, + {"XMLTYPE", 'f'}, + {"XML_IS_WELL_FORMED", 'f'}, + {"XOR", '&'}, + {"XPATH", 'f'}, + {"XPATH_EXISTS", 'f'}, + {"XP_EXECRESULTSET", 'k'}, + {"YEAR", 'f'}, + {"YEARWEEK", 'f'}, + {"YEAR_MONTH", 'k'}, + {"ZEROBLOB", 'f'}, + {"ZEROFILL", 'k'}, + {"^=", 'o'}, + {"_ARMSCII8", 't'}, + {"_ASCII", 't'}, + {"_BIG5", 't'}, + {"_BINARY", 't'}, + {"_CP1250", 't'}, + {"_CP1251", 't'}, + {"_CP1257", 't'}, + {"_CP850", 't'}, + {"_CP852", 't'}, + {"_CP866", 't'}, + {"_CP932", 't'}, + {"_DEC8", 't'}, + {"_EUCJPMS", 't'}, + {"_EUCKR", 't'}, + {"_GB2312", 't'}, + {"_GBK", 't'}, + {"_GEOSTD8", 't'}, + {"_GREEK", 't'}, + {"_HEBREW", 't'}, + {"_HP8", 't'}, + {"_KEYBCS2", 't'}, + {"_KOI8R", 't'}, + {"_KOI8U", 't'}, + {"_LATIN1", 't'}, + {"_LATIN2", 't'}, + {"_LATIN5", 't'}, + {"_LATIN7", 't'}, + {"_MACCE", 't'}, + {"_MACROMAN", 't'}, + {"_SJIS", 't'}, + {"_SWE7", 't'}, + {"_TIS620", 't'}, + {"_UJIS", 't'}, + {"_USC2", 't'}, + {"_UTF8", 't'}, + {"|/", 'o'}, + {"|=", 'o'}, + {"||", '&'}, + {"~*", 'o'}, +}; +static const size_t sql_keywords_sz = 9352; +#endif diff --git a/src/lib/third_party/include/libinjection_xss.h b/src/lib/third_party/include/libinjection_xss.h new file mode 100644 index 000000000..3443d6e38 --- /dev/null +++ b/src/lib/third_party/include/libinjection_xss.h @@ -0,0 +1,21 @@ +#ifndef LIBINJECTION_XSS +#define LIBINJECTION_XSS + +#ifdef __cplusplus +extern "C" { +#endif + +/** + * HEY THIS ISN'T DONE + */ + +/* pull in size_t */ + +#include <string.h> + + int libinjection_is_xss(const char* s, size_t len, int flags); + +#ifdef __cplusplus +} +#endif +#endif diff --git a/src/lib/third_party/src/libinjection_html5.c b/src/lib/third_party/src/libinjection_html5.c new file mode 100644 index 000000000..a380ca0ad --- /dev/null +++ b/src/lib/third_party/src/libinjection_html5.c @@ -0,0 +1,850 @@ +#include "libinjection_html5.h" + +#include <string.h> +#include <assert.h> + +#ifdef DEBUG +#include <stdio.h> +#define TRACE() printf("%s:%d\n", __FUNCTION__, __LINE__) +#else +#define TRACE() +#endif + + +#define CHAR_EOF -1 +#define CHAR_NULL 0 +#define CHAR_BANG 33 +#define CHAR_DOUBLE 34 +#define CHAR_PERCENT 37 +#define CHAR_SINGLE 39 +#define CHAR_DASH 45 +#define CHAR_SLASH 47 +#define CHAR_LT 60 +#define CHAR_EQUALS 61 +#define CHAR_GT 62 +#define CHAR_QUESTION 63 +#define CHAR_RIGHTB 93 +#define CHAR_TICK 96 + +/* prototypes */ + +static int h5_skip_white(h5_state_t* hs); +static int h5_is_white(char c); +static int h5_state_eof(h5_state_t* hs); +static int h5_state_data(h5_state_t* hs); +static int h5_state_tag_open(h5_state_t* hs); +static int h5_state_tag_name(h5_state_t* hs); +static int h5_state_tag_name_close(h5_state_t* hs); +static int h5_state_end_tag_open(h5_state_t* hs); +static int h5_state_self_closing_start_tag(h5_state_t* hs); +static int h5_state_attribute_name(h5_state_t* hs); +static int h5_state_after_attribute_name(h5_state_t* hs); +static int h5_state_before_attribute_name(h5_state_t* hs); +static int h5_state_before_attribute_value(h5_state_t* hs); +static int h5_state_attribute_value_double_quote(h5_state_t* hs); +static int h5_state_attribute_value_single_quote(h5_state_t* hs); +static int h5_state_attribute_value_back_quote(h5_state_t* hs); +static int h5_state_attribute_value_no_quote(h5_state_t* hs); +static int h5_state_after_attribute_value_quoted_state(h5_state_t* hs); +static int h5_state_comment(h5_state_t* hs); +static int h5_state_cdata(h5_state_t* hs); + + +/* 12.2.4.44 */ +static int h5_state_bogus_comment(h5_state_t* hs); +static int h5_state_bogus_comment2(h5_state_t* hs); + +/* 12.2.4.45 */ +static int h5_state_markup_declaration_open(h5_state_t* hs); + +/* 8.2.4.52 */ +static int h5_state_doctype(h5_state_t* hs); + +/** + * public function + */ +void libinjection_h5_init(h5_state_t* hs, const char* s, size_t len, enum html5_flags flags) +{ + memset(hs, 0, sizeof(h5_state_t)); + hs->s = s; + hs->len = len; + + switch (flags) { + case DATA_STATE: + hs->state = h5_state_data; + break; + case VALUE_NO_QUOTE: + hs->state = h5_state_before_attribute_name; + break; + case VALUE_SINGLE_QUOTE: + hs->state = h5_state_attribute_value_single_quote; + break; + case VALUE_DOUBLE_QUOTE: + hs->state = h5_state_attribute_value_double_quote; + break; + case VALUE_BACK_QUOTE: + hs->state = h5_state_attribute_value_back_quote; + break; + } +} + +/** + * public function + */ +int libinjection_h5_next(h5_state_t* hs) +{ + assert(hs->state != NULL); + return (*hs->state)(hs); +} + +/** + * Everything below here is private + * + */ + + +static int h5_is_white(char ch) +{ + /* + * \t = horizontal tab = 0x09 + * \n = newline = 0x0A + * \v = vertical tab = 0x0B + * \f = form feed = 0x0C + * \r = cr = 0x0D + */ + return strchr(" \t\n\v\f\r", ch) != NULL; +} + +static int h5_skip_white(h5_state_t* hs) +{ + char ch; + while (hs->pos < hs->len) { + ch = hs->s[hs->pos]; + switch (ch) { + case 0x00: /* IE only */ + case 0x20: + case 0x09: + case 0x0A: + case 0x0B: /* IE only */ + case 0x0C: + case 0x0D: /* IE only */ + hs->pos += 1; + break; + default: + return ch; + } + } + return CHAR_EOF; +} + +static int h5_state_eof(h5_state_t* hs) +{ + /* eliminate unused function argument warning */ + (void)hs; + return 0; +} + +static int h5_state_data(h5_state_t* hs) +{ + const char* idx; + + TRACE(); + assert(hs->len >= hs->pos); + idx = (const char*) memchr(hs->s + hs->pos, CHAR_LT, hs->len - hs->pos); + if (idx == NULL) { + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = DATA_TEXT; + hs->state = h5_state_eof; + if (hs->token_len == 0) { + return 0; + } + } else { + hs->token_start = hs->s + hs->pos; + hs->token_type = DATA_TEXT; + hs->token_len = (size_t)(idx - hs->s) - hs->pos; + hs->pos = (size_t)(idx - hs->s) + 1; + hs->state = h5_state_tag_open; + if (hs->token_len == 0) { + return h5_state_tag_open(hs); + } + } + return 1; +} + +/** + * 12 2.4.8 + */ +static int h5_state_tag_open(h5_state_t* hs) +{ + char ch; + + TRACE(); + if (hs->pos >= hs->len) { + return 0; + } + ch = hs->s[hs->pos]; + if (ch == CHAR_BANG) { + hs->pos += 1; + return h5_state_markup_declaration_open(hs); + } else if (ch == CHAR_SLASH) { + hs->pos += 1; + hs->is_close = 1; + return h5_state_end_tag_open(hs); + } else if (ch == CHAR_QUESTION) { + hs->pos += 1; + return h5_state_bogus_comment(hs); + } else if (ch == CHAR_PERCENT) { + /* this is not in spec.. alternative comment format used + by IE <= 9 and Safari < 4.0.3 */ + hs->pos += 1; + return h5_state_bogus_comment2(hs); + } else if ((ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z')) { + return h5_state_tag_name(hs); + } else if (ch == CHAR_NULL) { + /* IE-ism NULL characters are ignored */ + return h5_state_tag_name(hs); + } else { + /* user input mistake in configuring state */ + if (hs->pos == 0) { + return h5_state_data(hs); + } + hs->token_start = hs->s + hs->pos - 1; + hs->token_len = 1; + hs->token_type = DATA_TEXT; + hs->state = h5_state_data; + return 1; + } +} +/** + * 12.2.4.9 + */ +static int h5_state_end_tag_open(h5_state_t* hs) +{ + char ch; + + TRACE(); + + if (hs->pos >= hs->len) { + return 0; + } + ch = hs->s[hs->pos]; + if (ch == CHAR_GT) { + return h5_state_data(hs); + } else if ((ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z')) { + return h5_state_tag_name(hs); + } + + hs->is_close = 0; + return h5_state_bogus_comment(hs); +} +/* + * + */ +static int h5_state_tag_name_close(h5_state_t* hs) +{ + TRACE(); + hs->is_close = 0; + hs->token_start = hs->s + hs->pos; + hs->token_len = 1; + hs->token_type = TAG_NAME_CLOSE; + hs->pos += 1; + if (hs->pos < hs->len) { + hs->state = h5_state_data; + } else { + hs->state = h5_state_eof; + } + + return 1; +} + +/** + * 12.2.4.10 + */ +static int h5_state_tag_name(h5_state_t* hs) +{ + char ch; + size_t pos; + + TRACE(); + pos = hs->pos; + while (pos < hs->len) { + ch = hs->s[pos]; + if (ch == 0) { + /* special non-standard case */ + /* allow nulls in tag name */ + /* some old browsers apparently allow and ignore them */ + pos += 1; + } else if (h5_is_white(ch)) { + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + hs->token_type = TAG_NAME_OPEN; + hs->pos = pos + 1; + hs->state = h5_state_before_attribute_name; + return 1; + } else if (ch == CHAR_SLASH) { + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + hs->token_type = TAG_NAME_OPEN; + hs->pos = pos + 1; + hs->state = h5_state_self_closing_start_tag; + return 1; + } else if (ch == CHAR_GT) { + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + if (hs->is_close) { + hs->pos = pos + 1; + hs->is_close = 0; + hs->token_type = TAG_CLOSE; + hs->state = h5_state_data; + } else { + hs->pos = pos; + hs->token_type = TAG_NAME_OPEN; + hs->state = h5_state_tag_name_close; + } + return 1; + } else { + pos += 1; + } + } + + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = TAG_NAME_OPEN; + hs->state = h5_state_eof; + return 1; +} + +/** + * 12.2.4.34 + */ +static int h5_state_before_attribute_name(h5_state_t* hs) +{ + int ch; + + TRACE(); + ch = h5_skip_white(hs); + switch (ch) { + case CHAR_EOF: { + return 0; + } + case CHAR_SLASH: { + hs->pos += 1; + return h5_state_self_closing_start_tag(hs); + } + case CHAR_GT: { + hs->state = h5_state_data; + hs->token_start = hs->s + hs->pos; + hs->token_len = 1; + hs->token_type = TAG_NAME_CLOSE; + hs->pos += 1; + return 1; + } + default: { + return h5_state_attribute_name(hs); + } + } +} + +static int h5_state_attribute_name(h5_state_t* hs) +{ + char ch; + size_t pos; + + TRACE(); + pos = hs->pos + 1; + while (pos < hs->len) { + ch = hs->s[pos]; + if (h5_is_white(ch)) { + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + hs->token_type = ATTR_NAME; + hs->state = h5_state_after_attribute_name; + hs->pos = pos + 1; + return 1; + } else if (ch == CHAR_SLASH) { + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + hs->token_type = ATTR_NAME; + hs->state = h5_state_self_closing_start_tag; + hs->pos = pos + 1; + return 1; + } else if (ch == CHAR_EQUALS) { + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + hs->token_type = ATTR_NAME; + hs->state = h5_state_before_attribute_value; + hs->pos = pos + 1; + return 1; + } else if (ch == CHAR_GT) { + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + hs->token_type = ATTR_NAME; + hs->state = h5_state_tag_name_close; + hs->pos = pos; + return 1; + } else { + pos += 1; + } + } + /* EOF */ + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = ATTR_NAME; + hs->state = h5_state_eof; + hs->pos = hs->len; + return 1; +} + +/** + * 12.2.4.36 + */ +static int h5_state_after_attribute_name(h5_state_t* hs) +{ + int c; + + TRACE(); + c = h5_skip_white(hs); + switch (c) { + case CHAR_EOF: { + return 0; + } + case CHAR_SLASH: { + hs->pos += 1; + return h5_state_self_closing_start_tag(hs); + } + case CHAR_EQUALS: { + hs->pos += 1; + return h5_state_before_attribute_value(hs); + } + case CHAR_GT: { + return h5_state_tag_name_close(hs); + } + default: { + return h5_state_attribute_name(hs); + } + } +} + +/** + * 12.2.4.37 + */ +static int h5_state_before_attribute_value(h5_state_t* hs) +{ + int c; + TRACE(); + + c = h5_skip_white(hs); + + if (c == CHAR_EOF) { + hs->state = h5_state_eof; + return 0; + } + + if (c == CHAR_DOUBLE) { + return h5_state_attribute_value_double_quote(hs); + } else if (c == CHAR_SINGLE) { + return h5_state_attribute_value_single_quote(hs); + } else if (c == CHAR_TICK) { + /* NON STANDARD IE */ + return h5_state_attribute_value_back_quote(hs); + } else { + return h5_state_attribute_value_no_quote(hs); + } +} + + +static int h5_state_attribute_value_quote(h5_state_t* hs, char qchar) +{ + const char* idx; + + TRACE(); + + /* skip initial quote in normal case. + * don't do this "if (pos == 0)" since it means we have started + * in a non-data state. given an input of '><foo + * we want to make 0-length attribute name + */ + if (hs->pos > 0) { + hs->pos += 1; + } + + + idx = (const char*) memchr(hs->s + hs->pos, qchar, hs->len - hs->pos); + if (idx == NULL) { + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = ATTR_VALUE; + hs->state = h5_state_eof; + } else { + hs->token_start = hs->s + hs->pos; + hs->token_len = (size_t)(idx - hs->s) - hs->pos; + hs->token_type = ATTR_VALUE; + hs->state = h5_state_after_attribute_value_quoted_state; + hs->pos += hs->token_len + 1; + } + return 1; +} + +static +int h5_state_attribute_value_double_quote(h5_state_t* hs) +{ + TRACE(); + return h5_state_attribute_value_quote(hs, CHAR_DOUBLE); +} + +static +int h5_state_attribute_value_single_quote(h5_state_t* hs) +{ + TRACE(); + return h5_state_attribute_value_quote(hs, CHAR_SINGLE); +} + +static +int h5_state_attribute_value_back_quote(h5_state_t* hs) +{ + TRACE(); + return h5_state_attribute_value_quote(hs, CHAR_TICK); +} + +static int h5_state_attribute_value_no_quote(h5_state_t* hs) +{ + char ch; + size_t pos; + + TRACE(); + pos = hs->pos; + while (pos < hs->len) { + ch = hs->s[pos]; + if (h5_is_white(ch)) { + hs->token_type = ATTR_VALUE; + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + hs->pos = pos + 1; + hs->state = h5_state_before_attribute_name; + return 1; + } else if (ch == CHAR_GT) { + hs->token_type = ATTR_VALUE; + hs->token_start = hs->s + hs->pos; + hs->token_len = pos - hs->pos; + hs->pos = pos; + hs->state = h5_state_tag_name_close; + return 1; + } + pos += 1; + } + TRACE(); + /* EOF */ + hs->state = h5_state_eof; + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = ATTR_VALUE; + return 1; +} + +/** + * 12.2.4.41 + */ +static int h5_state_after_attribute_value_quoted_state(h5_state_t* hs) +{ + char ch; + + TRACE(); + if (hs->pos >= hs->len) { + return 0; + } + ch = hs->s[hs->pos]; + if (h5_is_white(ch)) { + hs->pos += 1; + return h5_state_before_attribute_name(hs); + } else if (ch == CHAR_SLASH) { + hs->pos += 1; + return h5_state_self_closing_start_tag(hs); + } else if (ch == CHAR_GT) { + hs->token_start = hs->s + hs->pos; + hs->token_len = 1; + hs->token_type = TAG_NAME_CLOSE; + hs->pos += 1; + hs->state = h5_state_data; + return 1; + } else { + return h5_state_before_attribute_name(hs); + } +} + +/** + * 12.2.4.43 + */ +static int h5_state_self_closing_start_tag(h5_state_t* hs) +{ + char ch; + + TRACE(); + if (hs->pos >= hs->len) { + return 0; + } + ch = hs->s[hs->pos]; + if (ch == CHAR_GT) { + assert(hs->pos > 0); + hs->token_start = hs->s + hs->pos -1; + hs->token_len = 2; + hs->token_type = TAG_NAME_SELFCLOSE; + hs->state = h5_state_data; + hs->pos += 1; + return 1; + } else { + return h5_state_before_attribute_name(hs); + } +} + +/** + * 12.2.4.44 + */ +static int h5_state_bogus_comment(h5_state_t* hs) +{ + const char* idx; + + TRACE(); + idx = (const char*) memchr(hs->s + hs->pos, CHAR_GT, hs->len - hs->pos); + if (idx == NULL) { + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->pos = hs->len; + hs->state = h5_state_eof; + } else { + hs->token_start = hs->s + hs->pos; + hs->token_len = (size_t)(idx - hs->s) - hs->pos; + hs->pos = (size_t)(idx - hs->s) + 1; + hs->state = h5_state_data; + } + + hs->token_type = TAG_COMMENT; + return 1; +} + +/** + * 12.2.4.44 ALT + */ +static int h5_state_bogus_comment2(h5_state_t* hs) +{ + const char* idx; + size_t pos; + + TRACE(); + pos = hs->pos; + while (1) { + idx = (const char*) memchr(hs->s + pos, CHAR_PERCENT, hs->len - pos); + if (idx == NULL || (idx + 1 >= hs->s + hs->len)) { + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->pos = hs->len; + hs->token_type = TAG_COMMENT; + hs->state = h5_state_eof; + return 1; + } + + if (*(idx +1) != CHAR_GT) { + pos = (size_t)(idx - hs->s) + 1; + continue; + } + + /* ends in %> */ + hs->token_start = hs->s + hs->pos; + hs->token_len = (size_t)(idx - hs->s) - hs->pos; + hs->pos = (size_t)(idx - hs->s) + 2; + hs->state = h5_state_data; + hs->token_type = TAG_COMMENT; + return 1; + } +} + +/** + * 8.2.4.45 + */ +static int h5_state_markup_declaration_open(h5_state_t* hs) +{ + size_t remaining; + + TRACE(); + remaining = hs->len - hs->pos; + if (remaining >= 7 && + /* case insensitive */ + (hs->s[hs->pos + 0] == 'D' || hs->s[hs->pos + 0] == 'd') && + (hs->s[hs->pos + 1] == 'O' || hs->s[hs->pos + 1] == 'o') && + (hs->s[hs->pos + 2] == 'C' || hs->s[hs->pos + 2] == 'c') && + (hs->s[hs->pos + 3] == 'T' || hs->s[hs->pos + 3] == 't') && + (hs->s[hs->pos + 4] == 'Y' || hs->s[hs->pos + 4] == 'y') && + (hs->s[hs->pos + 5] == 'P' || hs->s[hs->pos + 5] == 'p') && + (hs->s[hs->pos + 6] == 'E' || hs->s[hs->pos + 6] == 'e') + ) { + return h5_state_doctype(hs); + } else if (remaining >= 7 && + /* upper case required */ + hs->s[hs->pos + 0] == '[' && + hs->s[hs->pos + 1] == 'C' && + hs->s[hs->pos + 2] == 'D' && + hs->s[hs->pos + 3] == 'A' && + hs->s[hs->pos + 4] == 'T' && + hs->s[hs->pos + 5] == 'A' && + hs->s[hs->pos + 6] == '[' + ) { + hs->pos += 7; + return h5_state_cdata(hs); + } else if (remaining >= 2 && + hs->s[hs->pos + 0] == '-' && + hs->s[hs->pos + 1] == '-') { + hs->pos += 2; + return h5_state_comment(hs); + } + + return h5_state_bogus_comment(hs); +} + +/** + * 12.2.4.48 + * 12.2.4.49 + * 12.2.4.50 + * 12.2.4.51 + * state machine spec is confusing since it can only look + * at one character at a time but simply it's comments end by: + * 1) EOF + * 2) ending in --> + * 3) ending in -!> + */ +static int h5_state_comment(h5_state_t* hs) +{ + char ch; + const char* idx; + size_t pos; + size_t offset; + const char* end = hs->s + hs->len; + + TRACE(); + pos = hs->pos; + while (1) { + + idx = (const char*) memchr(hs->s + pos, CHAR_DASH, hs->len - pos); + + /* did not find anything or has less than 3 chars left */ + if (idx == NULL || idx > hs->s + hs->len - 3) { + hs->state = h5_state_eof; + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = TAG_COMMENT; + return 1; + } + offset = 1; + + /* skip all nulls */ + while (idx + offset < end && *(idx + offset) == 0) { + offset += 1; + } + if (idx + offset == end) { + hs->state = h5_state_eof; + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = TAG_COMMENT; + return 1; + } + + ch = *(idx + offset); + if (ch != CHAR_DASH && ch != CHAR_BANG) { + pos = (size_t)(idx - hs->s) + 1; + continue; + } + + /* need to test */ +#if 0 + /* skip all nulls */ + while (idx + offset < end && *(idx + offset) == 0) { + offset += 1; + } + if (idx + offset == end) { + hs->state = h5_state_eof; + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = TAG_COMMENT; + return 1; + } +#endif + + offset += 1; + if (idx + offset == end) { + hs->state = h5_state_eof; + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = TAG_COMMENT; + return 1; + } + + + ch = *(idx + offset); + if (ch != CHAR_GT) { + pos = (size_t)(idx - hs->s) + 1; + continue; + } + offset += 1; + + /* ends in --> or -!> */ + hs->token_start = hs->s + hs->pos; + hs->token_len = (size_t)(idx - hs->s) - hs->pos; + hs->pos = (size_t)(idx + offset - hs->s); + hs->state = h5_state_data; + hs->token_type = TAG_COMMENT; + return 1; + } +} + +static int h5_state_cdata(h5_state_t* hs) +{ + const char* idx; + size_t pos; + + TRACE(); + pos = hs->pos; + while (1) { + idx = (const char*) memchr(hs->s + pos, CHAR_RIGHTB, hs->len - pos); + + /* did not find anything or has less than 3 chars left */ + if (idx == NULL || idx > hs->s + hs->len - 3) { + hs->state = h5_state_eof; + hs->token_start = hs->s + hs->pos; + hs->token_len = hs->len - hs->pos; + hs->token_type = DATA_TEXT; + return 1; + } else if ( *(idx+1) == CHAR_RIGHTB && *(idx+2) == CHAR_GT) { + hs->state = h5_state_data; + hs->token_start = hs->s + hs->pos; + hs->token_len = (size_t)(idx - hs->s) - hs->pos; + hs->pos = (size_t)(idx - hs->s) + 3; + hs->token_type = DATA_TEXT; + return 1; + } else { + pos = (size_t)(idx - hs->s) + 1; + } + } +} + +/** + * 8.2.4.52 + * http://www.w3.org/html/wg/drafts/html/master/syntax.html#doctype-state + */ +static int h5_state_doctype(h5_state_t* hs) +{ + const char* idx; + + TRACE(); + hs->token_start = hs->s + hs->pos; + hs->token_type = DOCTYPE; + + idx = (const char*) memchr(hs->s + hs->pos, CHAR_GT, hs->len - hs->pos); + if (idx == NULL) { + hs->state = h5_state_eof; + hs->token_len = hs->len - hs->pos; + } else { + hs->state = h5_state_data; + hs->token_len = (size_t)(idx - hs->s) - hs->pos; + hs->pos = (size_t)(idx - hs->s) + 1; + } + return 1; +} diff --git a/src/lib/third_party/src/libinjection_sqli.c b/src/lib/third_party/src/libinjection_sqli.c new file mode 100644 index 000000000..cecbbea3f --- /dev/null +++ b/src/lib/third_party/src/libinjection_sqli.c @@ -0,0 +1,2325 @@ +/** + * Copyright 2012,2016 Nick Galbreath + * nickg@client9.com + * BSD License -- see COPYING.txt for details + * + * https://libinjection.client9.com/ + * + */ + +#include <string.h> +#include <stdlib.h> +#include <stdio.h> +#include <ctype.h> +#include <assert.h> +#include <stddef.h> + +#include "libinjection.h" +#include "libinjection_sqli.h" +#include "libinjection_sqli_data.h" + +#define LIBINJECTION_VERSION "3.9.2" + +#define LIBINJECTION_SQLI_TOKEN_SIZE sizeof(((stoken_t*)(0))->val) +#define LIBINJECTION_SQLI_MAX_TOKENS 5 + +#ifndef TRUE +#define TRUE 1 +#endif +#ifndef FALSE +#define FALSE 0 +#endif + +#define CHAR_NULL '\0' +#define CHAR_SINGLE '\'' +#define CHAR_DOUBLE '"' +#define CHAR_TICK '`' + +/* faster than calling out to libc isdigit */ +#define ISDIGIT(a) ((unsigned)((a) - '0') <= 9) + +#if 0 +#define FOLD_DEBUG printf("%d \t more=%d pos=%d left=%d\n", __LINE__, more, (int)pos, (int)left); +#else +#define FOLD_DEBUG +#endif + +/* + * not making public just yet + */ +typedef enum { + TYPE_NONE = 0 + , TYPE_KEYWORD = (int)'k' + , TYPE_UNION = (int)'U' + , TYPE_GROUP = (int)'B' + , TYPE_EXPRESSION = (int)'E' + , TYPE_SQLTYPE = (int)'t' + , TYPE_FUNCTION = (int)'f' + , TYPE_BAREWORD = (int)'n' + , TYPE_NUMBER = (int)'1' + , TYPE_VARIABLE = (int)'v' + , TYPE_STRING = (int)'s' + , TYPE_OPERATOR = (int)'o' + , TYPE_LOGIC_OPERATOR = (int)'&' + , TYPE_COMMENT = (int)'c' + , TYPE_COLLATE = (int)'A' + , TYPE_LEFTPARENS = (int)'(' + , TYPE_RIGHTPARENS = (int)')' /* not used? */ + , TYPE_LEFTBRACE = (int)'{' + , TYPE_RIGHTBRACE = (int)'}' + , TYPE_DOT = (int)'.' + , TYPE_COMMA = (int)',' + , TYPE_COLON = (int)':' + , TYPE_SEMICOLON = (int)';' + , TYPE_TSQL = (int)'T' /* TSQL start */ + , TYPE_UNKNOWN = (int)'?' + , TYPE_EVIL = (int)'X' /* unparsable, abort */ + , TYPE_FINGERPRINT = (int)'F' /* not really a token */ + , TYPE_BACKSLASH = (int)'\\' +} sqli_token_types; + +/** + * Initializes parsing state + * + */ +static char flag2delim(int flag) +{ + if (flag & FLAG_QUOTE_SINGLE) { + return CHAR_SINGLE; + } else if (flag & FLAG_QUOTE_DOUBLE) { + return CHAR_DOUBLE; + } else { + return CHAR_NULL; + } +} + +/* memchr2 finds a string of 2 characters inside another string + * This a specialized version of "memmem" or "memchr". + * 'memmem' doesn't exist on all platforms + * + * Porting notes: this is just a special version of + * astring.find("AB") + * + */ +static const char * +memchr2(const char *haystack, size_t haystack_len, char c0, char c1) +{ + const char *cur = haystack; + const char *last = haystack + haystack_len - 1; + + if (haystack_len < 2) { + return NULL; + } + + while (cur < last) { + /* safe since cur < len - 1 always */ + if (cur[0] == c0 && cur[1] == c1) { + return cur; + } + cur += 1; + } + + return NULL; +} + +/** + * memmem might not exist on some systems + */ +static const char * +my_memmem(const char* haystack, size_t hlen, const char* needle, size_t nlen) +{ + const char* cur; + const char* last; + assert(haystack); + assert(needle); + assert(nlen > 1); + last = haystack + hlen - nlen; + for (cur = haystack; cur <= last; ++cur) { + if (cur[0] == needle[0] && memcmp(cur, needle, nlen) == 0) { + return cur; + } + } + return NULL; +} + +/** Find largest string containing certain characters. + * + * C Standard library 'strspn' only works for 'c-strings' (null terminated) + * This works on arbitrary length. + * + * Performance notes: + * not critical + * + * Porting notes: + * if accept is 'ABC', then this function would be similar to + * a_regexp.match(a_str, '[ABC]*'), + */ +static size_t +strlenspn(const char *s, size_t len, const char *accept) +{ + size_t i; + for (i = 0; i < len; ++i) { + /* likely we can do better by inlining this function + * but this works for now + */ + if (strchr(accept, s[i]) == NULL) { + return i; + } + } + return len; +} + +static size_t +strlencspn(const char *s, size_t len, const char *accept) +{ + size_t i; + for (i = 0; i < len; ++i) { + /* likely we can do better by inlining this function + * but this works for now + */ + if (strchr(accept, s[i]) != NULL) { + return i; + } + } + return len; +} +static int char_is_white(char ch) { + /* ' ' space is 0x32 + '\t 0x09 \011 horizontal tab + '\n' 0x0a \012 new line + '\v' 0x0b \013 vertical tab + '\f' 0x0c \014 new page + '\r' 0x0d \015 carriage return + 0x00 \000 null (oracle) + 0xa0 \240 is Latin-1 + */ + return strchr(" \t\n\v\f\r\240\000", ch) != NULL; +} + +/* DANGER DANGER + * This is -very specialized function- + * + * this compares a ALL_UPPER CASE C STRING + * with a *arbitrary memory* + length + * + * Sane people would just make a copy, up-case + * and use a hash table. + * + * Required since libc version uses the current locale + * and is much slower. + */ +static int cstrcasecmp(const char *a, const char *b, size_t n) +{ + char cb; + + for (; n > 0; a++, b++, n--) { + cb = *b; + if (cb >= 'a' && cb <= 'z') { + cb -= 0x20; + } + if (*a != cb) { + return *a - cb; + } else if (*a == '\0') { + return -1; + } + } + + return (*a == 0) ? 0 : 1; +} + +/** + * Case sensitive string compare. + * Here only to make code more readable + */ +static int streq(const char *a, const char *b) +{ + return strcmp(a, b) == 0; +} + +/** + * + * + * + * Porting Notes: + * given a mapping/hash of string to char + * this is just + * typecode = mapping[key.upper()] + */ + +static char bsearch_keyword_type(const char *key, size_t len, + const keyword_t * keywords, size_t numb) +{ + size_t pos; + size_t left = 0; + size_t right = numb - 1; + + while (left < right) { + pos = (left + right) >> 1; + + /* arg0 = upper case only, arg1 = mixed case */ + if (cstrcasecmp(keywords[pos].word, key, len) < 0) { + left = pos + 1; + } else { + right = pos; + } + } + if ((left == right) && cstrcasecmp(keywords[left].word, key, len) == 0) { + return keywords[left].type; + } else { + return CHAR_NULL; + } +} + +static char is_keyword(const char* key, size_t len) +{ + return bsearch_keyword_type(key, len, sql_keywords, sql_keywords_sz); +} + +/* st_token methods + * + * The following functions manipulates the stoken_t type + * + * + */ + +static void st_clear(stoken_t * st) +{ + memset(st, 0, sizeof(stoken_t)); +} + +static void st_assign_char(stoken_t * st, const char stype, size_t pos, size_t len, + const char value) +{ + /* done to eliminate unused warning */ + (void)len; + st->type = (char) stype; + st->pos = pos; + st->len = 1; + st->val[0] = value; + st->val[1] = CHAR_NULL; +} + +static void st_assign(stoken_t * st, const char stype, + size_t pos, size_t len, const char* value) +{ + const size_t MSIZE = LIBINJECTION_SQLI_TOKEN_SIZE; + size_t last = len < MSIZE ? len : (MSIZE - 1); + st->type = (char) stype; + st->pos = pos; + st->len = last; + memcpy(st->val, value, last); + st->val[last] = CHAR_NULL; +} + +static void st_copy(stoken_t * dest, const stoken_t * src) +{ + memcpy(dest, src, sizeof(stoken_t)); +} + +static int st_is_arithmetic_op(const stoken_t* st) +{ + const char ch = st->val[0]; + return (st->type == TYPE_OPERATOR && st->len == 1 && + (ch == '*' || ch == '/' || ch == '-' || ch == '+' || ch == '%')); +} + +static int st_is_unary_op(const stoken_t * st) +{ + const char* str = st->val; + const size_t len = st->len; + + if (st->type != TYPE_OPERATOR) { + return FALSE; + } + + switch (len) { + case 1: + return *str == '+' || *str == '-' || *str == '!' || *str == '~'; + case 2: + return str[0] == '!' && str[1] == '!'; + case 3: + return cstrcasecmp("NOT", str, 3) == 0; + default: + return FALSE; + } +} + +/* Parsers + * + * + */ + +static size_t parse_white(struct libinjection_sqli_state * sf) +{ + return sf->pos + 1; +} + +static size_t parse_operator1(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + size_t pos = sf->pos; + + st_assign_char(sf->current, TYPE_OPERATOR, pos, 1, cs[pos]); + return pos + 1; +} + +static size_t parse_other(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + size_t pos = sf->pos; + + st_assign_char(sf->current, TYPE_UNKNOWN, pos, 1, cs[pos]); + return pos + 1; +} + +static size_t parse_char(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + size_t pos = sf->pos; + + st_assign_char(sf->current, cs[pos], pos, 1, cs[pos]); + return pos + 1; +} + +static size_t parse_eol_comment(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + + const char *endpos = + (const char *) memchr((const void *) (cs + pos), '\n', slen - pos); + if (endpos == NULL) { + st_assign(sf->current, TYPE_COMMENT, pos, slen - pos, cs + pos); + return slen; + } else { + st_assign(sf->current, TYPE_COMMENT, pos, (size_t)(endpos - cs) - pos, cs + pos); + return (size_t)((endpos - cs) + 1); + } +} + +/** In ANSI mode, hash is an operator + * In MYSQL mode, it's a EOL comment like '--' + */ +static size_t parse_hash(struct libinjection_sqli_state * sf) +{ + sf->stats_comment_hash += 1; + if (sf->flags & FLAG_SQL_MYSQL) { + sf->stats_comment_hash += 1; + return parse_eol_comment(sf); + } else { + st_assign_char(sf->current, TYPE_OPERATOR, sf->pos, 1, '#'); + return sf->pos + 1; + } +} + +static size_t parse_dash(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + + /* + * five cases + * 1) --[white] this is always a SQL comment + * 2) --[EOF] this is a comment + * 3) --[notwhite] in MySQL this is NOT a comment but two unary operators + * 4) --[notwhite] everyone else thinks this is a comment + * 5) -[not dash] '-' is a unary operator + */ + + if (pos + 2 < slen && cs[pos + 1] == '-' && char_is_white(cs[pos+2]) ) { + return parse_eol_comment(sf); + } else if (pos +2 == slen && cs[pos + 1] == '-') { + return parse_eol_comment(sf); + } else if (pos + 1 < slen && cs[pos + 1] == '-' && (sf->flags & FLAG_SQL_ANSI)) { + /* --[not-white] not-white case: + * + */ + sf->stats_comment_ddx += 1; + return parse_eol_comment(sf); + } else { + st_assign_char(sf->current, TYPE_OPERATOR, pos, 1, '-'); + return pos + 1; + } +} + + +/** This detects MySQL comments, comments that + * start with /x! We just ban these now but + * previously we attempted to parse the inside + * + * For reference: + * the form of /x![anything]x/ or /x!12345[anything] x/ + * + * Mysql 3 (maybe 4), allowed this: + * /x!0selectx/ 1; + * where 0 could be any number. + * + * The last version of MySQL 3 was in 2003. + + * It is unclear if the MySQL 3 syntax was allowed + * in MySQL 4. The last version of MySQL 4 was in 2008 + * + */ +static size_t is_mysql_comment(const char *cs, const size_t len, size_t pos) +{ + /* so far... + * cs[pos] == '/' && cs[pos+1] == '*' + */ + + if (pos + 2 >= len) { + /* not a mysql comment */ + return 0; + } + + if (cs[pos + 2] != '!') { + /* not a mysql comment */ + return 0; + } + + /* + * this is a mysql comment + * got "/x!" + */ + return 1; +} + +static size_t parse_slash(struct libinjection_sqli_state * sf) +{ + const char* ptr; + size_t clen; + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + const char* cur = cs + pos; + char ctype = TYPE_COMMENT; + size_t pos1 = pos + 1; + if (pos1 == slen || cs[pos1] != '*') { + return parse_operator1(sf); + } + + /* + * skip over initial '/x' + */ + ptr = memchr2(cur + 2, slen - (pos + 2), '*', '/'); + + /* + * (ptr == NULL) causes false positive in cppcheck 1.61 + * casting to type seems to fix it + */ + if (ptr == (const char*) NULL) { + /* till end of line */ + clen = slen - pos; + } else { + clen = (size_t)(ptr + 2 - cur); + } + + /* + * postgresql allows nested comments which makes + * this is incompatible with parsing so + * if we find a '/x' inside the coment, then + * make a new token. + * + * Also, Mysql's "conditional" comments for version + * are an automatic black ban! + */ + + if (memchr2(cur + 2, (size_t)(ptr - (cur + 1)), '/', '*') != NULL) { + ctype = TYPE_EVIL; + } else if (is_mysql_comment(cs, slen, pos)) { + ctype = TYPE_EVIL; + } + + st_assign(sf->current, ctype, pos, clen, cs + pos); + return pos + clen; +} + + +static size_t parse_backslash(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + + /* + * Weird MySQL alias for NULL, "\N" (capital N only) + */ + if (pos + 1 < slen && cs[pos +1] == 'N') { + st_assign(sf->current, TYPE_NUMBER, pos, 2, cs + pos); + return pos + 2; + } else { + st_assign_char(sf->current, TYPE_BACKSLASH, pos, 1, cs[pos]); + return pos + 1; + } +} + +static size_t parse_operator2(struct libinjection_sqli_state * sf) +{ + char ch; + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + + if (pos + 1 >= slen) { + return parse_operator1(sf); + } + + if (pos + 2 < slen && + cs[pos] == '<' && + cs[pos + 1] == '=' && + cs[pos + 2] == '>') { + /* + * special 3-char operator + */ + st_assign(sf->current, TYPE_OPERATOR, pos, 3, cs + pos); + return pos + 3; + } + + ch = sf->lookup(sf, LOOKUP_OPERATOR, cs + pos, 2); + if (ch != CHAR_NULL) { + st_assign(sf->current, ch, pos, 2, cs+pos); + return pos + 2; + } + + /* + * not an operator.. what to do with the two + * characters we got? + */ + + if (cs[pos] == ':') { + /* ':' is not an operator */ + st_assign(sf->current, TYPE_COLON, pos, 1, cs+pos); + return pos + 1; + } else { + /* + * must be a single char operator + */ + return parse_operator1(sf); + } +} + +/* + * Ok! " \" " one backslash = escaped! + * " \\" " two backslash = not escaped! + * "\\\" " three backslash = escaped! + */ +static int is_backslash_escaped(const char* end, const char* start) +{ + const char* ptr; + for (ptr = end; ptr >= start; ptr--) { + if (*ptr != '\\') { + break; + } + } + /* if number of backslashes is odd, it is escaped */ + + return (end - ptr) & 1; +} + +static size_t is_double_delim_escaped(const char* cur, const char* end) +{ + return ((cur + 1) < end) && *(cur+1) == *cur; +} + +/* Look forward for doubling of delimiter + * + * case 'foo''bar' --> foo''bar + * + * ending quote isn't duplicated (i.e. escaped) + * since it's the wrong char or EOL + * + */ +static size_t parse_string_core(const char *cs, const size_t len, size_t pos, + stoken_t * st, char delim, size_t offset) +{ + /* + * offset is to skip the perhaps first quote char + */ + const char *qpos = + (const char *) memchr((const void *) (cs + pos + offset), delim, + len - pos - offset); + + /* + * then keep string open/close info + */ + if (offset > 0) { + /* + * this is real quote + */ + st->str_open = delim; + } else { + /* + * this was a simulated quote + */ + st->str_open = CHAR_NULL; + } + + while (TRUE) { + if (qpos == NULL) { + /* + * string ended with no trailing quote + * assign what we have + */ + st_assign(st, TYPE_STRING, pos + offset, len - pos - offset, cs + pos + offset); + st->str_close = CHAR_NULL; + return len; + } else if ( is_backslash_escaped(qpos - 1, cs + pos + offset)) { + /* keep going, move ahead one character */ + qpos = + (const char *) memchr((const void *) (qpos + 1), delim, + (size_t)((cs + len) - (qpos + 1))); + continue; + } else if (is_double_delim_escaped(qpos, cs + len)) { + /* keep going, move ahead two characters */ + qpos = + (const char *) memchr((const void *) (qpos + 2), delim, + (size_t)((cs + len) - (qpos + 2))); + continue; + } else { + /* hey it's a normal string */ + st_assign(st, TYPE_STRING, pos + offset, + (size_t)(qpos - (cs + pos + offset)), cs + pos + offset); + st->str_close = delim; + return (size_t)(qpos - cs + 1); + } + } +} + +/** + * Used when first char is a ' or " + */ +static size_t parse_string(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + + /* + * assert cs[pos] == single or double quote + */ + return parse_string_core(cs, slen, pos, sf->current, cs[pos], 1); +} + +/** + * Used when first char is: + * N or n: mysql "National Character set" + * E : psql "Escaped String" + */ +static size_t parse_estring(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + + if (pos + 2 >= slen || cs[pos+1] != CHAR_SINGLE) { + return parse_word(sf); + } + return parse_string_core(cs, slen, pos, sf->current, CHAR_SINGLE, 2); +} + +static size_t parse_ustring(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + size_t slen = sf->slen; + size_t pos = sf->pos; + + if (pos + 2 < slen && cs[pos+1] == '&' && cs[pos+2] == '\'') { + sf->pos += 2; + pos = parse_string(sf); + sf->current->str_open = 'u'; + if (sf->current->str_close == '\'') { + sf->current->str_close = 'u'; + } + return pos; + } else { + return parse_word(sf); + } +} + +static size_t parse_qstring_core(struct libinjection_sqli_state * sf, size_t offset) +{ + char ch; + const char *strend; + const char *cs = sf->s; + size_t slen = sf->slen; + size_t pos = sf->pos + offset; + + /* if we are already at end of string.. + if current char is not q or Q + if we don't have 2 more chars + if char2 != a single quote + then, just treat as word + */ + if (pos >= slen || + (cs[pos] != 'q' && cs[pos] != 'Q') || + pos + 2 >= slen || + cs[pos + 1] != '\'') { + return parse_word(sf); + } + + ch = cs[pos + 2]; + + /* the ch > 127 is un-needed since + * we assume char is signed + */ + if (ch < 33 /* || ch > 127 */) { + return parse_word(sf); + } + switch (ch) { + case '(' : ch = ')'; break; + case '[' : ch = ']'; break; + case '{' : ch = '}'; break; + case '<' : ch = '>'; break; + } + + strend = memchr2(cs + pos + 3, slen - pos - 3, ch, '\''); + if (strend == NULL) { + st_assign(sf->current, TYPE_STRING, pos + 3, slen - pos - 3, cs + pos + 3); + sf->current->str_open = 'q'; + sf->current->str_close = CHAR_NULL; + return slen; + } else { + st_assign(sf->current, TYPE_STRING, pos + 3, (size_t)(strend - cs) - pos - 3, cs + pos + 3); + sf->current->str_open = 'q'; + sf->current->str_close = 'q'; + return (size_t)(strend - cs + 2); + } +} + +/* + * Oracle's q string + */ +static size_t parse_qstring(struct libinjection_sqli_state * sf) +{ + return parse_qstring_core(sf, 0); +} + +/* + * mysql's N'STRING' or + * ... Oracle's nq string + */ +static size_t parse_nqstring(struct libinjection_sqli_state * sf) +{ + size_t slen = sf->slen; + size_t pos = sf->pos; + if (pos + 2 < slen && sf->s[pos+1] == CHAR_SINGLE) { + return parse_estring(sf); + } + return parse_qstring_core(sf, 1); +} + +/* + * binary literal string + * re: [bB]'[01]*' + */ +static size_t parse_bstring(struct libinjection_sqli_state *sf) +{ + size_t wlen; + const char *cs = sf->s; + size_t pos = sf->pos; + size_t slen = sf->slen; + + /* need at least 2 more characters + * if next char isn't a single quote, then + * continue as normal word + */ + if (pos + 2 >= slen || cs[pos+1] != '\'') { + return parse_word(sf); + } + + wlen = strlenspn(cs + pos + 2, sf->slen - pos - 2, "01"); + if (pos + 2 + wlen >= slen || cs[pos + 2 + wlen] != '\'') { + return parse_word(sf); + } + st_assign(sf->current, TYPE_NUMBER, pos, wlen + 3, cs + pos); + return pos + 2 + wlen + 1; +} + +/* + * hex literal string + * re: [xX]'[0123456789abcdefABCDEF]*' + * mysql has requirement of having EVEN number of chars, + * but pgsql does not + */ +static size_t parse_xstring(struct libinjection_sqli_state *sf) +{ + size_t wlen; + const char *cs = sf->s; + size_t pos = sf->pos; + size_t slen = sf->slen; + + /* need at least 2 more characters + * if next char isn't a single quote, then + * continue as normal word + */ + if (pos + 2 >= slen || cs[pos+1] != '\'') { + return parse_word(sf); + } + + wlen = strlenspn(cs + pos + 2, sf->slen - pos - 2, "0123456789ABCDEFabcdef"); + if (pos + 2 + wlen >= slen || cs[pos + 2 + wlen] != '\'') { + return parse_word(sf); + } + st_assign(sf->current, TYPE_NUMBER, pos, wlen + 3, cs + pos); + return pos + 2 + wlen + 1; +} + +/** + * This handles MS SQLSERVER bracket words + * http://stackoverflow.com/questions/3551284/sql-serverwhat-do-brackets-mean-around-column-name + * + */ +static size_t parse_bword(struct libinjection_sqli_state * sf) +{ + const char *cs = sf->s; + size_t pos = sf->pos; + const char* endptr = (const char*) memchr(cs + pos, ']', sf->slen - pos); + if (endptr == NULL) { + st_assign(sf->current, TYPE_BAREWORD, pos, sf->slen - pos, cs + pos); + return sf->slen; + } else { + st_assign(sf->current, TYPE_BAREWORD, pos, (size_t)(endptr - cs) - pos + 1, cs + pos); + return (size_t)((endptr - cs) + 1); + } +} + +static size_t parse_word(struct libinjection_sqli_state * sf) +{ + char ch; + char delim; + size_t i; + const char *cs = sf->s; + size_t pos = sf->pos; + size_t wlen = strlencspn(cs + pos, sf->slen - pos, + " []{}<>:\\?=@!#~+-*/&|^%(),';\t\n\v\f\r\"\240\000"); + + st_assign(sf->current, TYPE_BAREWORD, pos, wlen, cs + pos); + + /* now we need to look inside what we good for "." and "`" + * and see if what is before is a keyword or not + */ + for (i =0; i < sf->current->len; ++i) { + delim = sf->current->val[i]; + if (delim == '.' || delim == '`') { + ch = sf->lookup(sf, LOOKUP_WORD, sf->current->val, i); + if (ch != TYPE_NONE && ch != TYPE_BAREWORD) { + /* needed for swig */ + st_clear(sf->current); + /* + * we got something like "SELECT.1" + * or SELECT`column` + */ + st_assign(sf->current, ch, pos, i, cs + pos); + return pos + i; + } + } + } + + /* + * do normal lookup with word including '.' + */ + if (wlen < LIBINJECTION_SQLI_TOKEN_SIZE) { + + ch = sf->lookup(sf, LOOKUP_WORD, sf->current->val, wlen); + if (ch == CHAR_NULL) { + ch = TYPE_BAREWORD; + } + sf->current->type = ch; + } + return pos + wlen; +} + +/* MySQL backticks are a cross between string and + * and a bare word. + * + */ +static size_t parse_tick(struct libinjection_sqli_state* sf) +{ + size_t pos = parse_string_core(sf->s, sf->slen, sf->pos, sf->current, CHAR_TICK, 1); + + /* we could check to see if start and end of + * of string are both "`", i.e. make sure we have + * matching set. `foo` vs. `foo + * but I don't think it matters much + */ + + /* check value of string to see if it's a keyword, + * function, operator, etc + */ + char ch = sf->lookup(sf, LOOKUP_WORD, sf->current->val, sf->current->len); + if (ch == TYPE_FUNCTION) { + /* if it's a function, then convert token */ + sf->current->type = TYPE_FUNCTION; + } else { + /* otherwise it's a 'n' type -- mysql treats + * everything as a bare word + */ + sf->current->type = TYPE_BAREWORD; + } + return pos; +} + +static size_t parse_var(struct libinjection_sqli_state * sf) +{ + size_t xlen; + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos + 1; + + /* + * var_count is only used to reconstruct + * the input. It counts the number of '@' + * seen 0 in the case of NULL, 1 or 2 + */ + + /* + * move past optional other '@' + */ + if (pos < slen && cs[pos] == '@') { + pos += 1; + sf->current->count = 2; + } else { + sf->current->count = 1; + } + + /* + * MySQL allows @@`version` + */ + if (pos < slen) { + if (cs[pos] == '`') { + sf->pos = pos; + pos = parse_tick(sf); + sf->current->type = TYPE_VARIABLE; + return pos; + } else if (cs[pos] == CHAR_SINGLE || cs[pos] == CHAR_DOUBLE) { + sf->pos = pos; + pos = parse_string(sf); + sf->current->type = TYPE_VARIABLE; + return pos; + } + } + + + xlen = strlencspn(cs + pos, slen - pos, + " <>:\\?=@!#~+-*/&|^%(),';\t\n\v\f\r'`\""); + if (xlen == 0) { + st_assign(sf->current, TYPE_VARIABLE, pos, 0, cs + pos); + return pos; + } else { + st_assign(sf->current, TYPE_VARIABLE, pos, xlen, cs + pos); + return pos + xlen; + } +} + +static size_t parse_money(struct libinjection_sqli_state *sf) +{ + size_t xlen; + const char* strend; + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + + if (pos + 1 == slen) { + /* end of line */ + st_assign_char(sf->current, TYPE_BAREWORD, pos, 1, '$'); + return slen; + } + + /* + * $1,000.00 or $1.000,00 ok! + * This also parses $....,,,111 but that's ok + */ + + xlen = strlenspn(cs + pos + 1, slen - pos - 1, "0123456789.,"); + if (xlen == 0) { + if (cs[pos + 1] == '$') { + /* we have $$ .. find ending $$ and make string */ + strend = memchr2(cs + pos + 2, slen - pos -2, '$', '$'); + if (strend == NULL) { + /* fell off edge */ + st_assign(sf->current, TYPE_STRING, pos + 2, slen - (pos + 2), cs + pos + 2); + sf->current->str_open = '$'; + sf->current->str_close = CHAR_NULL; + return slen; + } else { + st_assign(sf->current, TYPE_STRING, pos + 2, + (size_t)(strend - (cs + pos + 2)), cs + pos + 2); + sf->current->str_open = '$'; + sf->current->str_close = '$'; + return (size_t)(strend - cs + 2); + } + } else { + /* ok it's not a number or '$$', but maybe it's pgsql "$ quoted strings" */ + xlen = strlenspn(cs + pos + 1, slen - pos - 1, "abcdefghjiklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"); + if (xlen == 0) { + /* hmm it's "$" _something_ .. just add $ and keep going*/ + st_assign_char(sf->current, TYPE_BAREWORD, pos, 1, '$'); + return pos + 1; + } + /* we have $foobar????? */ + /* is it $foobar$ */ + if (pos + xlen + 1 == slen || cs[pos+xlen+1] != '$') { + /* not $foobar$, or fell off edge */ + st_assign_char(sf->current, TYPE_BAREWORD, pos, 1, '$'); + return pos + 1; + } + + /* we have $foobar$ ... find it again */ + strend = my_memmem(cs+xlen+2, slen - (pos+xlen+2), cs + pos, xlen+2); + + if (strend == NULL || ((size_t)(strend - cs) < (pos+xlen+2))) { + /* fell off edge */ + st_assign(sf->current, TYPE_STRING, pos+xlen+2, slen - pos - xlen - 2, cs+pos+xlen+2); + sf->current->str_open = '$'; + sf->current->str_close = CHAR_NULL; + return slen; + } else { + /* got one */ + st_assign(sf->current, TYPE_STRING, pos+xlen+2, + (size_t)(strend - (cs + pos + xlen + 2)), cs+pos+xlen+2); + sf->current->str_open = '$'; + sf->current->str_close = '$'; + return (size_t)((strend + xlen + 2) - cs); + } + } + } else if (xlen == 1 && cs[pos + 1] == '.') { + /* $. should parsed as a word */ + return parse_word(sf); + } else { + st_assign(sf->current, TYPE_NUMBER, pos, 1 + xlen, cs + pos); + return pos + 1 + xlen; + } +} + +static size_t parse_number(struct libinjection_sqli_state * sf) +{ + size_t xlen; + size_t start; + const char* digits = NULL; + const char *cs = sf->s; + const size_t slen = sf->slen; + size_t pos = sf->pos; + int have_e = 0; + int have_exp = 0; + + /* cs[pos] == '0' has 1/10 chance of being true, + * while pos+1< slen is almost always true + */ + if (cs[pos] == '0' && pos + 1 < slen) { + if (cs[pos + 1] == 'X' || cs[pos + 1] == 'x') { + digits = "0123456789ABCDEFabcdef"; + } else if (cs[pos + 1] == 'B' || cs[pos + 1] == 'b') { + digits = "01"; + } + + if (digits) { + xlen = strlenspn(cs + pos + 2, slen - pos - 2, digits); + if (xlen == 0) { + st_assign(sf->current, TYPE_BAREWORD, pos, 2, cs + pos); + return pos + 2; + } else { + st_assign(sf->current, TYPE_NUMBER, pos, 2 + xlen, cs + pos); + return pos + 2 + xlen; + } + } + } + + start = pos; + while (pos < slen && ISDIGIT(cs[pos])) { + pos += 1; + } + + if (pos < slen && cs[pos] == '.') { + pos += 1; + while (pos < slen && ISDIGIT(cs[pos])) { + pos += 1; + } + if (pos - start == 1) { + /* only one character read so far */ + st_assign_char(sf->current, TYPE_DOT, start, 1, '.'); + return pos; + } + } + + if (pos < slen) { + if (cs[pos] == 'E' || cs[pos] == 'e') { + have_e = 1; + pos += 1; + if (pos < slen && (cs[pos] == '+' || cs[pos] == '-')) { + pos += 1; + } + while (pos < slen && ISDIGIT(cs[pos])) { + have_exp = 1; + pos += 1; + } + } + } + + /* oracle's ending float or double suffix + * http://docs.oracle.com/cd/B19306_01/server.102/b14200/sql_elements003.htm#i139891 + */ + if (pos < slen && (cs[pos] == 'd' || cs[pos] == 'D' || cs[pos] == 'f' || cs[pos] == 'F')) { + if (pos + 1 == slen) { + /* line ends evaluate "... 1.2f$" as '1.2f' */ + pos += 1; + } else if ((char_is_white(cs[pos+1]) || cs[pos+1] == ';')) { + /* + * easy case, evaluate "... 1.2f ... as '1.2f' + */ + pos += 1; + } else if (cs[pos+1] == 'u' || cs[pos+1] == 'U') { + /* + * a bit of a hack but makes '1fUNION' parse as '1f UNION' + */ + pos += 1; + } else { + /* it's like "123FROM" */ + /* parse as "123" only */ + } + } + + if (have_e == 1 && have_exp == 0) { + /* very special form of + * "1234.e" + * "10.10E" + * ".E" + * this is a WORD not a number!! */ + st_assign(sf->current, TYPE_BAREWORD, start, pos - start, cs + start); + } else { + st_assign(sf->current, TYPE_NUMBER, start, pos - start, cs + start); + } + return pos; +} + +/* + * API to return version. This allows us to increment the version + * without having to regenerated the SWIG (or other binding) in minor + * releases. + */ +const char* libinjection_version() +{ + return LIBINJECTION_VERSION; +} + +int libinjection_sqli_tokenize(struct libinjection_sqli_state * sf) +{ + pt2Function fnptr; + size_t *pos = &sf->pos; + stoken_t *current = sf->current; + const char *s = sf->s; + const size_t slen = sf->slen; + + if (slen == 0) { + return FALSE; + } + + st_clear(current); + sf->current = current; + + /* + * if we are at beginning of string + * and in single-quote or double quote mode + * then pretend the input starts with a quote + */ + if (*pos == 0 && (sf->flags & (FLAG_QUOTE_SINGLE | FLAG_QUOTE_DOUBLE))) { + *pos = parse_string_core(s, slen, 0, current, flag2delim(sf->flags), 0); + sf->stats_tokens += 1; + return TRUE; + } + + while (*pos < slen) { + + /* + * get current character + */ + const unsigned char ch = (unsigned char) (s[*pos]); + + /* + * look up the parser, and call it + * + * Porting Note: this is mapping of char to function + * charparsers[ch]() + */ + fnptr = char_parse_map[ch]; + + *pos = (*fnptr) (sf); + + /* + * + */ + if (current->type != CHAR_NULL) { + sf->stats_tokens += 1; + return TRUE; + } + } + return FALSE; +} + +void libinjection_sqli_init(struct libinjection_sqli_state * sf, const char *s, size_t len, int flags) +{ + if (flags == 0) { + flags = FLAG_QUOTE_NONE | FLAG_SQL_ANSI; + } + + memset(sf, 0, sizeof(struct libinjection_sqli_state)); + sf->s = s; + sf->slen = len; + sf->lookup = libinjection_sqli_lookup_word; + sf->userdata = 0; + sf->flags = flags; + sf->current = &(sf->tokenvec[0]); +} + +void libinjection_sqli_reset(struct libinjection_sqli_state * sf, int flags) +{ + void *userdata = sf->userdata; + ptr_lookup_fn lookup = sf->lookup;; + + if (flags == 0) { + flags = FLAG_QUOTE_NONE | FLAG_SQL_ANSI; + } + libinjection_sqli_init(sf, sf->s, sf->slen, flags); + sf->lookup = lookup; + sf->userdata = userdata; +} + +void libinjection_sqli_callback(struct libinjection_sqli_state * sf, ptr_lookup_fn fn, void* userdata) +{ + if (fn == NULL) { + sf->lookup = libinjection_sqli_lookup_word; + sf->userdata = (void*)(NULL); + } else { + sf->lookup = fn; + sf->userdata = userdata; + } +} + +/** See if two tokens can be merged since they are compound SQL phrases. + * + * This takes two tokens, and, if they are the right type, + * merges their values together. Then checks to see if the + * new value is special using the PHRASES mapping. + * + * Example: "UNION" + "ALL" ==> "UNION ALL" + * + * C Security Notes: this is safe to use C-strings (null-terminated) + * since the types involved by definition do not have embedded nulls + * (e.g. there is no keyword with embedded null) + * + * Porting Notes: since this is C, it's oddly complicated. + * This is just: multikeywords[token.value + ' ' + token2.value] + * + */ +static int syntax_merge_words(struct libinjection_sqli_state * sf,stoken_t * a, stoken_t * b) +{ + size_t sz1; + size_t sz2; + size_t sz3; + char tmp[LIBINJECTION_SQLI_TOKEN_SIZE]; + char ch; + + /* first token is of right type? */ + if (! + (a->type == TYPE_KEYWORD || + a->type == TYPE_BAREWORD || + a->type == TYPE_OPERATOR || + a->type == TYPE_UNION || + a->type == TYPE_FUNCTION || + a->type == TYPE_EXPRESSION || + a->type == TYPE_TSQL || + a->type == TYPE_SQLTYPE)) { + return FALSE; + } + + if (! + (b->type == TYPE_KEYWORD || + b->type == TYPE_BAREWORD || + b->type == TYPE_OPERATOR || + b->type == TYPE_UNION || + b->type == TYPE_FUNCTION || + b->type == TYPE_EXPRESSION || + b->type == TYPE_TSQL || + b->type == TYPE_SQLTYPE || + b->type == TYPE_LOGIC_OPERATOR)) { + return FALSE; + } + + sz1 = a->len; + sz2 = b->len; + sz3 = sz1 + sz2 + 1; /* +1 for space in the middle */ + if (sz3 >= LIBINJECTION_SQLI_TOKEN_SIZE) { /* make sure there is room for ending null */ + return FALSE; + } + /* + * oddly annoying last.val + ' ' + current.val + */ + memcpy(tmp, a->val, sz1); + tmp[sz1] = ' '; + memcpy(tmp + sz1 + 1, b->val, sz2); + tmp[sz3] = CHAR_NULL; + ch = sf->lookup(sf, LOOKUP_WORD, tmp, sz3); + + if (ch != CHAR_NULL) { + st_assign(a, ch, a->pos, sz3, tmp); + return TRUE; + } else { + return FALSE; + } +} + +int libinjection_sqli_fold(struct libinjection_sqli_state * sf) +{ + stoken_t last_comment; + + /* POS is the position of where the NEXT token goes */ + size_t pos = 0; + + /* LEFT is a count of how many tokens that are already + folded or processed (i.e. part of the fingerprint) */ + size_t left = 0; + + int more = 1; + + st_clear(&last_comment); + + /* Skip all initial comments, right-parens ( and unary operators + * + */ + sf->current = &(sf->tokenvec[0]); + while (more) { + more = libinjection_sqli_tokenize(sf); + if ( ! (sf->current->type == TYPE_COMMENT || + sf->current->type == TYPE_LEFTPARENS || + sf->current->type == TYPE_SQLTYPE || + st_is_unary_op(sf->current))) { + break; + } + } + + if (! more) { + /* If input was only comments, unary or (, then exit */ + return 0; + } else { + /* it's some other token */ + pos += 1; + } + + while (1) { + FOLD_DEBUG; + + /* do we have all the max number of tokens? if so do + * some special cases for 5 tokens + */ + if (pos >= LIBINJECTION_SQLI_MAX_TOKENS) { + if ( + ( + sf->tokenvec[0].type == TYPE_NUMBER && + (sf->tokenvec[1].type == TYPE_OPERATOR || sf->tokenvec[1].type == TYPE_COMMA) && + sf->tokenvec[2].type == TYPE_LEFTPARENS && + sf->tokenvec[3].type == TYPE_NUMBER && + sf->tokenvec[4].type == TYPE_RIGHTPARENS + ) || + ( + sf->tokenvec[0].type == TYPE_BAREWORD && + sf->tokenvec[1].type == TYPE_OPERATOR && + sf->tokenvec[2].type == TYPE_LEFTPARENS && + (sf->tokenvec[3].type == TYPE_BAREWORD || sf->tokenvec[3].type == TYPE_NUMBER) && + sf->tokenvec[4].type == TYPE_RIGHTPARENS + ) || + ( + sf->tokenvec[0].type == TYPE_NUMBER && + sf->tokenvec[1].type == TYPE_RIGHTPARENS && + sf->tokenvec[2].type == TYPE_COMMA && + sf->tokenvec[3].type == TYPE_LEFTPARENS && + sf->tokenvec[4].type == TYPE_NUMBER + ) || + ( + sf->tokenvec[0].type == TYPE_BAREWORD && + sf->tokenvec[1].type == TYPE_RIGHTPARENS && + sf->tokenvec[2].type == TYPE_OPERATOR && + sf->tokenvec[3].type == TYPE_LEFTPARENS && + sf->tokenvec[4].type == TYPE_BAREWORD + ) + ) + { + if (pos > LIBINJECTION_SQLI_MAX_TOKENS) { + st_copy(&(sf->tokenvec[1]), &(sf->tokenvec[LIBINJECTION_SQLI_MAX_TOKENS])); + pos = 2; + left = 0; + } else { + pos = 1; + left = 0; + } + } + } + + if (! more || left >= LIBINJECTION_SQLI_MAX_TOKENS) { + left = pos; + break; + } + + /* get up to two tokens */ + while (more && pos <= LIBINJECTION_SQLI_MAX_TOKENS && (pos - left) < 2) { + sf->current = &(sf->tokenvec[pos]); + more = libinjection_sqli_tokenize(sf); + if (more) { + if (sf->current->type == TYPE_COMMENT) { + st_copy(&last_comment, sf->current); + } else { + last_comment.type = CHAR_NULL; + pos += 1; + } + } + } + FOLD_DEBUG; + /* did we get 2 tokens? if not then we are done */ + if (pos - left < 2) { + left = pos; + continue; + } + + /* FOLD: "ss" -> "s" + * "foo" "bar" is valid SQL + * just ignore second string + */ + if (sf->tokenvec[left].type == TYPE_STRING && sf->tokenvec[left+1].type == TYPE_STRING) { + pos -= 1; + sf->stats_folds += 1; + continue; + } else if (sf->tokenvec[left].type == TYPE_SEMICOLON && sf->tokenvec[left+1].type == TYPE_SEMICOLON) { + /* not sure how various engines handle + * 'select 1;;drop table foo' or + * 'select 1; /x foo x/; drop table foo' + * to prevent surprises, just fold away repeated semicolons + */ + pos -= 1; + sf->stats_folds += 1; + continue; + } else if ((sf->tokenvec[left].type == TYPE_OPERATOR || + sf->tokenvec[left].type == TYPE_LOGIC_OPERATOR) && + (st_is_unary_op(&sf->tokenvec[left+1]) || + sf->tokenvec[left+1].type == TYPE_SQLTYPE)) { + pos -= 1; + sf->stats_folds += 1; + left = 0; + continue; + } else if (sf->tokenvec[left].type == TYPE_LEFTPARENS && + st_is_unary_op(&sf->tokenvec[left+1])) { + pos -= 1; + sf->stats_folds += 1; + if (left > 0) { + left -= 1; + } + continue; + } else if (syntax_merge_words(sf, &sf->tokenvec[left], &sf->tokenvec[left+1])) { + pos -= 1; + sf->stats_folds += 1; + if (left > 0) { + left -= 1; + } + continue; + } else if (sf->tokenvec[left].type == TYPE_SEMICOLON && + sf->tokenvec[left+1].type == TYPE_FUNCTION && + (sf->tokenvec[left+1].val[0] == 'I' || + sf->tokenvec[left+1].val[0] == 'i' ) && + (sf->tokenvec[left+1].val[1] == 'F' || + sf->tokenvec[left+1].val[1] == 'f' )) { + /* IF is normally a function, except in Transact-SQL where it can be used as a + * standalone control flow operator, e.g. ; IF 1=1 ... + * if found after a semicolon, convert from 'f' type to 'T' type + */ + sf->tokenvec[left+1].type = TYPE_TSQL; + /* left += 2; */ + continue; /* reparse everything, but we probably can advance left, and pos */ + } else if ((sf->tokenvec[left].type == TYPE_BAREWORD || sf->tokenvec[left].type == TYPE_VARIABLE) && + sf->tokenvec[left+1].type == TYPE_LEFTPARENS && ( + /* TSQL functions but common enough to be column names */ + cstrcasecmp("USER_ID", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("USER_NAME", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + + /* Function in MYSQL */ + cstrcasecmp("DATABASE", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("PASSWORD", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("USER", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + + /* Mysql words that act as a variable and are a function */ + + /* TSQL current_users is fake-variable */ + /* http://msdn.microsoft.com/en-us/library/ms176050.aspx */ + cstrcasecmp("CURRENT_USER", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("CURRENT_DATE", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("CURRENT_TIME", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("CURRENT_TIMESTAMP", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("LOCALTIME", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("LOCALTIMESTAMP", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 + )) { + + /* pos is the same + * other conversions need to go here... for instance + * password CAN be a function, coalesce CAN be a function + */ + sf->tokenvec[left].type = TYPE_FUNCTION; + continue; + } else if (sf->tokenvec[left].type == TYPE_KEYWORD && ( + cstrcasecmp("IN", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("NOT IN", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 + )) { + + if (sf->tokenvec[left+1].type == TYPE_LEFTPARENS) { + /* got .... IN ( ... (or 'NOT IN') + * it's an operator + */ + sf->tokenvec[left].type = TYPE_OPERATOR; + } else { + /* + * it's a nothing + */ + sf->tokenvec[left].type = TYPE_BAREWORD; + } + + /* "IN" can be used as "IN BOOLEAN MODE" for mysql + * in which case merging of words can be done later + * other wise it acts as an equality operator __ IN (values..) + * + * here we got "IN" "(" so it's an operator. + * also back track to handle "NOT IN" + * might need to do the same with like + * two use cases "foo" LIKE "BAR" (normal operator) + * "foo" = LIKE(1,2) + */ + continue; + } else if ((sf->tokenvec[left].type == TYPE_OPERATOR) && ( + cstrcasecmp("LIKE", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0 || + cstrcasecmp("NOT LIKE", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0)) { + if (sf->tokenvec[left+1].type == TYPE_LEFTPARENS) { + /* SELECT LIKE(... + * it's a function + */ + sf->tokenvec[left].type = TYPE_FUNCTION; + } + } else if (sf->tokenvec[left].type == TYPE_SQLTYPE && + (sf->tokenvec[left+1].type == TYPE_BAREWORD || + sf->tokenvec[left+1].type == TYPE_NUMBER || + sf->tokenvec[left+1].type == TYPE_SQLTYPE || + sf->tokenvec[left+1].type == TYPE_LEFTPARENS || + sf->tokenvec[left+1].type == TYPE_FUNCTION || + sf->tokenvec[left+1].type == TYPE_VARIABLE || + sf->tokenvec[left+1].type == TYPE_STRING)) { + st_copy(&sf->tokenvec[left], &sf->tokenvec[left+1]); + pos -= 1; + sf->stats_folds += 1; + left = 0; + continue; + } else if (sf->tokenvec[left].type == TYPE_COLLATE && + sf->tokenvec[left+1].type == TYPE_BAREWORD) { + /* + * there are too many collation types.. so if the bareword has a "_" + * then it's TYPE_SQLTYPE + */ + if (strchr(sf->tokenvec[left+1].val, '_') != NULL) { + sf->tokenvec[left+1].type = TYPE_SQLTYPE; + left = 0; + } + } else if (sf->tokenvec[left].type == TYPE_BACKSLASH) { + if (st_is_arithmetic_op(&(sf->tokenvec[left+1]))) { + /* very weird case in TSQL where '\%1' is parsed as '0 % 1', etc */ + sf->tokenvec[left].type = TYPE_NUMBER; + } else { + /* just ignore it.. Again T-SQL seems to parse \1 as "1" */ + st_copy(&sf->tokenvec[left], &sf->tokenvec[left+1]); + pos -= 1; + sf->stats_folds += 1; + } + left = 0; + continue; + } else if (sf->tokenvec[left].type == TYPE_LEFTPARENS && + sf->tokenvec[left+1].type == TYPE_LEFTPARENS) { + pos -= 1; + left = 0; + sf->stats_folds += 1; + continue; + } else if (sf->tokenvec[left].type == TYPE_RIGHTPARENS && + sf->tokenvec[left+1].type == TYPE_RIGHTPARENS) { + pos -= 1; + left = 0; + sf->stats_folds += 1; + continue; + } else if (sf->tokenvec[left].type == TYPE_LEFTBRACE && + sf->tokenvec[left+1].type == TYPE_BAREWORD) { + + /* + * MySQL Degenerate case -- + * + * select { ``.``.id }; -- valid !!! + * select { ``.``.``.id }; -- invalid + * select ``.``.id; -- invalid + * select { ``.id }; -- invalid + * + * so it appears {``.``.id} is a magic case + * I suspect this is "current database, current table, field id" + * + * The folding code can't look at more than 3 tokens, and + * I don't want to make two passes. + * + * Since "{ ``" so rare, we are just going to blacklist it. + * + * Highly likely this will need revisiting! + * + * CREDIT @rsalgado 2013-11-25 + */ + if (sf->tokenvec[left+1].len == 0) { + sf->tokenvec[left+1].type = TYPE_EVIL; + return (int)(left+2); + } + /* weird ODBC / MYSQL {foo expr} --> expr + * but for this rule we just strip away the "{ foo" part + */ + left = 0; + pos -= 2; + sf->stats_folds += 2; + continue; + } else if (sf->tokenvec[left+1].type == TYPE_RIGHTBRACE) { + pos -= 1; + left = 0; + sf->stats_folds += 1; + continue; + } + + /* all cases of handing 2 tokens is done + and nothing matched. Get one more token + */ + FOLD_DEBUG; + while (more && pos <= LIBINJECTION_SQLI_MAX_TOKENS && pos - left < 3) { + sf->current = &(sf->tokenvec[pos]); + more = libinjection_sqli_tokenize(sf); + if (more) { + if (sf->current->type == TYPE_COMMENT) { + st_copy(&last_comment, sf->current); + } else { + last_comment.type = CHAR_NULL; + pos += 1; + } + } + } + + /* do we have three tokens? If not then we are done */ + if (pos -left < 3) { + left = pos; + continue; + } + + /* + * now look for three token folding + */ + if (sf->tokenvec[left].type == TYPE_NUMBER && + sf->tokenvec[left+1].type == TYPE_OPERATOR && + sf->tokenvec[left+2].type == TYPE_NUMBER) { + pos -= 2; + left = 0; + continue; + } else if (sf->tokenvec[left].type == TYPE_OPERATOR && + sf->tokenvec[left+1].type != TYPE_LEFTPARENS && + sf->tokenvec[left+2].type == TYPE_OPERATOR) { + left = 0; + pos -= 2; + continue; + } else if (sf->tokenvec[left].type == TYPE_LOGIC_OPERATOR && + sf->tokenvec[left+2].type == TYPE_LOGIC_OPERATOR) { + pos -= 2; + left = 0; + continue; + } else if (sf->tokenvec[left].type == TYPE_VARIABLE && + sf->tokenvec[left+1].type == TYPE_OPERATOR && + (sf->tokenvec[left+2].type == TYPE_VARIABLE || + sf->tokenvec[left+2].type == TYPE_NUMBER || + sf->tokenvec[left+2].type == TYPE_BAREWORD)) { + pos -= 2; + left = 0; + continue; + } else if ((sf->tokenvec[left].type == TYPE_BAREWORD || + sf->tokenvec[left].type == TYPE_NUMBER ) && + sf->tokenvec[left+1].type == TYPE_OPERATOR && + (sf->tokenvec[left+2].type == TYPE_NUMBER || + sf->tokenvec[left+2].type == TYPE_BAREWORD)) { + pos -= 2; + left = 0; + continue; + } else if ((sf->tokenvec[left].type == TYPE_BAREWORD || + sf->tokenvec[left].type == TYPE_NUMBER || + sf->tokenvec[left].type == TYPE_VARIABLE || + sf->tokenvec[left].type == TYPE_STRING) && + sf->tokenvec[left+1].type == TYPE_OPERATOR && + streq(sf->tokenvec[left+1].val, "::") && + sf->tokenvec[left+2].type == TYPE_SQLTYPE) { + pos -= 2; + left = 0; + sf->stats_folds += 2; + continue; + } else if ((sf->tokenvec[left].type == TYPE_BAREWORD || + sf->tokenvec[left].type == TYPE_NUMBER || + sf->tokenvec[left].type == TYPE_STRING || + sf->tokenvec[left].type == TYPE_VARIABLE) && + sf->tokenvec[left+1].type == TYPE_COMMA && + (sf->tokenvec[left+2].type == TYPE_NUMBER || + sf->tokenvec[left+2].type == TYPE_BAREWORD || + sf->tokenvec[left+2].type == TYPE_STRING || + sf->tokenvec[left+2].type == TYPE_VARIABLE)) { + pos -= 2; + left = 0; + continue; + } else if ((sf->tokenvec[left].type == TYPE_EXPRESSION || + sf->tokenvec[left].type == TYPE_GROUP || + sf->tokenvec[left].type == TYPE_COMMA) && + st_is_unary_op(&sf->tokenvec[left+1]) && + sf->tokenvec[left+2].type == TYPE_LEFTPARENS) { + /* got something like SELECT + (, LIMIT + ( + * remove unary operator + */ + st_copy(&sf->tokenvec[left+1], &sf->tokenvec[left+2]); + pos -= 1; + left = 0; + continue; + } else if ((sf->tokenvec[left].type == TYPE_KEYWORD || + sf->tokenvec[left].type == TYPE_EXPRESSION || + sf->tokenvec[left].type == TYPE_GROUP ) && + st_is_unary_op(&sf->tokenvec[left+1]) && + (sf->tokenvec[left+2].type == TYPE_NUMBER || + sf->tokenvec[left+2].type == TYPE_BAREWORD || + sf->tokenvec[left+2].type == TYPE_VARIABLE || + sf->tokenvec[left+2].type == TYPE_STRING || + sf->tokenvec[left+2].type == TYPE_FUNCTION )) { + /* remove unary operators + * select - 1 + */ + st_copy(&sf->tokenvec[left+1], &sf->tokenvec[left+2]); + pos -= 1; + left = 0; + continue; + } else if (sf->tokenvec[left].type == TYPE_COMMA && + st_is_unary_op(&sf->tokenvec[left+1]) && + (sf->tokenvec[left+2].type == TYPE_NUMBER || + sf->tokenvec[left+2].type == TYPE_BAREWORD || + sf->tokenvec[left+2].type == TYPE_VARIABLE || + sf->tokenvec[left+2].type == TYPE_STRING)) { + /* + * interesting case turn ", -1" ->> ",1" PLUS we need to back up + * one token if possible to see if more folding can be done + * "1,-1" --> "1" + */ + st_copy(&sf->tokenvec[left+1], &sf->tokenvec[left+2]); + left = 0; + /* pos is >= 3 so this is safe */ + assert(pos >= 3); + pos -= 3; + continue; + } else if (sf->tokenvec[left].type == TYPE_COMMA && + st_is_unary_op(&sf->tokenvec[left+1]) && + sf->tokenvec[left+2].type == TYPE_FUNCTION) { + + /* Separate case from above since you end up with + * 1,-sin(1) --> 1 (1) + * Here, just do + * 1,-sin(1) --> 1,sin(1) + * just remove unary operator + */ + st_copy(&sf->tokenvec[left+1], &sf->tokenvec[left+2]); + pos -= 1; + left = 0; + continue; + } else if ((sf->tokenvec[left].type == TYPE_BAREWORD) && + (sf->tokenvec[left+1].type == TYPE_DOT) && + (sf->tokenvec[left+2].type == TYPE_BAREWORD)) { + /* ignore the '.n' + * typically is this databasename.table + */ + assert(pos >= 3); + pos -= 2; + left = 0; + continue; + } else if ((sf->tokenvec[left].type == TYPE_EXPRESSION) && + (sf->tokenvec[left+1].type == TYPE_DOT) && + (sf->tokenvec[left+2].type == TYPE_BAREWORD)) { + /* select . `foo` --> select `foo` */ + st_copy(&sf->tokenvec[left+1], &sf->tokenvec[left+2]); + pos -= 1; + left = 0; + continue; + } else if ((sf->tokenvec[left].type == TYPE_FUNCTION) && + (sf->tokenvec[left+1].type == TYPE_LEFTPARENS) && + (sf->tokenvec[left+2].type != TYPE_RIGHTPARENS)) { + /* + * whats going on here + * Some SQL functions like USER() have 0 args + * if we get User(foo), then User is not a function + * This should be expanded since it eliminated a lot of false + * positives. + */ + if (cstrcasecmp("USER", sf->tokenvec[left].val, sf->tokenvec[left].len) == 0) { + sf->tokenvec[left].type = TYPE_BAREWORD; + } + } + + /* no folding -- assume left-most token is + is good, now use the existing 2 tokens -- + do not get another + */ + + left += 1; + + } /* while(1) */ + + /* if we have 4 or less tokens, and we had a comment token + * at the end, add it back + */ + + if (left < LIBINJECTION_SQLI_MAX_TOKENS && last_comment.type == TYPE_COMMENT) { + st_copy(&sf->tokenvec[left], &last_comment); + left += 1; + } + + /* sometimes we grab a 6th token to help + determine the type of token 5. + */ + if (left > LIBINJECTION_SQLI_MAX_TOKENS) { + left = LIBINJECTION_SQLI_MAX_TOKENS; + } + + return (int)left; +} + +/* secondary api: detects SQLi in a string, GIVEN a context. + * + * A context can be: + * * CHAR_NULL (\0), process as is + * * CHAR_SINGLE ('), process pretending input started with a + * single quote. + * * CHAR_DOUBLE ("), process pretending input started with a + * double quote. + * + */ +const char* libinjection_sqli_fingerprint(struct libinjection_sqli_state * sql_state, int flags) +{ + int i; + int tlen = 0; + + libinjection_sqli_reset(sql_state, flags); + + tlen = libinjection_sqli_fold(sql_state); + + /* Check for magic PHP backquote comment + * If: + * * last token is of type "bareword" + * * And is quoted in a backtick + * * And isn't closed + * * And it's empty? + * Then convert it to comment + */ + if (tlen > 2 && + sql_state->tokenvec[tlen-1].type == TYPE_BAREWORD && + sql_state->tokenvec[tlen-1].str_open == CHAR_TICK && + sql_state->tokenvec[tlen-1].len == 0 && + sql_state->tokenvec[tlen-1].str_close == CHAR_NULL) { + sql_state->tokenvec[tlen-1].type = TYPE_COMMENT; + } + + for (i = 0; i < tlen; ++i) { + sql_state->fingerprint[i] = sql_state->tokenvec[i].type; + } + + /* + * make the fingerprint pattern a c-string (null delimited) + */ + sql_state->fingerprint[tlen] = CHAR_NULL; + + /* + * check for 'X' in pattern, and then + * clear out all tokens + * + * this means parsing could not be done + * accurately due to pgsql's double comments + * or other syntax that isn't consistent. + * Should be very rare false positive + */ + if (strchr(sql_state->fingerprint, TYPE_EVIL)) { + /* needed for SWIG */ + memset((void*)sql_state->fingerprint, 0, LIBINJECTION_SQLI_MAX_TOKENS + 1); + memset((void*)sql_state->tokenvec[0].val, 0, LIBINJECTION_SQLI_TOKEN_SIZE); + + sql_state->fingerprint[0] = TYPE_EVIL; + + sql_state->tokenvec[0].type = TYPE_EVIL; + sql_state->tokenvec[0].val[0] = TYPE_EVIL; + sql_state->tokenvec[1].type = CHAR_NULL; + } + + + return sql_state->fingerprint; +} + +int libinjection_sqli_check_fingerprint(struct libinjection_sqli_state* sql_state) +{ + return libinjection_sqli_blacklist(sql_state) && + libinjection_sqli_not_whitelist(sql_state); +} + +char libinjection_sqli_lookup_word(struct libinjection_sqli_state *sql_state, int lookup_type, + const char* str, size_t len) +{ + if (lookup_type == LOOKUP_FINGERPRINT) { + return libinjection_sqli_check_fingerprint(sql_state) ? 'X' : '\0'; + } else { + return bsearch_keyword_type(str, len, sql_keywords, sql_keywords_sz); + } +} + +int libinjection_sqli_blacklist(struct libinjection_sqli_state* sql_state) +{ + /* + * use minimum of 8 bytes to make sure gcc -fstack-protector + * works correctly + */ + char fp2[8]; + char ch; + size_t i; + size_t len = strlen(sql_state->fingerprint); + int patmatch; + + if (len < 1) { + sql_state->reason = __LINE__; + return FALSE; + } + + /* + to keep everything compatible, convert the + v0 fingerprint pattern to v1 + v0: up to 5 chars, mixed case + v1: 1 char is '0', up to 5 more chars, upper case + */ + + fp2[0] = '0'; + for (i = 0; i < len; ++i) { + ch = sql_state->fingerprint[i]; + if (ch >= 'a' && ch <= 'z') { + ch -= 0x20; + } + fp2[i+1] = ch; + } + fp2[i+1] = '\0'; + + patmatch = is_keyword(fp2, len + 1) == TYPE_FINGERPRINT; + + /* + * No match. + * + * Set sql_state->reason to current line number + * only for debugging purposes. + */ + if (!patmatch) { + sql_state->reason = __LINE__; + return FALSE; + } + + return TRUE; +} + +/* + * return TRUE if SQLi, false is benign + */ +int libinjection_sqli_not_whitelist(struct libinjection_sqli_state* sql_state) +{ + /* + * We assume we got a SQLi match + * This next part just helps reduce false positives. + * + */ + char ch; + size_t tlen = strlen(sql_state->fingerprint); + + if (tlen > 1 && sql_state->fingerprint[tlen-1] == TYPE_COMMENT) { + /* + * if ending comment is contains 'sp_password' then it's SQLi! + * MS Audit log apparently ignores anything with + * 'sp_password' in it. Unable to find primary reference to + * this "feature" of SQL Server but seems to be known SQLi + * technique + */ + if (my_memmem(sql_state->s, sql_state->slen, + "sp_password", strlen("sp_password"))) { + sql_state->reason = __LINE__; + return TRUE; + } + } + + switch (tlen) { + case 2:{ + /* + * case 2 are "very small SQLi" which make them + * hard to tell from normal input... + */ + + if (sql_state->fingerprint[1] == TYPE_UNION) { + if (sql_state->stats_tokens == 2) { + /* not sure why but 1U comes up in SQLi attack + * likely part of parameter splitting/etc. + * lots of reasons why "1 union" might be normal + * input, so beep only if other SQLi things are present + */ + /* it really is a number and 'union' + * other wise it has folding or comments + */ + sql_state->reason = __LINE__; + return FALSE; + } else { + sql_state->reason = __LINE__; + return TRUE; + } + } + /* + * if 'comment' is '#' ignore.. too many FP + */ + if (sql_state->tokenvec[1].val[0] == '#') { + sql_state->reason = __LINE__; + return FALSE; + } + + /* + * for fingerprint like 'nc', only comments of /x are treated + * as SQL... ending comments of "--" and "#" are not SQLi + */ + if (sql_state->tokenvec[0].type == TYPE_BAREWORD && + sql_state->tokenvec[1].type == TYPE_COMMENT && + sql_state->tokenvec[1].val[0] != '/') { + sql_state->reason = __LINE__; + return FALSE; + } + + /* + * if '1c' ends with '/x' then it's SQLi + */ + if (sql_state->tokenvec[0].type == TYPE_NUMBER && + sql_state->tokenvec[1].type == TYPE_COMMENT && + sql_state->tokenvec[1].val[0] == '/') { + return TRUE; + } + + /** + * there are some odd base64-looking query string values + * 1234-ABCDEFEhfhihwuefi-- + * which evaluate to "1c"... these are not SQLi + * but 1234-- probably is. + * Make sure the "1" in "1c" is actually a true decimal number + * + * Need to check -original- string since the folding step + * may have merged tokens, e.g. "1+FOO" is folded into "1" + * + * Note: evasion: 1*1-- + */ + if (sql_state->tokenvec[0].type == TYPE_NUMBER && + sql_state->tokenvec[1].type == TYPE_COMMENT) { + if (sql_state->stats_tokens > 2) { + /* we have some folding going on, highly likely SQLi */ + sql_state->reason = __LINE__; + return TRUE; + } + /* + * we check that next character after the number is either whitespace, + * or '/' or a '-' ==> SQLi. + */ + ch = sql_state->s[sql_state->tokenvec[0].len]; + if ( ch <= 32 ) { + /* next char was whitespace,e.g. "1234 --" + * this isn't exactly correct.. ideally we should skip over all whitespace + * but this seems to be ok for now + */ + return TRUE; + } + if (ch == '/' && sql_state->s[sql_state->tokenvec[0].len + 1] == '*') { + return TRUE; + } + if (ch == '-' && sql_state->s[sql_state->tokenvec[0].len + 1] == '-') { + return TRUE; + } + + sql_state->reason = __LINE__; + return FALSE; + } + + /* + * detect obvious SQLi scans.. many people put '--' in plain text + * so only detect if input ends with '--', e.g. 1-- but not 1-- foo + */ + if ((sql_state->tokenvec[1].len > 2) + && sql_state->tokenvec[1].val[0] == '-') { + sql_state->reason = __LINE__; + return FALSE; + } + + break; + } /* case 2 */ + case 3:{ + /* + * ...foo' + 'bar... + * no opening quote, no closing quote + * and each string has data + */ + + if (streq(sql_state->fingerprint, "sos") + || streq(sql_state->fingerprint, "s&s")) { + + if ((sql_state->tokenvec[0].str_open == CHAR_NULL) + && (sql_state->tokenvec[2].str_close == CHAR_NULL) + && (sql_state->tokenvec[0].str_close == sql_state->tokenvec[2].str_open)) { + /* + * if ....foo" + "bar.... + */ + sql_state->reason = __LINE__; + return TRUE; + } + if (sql_state->stats_tokens == 3) { + sql_state->reason = __LINE__; + return FALSE; + } + + /* + * not SQLi + */ + sql_state->reason = __LINE__; + return FALSE; + } else if (streq(sql_state->fingerprint, "s&n") || + streq(sql_state->fingerprint, "n&1") || + streq(sql_state->fingerprint, "1&1") || + streq(sql_state->fingerprint, "1&v") || + streq(sql_state->fingerprint, "1&s")) { + /* 'sexy and 17' not SQLi + * 'sexy and 17<18' SQLi + */ + if (sql_state->stats_tokens == 3) { + sql_state->reason = __LINE__; + return FALSE; + } + } else if (sql_state->tokenvec[1].type == TYPE_KEYWORD) { + if ((sql_state->tokenvec[1].len < 5) || + cstrcasecmp("INTO", sql_state->tokenvec[1].val, 4)) { + /* if it's not "INTO OUTFILE", or "INTO DUMPFILE" (MySQL) + * then treat as safe + */ + sql_state->reason = __LINE__; + return FALSE; + } + } + break; + } /* case 3 */ + case 4: + case 5: { + /* nothing right now */ + break; + } /* case 5 */ + } /* end switch */ + + return TRUE; +} + +/** Main API, detects SQLi in an input. + * + * + */ +static int reparse_as_mysql(struct libinjection_sqli_state * sql_state) +{ + return sql_state->stats_comment_ddx || + sql_state->stats_comment_hash; +} + +/* + * This function is mostly use with SWIG + */ +struct libinjection_sqli_token* +libinjection_sqli_get_token(struct libinjection_sqli_state * sql_state, int i) +{ + if (i < 0 || i > (int)LIBINJECTION_SQLI_MAX_TOKENS) { + return NULL; + } + return &(sql_state->tokenvec[i]); +} + +int libinjection_is_sqli(struct libinjection_sqli_state * sql_state) +{ + const char *s = sql_state->s; + size_t slen = sql_state->slen; + + /* + * no input? not SQLi + */ + if (slen == 0) { + return FALSE; + } + + /* + * test input "as-is" + */ + libinjection_sqli_fingerprint(sql_state, FLAG_QUOTE_NONE | FLAG_SQL_ANSI); + if (sql_state->lookup(sql_state, LOOKUP_FINGERPRINT, + sql_state->fingerprint, strlen(sql_state->fingerprint))) { + return TRUE; + } else if (reparse_as_mysql(sql_state)) { + libinjection_sqli_fingerprint(sql_state, FLAG_QUOTE_NONE | FLAG_SQL_MYSQL); + if (sql_state->lookup(sql_state, LOOKUP_FINGERPRINT, + sql_state->fingerprint, strlen(sql_state->fingerprint))) { + return TRUE; + } + } + + /* + * if input has a single_quote, then + * test as if input was actually ' + * example: if input if "1' = 1", then pretend it's + * "'1' = 1" + * Porting Notes: example the same as doing + * is_string_sqli(sql_state, "'" + s, slen+1, NULL, fn, arg) + * + */ + if (memchr(s, CHAR_SINGLE, slen)) { + libinjection_sqli_fingerprint(sql_state, FLAG_QUOTE_SINGLE | FLAG_SQL_ANSI); + if (sql_state->lookup(sql_state, LOOKUP_FINGERPRINT, + sql_state->fingerprint, strlen(sql_state->fingerprint))) { + return TRUE; + } else if (reparse_as_mysql(sql_state)) { + libinjection_sqli_fingerprint(sql_state, FLAG_QUOTE_SINGLE | FLAG_SQL_MYSQL); + if (sql_state->lookup(sql_state, LOOKUP_FINGERPRINT, + sql_state->fingerprint, strlen(sql_state->fingerprint))) { + return TRUE; + } + } + } + + /* + * same as above but with a double-quote " + */ + if (memchr(s, CHAR_DOUBLE, slen)) { + libinjection_sqli_fingerprint(sql_state, FLAG_QUOTE_DOUBLE | FLAG_SQL_MYSQL); + if (sql_state->lookup(sql_state, LOOKUP_FINGERPRINT, + sql_state->fingerprint, strlen(sql_state->fingerprint))) { + return TRUE; + } + } + + /* + * Hurray, input is not SQLi + */ + return FALSE; +} + +int libinjection_sqli(const char* input, size_t slen, char fingerprint[]) +{ + int issqli; + struct libinjection_sqli_state state; + + libinjection_sqli_init(&state, input, slen, 0); + issqli = libinjection_is_sqli(&state); + if (issqli) { + strcpy(fingerprint, state.fingerprint); + } else { + fingerprint[0] = '\0'; + } + return issqli; +} diff --git a/src/lib/third_party/src/libinjection_xss.c b/src/lib/third_party/src/libinjection_xss.c new file mode 100644 index 000000000..f0df4d84a --- /dev/null +++ b/src/lib/third_party/src/libinjection_xss.c @@ -0,0 +1,532 @@ + +#include "libinjection.h" +#include "libinjection_xss.h" +#include "libinjection_html5.h" + +#include <assert.h> +#include <stdio.h> + +typedef enum attribute { + TYPE_NONE + , TYPE_BLACK /* ban always */ + , TYPE_ATTR_URL /* attribute value takes a URL-like object */ + , TYPE_STYLE + , TYPE_ATTR_INDIRECT /* attribute *name* is given in *value* */ +} attribute_t; + + +static attribute_t is_black_attr(const char* s, size_t len); +static int is_black_tag(const char* s, size_t len); +static int is_black_url(const char* s, size_t len); +static int cstrcasecmp_with_null(const char *a, const char *b, size_t n); +static int html_decode_char_at(const char* src, size_t len, size_t* consumed); +static int htmlencode_startswith(const char* prefix, const char *src, size_t n); + + +typedef struct stringtype { + const char* name; + attribute_t atype; +} stringtype_t; + + +static const int gsHexDecodeMap[256] = { + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 256, 256, + 256, 256, 256, 256, 256, 10, 11, 12, 13, 14, 15, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 10, 11, 12, 13, 14, 15, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, 256, + 256, 256, 256, 256 +}; + +static int html_decode_char_at(const char* src, size_t len, size_t* consumed) +{ + int val = 0; + size_t i; + int ch; + + if (len == 0 || src == NULL) { + *consumed = 0; + return -1; + } + + *consumed = 1; + if (*src != '&' || len < 2) { + return (unsigned char)(*src); + } + + + if (*(src+1) != '#') { + /* normally this would be for named entities + * but for this case we don't actually care + */ + return '&'; + } + + if (*(src+2) == 'x' || *(src+2) == 'X') { + ch = (unsigned char) (*(src+3)); + ch = gsHexDecodeMap[ch]; + if (ch == 256) { + /* degenerate case '&#[?]' */ + return '&'; + } + val = ch; + i = 4; + while (i < len) { + ch = (unsigned char) src[i]; + if (ch == ';') { + *consumed = i + 1; + return val; + } + ch = gsHexDecodeMap[ch]; + if (ch == 256) { + *consumed = i; + return val; + } + val = (val * 16) + ch; + if (val > 0x1000FF) { + return '&'; + } + ++i; + } + *consumed = i; + return val; + } else { + i = 2; + ch = (unsigned char) src[i]; + if (ch < '0' || ch > '9') { + return '&'; + } + val = ch - '0'; + i += 1; + while (i < len) { + ch = (unsigned char) src[i]; + if (ch == ';') { + *consumed = i + 1; + return val; + } + if (ch < '0' || ch > '9') { + *consumed = i; + return val; + } + val = (val * 10) + (ch - '0'); + if (val > 0x1000FF) { + return '&'; + } + ++i; + } + *consumed = i; + return val; + } +} + + +/* + * view-source: + * data: + * javascript: + */ +static stringtype_t BLACKATTR[] = { + { "ACTION", TYPE_ATTR_URL } /* form */ + , { "ATTRIBUTENAME", TYPE_ATTR_INDIRECT } /* SVG allow indirection of attribute names */ + , { "BY", TYPE_ATTR_URL } /* SVG */ + , { "BACKGROUND", TYPE_ATTR_URL } /* IE6, O11 */ + , { "DATAFORMATAS", TYPE_BLACK } /* IE */ + , { "DATASRC", TYPE_BLACK } /* IE */ + , { "DYNSRC", TYPE_ATTR_URL } /* Obsolete img attribute */ + , { "FILTER", TYPE_STYLE } /* Opera, SVG inline style */ + , { "FORMACTION", TYPE_ATTR_URL } /* HTML 5 */ + , { "FOLDER", TYPE_ATTR_URL } /* Only on A tags, IE-only */ + , { "FROM", TYPE_ATTR_URL } /* SVG */ + , { "HANDLER", TYPE_ATTR_URL } /* SVG Tiny, Opera */ + , { "HREF", TYPE_ATTR_URL } + , { "LOWSRC", TYPE_ATTR_URL } /* Obsolete img attribute */ + , { "POSTER", TYPE_ATTR_URL } /* Opera 10,11 */ + , { "SRC", TYPE_ATTR_URL } + , { "STYLE", TYPE_STYLE } + , { "TO", TYPE_ATTR_URL } /* SVG */ + , { "VALUES", TYPE_ATTR_URL } /* SVG */ + , { "XLINK:HREF", TYPE_ATTR_URL } + , { NULL, TYPE_NONE } +}; + +/* xmlns */ +/* `xml-stylesheet` > <eval>, <if expr=> */ + +/* + static const char* BLACKATTR[] = { + "ATTRIBUTENAME", + "BACKGROUND", + "DATAFORMATAS", + "HREF", + "SCROLL", + "SRC", + "STYLE", + "SRCDOC", + NULL + }; +*/ + +static const char* BLACKTAG[] = { + "APPLET" + /* , "AUDIO" */ + , "BASE" + , "COMMENT" /* IE http://html5sec.org/#38 */ + , "EMBED" + /* , "FORM" */ + , "FRAME" + , "FRAMESET" + , "HANDLER" /* Opera SVG, effectively a script tag */ + , "IFRAME" + , "IMPORT" + , "ISINDEX" + , "LINK" + , "LISTENER" + /* , "MARQUEE" */ + , "META" + , "NOSCRIPT" + , "OBJECT" + , "SCRIPT" + , "STYLE" + /* , "VIDEO" */ + , "VMLFRAME" + , "XML" + , "XSS" + , NULL +}; + + +static int cstrcasecmp_with_null(const char *a, const char *b, size_t n) +{ + char ca; + char cb; + /* printf("Comparing to %s %.*s\n", a, (int)n, b); */ + while (n-- > 0) { + cb = *b++; + if (cb == '\0') continue; + + ca = *a++; + + if (cb >= 'a' && cb <= 'z') { + cb -= 0x20; + } + /* printf("Comparing %c vs %c with %d left\n", ca, cb, (int)n); */ + if (ca != cb) { + return 1; + } + } + + if (*a == 0) { + /* printf(" MATCH \n"); */ + return 0; + } else { + return 1; + } +} + +/* + * Does an HTML encoded binary string (const char*, length) start with + * a all uppercase c-string (null terminated), case insensitive! + * + * also ignore any embedded nulls in the HTML string! + * + * return 1 if match / starts with + * return 0 if not + */ +static int htmlencode_startswith(const char *a, const char *b, size_t n) +{ + size_t consumed; + int cb; + int first = 1; + /* printf("Comparing %s with %.*s\n", a,(int)n,b); */ + while (n > 0) { + if (*a == 0) { + /* printf("Match EOL!\n"); */ + return 1; + } + cb = html_decode_char_at(b, n, &consumed); + b += consumed; + n -= consumed; + + if (first && cb <= 32) { + /* ignore all leading whitespace and control characters */ + continue; + } + first = 0; + + if (cb == 0) { + /* always ignore null characters in user input */ + continue; + } + + if (cb == 10) { + /* always ignore vertical tab characters in user input */ + /* who allows this?? */ + continue; + } + + if (cb >= 'a' && cb <= 'z') { + /* upcase */ + cb -= 0x20; + } + + if (*a != (char) cb) { + /* printf(" %c != %c\n", *a, cb); */ + /* mismatch */ + return 0; + } + a++; + } + + return (*a == 0) ? 1 : 0; +} + +static int is_black_tag(const char* s, size_t len) +{ + const char** black; + + if (len < 3) { + return 0; + } + + black = BLACKTAG; + while (*black != NULL) { + if (cstrcasecmp_with_null(*black, s, len) == 0) { + /* printf("Got black tag %s\n", *black); */ + return 1; + } + black += 1; + } + + /* anything SVG related */ + if ((s[0] == 's' || s[0] == 'S') && + (s[1] == 'v' || s[1] == 'V') && + (s[2] == 'g' || s[2] == 'G')) { + /* printf("Got SVG tag \n"); */ + return 1; + } + + /* Anything XSL(t) related */ + if ((s[0] == 'x' || s[0] == 'X') && + (s[1] == 's' || s[1] == 'S') && + (s[2] == 'l' || s[2] == 'L')) { + /* printf("Got XSL tag\n"); */ + return 1; + } + + return 0; +} + +static attribute_t is_black_attr(const char* s, size_t len) +{ + stringtype_t* black; + + if (len < 2) { + return TYPE_NONE; + } + + if (len >= 5) { + /* JavaScript on.* */ + if ((s[0] == 'o' || s[0] == 'O') && (s[1] == 'n' || s[1] == 'N')) { + /* printf("Got JavaScript on- attribute name\n"); */ + return TYPE_BLACK; + } + + + + /* XMLNS can be used to create arbitrary tags */ + if (cstrcasecmp_with_null("XMLNS", s, 5) == 0 || cstrcasecmp_with_null("XLINK", s, 5) == 0) { + /* printf("Got XMLNS and XLINK tags\n"); */ + return TYPE_BLACK; + } + } + + black = BLACKATTR; + while (black->name != NULL) { + if (cstrcasecmp_with_null(black->name, s, len) == 0) { + /* printf("Got banned attribute name %s\n", black->name); */ + return black->atype; + } + black += 1; + } + + return TYPE_NONE; +} + +static int is_black_url(const char* s, size_t len) +{ + + static const char* data_url = "DATA"; + static const char* viewsource_url = "VIEW-SOURCE"; + + /* obsolete but interesting signal */ + static const char* vbscript_url = "VBSCRIPT"; + + /* covers JAVA, JAVASCRIPT, + colon */ + static const char* javascript_url = "JAVA"; + + /* skip whitespace */ + while (len > 0 && (*s <= 32 || *s >= 127)) { + /* + * HEY: this is a signed character. + * We are intentionally skipping high-bit characters too + * since they are not ASCII, and Opera sometimes uses UTF-8 whitespace. + * + * Also in EUC-JP some of the high bytes are just ignored. + */ + ++s; + --len; + } + + if (htmlencode_startswith(data_url, s, len)) { + return 1; + } + + if (htmlencode_startswith(viewsource_url, s, len)) { + return 1; + } + + if (htmlencode_startswith(javascript_url, s, len)) { + return 1; + } + + if (htmlencode_startswith(vbscript_url, s, len)) { + return 1; + } + return 0; +} + +int libinjection_is_xss(const char* s, size_t len, int flags) +{ + h5_state_t h5; + attribute_t attr = TYPE_NONE; + + libinjection_h5_init(&h5, s, len, (enum html5_flags) flags); + while (libinjection_h5_next(&h5)) { + if (h5.token_type != ATTR_VALUE) { + attr = TYPE_NONE; + } + + if (h5.token_type == DOCTYPE) { + return 1; + } else if (h5.token_type == TAG_NAME_OPEN) { + if (is_black_tag(h5.token_start, h5.token_len)) { + return 1; + } + } else if (h5.token_type == ATTR_NAME) { + attr = is_black_attr(h5.token_start, h5.token_len); + } else if (h5.token_type == ATTR_VALUE) { + /* + * IE6,7,8 parsing works a bit differently so + * a whole <script> or other black tag might be hiding + * inside an attribute value under HTML 5 parsing + * See http://html5sec.org/#102 + * to avoid doing a full reparse of the value, just + * look for "<". This probably need adjusting to + * handle escaped characters + */ + /* + if (memchr(h5.token_start, '<', h5.token_len) != NULL) { + return 1; + } + */ + + switch (attr) { + case TYPE_NONE: + break; + case TYPE_BLACK: + return 1; + case TYPE_ATTR_URL: + if (is_black_url(h5.token_start, h5.token_len)) { + return 1; + } + break; + case TYPE_STYLE: + return 1; + case TYPE_ATTR_INDIRECT: + /* an attribute name is specified in a _value_ */ + if (is_black_attr(h5.token_start, h5.token_len)) { + return 1; + } + break; +/* + default: + assert(0); +*/ + } + attr = TYPE_NONE; + } else if (h5.token_type == TAG_COMMENT) { + /* IE uses a "`" as a tag ending char */ + if (memchr(h5.token_start, '`', h5.token_len) != NULL) { + return 1; + } + + /* IE conditional comment */ + if (h5.token_len > 3) { + if (h5.token_start[0] == '[' && + (h5.token_start[1] == 'i' || h5.token_start[1] == 'I') && + (h5.token_start[2] == 'f' || h5.token_start[2] == 'F')) { + return 1; + } + if ((h5.token_start[0] == 'x' || h5.token_start[0] == 'X') && + (h5.token_start[1] == 'm' || h5.token_start[1] == 'M') && + (h5.token_start[2] == 'l' || h5.token_start[2] == 'L')) { + return 1; + } + } + + if (h5.token_len > 5) { + /* IE <?import pseudo-tag */ + if (cstrcasecmp_with_null("IMPORT", h5.token_start, 6) == 0) { + return 1; + } + + /* XML Entity definition */ + if (cstrcasecmp_with_null("ENTITY", h5.token_start, 6) == 0) { + return 1; + } + } + } + } + return 0; +} + + +/* + * wrapper + */ +int libinjection_xss(const char* s, size_t len) +{ + if (libinjection_is_xss(s, len, DATA_STATE)) { + return 1; + } + if (libinjection_is_xss(s, len, VALUE_NO_QUOTE)) { + return 1; + } + if (libinjection_is_xss(s, len, VALUE_SINGLE_QUOTE)) { + return 1; + } + if (libinjection_is_xss(s, len, VALUE_DOUBLE_QUOTE)) { + return 1; + } + if (libinjection_is_xss(s, len, VALUE_BACK_QUOTE)) { + return 1; + } + + return 0; +} diff --git a/tests/dnp3.pcap b/tests/pcap/dnp3.pcap Binary files differindex 48dca2c01..48dca2c01 100644 --- a/tests/dnp3.pcap +++ b/tests/pcap/dnp3.pcap diff --git a/tests/pcap/ftp_failed.pcap b/tests/pcap/ftp_failed.pcap Binary files differnew file mode 100644 index 000000000..0fe7d1322 --- /dev/null +++ b/tests/pcap/ftp_failed.pcap diff --git a/tests/iec60780-5-104.pcap b/tests/pcap/iec60780-5-104.pcap Binary files differindex dbd77b098..dbd77b098 100644 --- a/tests/iec60780-5-104.pcap +++ b/tests/pcap/iec60780-5-104.pcap diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out index e2d5cea15..7cede1bfa 100644 --- a/tests/result/1kxun.pcap.out +++ b/tests/result/1kxun.pcap.out @@ -2,7 +2,6 @@ Unknown 24 6428 14 DNS 5 638 2 HTTP 945 530967 19 MDNS 1 82 1 -NTP 1 90 1 NetBIOS 31 3589 8 SSDP 143 36951 13 DHCP 24 8208 5 @@ -12,6 +11,7 @@ TLS 105 21914 7 DHCPV6 10 980 3 Facebook 19 6840 2 Google 12 991 4 +Apple 1 90 1 LLMNR 89 6799 47 JA3 Host Stats: @@ -19,7 +19,7 @@ JA3 Host Stats: 1 192.168.5.16 2 - 1 TCP 192.168.115.8:49613 <-> 183.131.48.144:80 [proto: 7/HTTP][cat: Web/5][260 pkts/15070 bytes <-> 159 pkts/168623 bytes][Goodput ratio: 6.7/94.9][51.74 sec][Host: 183.131.48.144][bytes ratio: -0.836 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 189.9/321.4 862/665 235.6/194.0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 58.0/1060.5 557/1078 44.0/127.3][URL: 183.131.48.144/vlive.qqvideo.tc.qq.com/u0020mkrnds.p1203.1.mp4?vkey=7AB139BF6B32F53747E8FF192E6FE557B3A3D644C034E34BF6EAEB4E0774F2A92EF3AC5C007520BB925E5C8A18E6D302C2DAE0A295B26AA8FD1DC8069D47CE1B4A16A56870BD1ACA3E86ABE4C079659DB2182FC71217AB68CCD344CE656][StatusCode: 206][ContentType: video/mp4][UserAgent: ][PLAIN TEXT (GET /vlive.qq)] + 1 TCP 192.168.115.8:49613 <-> 183.131.48.144:80 [proto: 7/HTTP][cat: Media/1][260 pkts/15070 bytes <-> 159 pkts/168623 bytes][Goodput ratio: 6.7/94.9][51.74 sec][Host: 183.131.48.144][bytes ratio: -0.836 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 189.9/321.4 862/665 235.6/194.0][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 58.0/1060.5 557/1078 44.0/127.3][URL: 183.131.48.144/vlive.qqvideo.tc.qq.com/u0020mkrnds.p1203.1.mp4?vkey=7AB139BF6B32F53747E8FF192E6FE557B3A3D644C034E34BF6EAEB4E0774F2A92EF3AC5C007520BB925E5C8A18E6D302C2DAE0A295B26AA8FD1DC8069D47CE1B4A16A56870BD1ACA3E86ABE4C079659DB2182FC71217AB68CCD344CE656][StatusCode: 206][ContentType: video/mp4][UserAgent: ][PLAIN TEXT (GET /vlive.qq)] 2 TCP 192.168.115.8:49600 <-> 106.187.35.246:80 [proto: 7/HTTP][cat: Streaming/17][18 pkts/1722 bytes <-> 51 pkts/61707 bytes][Goodput ratio: 42.1/95.5][45.37 sec][Host: pic.1kxun.com][bytes ratio: -0.946 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 3472.5/1028.9 44994/45054 11986.3/6713.8][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 95.7/1209.9 416/1314 113.3/325.4][URL: pic.1kxun.com/video_kankan/images/videos/18283-jfyj3.jpg][StatusCode: 200][ContentType: image/jpeg][UserAgent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22][PLAIN TEXT (GET /video)] 3 TCP 192.168.115.8:49601 <-> 106.187.35.246:80 [proto: 7/HTTP][cat: Streaming/17][18 pkts/2440 bytes <-> 43 pkts/49237 bytes][Goodput ratio: 59.2/95.2][45.30 sec][Host: pic.1kxun.com][bytes ratio: -0.906 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 3465.9/3.9 44999/62 11989.6/12.9][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 135.6/1145.0 415/1314 149.1/400.0][URL: pic.1kxun.com/video_kankan/images/videos/3578-ywzj.jpg][StatusCode: 200][ContentType: image/jpeg][UserAgent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22][PLAIN TEXT (GET /video)] 4 TCP 192.168.115.8:49602 <-> 106.187.35.246:80 [proto: 7/HTTP][cat: Streaming/17][24 pkts/2786 bytes <-> 41 pkts/46203 bytes][Goodput ratio: 51.7/95.1][45.33 sec][Host: pic.1kxun.com][bytes ratio: -0.886 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2648.9/11.6 44748/253 10524.9/44.9][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 116.1/1126.9 415/1314 133.3/398.1][URL: pic.1kxun.com/video_kankan/images/videos/3713-ydm.jpg][StatusCode: 200][ContentType: image/jpeg][UserAgent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22][PLAIN TEXT (GET /video)] @@ -127,7 +127,7 @@ JA3 Host Stats: 106 UDP 192.168.5.45:59789 -> 192.168.255.255:137 [proto: 10/NetBIOS][cat: System/18][1 pkts/92 bytes -> 0 pkts/0 bytes][Goodput ratio: 53.8/0.0][< 1 sec][Host: sanji-lifebook-][PLAIN TEXT ( FDEBEOEKEJ)] 107 UDP [fe80::e034:7be:d8f9:6197]:57143 -> [ff02::1:3]:5355 [proto: 154/LLMNR][cat: Network/14][1 pkts/91 bytes -> 0 pkts/0 bytes][Goodput ratio: 31.5/0.0][< 1 sec][Host: charming-pc][PLAIN TEXT (charming)] 108 UDP [fe80::e034:7be:d8f9:6197]:62756 -> [ff02::1:3]:5355 [proto: 154/LLMNR][cat: Network/14][1 pkts/91 bytes -> 0 pkts/0 bytes][Goodput ratio: 31.5/0.0][< 1 sec][Host: charming-pc][PLAIN TEXT (charming)] - 109 UDP 192.168.5.16:123 -> 17.253.26.125:123 [proto: 9/NTP][cat: System/18][1 pkts/90 bytes -> 0 pkts/0 bytes][Goodput ratio: 52.7/0.0][< 1 sec] + 109 UDP 192.168.5.16:123 -> 17.253.26.125:123 [proto: 9.140/NTP.Apple][cat: System/18][1 pkts/90 bytes -> 0 pkts/0 bytes][Goodput ratio: 52.7/0.0][< 1 sec] 110 UDP 192.168.5.64:5353 -> 224.0.0.251:5353 [proto: 8/MDNS][cat: Network/14][1 pkts/82 bytes -> 0 pkts/0 bytes][Goodput ratio: 48.2/0.0][< 1 sec][PLAIN TEXT (googlecast)] 111 UDP 192.168.5.50:49766 -> 224.0.0.252:5355 [proto: 154/LLMNR][cat: Network/14][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40.3/0.0][< 1 sec][Host: charming-pc][PLAIN TEXT (charming)] 112 UDP 192.168.5.50:50030 -> 224.0.0.252:5355 [proto: 154/LLMNR][cat: Network/14][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40.3/0.0][< 1 sec][Host: charming-pc][PLAIN TEXT (charming)] diff --git a/tests/result/WebattackSQLinj.pcap.out b/tests/result/WebattackSQLinj.pcap.out new file mode 100644 index 000000000..b49e454c3 --- /dev/null +++ b/tests/result/WebattackSQLinj.pcap.out @@ -0,0 +1,11 @@ +HTTP 94 30008 9 + + 1 TCP 172.16.0.1:36212 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][7 pkts/1070 bytes <-> 5 pkts/4487 bytes][Goodput ratio: 56.0/92.4][5.01 sec][Host: 205.174.165.68][bytes ratio: -0.615 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1002.2/3.3 5000/10 1998.9/4.7][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 152.9/897.4 666/2767 209.5/1089.6][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+null%2C+table_name+from+information_schema.tables%23&Submit=Submit ** SQL Injection **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] + 2 TCP 172.16.0.1:36202 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][6 pkts/1004 bytes <-> 5 pkts/4487 bytes][Goodput ratio: 59.7/92.4][5.09 sec][Host: 205.174.165.68][bytes ratio: -0.634 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/80 1017.0/40.0 5004/80 1993.7/40.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 167.3/897.4 666/4215 223.0/1658.8][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+null%2C+table_name+from+information_schema.tables%23&Submit=Submit ** SQL Injection **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] + 3 TCP 172.16.0.1:36204 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][5 pkts/937 bytes <-> 5 pkts/2359 bytes][Goodput ratio: 63.9/85.6][5.01 sec][Host: 205.174.165.68][bytes ratio: -0.431 (Download)][IAT c2s/s2c min/avg/max/stddev: 5/0 1251.2/1.3 5000/4 2164.3/1.9][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 187.4/471.8 665/2087 238.8/807.6][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+user%2C+password+from+users%23&Submit=Submit ** SQL Injection **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] + 4 TCP 172.16.0.1:36200 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][5 pkts/875 bytes <-> 5 pkts/2219 bytes][Goodput ratio: 61.3/84.7][5.04 sec][Host: 205.174.165.68][bytes ratio: -0.434 (Download)][IAT c2s/s2c min/avg/max/stddev: 33/0 1259.2/10.7 5004/32 2162.1/15.1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 175.0/443.8 603/1947 214.0/751.6][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+database%28%29%2C+user%28%29%23&Submit=Submit ** SQL Injection **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] + 5 TCP 172.16.0.1:36210 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][6 pkts/941 bytes <-> 4 pkts/2153 bytes][Goodput ratio: 57.0/87.3][5.01 sec][Host: 205.174.165.68][bytes ratio: -0.392 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/5 1001.0/2.5 5000/5 1999.5/2.5][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 156.8/538.2 603/1947 199.6/813.3][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1+union+select+database%28%29%2C+user%28%29%23&Submit=Submit ** SQL Injection **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] + 6 TCP 172.16.0.1:36208 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][5 pkts/874 bytes <-> 5 pkts/2178 bytes][Goodput ratio: 61.3/84.4][5.01 sec][Host: 205.174.165.68][bytes ratio: -0.427 (Download)][IAT c2s/s2c min/avg/max/stddev: 4/0 1252.2/1.0 5005/3 2166.7/1.4][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 174.8/435.6 602/1906 213.6/735.2][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1%23&Submit=Submit ** SQL Injection **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] + 7 TCP 172.16.0.1:36198 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][5 pkts/798 bytes <-> 5 pkts/2178 bytes][Goodput ratio: 57.6/84.4][5.07 sec][Host: 205.174.165.68][bytes ratio: -0.464 (Download)][IAT c2s/s2c min/avg/max/stddev: 68/0 1267.2/22.3 5001/67 2155.9/31.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 159.6/435.6 526/1906 183.2/735.2][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27+and+1%3D1%23&Submit=Submit ** SQL Injection **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] + 8 TCP 172.16.0.1:36206 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][5 pkts/861 bytes <-> 5 pkts/868 bytes][Goodput ratio: 60.7/61.0][5.01 sec][Host: 205.174.165.68][bytes ratio: -0.004 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 3/0 1252.0/0.7 5005/2 2166.8/0.9][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 172.2/173.6 589/596 208.4/211.2][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27&Submit=Submit][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] + 9 TCP 172.16.0.1:36196 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][6 pkts/851 bytes <-> 5 pkts/868 bytes][Goodput ratio: 52.5/61.0][5.01 sec][Host: 205.174.165.68][bytes ratio: -0.010 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1251.2/1.3 5000/3 2164.3/1.2][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 141.8/173.6 513/596 166.0/211.2][URL: 205.174.165.68/dv/vulnerabilities/sqli/?id=1%27&Submit=Submit][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/sqli/)] diff --git a/tests/result/WebattackXSS.pcap.out b/tests/result/WebattackXSS.pcap.out new file mode 100644 index 000000000..e09426150 --- /dev/null +++ b/tests/result/WebattackXSS.pcap.out @@ -0,0 +1,663 @@ +HTTP 9374 4721148 661 + + 1 TCP 172.16.0.1:59042 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][214 pkts/62915 bytes <-> 107 pkts/190654 bytes][Goodput ratio: 77.5/96.3][68.07 sec][Host: 205.174.165.68][bytes ratio: -0.504 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 339.9/679.8 4821/4822 529.8/629.2][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 294.0/1781.8 651/1935 250.9/392.7][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 2 TCP 172.16.0.1:56306 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62321 bytes <-> 115 pkts/191204 bytes][Goodput ratio: 78.3/96.0][68.15 sec][Host: 205.174.165.68][bytes ratio: -0.508 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 353.6/599.7 4804/4805 540.1/627.5][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 304.0/1662.6 651/1936 251.6/499.6][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 3 TCP 172.16.0.1:58360 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][210 pkts/62853 bytes <-> 105 pkts/190635 bytes][Goodput ratio: 77.9/96.4][67.29 sec][Host: 205.174.165.68][bytes ratio: -0.504 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/2 346.5/634.9 3808/3809 493.8/542.8][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 299.3/1815.6 651/1936 252.2/351.0][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27MRVS1VO9FLO4CFA5FLJ13I9GULOFH69WHOJQ0PH0OKE2FMG3MQ%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 4 TCP 172.16.0.1:33580 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][206 pkts/62387 bytes <-> 110 pkts/190854 bytes][Goodput ratio: 78.2/96.2][69.42 sec][Host: 205.174.165.68][bytes ratio: -0.507 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 342.6/689.5 4839/4840 531.5/624.4][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 302.8/1735.0 651/1935 251.6/441.5][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 5 TCP 172.16.0.1:34278 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][206 pkts/62589 bytes <-> 105 pkts/190625 bytes][Goodput ratio: 78.3/96.4][67.05 sec][Host: 205.174.165.68][bytes ratio: -0.506 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/3 328.1/716.1 2587/2588 440.4/440.3][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 303.8/1815.5 651/1936 252.5/351.0][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27TNRH0PFRPCFVXECFZU2OUYBTDZQVIWB8HBZ1VC7EXA9PGMGBWA%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 6 TCP 172.16.0.1:32906 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62523 bytes <-> 105 pkts/190638 bytes][Goodput ratio: 78.3/96.4][68.34 sec][Host: 205.174.165.68][bytes ratio: -0.506 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/1 377.3/618.6 3861/3861 508.3/537.9][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 305.0/1815.6 651/1936 252.6/351.0][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27UQE70NGV80W4ZBVWQELDMRMBY9BF6W552ZBHL3F4W4MIP7R7K6%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 7 TCP 172.16.0.1:56994 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62523 bytes <-> 105 pkts/190634 bytes][Goodput ratio: 78.3/96.4][67.00 sec][Host: 205.174.165.68][bytes ratio: -0.506 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/1 370.4/604.6 3818/3818 505.5/540.5][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 305.0/1815.6 651/1935 252.6/351.0][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27AA0U7VCIO18AUKPZNB0ZXFCDF9PVHM0BRGOWM22EICNEPXK5UC%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 8 TCP 172.16.0.1:52910 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62523 bytes <-> 105 pkts/190630 bytes][Goodput ratio: 78.3/96.4][68.12 sec][Host: 205.174.165.68][bytes ratio: -0.506 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/1 376.1/616.7 3808/3808 507.2/537.3][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 305.0/1815.5 651/1935 252.6/351.0][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27AQ80NQUS4TAQLQVWHMAGXB11KUBK34NZA8RUUD143IFKQDS3P5%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 9 TCP 172.16.0.1:55632 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62523 bytes <-> 105 pkts/190627 bytes][Goodput ratio: 78.3/96.4][67.55 sec][Host: 205.174.165.68][bytes ratio: -0.506 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/1 372.5/608.7 3784/3784 506.8/540.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 305.0/1815.5 651/1935 252.6/351.0][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27JUL2D3WXHEGWRAFJE2PI7OS71Z4Z8RFUHXGNFLUFYVP6M3OL55%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 10 TCP 172.16.0.1:54268 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62523 bytes <-> 105 pkts/190611 bytes][Goodput ratio: 78.3/96.4][67.52 sec][Host: 205.174.165.68][bytes ratio: -0.506 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/1 372.8/610.5 3826/3827 507.1/543.2][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 305.0/1815.3 651/1935 252.6/350.9][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%270XVM4C1CNSWY8VF443GGZ6W527WBY4H29E2XQNGG2QUPQEKW0U%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (KGET /dv/vulnerabilities/xss)] + 11 TCP 172.16.0.1:53584 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62321 bytes <-> 107 pkts/190662 bytes][Goodput ratio: 78.3/96.3][69.30 sec][Host: 205.174.165.68][bytes ratio: -0.507 (Download)][IAT c2s/s2c min/avg/max/stddev: 3/0 353.7/684.8 4897/4898 539.1/630.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 304.0/1781.9 651/1935 251.6/392.7][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 12 TCP 172.16.0.1:60464 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62321 bytes <-> 106 pkts/190596 bytes][Goodput ratio: 78.3/96.3][67.94 sec][Host: 205.174.165.68][bytes ratio: -0.507 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 339.6/695.3 3581/3582 475.3/512.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 304.0/1798.1 651/1936 251.6/372.9][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 13 TCP 172.16.0.1:57684 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62321 bytes <-> 106 pkts/190590 bytes][Goodput ratio: 78.3/96.3][66.98 sec][Host: 205.174.165.68][bytes ratio: -0.507 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 338.8/669.0 3535/3536 477.5/516.9][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 304.0/1798.0 651/1935 251.6/372.9][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 14 TCP 172.16.0.1:34940 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][206 pkts/62387 bytes <-> 105 pkts/190510 bytes][Goodput ratio: 78.2/96.4][69.37 sec][Host: 205.174.165.68][bytes ratio: -0.507 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/3 368.1/664.4 4896/4897 547.3/631.4][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 302.8/1814.4 651/1935 251.6/350.8][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 15 TCP 172.16.0.1:54956 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][205 pkts/62321 bytes <-> 105 pkts/190525 bytes][Goodput ratio: 78.3/96.4][66.90 sec][Host: 205.174.165.68][bytes ratio: -0.507 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/1 325.3/707.1 3641/3642 473.1/523.5][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 304.0/1814.5 651/1935 251.6/350.9][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 16 TCP 172.16.0.1:59732 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][206 pkts/62299 bytes <-> 106 pkts/190495 bytes][Goodput ratio: 78.2/96.3][70.21 sec][Host: 205.174.165.68][bytes ratio: -0.507 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/3 383.9/680.9 3766/3767 515.7/542.9][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 302.4/1797.1 651/1935 250.9/372.6][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27SZGGJRXX6DR9VWKN864H8LTBEZ6QC3GJPC8TUUNAED3BBL4L8P%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 17 TCP 172.16.0.1:52298 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][208 pkts/61639 bytes <-> 107 pkts/190727 bytes][Goodput ratio: 77.7/96.3][60.17 sec][Host: 205.174.165.68][bytes ratio: -0.512 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 317.3/536.3 1046/1043 421.3/406.4][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 296.3/1782.5 651/4410 247.7/575.1][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 302][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 18 TCP 172.16.0.1:35626 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][88 pkts/26722 bytes <-> 45 pkts/81226 bytes][Goodput ratio: 78.2/96.3][31.23 sec][Host: 205.174.165.68][bytes ratio: -0.505 (Download)][IAT c2s/s2c min/avg/max/stddev: 3/3 401.5/695.4 3953/3953 600.6/706.3][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 303.7/1805.0 651/1935 253.0/377.2][URL: 205.174.165.68/dv/vulnerabilities/xss_r/?name=%3Cscript%3Econsole.log%28%27KGE8ES9SCQ7FORY5VSPTYY4R4UHJNRQTPTAY6L9JR1OU40RPDA%27%29%3Bconsole.log%28document.cookie%29%3B%3C%2Fscript%3E ** XSS **][StatusCode: 200][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 19 TCP 172.16.0.1:52200 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][21 pkts/4366 bytes <-> 12 pkts/14453 bytes][Goodput ratio: 68.1/94.5][4.02 sec][Host: 205.174.165.68][bytes ratio: -0.536 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 70.9/139.6 842/846 195.9/271.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 207.9/1204.4 625/7992 186.0/2089.1][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 302][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 20 TCP 172.16.0.1:52098 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][17 pkts/3745 bytes <-> 13 pkts/13999 bytes][Goodput ratio: 69.8/93.8][6.08 sec][Host: 205.174.165.68][bytes ratio: -0.578 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 430.8/104.3 5005/845 1286.4/262.8][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 220.3/1076.8 625/7306 190.5/1848.9][URL: 205.174.165.68/dv/vulnerabilities/xss_r/][StatusCode: 302][ContentType: text/html][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/vulnerabilities/xss)] + 21 TCP 172.16.0.1:52300 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][7 pkts/1229 bytes <-> 6 pkts/6497 bytes][Goodput ratio: 61.7/93.8][6.24 sec][Host: 205.174.165.68][bytes ratio: -0.682 (Download)][IAT c2s/s2c min/avg/max/stddev: 8/0 246.0/307.8 1185/1186 469.6/507.1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 175.6/1082.8 461/5396 170.9/1948.8][URL: 205.174.165.68/dv/dvwa/js/dvwaPage.js][StatusCode: 200][ContentType: application/javascript][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/dvwa/js/dvwaPage.js HTT)] + 22 TCP 172.16.0.1:52318 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][5 pkts/696 bytes <-> 5 pkts/2045 bytes][Goodput ratio: 51.4/83.4][5.91 sec][Host: 205.174.165.68][bytes ratio: -0.492 (Download)][IAT c2s/s2c min/avg/max/stddev: 34/0 1476.2/301.0 5002/870 2065.1/402.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 139.2/409.0 424/1773 142.4/682.0][URL: 205.174.165.68/dv/favicon.ico][StatusCode: 200][ContentType: image/vnd.microsoft.icon][UserAgent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0][PLAIN TEXT (GET /dv/favicon.ico HTTP/1.1)] + 23 TCP 172.16.0.1:33068 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.73 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5728 1909.0/5728.0 5727/5728 2699.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 24 TCP 172.16.0.1:34752 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.52 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5523 1840.7/5523.0 5522/5523 2603.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 25 TCP 172.16.0.1:35208 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.79 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/5792 1930.7/5792.0 5790/5792 2729.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 26 TCP 172.16.0.1:35262 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5613 1870.7/5613.0 5612/5613 2645.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 27 TCP 172.16.0.1:52414 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.85 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/5847 1948.7/5847.0 5845/5847 2755.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 28 TCP 172.16.0.1:53450 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.99 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5993 1997.3/5993.0 5992/5993 2824.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 29 TCP 172.16.0.1:54620 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5328 1775.7/5328.0 5327/5328 2511.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 30 TCP 172.16.0.1:57170 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.46 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5459 1819.3/5459.0 5458/5459 2572.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 31 TCP 172.16.0.1:57536 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5413 1804.0/5413.0 5412/5413 2551.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 32 TCP 172.16.0.1:58116 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5975 1991.3/5975.0 5974/5975 2816.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 33 TCP 172.16.0.1:58650 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/5407 1802.3/5407.0 5406/5407 2548.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 34 TCP 172.16.0.1:58664 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/5121 1707.3/5121.0 5120/5121 2413.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 35 TCP 172.16.0.1:58690 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/5609 1869.7/5609.0 5607/5609 2642.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 36 TCP 172.16.0.1:60180 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/5570 1856.3/5570.0 5569/5570 2625.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 37 TCP 172.16.0.1:60626 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 3 pkts/206 bytes][Goodput ratio: 0.0/0.0][5.06 sec][bytes ratio: 0.138 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/5055 1685.0/5055.0 5054/5055 2382.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/68.7 74/74 3.5/3.8] + 38 TCP 172.16.0.1:32784 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.71 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1902.3/0.0 5707/0 2690.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 39 TCP 172.16.0.1:32798 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1806.0/0.0 5418/0 2554.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 40 TCP 172.16.0.1:32812 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.13 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1708.3/0.0 5125/0 2415.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 41 TCP 172.16.0.1:32838 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1856.0/0.0 5568/0 2624.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 42 TCP 172.16.0.1:32852 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.29 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1763.3/0.0 5290/0 2493.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 43 TCP 172.16.0.1:32878 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.72 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1907.0/0.0 5721/0 2696.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 44 TCP 172.16.0.1:32892 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.14 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1712.0/0.0 5135/0 2420.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 45 TCP 172.16.0.1:32932 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.60 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1866.0/0.0 5597/0 2638.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 46 TCP 172.16.0.1:32946 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1772.3/0.0 5316/0 2505.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 47 TCP 172.16.0.1:32960 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.05 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1681.7/0.0 5045/0 2378.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 48 TCP 172.16.0.1:32974 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.78 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1925.7/0.0 5777/0 2723.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 49 TCP 172.16.0.1:32988 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1830.7/0.0 5492/0 2589.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 50 TCP 172.16.0.1:33002 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.19 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1728.7/0.0 5186/0 2444.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 51 TCP 172.16.0.1:33028 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.60 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1864.7/0.0 5594/0 2637.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 52 TCP 172.16.0.1:33042 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1778.7/0.0 5336/0 2515.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 53 TCP 172.16.0.1:33082 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1806.3/0.0 5419/0 2554.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 54 TCP 172.16.0.1:33096 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1704.3/0.0 5113/0 2410.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 55 TCP 172.16.0.1:33122 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.48 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1826.0/0.0 5477/0 2581.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 56 TCP 172.16.0.1:33136 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1726.3/0.0 5179/0 2441.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 57 TCP 172.16.0.1:33162 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.65 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1882.0/0.0 5645/0 2660.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 58 TCP 172.16.0.1:33176 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.39 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1795.3/0.0 5386/0 2539.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 59 TCP 172.16.0.1:33202 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.76 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1917.7/0.0 5753/0 2712.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 60 TCP 172.16.0.1:33216 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.48 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1825.3/0.0 5476/0 2581.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 61 TCP 172.16.0.1:33230 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1724.7/0.0 5174/0 2439.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 62 TCP 172.16.0.1:33256 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.63 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1875.0/0.0 5625/0 2651.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 63 TCP 172.16.0.1:33270 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1787.7/0.0 5363/0 2528.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 64 TCP 172.16.0.1:33296 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.78 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1926.0/0.0 5778/0 2723.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 65 TCP 172.16.0.1:33310 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1837.0/0.0 5511/0 2597.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 66 TCP 172.16.0.1:33324 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1742.3/0.0 5227/0 2464.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 67 TCP 172.16.0.1:33350 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.65 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1882.7/0.0 5648/0 2662.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 68 TCP 172.16.0.1:33364 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.38 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1793.7/0.0 5381/0 2536.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 69 TCP 172.16.0.1:33378 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1705.0/0.0 5115/0 2411.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 70 TCP 172.16.0.1:33404 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.54 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1844.3/0.0 5533/0 2608.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 71 TCP 172.16.0.1:33418 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.27 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1755.0/0.0 5265/0 2481.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 72 TCP 172.16.0.1:33444 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.67 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1889.0/0.0 5667/0 2671.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 73 TCP 172.16.0.1:33458 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1790.3/0.0 5371/0 2531.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 74 TCP 172.16.0.1:33472 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1692.3/0.0 5077/0 2393.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 75 TCP 172.16.0.1:33486 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.79 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1929.7/0.0 5789/0 2729.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 76 TCP 172.16.0.1:33500 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.50 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1832.0/0.0 5495/0 2590.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 77 TCP 172.16.0.1:33526 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.78 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1926.0/0.0 5777/0 2723.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 78 TCP 172.16.0.1:33540 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1835.0/0.0 5505/0 2595.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 79 TCP 172.16.0.1:33554 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1745.0/0.0 5235/0 2467.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 80 TCP 172.16.0.1:33594 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.40 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1800.0/0.0 5400/0 2545.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 81 TCP 172.16.0.1:33608 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.13 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1709.3/0.0 5128/0 2417.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 82 TCP 172.16.0.1:33634 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1858.0/0.0 5574/0 2627.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 83 TCP 172.16.0.1:33648 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1766.3/0.0 5299/0 2498.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 84 TCP 172.16.0.1:33674 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.73 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1908.7/0.0 5726/0 2699.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 85 TCP 172.16.0.1:33688 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1821.3/0.0 5464/0 2575.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 86 TCP 172.16.0.1:33702 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1725.0/0.0 5175/0 2439.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 87 TCP 172.16.0.1:33728 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1858.0/0.0 5574/0 2627.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 88 TCP 172.16.0.1:33742 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1766.0/0.0 5298/0 2497.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 89 TCP 172.16.0.1:33768 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.68 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1893.0/0.0 5679/0 2677.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 90 TCP 172.16.0.1:33782 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1778.7/0.0 5336/0 2515.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 91 TCP 172.16.0.1:33808 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.78 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1926.3/0.0 5779/0 2724.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 92 TCP 172.16.0.1:33822 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.48 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1825.3/0.0 5476/0 2581.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 93 TCP 172.16.0.1:33836 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.16 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1719.0/0.0 5157/0 2431.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 94 TCP 172.16.0.1:33862 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.60 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1866.3/0.0 5598/0 2638.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 95 TCP 172.16.0.1:33876 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1776.7/0.0 5330/0 2512.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 96 TCP 172.16.0.1:33902 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.75 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1916.7/0.0 5750/0 2710.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 97 TCP 172.16.0.1:33916 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1829.7/0.0 5489/0 2587.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 98 TCP 172.16.0.1:33930 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1727.0/0.0 5181/0 2442.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 99 TCP 172.16.0.1:33956 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.62 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1874.0/0.0 5622/0 2650.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 100 TCP 172.16.0.1:33970 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1766.7/0.0 5300/0 2498.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 101 TCP 172.16.0.1:33996 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.74 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1911.3/0.0 5734/0 2703.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 102 TCP 172.16.0.1:34010 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.46 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1819.7/0.0 5459/0 2573.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 103 TCP 172.16.0.1:34024 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.17 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1721.7/0.0 5165/0 2434.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 104 TCP 172.16.0.1:34050 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.56 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1851.3/0.0 5554/0 2618.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 105 TCP 172.16.0.1:34064 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.27 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1756.3/0.0 5269/0 2483.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 106 TCP 172.16.0.1:34090 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.71 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1902.3/0.0 5706/0 2689.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 107 TCP 172.16.0.1:34104 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1802.0/0.0 5406/0 2548.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 108 TCP 172.16.0.1:34118 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.14 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1713.7/0.0 5141/0 2423.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 109 TCP 172.16.0.1:34144 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1850.0/0.0 5550/0 2616.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 110 TCP 172.16.0.1:34158 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.22 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1740.3/0.0 5221/0 2461.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 111 TCP 172.16.0.1:34184 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1871.0/0.0 5613/0 2646.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 112 TCP 172.16.0.1:34198 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.35 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1783.0/0.0 5349/0 2521.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 113 TCP 172.16.0.1:34224 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.73 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1909.3/0.0 5728/0 2700.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 114 TCP 172.16.0.1:34238 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1812.0/0.0 5436/0 2562.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 115 TCP 172.16.0.1:34252 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1716.0/0.0 5146/0 2425.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 116 TCP 172.16.0.1:34292 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.29 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1762.7/0.0 5288/0 2492.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 117 TCP 172.16.0.1:34318 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.74 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1912.3/0.0 5737/0 2704.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 118 TCP 172.16.0.1:34332 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.45 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1814.3/0.0 5443/0 2565.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 119 TCP 172.16.0.1:34346 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.17 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1721.3/0.0 5164/0 2434.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 120 TCP 172.16.0.1:34372 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.59 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1863.7/0.0 5591/0 2635.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 121 TCP 172.16.0.1:34386 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1765.7/0.0 5297/0 2497.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 122 TCP 172.16.0.1:34412 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.73 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1907.7/0.0 5723/0 2697.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 123 TCP 172.16.0.1:34426 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.45 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1815.0/0.0 5445/0 2566.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 124 TCP 172.16.0.1:34440 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1715.7/0.0 5147/0 2426.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 125 TCP 172.16.0.1:34466 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1867.3/0.0 5602/0 2640.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 126 TCP 172.16.0.1:34480 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1766.0/0.0 5298/0 2497.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 127 TCP 172.16.0.1:34506 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.72 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1906.3/0.0 5719/0 2696.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 128 TCP 172.16.0.1:34520 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1802.0/0.0 5406/0 2548.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 129 TCP 172.16.0.1:34534 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1704.0/0.0 5112/0 2409.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 130 TCP 172.16.0.1:34548 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.76 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1918.0/0.0 5754/0 2712.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 131 TCP 172.16.0.1:34562 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1822.7/0.0 5468/0 2577.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 132 TCP 172.16.0.1:34576 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.16 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1721.0/0.0 5163/0 2433.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 133 TCP 172.16.0.1:34602 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.62 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1874.0/0.0 5622/0 2650.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 134 TCP 172.16.0.1:34616 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1776.0/0.0 5328/0 2511.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 135 TCP 172.16.0.1:34642 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.78 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1925.3/0.0 5776/0 2722.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 136 TCP 172.16.0.1:34656 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.52 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1839.7/0.0 5518/0 2601.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 137 TCP 172.16.0.1:34670 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1744.3/0.0 5232/0 2466.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 138 TCP 172.16.0.1:34696 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.64 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1880.0/0.0 5640/0 2658.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 139 TCP 172.16.0.1:34710 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1789.3/0.0 5368/0 2530.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 140 TCP 172.16.0.1:34724 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1703.0/0.0 5109/0 2408.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 141 TCP 172.16.0.1:34738 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.83 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1943.7/0.0 5831/0 2748.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 142 TCP 172.16.0.1:34766 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.21 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1735.7/0.0 5207/0 2454.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 143 TCP 172.16.0.1:34792 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.66 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1887.0/0.0 5661/0 2668.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 144 TCP 172.16.0.1:34806 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1789.7/0.0 5369/0 2531.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 145 TCP 172.16.0.1:34832 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.76 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1919.0/0.0 5756/0 2713.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 146 TCP 172.16.0.1:34846 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1828.3/0.0 5485/0 2585.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 147 TCP 172.16.0.1:34860 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.22 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1738.3/0.0 5215/0 2458.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 148 TCP 172.16.0.1:34886 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1851.0/0.0 5553/0 2617.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 149 TCP 172.16.0.1:34900 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1764.0/0.0 5292/0 2494.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 150 TCP 172.16.0.1:34926 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.75 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1917.0/0.0 5751/0 2711.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 151 TCP 172.16.0.1:34954 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.16 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1720.0/0.0 5160/0 2432.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 152 TCP 172.16.0.1:34980 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1856.0/0.0 5568/0 2624.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 153 TCP 172.16.0.1:34994 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1767.3/0.0 5302/0 2499.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 154 TCP 172.16.0.1:35020 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.76 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1919.3/0.0 5757/0 2713.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 155 TCP 172.16.0.1:35034 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1823.3/0.0 5470/0 2578.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 156 TCP 172.16.0.1:35048 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1725.0/0.0 5175/0 2439.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 157 TCP 172.16.0.1:35074 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.66 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1884.7/0.0 5653/0 2664.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 158 TCP 172.16.0.1:35088 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.38 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1792.7/0.0 5378/0 2535.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 159 TCP 172.16.0.1:35114 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.85 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1948.3/0.0 5845/0 2755.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 160 TCP 172.16.0.1:35128 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1849.3/0.0 5548/0 2615.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 161 TCP 172.16.0.1:35142 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.25 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1748.7/0.0 5246/0 2473.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 162 TCP 172.16.0.1:35168 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.70 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1900.3/0.0 5701/0 2687.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 163 TCP 172.16.0.1:35182 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1803.7/0.0 5411/0 2550.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 164 TCP 172.16.0.1:35222 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1837.7/0.0 5513/0 2598.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 165 TCP 172.16.0.1:35236 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.22 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1740.7/0.0 5222/0 2461.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 166 TCP 172.16.0.1:35276 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1780.0/0.0 5340/0 2517.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 167 TCP 172.16.0.1:35302 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.74 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1911.3/0.0 5734/0 2703.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 168 TCP 172.16.0.1:35316 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1824.0/0.0 5472/0 2579.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 169 TCP 172.16.0.1:35342 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.82 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1940.7/0.0 5822/0 2744.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 170 TCP 172.16.0.1:35356 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.53 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1842.0/0.0 5526/0 2605.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 171 TCP 172.16.0.1:35370 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1747.0/0.0 5241/0 2470.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 172 TCP 172.16.0.1:35396 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.65 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1882.7/0.0 5648/0 2662.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 173 TCP 172.16.0.1:35410 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1788.3/0.0 5364/0 2528.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 174 TCP 172.16.0.1:35436 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.83 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1944.3/0.0 5832/0 2749.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 175 TCP 172.16.0.1:35450 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1850.0/0.0 5550/0 2616.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 176 TCP 172.16.0.1:35464 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.27 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1756.7/0.0 5270/0 2484.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 177 TCP 172.16.0.1:35490 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.68 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1894.3/0.0 5683/0 2679.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 178 TCP 172.16.0.1:35504 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.38 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1792.3/0.0 5377/0 2534.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 179 TCP 172.16.0.1:35518 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1707.3/0.0 5122/0 2414.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 180 TCP 172.16.0.1:35532 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.85 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1947.7/0.0 5843/0 2754.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 181 TCP 172.16.0.1:35546 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.52 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1840.0/0.0 5520/0 2602.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 182 TCP 172.16.0.1:35560 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1743.0/0.0 5229/0 2465.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 183 TCP 172.16.0.1:35586 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.67 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1890.0/0.0 5670/0 2672.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 184 TCP 172.16.0.1:35600 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1789.3/0.0 5367/0 2529.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 185 TCP 172.16.0.1:35640 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1829.7/0.0 5489/0 2587.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 186 TCP 172.16.0.1:35654 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.13 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1708.3/0.0 5125/0 2415.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 187 TCP 172.16.0.1:35668 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.83 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1942.7/0.0 5828/0 2747.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 188 TCP 172.16.0.1:35682 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1850.7/0.0 5552/0 2617.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 189 TCP 172.16.0.1:35696 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.25 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1749.0/0.0 5247/0 2473.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 190 TCP 172.16.0.1:35722 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.70 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1899.7/0.0 5699/0 2686.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 191 TCP 172.16.0.1:35736 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.39 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1795.7/0.0 5387/0 2539.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 192 TCP 172.16.0.1:35762 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.81 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1935.7/0.0 5806/0 2736.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 193 TCP 172.16.0.1:35776 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.50 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1832.3/0.0 5497/0 2591.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 194 TCP 172.16.0.1:35790 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.21 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1734.7/0.0 5204/0 2453.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 195 TCP 172.16.0.1:35816 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.62 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1874.0/0.0 5621/0 2649.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 196 TCP 172.16.0.1:35830 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1784.7/0.0 5354/0 2523.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 197 TCP 172.16.0.1:35856 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.80 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1931.0/0.0 5793/0 2730.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 198 TCP 172.16.0.1:35870 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1836.3/0.0 5509/0 2597.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 199 TCP 172.16.0.1:35884 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.25 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1749.3/0.0 5248/0 2473.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 200 TCP 172.16.0.1:52100 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.95 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1981.7/0.0 5945/0 2802.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 201 TCP 172.16.0.1:52118 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.64 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1879.0/0.0 5637/0 2657.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 202 TCP 172.16.0.1:52120 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.64 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1879.0/0.0 5637/0 2657.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 203 TCP 172.16.0.1:52202 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][3.96 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1319.0/0.0 3957/0 1865.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 204 TCP 172.16.0.1:52220 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][3.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1202.0/0.0 3606/0 1699.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 205 TCP 172.16.0.1:52222 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][3.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1202.0/0.0 3606/0 1699.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 206 TCP 172.16.0.1:52320 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1868.7/0.0 5606/0 2642.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 207 TCP 172.16.0.1:52386 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.43 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1810.0/0.0 5430/0 2559.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 208 TCP 172.16.0.1:52400 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.14 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1712.3/0.0 5137/0 2421.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 209 TCP 172.16.0.1:52440 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.29 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1763.0/0.0 5289/0 2493.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 210 TCP 172.16.0.1:52454 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1675.7/0.0 5027/0 2369.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 211 TCP 172.16.0.1:52480 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1821.3/0.0 5464/0 2575.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 212 TCP 172.16.0.1:52494 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1724.7/0.0 5174/0 2439.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 213 TCP 172.16.0.1:52508 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.88 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1959.7/0.0 5879/0 2771.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 214 TCP 172.16.0.1:52534 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1765.0/0.0 5295/0 2496.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 215 TCP 172.16.0.1:52548 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1677.3/0.0 5031/0 2371.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 216 TCP 172.16.0.1:52574 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.50 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1833.3/0.0 5499/0 2592.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 217 TCP 172.16.0.1:52588 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.21 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1737.0/0.0 5211/0 2456.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 218 TCP 172.16.0.1:52602 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.92 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1971.7/0.0 5915/0 2788.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 219 TCP 172.16.0.1:52628 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.38 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1792.3/0.0 5377/0 2534.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 220 TCP 172.16.0.1:52642 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1705.0/0.0 5115/0 2411.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 221 TCP 172.16.0.1:52668 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.53 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1843.7/0.0 5531/0 2607.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 222 TCP 172.16.0.1:52682 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.26 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1754.0/0.0 5262/0 2480.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 223 TCP 172.16.0.1:52696 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][6.00 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1998.0/0.0 5994/0 2825.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 224 TCP 172.16.0.1:52722 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.45 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1815.7/0.0 5447/0 2567.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 225 TCP 172.16.0.1:52736 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.16 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1719.0/0.0 5157/0 2431.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 226 TCP 172.16.0.1:52750 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.87 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1956.0/0.0 5868/0 2766.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 227 TCP 172.16.0.1:52776 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.29 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1761.3/0.0 5284/0 2490.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 228 TCP 172.16.0.1:52790 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.99 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1997.7/0.0 5993/0 2825.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 229 TCP 172.16.0.1:52816 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1806.0/0.0 5418/0 2554.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 230 TCP 172.16.0.1:52830 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1701.3/0.0 5104/0 2406.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 231 TCP 172.16.0.1:52856 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.53 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1843.0/0.0 5529/0 2606.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 232 TCP 172.16.0.1:52870 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1747.3/0.0 5242/0 2471.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 233 TCP 172.16.0.1:52884 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1992.0/0.0 5976/0 2817.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 234 TCP 172.16.0.1:52924 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1716.3/0.0 5149/0 2427.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 235 TCP 172.16.0.1:52938 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.87 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1956.0/0.0 5867/0 2765.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 236 TCP 172.16.0.1:52964 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1780.3/0.0 5341/0 2517.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 237 TCP 172.16.0.1:52978 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1677.0/0.0 5030/0 2370.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 238 TCP 172.16.0.1:53004 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1823.0/0.0 5468/0 2577.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 239 TCP 172.16.0.1:53018 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1733.7/0.0 5201/0 2451.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 240 TCP 172.16.0.1:53032 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.95 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1981.3/0.0 5944/0 2802.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 241 TCP 172.16.0.1:53058 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1790.7/0.0 5372/0 2532.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 242 TCP 172.16.0.1:53072 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1691.3/0.0 5074/0 2391.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 243 TCP 172.16.0.1:53098 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.48 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1826.0/0.0 5478/0 2582.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 244 TCP 172.16.0.1:53112 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.19 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1729.3/0.0 5188/0 2445.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 245 TCP 172.16.0.1:53126 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.89 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1962.7/0.0 5888/0 2775.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 246 TCP 172.16.0.1:53152 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.29 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1763.7/0.0 5291/0 2494.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 247 TCP 172.16.0.1:53166 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][6.00 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1999.0/0.0 5997/0 2827.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 248 TCP 172.16.0.1:53192 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.45 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1816.3/0.0 5449/0 2568.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 249 TCP 172.16.0.1:53206 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1725.0/0.0 5175/0 2439.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 250 TCP 172.16.0.1:53220 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.89 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1962.3/0.0 5887/0 2775.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 251 TCP 172.16.0.1:53246 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1780.3/0.0 5341/0 2517.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 252 TCP 172.16.0.1:53260 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1689.7/0.0 5069/0 2389.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 253 TCP 172.16.0.1:53286 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.48 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1827.3/0.0 5482/0 2584.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 254 TCP 172.16.0.1:53300 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.21 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1735.7/0.0 5207/0 2454.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 255 TCP 172.16.0.1:53314 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.95 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1981.3/0.0 5944/0 2802.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 256 TCP 172.16.0.1:53340 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1787.7/0.0 5363/0 2528.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 257 TCP 172.16.0.1:53354 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1678.3/0.0 5035/0 2373.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 258 TCP 172.16.0.1:53380 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1821.0/0.0 5463/0 2575.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 259 TCP 172.16.0.1:53394 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.19 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1727.7/0.0 5183/0 2443.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 260 TCP 172.16.0.1:53408 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.84 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1946.7/0.0 5840/0 2753.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 261 TCP 172.16.0.1:53422 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1850.0/0.0 5550/0 2616.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 262 TCP 172.16.0.1:53436 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.28 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1759.0/0.0 5277/0 2487.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 263 TCP 172.16.0.1:53476 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.38 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1793.3/0.0 5380/0 2536.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 264 TCP 172.16.0.1:53490 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.09 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1694.7/0.0 5084/0 2396.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 265 TCP 172.16.0.1:53516 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.54 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1844.7/0.0 5534/0 2608.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 266 TCP 172.16.0.1:53530 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.27 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1754.3/0.0 5263/0 2481.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 267 TCP 172.16.0.1:53544 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1992.0/0.0 5976/0 2817.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 268 TCP 172.16.0.1:53570 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1812.3/0.0 5437/0 2563.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 269 TCP 172.16.0.1:53598 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.89 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1964.0/0.0 5892/0 2777.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 270 TCP 172.16.0.1:53624 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1775.3/0.0 5326/0 2510.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 271 TCP 172.16.0.1:53638 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1676.7/0.0 5030/0 2371.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 272 TCP 172.16.0.1:53664 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1828.7/0.0 5486/0 2586.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 273 TCP 172.16.0.1:53678 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1734.3/0.0 5202/0 2452.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 274 TCP 172.16.0.1:53692 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.92 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1974.0/0.0 5922/0 2791.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 275 TCP 172.16.0.1:53718 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.38 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1791.7/0.0 5375/0 2533.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 276 TCP 172.16.0.1:53732 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1692.0/0.0 5076/0 2392.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 277 TCP 172.16.0.1:53758 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.53 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1843.3/0.0 5530/0 2606.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 278 TCP 172.16.0.1:53772 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1745.0/0.0 5234/0 2467.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 279 TCP 172.16.0.1:53786 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.94 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1979.0/0.0 5937/0 2798.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 280 TCP 172.16.0.1:53812 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.31 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1769.0/0.0 5307/0 2501.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 281 TCP 172.16.0.1:53826 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1680.0/0.0 5040/0 2375.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 282 TCP 172.16.0.1:53852 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1823.3/0.0 5470/0 2578.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 283 TCP 172.16.0.1:53866 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.19 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1730.7/0.0 5192/0 2447.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 284 TCP 172.16.0.1:53880 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.91 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1968.0/0.0 5904/0 2783.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 285 TCP 172.16.0.1:53906 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1778.7/0.0 5336/0 2515.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 286 TCP 172.16.0.1:53920 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1688.0/0.0 5064/0 2387.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 287 TCP 172.16.0.1:53946 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1837.0/0.0 5511/0 2597.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 288 TCP 172.16.0.1:53960 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.22 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1738.7/0.0 5215/0 2458.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 289 TCP 172.16.0.1:53974 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.95 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1982.3/0.0 5947/0 2803.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 290 TCP 172.16.0.1:54000 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1803.7/0.0 5411/0 2550.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 291 TCP 172.16.0.1:54014 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.10 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1699.7/0.0 5098/0 2403.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 292 TCP 172.16.0.1:54040 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.54 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1846.7/0.0 5540/0 2611.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 293 TCP 172.16.0.1:54054 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1746.3/0.0 5239/0 2469.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 294 TCP 172.16.0.1:54068 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1991.7/0.0 5975/0 2816.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 295 TCP 172.16.0.1:54094 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.39 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1794.7/0.0 5384/0 2538.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 296 TCP 172.16.0.1:54108 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.13 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1709.7/0.0 5129/0 2417.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 297 TCP 172.16.0.1:54134 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1805.7/0.0 5417/0 2553.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 298 TCP 172.16.0.1:54148 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.14 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1711.3/0.0 5134/0 2420.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 299 TCP 172.16.0.1:54162 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.87 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1956.0/0.0 5868/0 2766.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 300 TCP 172.16.0.1:54188 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.31 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1770.0/0.0 5310/0 2503.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 301 TCP 172.16.0.1:54202 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1675.3/0.0 5026/0 2369.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 302 TCP 172.16.0.1:54228 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1778.0/0.0 5334/0 2514.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 303 TCP 172.16.0.1:54242 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1691.7/0.0 5075/0 2392.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 304 TCP 172.16.0.1:54282 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1732.7/0.0 5198/0 2450.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 305 TCP 172.16.0.1:54296 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.92 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1972.3/0.0 5917/0 2789.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 306 TCP 172.16.0.1:54322 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1785.7/0.0 5357/0 2525.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 307 TCP 172.16.0.1:54336 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.09 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1695.0/0.0 5085/0 2397.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 308 TCP 172.16.0.1:54362 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.56 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1854.0/0.0 5561/0 2621.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 309 TCP 172.16.0.1:54376 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.29 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1762.0/0.0 5286/0 2491.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 310 TCP 172.16.0.1:54390 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.99 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1998.0/0.0 5993/0 2824.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 311 TCP 172.16.0.1:54416 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1804.3/0.0 5413/0 2551.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 312 TCP 172.16.0.1:54430 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1707.0/0.0 5121/0 2414.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 313 TCP 172.16.0.1:54456 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1828.0/0.0 5484/0 2585.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 314 TCP 172.16.0.1:54470 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1742.3/0.0 5227/0 2464.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 315 TCP 172.16.0.1:54484 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.95 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1982.7/0.0 5948/0 2803.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 316 TCP 172.16.0.1:54510 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.38 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1792.3/0.0 5377/0 2534.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 317 TCP 172.16.0.1:54524 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1705.3/0.0 5116/0 2411.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 318 TCP 172.16.0.1:54538 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.87 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1955.3/0.0 5866/0 2765.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 319 TCP 172.16.0.1:54552 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.62 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1871.3/0.0 5614/0 2646.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 320 TCP 172.16.0.1:54566 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1788.7/0.0 5366/0 2529.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 321 TCP 172.16.0.1:54580 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1706.7/0.0 5120/0 2413.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 322 TCP 172.16.0.1:54606 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1856.0/0.0 5568/0 2624.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 323 TCP 172.16.0.1:54634 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1680.3/0.0 5041/0 2376.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 324 TCP 172.16.0.1:54660 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.50 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1833.0/0.0 5499/0 2592.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 325 TCP 172.16.0.1:54674 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1732.7/0.0 5198/0 2450.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 326 TCP 172.16.0.1:54688 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.95 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1982.7/0.0 5948/0 2803.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 327 TCP 172.16.0.1:54714 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.46 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1819.0/0.0 5456/0 2571.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 328 TCP 172.16.0.1:54728 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1724.7/0.0 5174/0 2439.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 329 TCP 172.16.0.1:54742 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.91 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1969.3/0.0 5908/0 2785.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 330 TCP 172.16.0.1:54768 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1801.0/0.0 5403/0 2547.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 331 TCP 172.16.0.1:54782 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1717.3/0.0 5151/0 2428.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 332 TCP 172.16.0.1:54808 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.59 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1861.7/0.0 5585/0 2632.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 333 TCP 172.16.0.1:54822 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1770.7/0.0 5312/0 2504.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 334 TCP 172.16.0.1:54836 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.02 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1671.7/0.0 5015/0 2364.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 335 TCP 172.16.0.1:54862 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1822.3/0.0 5467/0 2577.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 336 TCP 172.16.0.1:54876 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1742.7/0.0 5228/0 2464.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 337 TCP 172.16.0.1:54890 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1993.7/0.0 5981/0 2819.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 338 TCP 172.16.0.1:54916 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1779.3/0.0 5338/0 2516.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 339 TCP 172.16.0.1:54930 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.09 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1695.7/0.0 5087/0 2398.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 340 TCP 172.16.0.1:54970 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.26 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1754.0/0.0 5262/0 2480.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 341 TCP 172.16.0.1:54984 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.99 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1996.3/0.0 5989/0 2823.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 342 TCP 172.16.0.1:55010 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.46 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1820.3/0.0 5461/0 2574.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 343 TCP 172.16.0.1:55024 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.21 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1737.0/0.0 5211/0 2456.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 344 TCP 172.16.0.1:55038 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.97 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1988.0/0.0 5964/0 2811.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 345 TCP 172.16.0.1:55064 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1807.0/0.0 5420/0 2554.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 346 TCP 172.16.0.1:55078 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.17 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1721.3/0.0 5164/0 2434.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 347 TCP 172.16.0.1:55092 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.90 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1965.3/0.0 5896/0 2779.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 348 TCP 172.16.0.1:55118 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.35 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1783.0/0.0 5349/0 2521.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 349 TCP 172.16.0.1:55132 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1700.7/0.0 5102/0 2405.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 350 TCP 172.16.0.1:55158 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1856.3/0.0 5569/0 2625.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 351 TCP 172.16.0.1:55172 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.31 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1770.3/0.0 5311/0 2503.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 352 TCP 172.16.0.1:55186 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1678.0/0.0 5033/0 2372.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 353 TCP 172.16.0.1:55212 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1835.3/0.0 5506/0 2595.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 354 TCP 172.16.0.1:55226 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1747.0/0.0 5241/0 2470.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 355 TCP 172.16.0.1:55240 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.97 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1991.0/0.0 5973/0 2815.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 356 TCP 172.16.0.1:55266 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1820.7/0.0 5462/0 2574.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 357 TCP 172.16.0.1:55280 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.22 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1737.7/0.0 5213/0 2457.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 358 TCP 172.16.0.1:55294 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.93 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1976.3/0.0 5929/0 2795.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 359 TCP 172.16.0.1:55320 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.40 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1800.0/0.0 5400/0 2545.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 360 TCP 172.16.0.1:55334 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1716.0/0.0 5148/0 2426.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 361 TCP 172.16.0.1:55348 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.89 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1962.0/0.0 5886/0 2774.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 362 TCP 172.16.0.1:55362 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.59 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1864.3/0.0 5593/0 2636.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 363 TCP 172.16.0.1:55376 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1771.7/0.0 5315/0 2505.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 364 TCP 172.16.0.1:55390 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1677.3/0.0 5032/0 2372.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 365 TCP 172.16.0.1:55416 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.53 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1843.0/0.0 5529/0 2606.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 366 TCP 172.16.0.1:55430 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1741.0/0.0 5223/0 2462.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 367 TCP 172.16.0.1:55444 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.95 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1983.7/0.0 5951/0 2805.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 368 TCP 172.16.0.1:55470 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1805.0/0.0 5415/0 2552.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 369 TCP 172.16.0.1:55484 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1724.3/0.0 5173/0 2438.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 370 TCP 172.16.0.1:55510 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.65 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1881.7/0.0 5645/0 2661.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 371 TCP 172.16.0.1:55524 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1790.0/0.0 5370/0 2531.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 372 TCP 172.16.0.1:55538 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1707.3/0.0 5121/0 2413.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 373 TCP 172.16.0.1:55564 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1860.7/0.0 5582/0 2631.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 374 TCP 172.16.0.1:55578 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1764.3/0.0 5293/0 2495.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 375 TCP 172.16.0.1:55592 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1679.0/0.0 5037/0 2374.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 376 TCP 172.16.0.1:55618 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1687.7/0.0 5063/0 2386.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 377 TCP 172.16.0.1:55646 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.97 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1991.0/0.0 5973/0 2815.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 378 TCP 172.16.0.1:55672 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.48 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1825.0/0.0 5475/0 2580.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 379 TCP 172.16.0.1:55686 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1745.7/0.0 5237/0 2468.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 380 TCP 172.16.0.1:55700 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.97 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1989.0/0.0 5967/0 2812.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 381 TCP 172.16.0.1:55726 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1812.0/0.0 5436/0 2562.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 382 TCP 172.16.0.1:55740 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1726.3/0.0 5179/0 2441.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 383 TCP 172.16.0.1:55766 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1858.3/0.0 5575/0 2628.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 384 TCP 172.16.0.1:55780 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1766.3/0.0 5299/0 2498.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 385 TCP 172.16.0.1:55794 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.02 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1673.7/0.0 5021/0 2366.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 386 TCP 172.16.0.1:55820 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.39 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1796.0/0.0 5388/0 2539.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 387 TCP 172.16.0.1:55834 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.14 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1712.0/0.0 5136/0 2421.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 388 TCP 172.16.0.1:55860 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.60 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1865.7/0.0 5597/0 2638.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 389 TCP 172.16.0.1:55874 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.35 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1781.7/0.0 5345/0 2519.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 390 TCP 172.16.0.1:55888 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1690.7/0.0 5072/0 2391.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 391 TCP 172.16.0.1:55914 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.53 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1841.3/0.0 5523/0 2603.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 392 TCP 172.16.0.1:55928 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1746.0/0.0 5238/0 2469.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 393 TCP 172.16.0.1:55942 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.99 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1997.7/0.0 5992/0 2824.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 394 TCP 172.16.0.1:55968 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1823.0/0.0 5469/0 2578.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 395 TCP 172.16.0.1:55982 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.17 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1722.0/0.0 5166/0 2435.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 396 TCP 172.16.0.1:55996 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.93 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1976.3/0.0 5929/0 2795.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 397 TCP 172.16.0.1:56022 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1802.7/0.0 5408/0 2549.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 398 TCP 172.16.0.1:56036 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1704.3/0.0 5112/0 2409.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 399 TCP 172.16.0.1:56062 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1857.0/0.0 5571/0 2626.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 400 TCP 172.16.0.1:56076 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.29 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1762.7/0.0 5288/0 2492.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 401 TCP 172.16.0.1:56090 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1680.0/0.0 5040/0 2375.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 402 TCP 172.16.0.1:56116 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.48 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1827.0/0.0 5481/0 2583.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 403 TCP 172.16.0.1:56130 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1741.3/0.0 5224/0 2462.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 404 TCP 172.16.0.1:56144 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.93 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1976.0/0.0 5928/0 2794.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 405 TCP 172.16.0.1:56158 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1868.0/0.0 5604/0 2641.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 406 TCP 172.16.0.1:56172 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1775.0/0.0 5325/0 2510.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 407 TCP 172.16.0.1:56186 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1679.3/0.0 5038/0 2374.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 408 TCP 172.16.0.1:56212 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.50 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1833.3/0.0 5500/0 2592.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 409 TCP 172.16.0.1:56226 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1742.7/0.0 5228/0 2464.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 410 TCP 172.16.0.1:56240 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.94 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1978.7/0.0 5936/0 2798.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 411 TCP 172.16.0.1:56266 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1804.3/0.0 5413/0 2551.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 412 TCP 172.16.0.1:56280 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.02 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1671.3/0.0 5014/0 2363.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 413 TCP 172.16.0.1:56320 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1745.3/0.0 5236/0 2468.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 414 TCP 172.16.0.1:56334 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.99 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1996.0/0.0 5987/0 2822.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 415 TCP 172.16.0.1:56360 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.43 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1810.3/0.0 5430/0 2559.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 416 TCP 172.16.0.1:56374 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1724.7/0.0 5174/0 2439.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 417 TCP 172.16.0.1:56400 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.66 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1886.3/0.0 5659/0 2667.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 418 TCP 172.16.0.1:56414 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.40 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1798.3/0.0 5395/0 2543.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 419 TCP 172.16.0.1:56428 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.13 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1709.7/0.0 5129/0 2417.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 420 TCP 172.16.0.1:56454 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.64 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1879.7/0.0 5639/0 2658.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 421 TCP 172.16.0.1:56468 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.38 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1792.7/0.0 5378/0 2535.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 422 TCP 172.16.0.1:56482 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1705.0/0.0 5115/0 2411.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 423 TCP 172.16.0.1:56508 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1860.7/0.0 5581/0 2630.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 424 TCP 172.16.0.1:56522 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1776.7/0.0 5330/0 2512.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 425 TCP 172.16.0.1:56536 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1693.3/0.0 5080/0 2394.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 426 TCP 172.16.0.1:56562 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1849.3/0.0 5548/0 2615.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 427 TCP 172.16.0.1:56576 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1765.3/0.0 5296/0 2496.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 428 TCP 172.16.0.1:56590 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1675.3/0.0 5026/0 2369.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 429 TCP 172.16.0.1:56616 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.54 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1844.7/0.0 5534/0 2608.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 430 TCP 172.16.0.1:56630 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1746.7/0.0 5240/0 2470.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 431 TCP 172.16.0.1:56644 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.99 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1995.0/0.0 5985/0 2821.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 432 TCP 172.16.0.1:56670 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1805.3/0.0 5416/0 2553.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 433 TCP 172.16.0.1:56684 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.14 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1714.0/0.0 5141/0 2423.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 434 TCP 172.16.0.1:56710 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.59 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1862.3/0.0 5587/0 2633.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 435 TCP 172.16.0.1:56724 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1775.0/0.0 5324/0 2509.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 436 TCP 172.16.0.1:56738 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.99 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1996.0/0.0 5987/0 2822.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 437 TCP 172.16.0.1:56764 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1821.7/0.0 5465/0 2576.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 438 TCP 172.16.0.1:56778 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.21 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1736.7/0.0 5210/0 2456.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 439 TCP 172.16.0.1:56792 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.97 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1990.3/0.0 5971/0 2814.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 440 TCP 172.16.0.1:56818 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.40 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1799.0/0.0 5397/0 2544.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 441 TCP 172.16.0.1:56832 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1716.3/0.0 5149/0 2427.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 442 TCP 172.16.0.1:56858 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.63 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1875.0/0.0 5625/0 2651.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 443 TCP 172.16.0.1:56872 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1786.3/0.0 5359/0 2526.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 444 TCP 172.16.0.1:56886 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1694.3/0.0 5082/0 2395.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 445 TCP 172.16.0.1:56912 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1855.3/0.0 5566/0 2623.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 446 TCP 172.16.0.1:56926 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1774.0/0.0 5322/0 2508.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 447 TCP 172.16.0.1:56940 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.02 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1672.7/0.0 5018/0 2365.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 448 TCP 172.16.0.1:56966 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1828.3/0.0 5485/0 2585.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 449 TCP 172.16.0.1:56980 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.09 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1695.0/0.0 5085/0 2397.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 450 TCP 172.16.0.1:57008 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.66 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1887.0/0.0 5661/0 2668.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 451 TCP 172.16.0.1:57022 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.40 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1799.3/0.0 5398/0 2544.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 452 TCP 172.16.0.1:57036 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.13 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1708.7/0.0 5126/0 2416.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 453 TCP 172.16.0.1:57062 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1869.7/0.0 5609/0 2644.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 454 TCP 172.16.0.1:57076 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1788.0/0.0 5364/0 2528.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 455 TCP 172.16.0.1:57090 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.06 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1687.0/0.0 5061/0 2385.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 456 TCP 172.16.0.1:57116 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.54 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1846.3/0.0 5539/0 2611.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 457 TCP 172.16.0.1:57130 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.25 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1750.0/0.0 5250/0 2474.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 458 TCP 172.16.0.1:57144 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1993.0/0.0 5978/0 2817.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 459 TCP 172.16.0.1:57184 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.19 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1730.3/0.0 5191/0 2447.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 460 TCP 172.16.0.1:57210 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1870.7/0.0 5612/0 2645.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 461 TCP 172.16.0.1:57224 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1789.3/0.0 5368/0 2530.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 462 TCP 172.16.0.1:57238 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1702.0/0.0 5106/0 2407.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 463 TCP 172.16.0.1:57264 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1858.0/0.0 5574/0 2627.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 464 TCP 172.16.0.1:57278 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1771.3/0.0 5314/0 2505.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 465 TCP 172.16.0.1:57292 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1688.0/0.0 5063/0 2386.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 466 TCP 172.16.0.1:57318 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.56 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1851.3/0.0 5554/0 2618.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 467 TCP 172.16.0.1:57332 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.31 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1769.0/0.0 5307/0 2501.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 468 TCP 172.16.0.1:57346 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.01 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1668.0/0.0 5004/0 2358.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 469 TCP 172.16.0.1:57372 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1837.0/0.0 5511/0 2597.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 470 TCP 172.16.0.1:57386 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.28 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1757.7/0.0 5273/0 2485.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 471 TCP 172.16.0.1:57400 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1676.7/0.0 5030/0 2371.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 472 TCP 172.16.0.1:57426 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1828.0/0.0 5484/0 2585.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 473 TCP 172.16.0.1:57440 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1742.7/0.0 5228/0 2464.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 474 TCP 172.16.0.1:57454 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1993.3/0.0 5979/0 2818.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 475 TCP 172.16.0.1:57480 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1811.3/0.0 5434/0 2561.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 476 TCP 172.16.0.1:57494 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.19 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1728.7/0.0 5186/0 2444.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 477 TCP 172.16.0.1:57508 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.95 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1982.0/0.0 5946/0 2803.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 478 TCP 172.16.0.1:57522 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.68 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1893.0/0.0 5679/0 2677.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 479 TCP 172.16.0.1:57550 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1715.7/0.0 5147/0 2426.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 480 TCP 172.16.0.1:57576 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.64 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1880.3/0.0 5641/0 2659.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 481 TCP 172.16.0.1:57590 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1786.3/0.0 5358/0 2525.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 482 TCP 172.16.0.1:57604 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1692.0/0.0 5076/0 2392.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 483 TCP 172.16.0.1:57630 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1857.0/0.0 5571/0 2626.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 484 TCP 172.16.0.1:57644 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.31 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1768.7/0.0 5306/0 2501.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 485 TCP 172.16.0.1:57658 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.02 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1673.7/0.0 5020/0 2366.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 486 TCP 172.16.0.1:57698 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.21 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1737.3/0.0 5212/0 2457.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 487 TCP 172.16.0.1:57712 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.96 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1986.3/0.0 5959/0 2809.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 488 TCP 172.16.0.1:57738 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1779.3/0.0 5338/0 2516.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 489 TCP 172.16.0.1:57752 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.09 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1696.0/0.0 5088/0 2398.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 490 TCP 172.16.0.1:57778 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1860.0/0.0 5580/0 2630.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 491 TCP 172.16.0.1:57792 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1767.0/0.0 5301/0 2498.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 492 TCP 172.16.0.1:57806 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1678.0/0.0 5034/0 2373.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 493 TCP 172.16.0.1:57832 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.50 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1832.7/0.0 5498/0 2591.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 494 TCP 172.16.0.1:57846 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.25 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1749.0/0.0 5247/0 2473.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 495 TCP 172.16.0.1:57860 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1993.0/0.0 5979/0 2818.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 496 TCP 172.16.0.1:57886 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.48 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1825.3/0.0 5476/0 2581.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 497 TCP 172.16.0.1:57900 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.22 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1740.0/0.0 5220/0 2460.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 498 TCP 172.16.0.1:57914 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1992.0/0.0 5976/0 2817.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 499 TCP 172.16.0.1:57940 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1802.3/0.0 5407/0 2548.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 500 TCP 172.16.0.1:57954 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1716.7/0.0 5150/0 2427.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 501 TCP 172.16.0.1:57980 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.67 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1890.0/0.0 5670/0 2672.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 502 TCP 172.16.0.1:57994 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.40 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1799.7/0.0 5399/0 2545.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 503 TCP 172.16.0.1:58008 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1701.3/0.0 5104/0 2406.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 504 TCP 172.16.0.1:58034 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1860.3/0.0 5581/0 2630.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 505 TCP 172.16.0.1:58048 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1781.0/0.0 5343/0 2518.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 506 TCP 172.16.0.1:58062 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1691.7/0.0 5074/0 2391.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 507 TCP 172.16.0.1:58088 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1850.0/0.0 5550/0 2616.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 508 TCP 172.16.0.1:58102 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.27 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1755.7/0.0 5267/0 2482.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 509 TCP 172.16.0.1:58130 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.60 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1867.0/0.0 5601/0 2640.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 510 TCP 172.16.0.1:58144 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1777.0/0.0 5331/0 2513.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 511 TCP 172.16.0.1:58158 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1692.3/0.0 5077/0 2393.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 512 TCP 172.16.0.1:58184 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.46 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1818.0/0.0 5454/0 2571.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 513 TCP 172.16.0.1:58198 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1732.7/0.0 5198/0 2450.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 514 TCP 172.16.0.1:58224 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.68 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1892.7/0.0 5678/0 2676.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 515 TCP 172.16.0.1:58238 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.43 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1809.0/0.0 5427/0 2558.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 516 TCP 172.16.0.1:58252 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.17 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1722.7/0.0 5168/0 2436.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0][PLAIN TEXT (F reIL)] + 517 TCP 172.16.0.1:58278 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.62 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1872.3/0.0 5616/0 2647.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 518 TCP 172.16.0.1:58292 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1787.7/0.0 5362/0 2527.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 519 TCP 172.16.0.1:58306 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1704.0/0.0 5112/0 2409.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 520 TCP 172.16.0.1:58332 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.59 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1861.7/0.0 5585/0 2632.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 521 TCP 172.16.0.1:58346 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1689.3/0.0 5068/0 2389.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 522 TCP 172.16.0.1:58386 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.56 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1851.3/0.0 5554/0 2618.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 523 TCP 172.16.0.1:58400 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.27 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1756.0/0.0 5268/0 2483.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 524 TCP 172.16.0.1:58414 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1676.0/0.0 5028/0 2370.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 525 TCP 172.16.0.1:58440 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1836.3/0.0 5509/0 2597.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 526 TCP 172.16.0.1:58454 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1747.3/0.0 5242/0 2471.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 527 TCP 172.16.0.1:58468 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.98 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1992.0/0.0 5976/0 2817.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 528 TCP 172.16.0.1:58482 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.72 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1907.7/0.0 5723/0 2697.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 529 TCP 172.16.0.1:58496 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1812.7/0.0 5438/0 2563.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 530 TCP 172.16.0.1:58510 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1715.3/0.0 5146/0 2425.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 531 TCP 172.16.0.1:58536 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.56 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1852.3/0.0 5557/0 2619.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 532 TCP 172.16.0.1:58550 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.31 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1770.3/0.0 5311/0 2503.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 533 TCP 172.16.0.1:58564 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.05 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1683.3/0.0 5050/0 2380.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 534 TCP 172.16.0.1:58590 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.45 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1816.3/0.0 5449/0 2568.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 535 TCP 172.16.0.1:58604 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1733.3/0.0 5199/0 2450.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 536 TCP 172.16.0.1:58630 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.71 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1902.3/0.0 5706/0 2689.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 537 TCP 172.16.0.1:58704 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.37 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1789.3/0.0 5367/0 2529.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 538 TCP 172.16.0.1:58718 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1693.7/0.0 5079/0 2393.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 539 TCP 172.16.0.1:58744 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1855.0/0.0 5562/0 2621.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 540 TCP 172.16.0.1:58758 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.31 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1768.0/0.0 5301/0 2498.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 541 TCP 172.16.0.1:58772 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1676.7/0.0 5029/0 2370.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 542 TCP 172.16.0.1:58798 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1835.3/0.0 5504/0 2594.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 543 TCP 172.16.0.1:58812 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.22 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1740.7/0.0 5219/0 2459.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 544 TCP 172.16.0.1:58838 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.72 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1906.0/0.0 5716/0 2694.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 545 TCP 172.16.0.1:58852 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.45 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1817.0/0.0 5447/0 2566.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 546 TCP 172.16.0.1:58866 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1728.0/0.0 5181/0 2441.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 547 TCP 172.16.0.1:58892 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.66 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1886.0/0.0 5656/0 2665.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 548 TCP 172.16.0.1:58906 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.40 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1799.0/0.0 5394/0 2542.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 549 TCP 172.16.0.1:58920 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.12 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1706.0/0.0 5116/0 2411.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 550 TCP 172.16.0.1:58946 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.56 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1853.0/0.0 5557/0 2619.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 551 TCP 172.16.0.1:58960 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.28 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1759.0/0.0 5274/0 2485.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 552 TCP 172.16.0.1:58974 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1677.0/0.0 5029/0 2370.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 553 TCP 172.16.0.1:58988 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.71 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1902.3/0.0 5704/0 2688.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 554 TCP 172.16.0.1:59002 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1813.0/0.0 5438/0 2563.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 555 TCP 172.16.0.1:59016 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.19 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1730.0/0.0 5187/0 2444.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 556 TCP 172.16.0.1:59056 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1773.0/0.0 5317/0 2506.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 557 TCP 172.16.0.1:59070 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1689.3/0.0 5065/0 2387.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 558 TCP 172.16.0.1:59096 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1858.7/0.0 5573/0 2626.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 559 TCP 172.16.0.1:59110 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.30 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1765.0/0.0 5294/0 2495.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 560 TCP 172.16.0.1:59124 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.03 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1676.3/0.0 5028/0 2370.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 561 TCP 172.16.0.1:59150 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.53 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1843.7/0.0 5529/0 2605.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 562 TCP 172.16.0.1:59164 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.27 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1754.7/0.0 5262/0 2480.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 563 TCP 172.16.0.1:59178 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.01 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1667.7/0.0 5001/0 2357.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 564 TCP 172.16.0.1:59192 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.70 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1898.7/0.0 5694/0 2683.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 565 TCP 172.16.0.1:59206 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1813.7/0.0 5438/0 2562.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 566 TCP 172.16.0.1:59220 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1724.7/0.0 5172/0 2437.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 567 TCP 172.16.0.1:59246 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.66 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1887.3/0.0 5659/0 2667.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 568 TCP 172.16.0.1:59260 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1801.0/0.0 5401/0 2545.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 569 TCP 172.16.0.1:59274 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.16 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1719.3/0.0 5155/0 2429.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 570 TCP 172.16.0.1:59300 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.64 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1879.3/0.0 5635/0 2655.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 571 TCP 172.16.0.1:59314 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1787.3/0.0 5360/0 2526.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 572 TCP 172.16.0.1:59328 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.11 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1701.7/0.0 5103/0 2405.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 573 TCP 172.16.0.1:59354 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.59 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1864.7/0.0 5592/0 2635.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 574 TCP 172.16.0.1:59368 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1784.7/0.0 5350/0 2521.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 575 TCP 172.16.0.1:59382 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1692.3/0.0 5075/0 2391.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 576 TCP 172.16.0.1:59408 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.57 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1854.7/0.0 5560/0 2620.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 577 TCP 172.16.0.1:59422 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1772.3/0.0 5310/0 2501.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 578 TCP 172.16.0.1:59436 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1688.7/0.0 5062/0 2385.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 579 TCP 172.16.0.1:59462 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.51 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1836.3/0.0 5504/0 2593.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 580 TCP 172.16.0.1:59476 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1747.3/0.0 5235/0 2466.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 581 TCP 172.16.0.1:59502 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.74 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1912.0/0.0 5730/0 2699.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0][PLAIN TEXT (nywiaN)] + 582 TCP 172.16.0.1:59516 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/0 1813.3/0.0 5430/0 2557.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 583 TCP 172.16.0.1:59530 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 1726.0/0.0 5173/0 2437.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 584 TCP 172.16.0.1:59556 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.68 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1891.3/0.0 5673/0 2674.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 585 TCP 172.16.0.1:59570 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1785.3/0.0 5349/0 2519.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 586 TCP 172.16.0.1:59584 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.10 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1698.0/0.0 5091/0 2399.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 587 TCP 172.16.0.1:59610 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.58 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1858.3/0.0 5574/0 2627.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 588 TCP 172.16.0.1:59624 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1776.0/0.0 5328/0 2511.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 589 TCP 172.16.0.1:59650 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.73 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1911.0/0.0 5733/0 2702.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 590 TCP 172.16.0.1:59664 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1822.0/0.0 5466/0 2576.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 591 TCP 172.16.0.1:59678 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.22 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1740.0/0.0 5220/0 2460.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 592 TCP 172.16.0.1:59704 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.67 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1888.7/0.0 5666/0 2671.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 593 TCP 172.16.0.1:59718 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1678.7/0.0 5036/0 2374.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 594 TCP 172.16.0.1:59758 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1868.0/0.0 5604/0 2641.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 595 TCP 172.16.0.1:59772 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.34 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1778.3/0.0 5334/0 2514.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 596 TCP 172.16.0.1:59786 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.06 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1685.7/0.0 5057/0 2383.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 597 TCP 172.16.0.1:59812 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1830.7/0.0 5491/0 2588.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 598 TCP 172.16.0.1:59826 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.24 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1747.3/0.0 5241/0 2470.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 599 TCP 172.16.0.1:59852 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.72 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1905.3/0.0 5716/0 2694.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 600 TCP 172.16.0.1:59866 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1813.3/0.0 5440/0 2564.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 601 TCP 172.16.0.1:59880 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.19 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1730.7/0.0 5192/0 2447.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 602 TCP 172.16.0.1:59906 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.68 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1892.3/0.0 5677/0 2676.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 603 TCP 172.16.0.1:59920 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.42 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1806.3/0.0 5419/0 2554.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 604 TCP 172.16.0.1:59934 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.15 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1714.7/0.0 5144/0 2424.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 605 TCP 172.16.0.1:59960 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.62 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1872.3/0.0 5617/0 2647.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 606 TCP 172.16.0.1:59974 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1786.0/0.0 5358/0 2525.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 607 TCP 172.16.0.1:59988 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1694.3/0.0 5083/0 2396.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 608 TCP 172.16.0.1:60014 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.52 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1840.3/0.0 5521/0 2602.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 609 TCP 172.16.0.1:60028 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1694.0/0.0 5082/0 2395.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 610 TCP 172.16.0.1:60042 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.70 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1897.7/0.0 5693/0 2683.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 611 TCP 172.16.0.1:60056 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1803.3/0.0 5410/0 2550.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 612 TCP 172.16.0.1:60084 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.56 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1852.3/0.0 5557/0 2619.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 613 TCP 172.16.0.1:60134 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.54 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1845.0/0.0 5535/0 2609.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 614 TCP 172.16.0.1:60136 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.54 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1845.0/0.0 5535/0 2609.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 615 TCP 172.16.0.1:60154 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1741.3/0.0 5224/0 2462.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 616 TCP 172.16.0.1:60194 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.28 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1759.7/0.0 5279/0 2488.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 617 TCP 172.16.0.1:60220 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.72 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1906.0/0.0 5718/0 2695.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 618 TCP 172.16.0.1:60234 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.44 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1812.7/0.0 5438/0 2563.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 619 TCP 172.16.0.1:60260 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.74 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1911.0/0.0 5733/0 2702.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 620 TCP 172.16.0.1:60274 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.46 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1820.0/0.0 5460/0 2573.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 621 TCP 172.16.0.1:60288 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1731.0/0.0 5193/0 2448.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 622 TCP 172.16.0.1:60314 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.61 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1868.7/0.0 5606/0 2642.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 623 TCP 172.16.0.1:60328 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1772.0/0.0 5316/0 2506.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 624 TCP 172.16.0.1:60342 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.02 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1673.3/0.0 5020/0 2366.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 625 TCP 172.16.0.1:60356 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.74 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1911.7/0.0 5735/0 2703.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 626 TCP 172.16.0.1:60370 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.47 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1823.3/0.0 5470/0 2578.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 627 TCP 172.16.0.1:60384 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.16 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1718.3/0.0 5155/0 2430.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 628 TCP 172.16.0.1:60410 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.59 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1864.0/0.0 5592/0 2636.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 629 TCP 172.16.0.1:60424 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1774.7/0.0 5324/0 2509.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 630 TCP 172.16.0.1:60438 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.07 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1690.3/0.0 5071/0 2390.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 631 TCP 172.16.0.1:60478 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1742.7/0.0 5228/0 2464.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 632 TCP 172.16.0.1:60504 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.64 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1879.0/0.0 5637/0 2657.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 633 TCP 172.16.0.1:60518 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.36 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1784.3/0.0 5353/0 2523.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 634 TCP 172.16.0.1:60532 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1691.0/0.0 5073/0 2391.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 635 TCP 172.16.0.1:60558 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.52 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1839.3/0.0 5517/0 2600.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 636 TCP 172.16.0.1:60572 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.18 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1725.3/0.0 5176/0 2440.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 637 TCP 172.16.0.1:60598 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.59 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1861.0/0.0 5582/0 2631.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 638 TCP 172.16.0.1:60612 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1775.3/0.0 5326/0 2510.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 639 TCP 172.16.0.1:60652 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.41 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1803.3/0.0 5410/0 2550.3/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 640 TCP 172.16.0.1:60666 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.16 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1718.0/0.0 5154/0 2429.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 641 TCP 172.16.0.1:60692 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.60 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1866.7/0.0 5600/0 2639.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 642 TCP 172.16.0.1:60706 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.33 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1774.7/0.0 5324/0 2509.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 643 TCP 172.16.0.1:60720 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.04 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1679.3/0.0 5038/0 2374.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 644 TCP 172.16.0.1:60734 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.76 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1918.0/0.0 5754/0 2712.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 645 TCP 172.16.0.1:60748 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.49 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1828.7/0.0 5486/0 2586.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 646 TCP 172.16.0.1:60762 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1732.0/0.0 5196/0 2449.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 647 TCP 172.16.0.1:60788 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.63 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1876.0/0.0 5628/0 2653.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 648 TCP 172.16.0.1:60802 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.35 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1782.3/0.0 5347/0 2520.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 649 TCP 172.16.0.1:60816 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.08 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1693.3/0.0 5080/0 2394.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 650 TCP 172.16.0.1:60842 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.50 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1833.7/0.0 5501/0 2593.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 651 TCP 172.16.0.1:60856 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.23 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1743.0/0.0 5229/0 2465.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 652 TCP 172.16.0.1:60882 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.66 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1886.0/0.0 5658/0 2667.2/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 653 TCP 172.16.0.1:60896 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.32 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1771.7/0.0 5315/0 2505.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 654 TCP 172.16.0.1:60922 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.74 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1912.3/0.0 5737/0 2704.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 655 TCP 172.16.0.1:60936 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.46 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 1820.3/0.0 5460/0 2573.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 656 TCP 172.16.0.1:60950 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.20 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1731.7/0.0 5195/0 2448.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 657 TCP 172.16.0.1:60976 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.55 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1848.3/0.0 5545/0 2613.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 658 TCP 172.16.0.1:60990 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][4 pkts/272 bytes <-> 2 pkts/140 bytes][Goodput ratio: 0.0/0.0][5.26 sec][bytes ratio: 0.320 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1753.7/0.0 5261/0 2480.1/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 68.0/70.0 74/74 3.5/4.0] + 659 TCP 172.16.0.1:35910 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][2 pkts/140 bytes <-> 1 pkts/74 bytes][Goodput ratio: 0.0/0.0][0.00 sec] + 660 TCP 172.16.0.1:35924 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][2 pkts/140 bytes <-> 1 pkts/74 bytes][Goodput ratio: 0.0/0.0][< 1 sec] + 661 TCP 172.16.0.1:35950 <-> 192.168.10.50:80 [proto: 7/HTTP][cat: Web/5][2 pkts/140 bytes <-> 1 pkts/74 bytes][Goodput ratio: 0.0/0.0][0.00 sec] diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out index d521cbec5..e4841247f 100644 --- a/tests/result/anyconnect-vpn.pcap.out +++ b/tests/result/anyconnect-vpn.pcap.out @@ -11,10 +11,10 @@ ICMPV6 18 2964 2 Slack 29 4979 2 Google 2 132 1 AJP 5 390 1 -Apple 2 297 1 +Apple 7 656 2 CiscoVPN 33 4378 2 Amazon 36 3540 3 -ApplePush 11 1325 4 +ApplePush 6 966 3 JA3 Host Stats: IP Address # JA3C @@ -51,7 +51,7 @@ JA3 Host Stats: 28 UDP 10.0.0.227:59582 <-> 75.75.75.75:53 [proto: 5.238/DNS.ApplePush][cat: Cloud/13][1 pkts/92 bytes <-> 1 pkts/323 bytes][Goodput ratio: 53.8/86.7][0.02 sec][Host: 1-courier.sandbox.push.apple.com][PLAIN TEXT (courier)] 29 TCP 10.0.0.227:56871 <-> 8.37.103.196:443 [proto: 91/TLS][cat: Web/5][1 pkts/66 bytes <-> 5 pkts/330 bytes][Goodput ratio: 0.0/0.0][20.32 sec][bytes ratio: -0.667 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 0.0/0.0 0/0 0.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 66.0/66.0 66/66 0.0/0.0] 30 TCP 10.0.0.227:56916 -> 10.0.0.151:8009 [proto: 139/AJP][cat: Web/5][5 pkts/390 bytes -> 0 pkts/0 bytes][Goodput ratio: 0.0/0.0][5.03 sec] - 31 TCP 10.0.0.227:56886 <-> 17.57.144.116:5223 [proto: 238/ApplePush][cat: Cloud/13][3 pkts/174 bytes <-> 2 pkts/185 bytes][Goodput ratio: 0.0/28.5][0.02 sec] + 31 TCP 10.0.0.227:56886 <-> 17.57.144.116:5223 [proto: 238.140/ApplePush.Apple][cat: Cloud/13][3 pkts/174 bytes <-> 2 pkts/185 bytes][Goodput ratio: 0.0/28.5][0.02 sec] 32 UDP 10.0.0.151:1900 -> 10.0.0.227:61328 [proto: 12/SSDP][cat: System/18][1 pkts/353 bytes -> 0 pkts/0 bytes][Goodput ratio: 87.9/0.0][< 1 sec][PLAIN TEXT (HTTP/1.1 200 OK)] 33 TCP 10.0.0.227:56910 <-> 35.201.124.9:443 [proto: 91/TLS][cat: Web/5][2 pkts/170 bytes <-> 2 pkts/164 bytes][Goodput ratio: 22.2/19.4][0.05 sec] 34 UDP 10.0.0.227:62427 <-> 75.75.75.75:53 [proto: 5/DNS][cat: Network/14][1 pkts/84 bytes <-> 1 pkts/242 bytes][Goodput ratio: 49.4/82.3][0.02 sec][Host: detectportal.firefox.com][PLAIN TEXT (detectportal)] diff --git a/tests/result/dnp3.pcap.out b/tests/result/dnp3.pcap.out new file mode 100644 index 000000000..3897eb033 --- /dev/null +++ b/tests/result/dnp3.pcap.out @@ -0,0 +1,11 @@ +SOCKS 135 9351 1 +DNP3 408 29403 7 + + 1 TCP 10.0.0.8:2828 <-> 10.0.0.3:20000 [proto: 244/DNP3][cat: Network/14][60 pkts/4041 bytes <-> 78 pkts/7164 bytes][Goodput ratio: 17.0/38.1][121.83 sec][bytes ratio: -0.279 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 420.5/302.2 13044/8439 1925.7/1115.4][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 67.3/91.8 79/145 5.4/37.0] + 2 TCP 10.0.0.9:1080 <-> 10.0.0.3:20000 [proto: 172/SOCKS][cat: Web/5][72 pkts/4659 bytes <-> 63 pkts/4692 bytes][Goodput ratio: 9.8/27.0][384.60 sec][bytes ratio: -0.004 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 4731.8/3048.6 75028/40127 13787.2/9967.8][Pkt Len c2s/s2c min/avg/max/stddev: 60/62 64.7/74.5 81/147 7.5/16.4] + 3 TCP 10.0.0.8:1086 <-> 10.0.0.3:20000 [proto: 244/DNP3][cat: Network/14][57 pkts/3891 bytes <-> 36 pkts/2760 bytes][Goodput ratio: 16.6/28.0][70.37 sec][bytes ratio: 0.170 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1467.0/2685.8 45001/45233 7093.4/9611.2][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 68.3/76.7 81/147 8.3/21.7] + 4 TCP 10.0.0.8:2789 <-> 10.0.0.3:20000 [proto: 244/DNP3][cat: Network/14][24 pkts/1584 bytes <-> 15 pkts/1005 bytes][Goodput ratio: 12.1/15.2][123.54 sec][bytes ratio: 0.224 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 161.9/2.4 2891/21 628.4/6.6][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 66.0/67.0 79/71 7.8/4.9] + 5 TCP 10.0.0.8:2803 <-> 10.0.0.3:20000 [proto: 244/DNP3][cat: Network/14][21 pkts/1374 bytes <-> 18 pkts/1119 bytes][Goodput ratio: 10.5/4.6][25.63 sec][bytes ratio: 0.102 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1204.6/2488.3 17203/17487 4072.9/5519.1][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 65.4/62.2 78/71 8.0/4.0] + 6 TCP 10.0.0.9:1084 <-> 10.0.0.3:20000 [proto: 244/DNP3][cat: Network/14][21 pkts/1374 bytes <-> 18 pkts/1119 bytes][Goodput ratio: 10.5/4.6][7.81 sec][bytes ratio: 0.102 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 343.2/629.6 3672/3963 975.0/1292.5][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 65.4/62.2 78/71 8.0/4.0] + 7 TCP 10.0.0.8:1184 <-> 10.0.0.3:20000 [proto: 244/DNP3][cat: Network/14][21 pkts/1374 bytes <-> 12 pkts/825 bytes][Goodput ratio: 10.5/18.5][12.41 sec][bytes ratio: 0.250 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 697.8/1757.4 9226/9487 2220.1/3301.6][Pkt Len c2s/s2c min/avg/max/stddev: 60/62 65.4/68.8 78/71 8.0/3.9] + 8 TCP 10.0.0.8:1159 <-> 10.0.0.3:20000 [proto: 244/DNP3][cat: Network/14][15 pkts/1014 bytes <-> 12 pkts/759 bytes][Goodput ratio: 14.2/6.7][12.40 sec][bytes ratio: 0.144 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 245.5/1770.4 2946/9113 814.2/3204.0][Pkt Len c2s/s2c min/avg/max/stddev: 60/60 67.6/63.2 78/71 8.5/4.5] diff --git a/tests/result/ftp_failed.pcap.out b/tests/result/ftp_failed.pcap.out new file mode 100644 index 000000000..27c90204c --- /dev/null +++ b/tests/result/ftp_failed.pcap.out @@ -0,0 +1,3 @@ +FTP_CONTROL 18 1700 1 + + 1 TCP [2a00:d40:1:3:192:12:193:11]:44724 <-> [2a00:800:1010::1]:21 [proto: 1/FTP_CONTROL][cat: Download-FileTransfer-FileSharing/7][10 pkts/892 bytes <-> 8 pkts/808 bytes][Goodput ratio: 2.7/13.8][7.24 sec][User: hello][Pwd: ][Auth Failed][bytes ratio: 0.049 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 895.6/1441.8 5304/5318 1756.8/2052.2][Pkt Len c2s/s2c min/avg/max/stddev: 86/86 89.2/101.0 98/126 4.2/15.4][PLAIN TEXT (vsFTPd 3.0.3)] diff --git a/tests/result/iec60780-5-104.pcap.out b/tests/result/iec60780-5-104.pcap.out new file mode 100644 index 000000000..04afc31db --- /dev/null +++ b/tests/result/iec60780-5-104.pcap.out @@ -0,0 +1,8 @@ +IEC60870 147 9033 6 + + 1 TCP 172.27.248.109:1578 <-> 172.27.248.79:2404 [proto: 245/IEC60870][cat: Network/14][28 pkts/1758 bytes <-> 19 pkts/1297 bytes][Goodput ratio: 8.8/20.3][235.18 sec][bytes ratio: 0.151 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/4 9105.8/11905.2 32485/32516 10297.2/10287.4][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 62.8/68.3 76/118 4.8/15.2] + 2 TCP 172.27.248.109:1568 <-> 172.27.248.79:2404 [proto: 245/IEC60870][cat: Network/14][17 pkts/1040 bytes <-> 12 pkts/674 bytes][Goodput ratio: 6.6/2.7][160.96 sec][bytes ratio: 0.214 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 9874.4/10028.6 38294/26906 11814.6/8997.2][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 61.2/56.2 68/62 2.2/3.1] + 3 TCP 172.27.248.109:1572 <-> 172.27.248.79:2404 [proto: 245/IEC60870][cat: Network/14][15 pkts/940 bytes <-> 10 pkts/572 bytes][Goodput ratio: 9.1/4.2][191.16 sec][bytes ratio: 0.243 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 12849.7/21995.9 59783/60001 22022.7/25275.8][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 62.7/57.2 76/62 5.2/3.2] + 4 TCP 172.27.248.109:1571 <-> 172.27.248.79:2404 [proto: 245/IEC60870][cat: Network/14][10 pkts/609 bytes <-> 7 pkts/398 bytes][Goodput ratio: 4.9/3.0][102.90 sec][bytes ratio: 0.210 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 8707.9/15094.0 59736/60003 19502.7/25928.3][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 60.9/56.9 67/62 2.1/3.4] + 5 TCP 172.27.248.109:1570 <-> 172.27.248.79:2404 [proto: 245/IEC60870][cat: Network/14][10 pkts/624 bytes <-> 6 pkts/344 bytes][Goodput ratio: 7.4/3.5][92.07 sec][bytes ratio: 0.289 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 11476.9/15000.2 42399/42717 16042.0/17487.9][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 62.4/57.3 72/62 4.4/3.4] + 6 TCP 172.27.248.109:1577 <-> 172.27.248.79:2404 [proto: 245/IEC60870][cat: Network/14][8 pkts/493 bytes <-> 5 pkts/284 bytes][Goodput ratio: 5.7/2.1][36.61 sec][bytes ratio: 0.269 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/4 6100.3/11100.0 21872/22196 8836.3/11096.0][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 61.6/56.8 71/62 3.6/3.5] diff --git a/tests/result/kerberos.pcap.out b/tests/result/kerberos.pcap.out index 460e3d3d0..d6df722f6 100644 --- a/tests/result/kerberos.pcap.out +++ b/tests/result/kerberos.pcap.out @@ -3,28 +3,28 @@ SMBv23 6 1914 3 Kerberos 48 19194 24 LDAP 14 4152 7 - 1 TCP 172.16.8.201:49171 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/1486 bytes <-> 1 pkts/1506 bytes][Goodput ratio: 96.3/96.4][0.00 sec][johnson-pc (happycraft.org)][PLAIN TEXT (HAPPYCRAFT.ORG)] - 2 TCP 172.16.8.201:49160 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/1485 bytes <-> 1 pkts/1498 bytes][Goodput ratio: 96.3/96.3][< 1 sec][johnson-pc (happycraft.org)][PLAIN TEXT (HAPPYCRAFT.ORG)] - 3 TCP 172.16.8.201:49176 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/1485 bytes <-> 1 pkts/1498 bytes][Goodput ratio: 96.3/96.3][0.00 sec][johnson-pc (happycraft.org)][PLAIN TEXT (HAPPYCRAFT.ORG)] + 1 TCP 172.16.8.201:49171 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/1486 bytes <-> 1 pkts/1506 bytes][Goodput ratio: 96.3/96.4][0.00 sec][happycraft.org\johnson-pc][PLAIN TEXT (HAPPYCRAFT.ORG)] + 2 TCP 172.16.8.201:49160 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/1485 bytes <-> 1 pkts/1498 bytes][Goodput ratio: 96.3/96.3][< 1 sec][happycraft.org\johnson-pc][PLAIN TEXT (HAPPYCRAFT.ORG)] + 3 TCP 172.16.8.201:49176 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/1485 bytes <-> 1 pkts/1498 bytes][Goodput ratio: 96.3/96.3][0.00 sec][happycraft.org\johnson-pc][PLAIN TEXT (HAPPYCRAFT.ORG)] 4 TCP 172.16.8.201:49173 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/1118 bytes <-> 1 pkts/190 bytes][Goodput ratio: 95.1/71.2][0.00 sec][PLAIN TEXT (HAPPYCRAFT.ORG)] 5 TCP 172.16.8.201:49194 <-> 172.16.8.8:445 [proto: 41/SMBv23][cat: System/18][1 pkts/410 bytes <-> 1 pkts/314 bytes][Goodput ratio: 86.6/82.5][0.00 sec] 6 TCP 172.16.8.201:49193 <-> 172.16.8.8:389 [proto: 112/LDAP][cat: System/18][1 pkts/384 bytes <-> 1 pkts/264 bytes][Goodput ratio: 85.7/79.2][0.00 sec] 7 TCP 172.16.8.201:49191 <-> 172.16.8.8:389 [proto: 112/LDAP][cat: System/18][1 pkts/368 bytes <-> 1 pkts/264 bytes][Goodput ratio: 85.1/79.2][< 1 sec] - 8 TCP 172.16.8.201:49157 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/293 bytes <-> 1 pkts/332 bytes][Goodput ratio: 81.3/83.5][< 1 sec][johnson-pc (happycraft.org)][PLAIN TEXT (johnson)] - 9 TCP 172.16.8.201:49166 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/293 bytes <-> 1 pkts/332 bytes][Goodput ratio: 81.3/83.5][0.00 sec][johnson-pc (happycraft.org)][PLAIN TEXT (johnson)] - 10 TCP 172.16.8.201:49181 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/293 bytes <-> 1 pkts/332 bytes][Goodput ratio: 81.3/83.5][< 1 sec][johnson-pc (happycraft.org)][PLAIN TEXT (JOHNSON)] + 8 TCP 172.16.8.201:49157 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/293 bytes <-> 1 pkts/332 bytes][Goodput ratio: 81.3/83.5][< 1 sec][happycraft.org\johnson-pc][PLAIN TEXT (johnson)] + 9 TCP 172.16.8.201:49166 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/293 bytes <-> 1 pkts/332 bytes][Goodput ratio: 81.3/83.5][0.00 sec][happycraft.org\johnson-pc][PLAIN TEXT (johnson)] + 10 TCP 172.16.8.201:49181 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/293 bytes <-> 1 pkts/332 bytes][Goodput ratio: 81.3/83.5][< 1 sec][happycraft.org\johnson-pc][PLAIN TEXT (JOHNSON)] 11 TCP 172.16.8.201:49156 <-> 172.16.8.8:445 [proto: 41/SMBv23][cat: System/18][1 pkts/281 bytes <-> 1 pkts/314 bytes][Goodput ratio: 80.5/82.5][0.00 sec] 12 TCP 172.16.8.201:49174 <-> 172.16.8.8:445 [proto: 41/SMBv23][cat: System/18][1 pkts/281 bytes <-> 1 pkts/314 bytes][Goodput ratio: 80.5/82.5][0.00 sec] - 13 TCP 172.16.8.201:49188 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/369 bytes <-> 1 pkts/216 bytes][Goodput ratio: 85.1/74.7][< 1 sec][theresa.johnson (happycraft)][PLAIN TEXT (theresa.johnson)] + 13 TCP 172.16.8.201:49188 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/369 bytes <-> 1 pkts/216 bytes][Goodput ratio: 85.1/74.7][< 1 sec][happycraft\theresa.johnson][PLAIN TEXT (theresa.johnson)] 14 TCP 172.16.8.201:49161 <-> 172.16.8.8:389 [proto: 112/LDAP][cat: System/18][1 pkts/320 bytes <-> 1 pkts/264 bytes][Goodput ratio: 82.9/79.2][< 1 sec] 15 TCP 172.16.8.201:49179 <-> 172.16.8.8:389 [proto: 112/LDAP][cat: System/18][1 pkts/320 bytes <-> 1 pkts/264 bytes][Goodput ratio: 82.9/79.2][0.00 sec] 16 TCP 172.16.8.201:49180 <-> 172.16.8.8:389 [proto: 112/LDAP][cat: System/18][1 pkts/320 bytes <-> 1 pkts/264 bytes][Goodput ratio: 82.9/79.2][0.00 sec] - 17 TCP 172.16.8.201:49187 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/289 bytes <-> 1 pkts/294 bytes][Goodput ratio: 81.0/81.4][0.00 sec][theresa.johnson (happycraft)][PLAIN TEXT (theresa.johnson)] + 17 TCP 172.16.8.201:49187 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/289 bytes <-> 1 pkts/294 bytes][Goodput ratio: 81.0/81.4][0.00 sec][happycraft\theresa.johnson][PLAIN TEXT (theresa.johnson)] 18 TCP 172.16.8.201:49169 <-> 172.16.8.8:389 [proto: 112/LDAP][cat: System/18][1 pkts/296 bytes <-> 1 pkts/264 bytes][Goodput ratio: 81.5/79.2][0.00 sec][PLAIN TEXT (PSTUsM)] 19 TCP 172.16.8.201:49172 <-> 172.16.8.8:389 [proto: 112/LDAP][cat: System/18][1 pkts/296 bytes <-> 1 pkts/264 bytes][Goodput ratio: 81.5/79.2][0.00 sec] - 20 TCP 172.16.8.201:49158 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/373 bytes <-> 1 pkts/166 bytes][Goodput ratio: 85.3/67.1][0.00 sec][johnson-pc (happycraft.org)][PLAIN TEXT (johnson)] - 21 TCP 172.16.8.201:49167 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/373 bytes <-> 1 pkts/166 bytes][Goodput ratio: 85.3/67.1][< 1 sec][johnson-pc (happycraft.org)][PLAIN TEXT (johnson)] - 22 TCP 172.16.8.201:49182 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/373 bytes <-> 1 pkts/166 bytes][Goodput ratio: 85.3/67.1][< 1 sec][johnson-pc (happycraft.org)][PLAIN TEXT (JOHNSON)] + 20 TCP 172.16.8.201:49158 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/373 bytes <-> 1 pkts/166 bytes][Goodput ratio: 85.3/67.1][0.00 sec][happycraft.org\johnson-pc][PLAIN TEXT (johnson)] + 21 TCP 172.16.8.201:49167 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/373 bytes <-> 1 pkts/166 bytes][Goodput ratio: 85.3/67.1][< 1 sec][happycraft.org\johnson-pc][PLAIN TEXT (johnson)] + 22 TCP 172.16.8.201:49182 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/373 bytes <-> 1 pkts/166 bytes][Goodput ratio: 85.3/67.1][< 1 sec][happycraft.org\johnson-pc][PLAIN TEXT (JOHNSON)] 23 TCP 172.16.8.201:49190 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/271 bytes <-> 1 pkts/244 bytes][Goodput ratio: 79.8/77.6][0.00 sec][PLAIN TEXT (happycraft.org)] 24 TCP 172.16.8.201:49192 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/255 bytes <-> 1 pkts/233 bytes][Goodput ratio: 78.5/76.5][0.00 sec][PLAIN TEXT (20370913024805Z)] 25 TCP 172.16.8.201:49195 <-> 172.16.8.8:88 [proto: 111/Kerberos][cat: Network/14][1 pkts/255 bytes <-> 1 pkts/233 bytes][Goodput ratio: 78.5/76.5][0.00 sec][PLAIN TEXT (20370913024805Z)] diff --git a/tests/result/mpeg.pcap.out b/tests/result/mpeg.pcap.out index ee94c2573..8dd4f10eb 100644 --- a/tests/result/mpeg.pcap.out +++ b/tests/result/mpeg.pcap.out @@ -1,3 +1,3 @@ ntop 19 10643 1 - 1 TCP 192.168.80.160:55804 <-> 46.101.157.119:80 [proto: 7.26/HTTP.ntop][cat: Network/14][9 pkts/754 bytes <-> 10 pkts/9889 bytes][Goodput ratio: 19.6/93.2][0.18 sec][Host: luca.ntop.org][bytes ratio: -0.858 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 25.4/5.9 77/41 28.4/14.3][Pkt Len c2s/s2c min/avg/max/stddev: 66/68 83.8/988.9 214/1502 46.2/649.2][URL: luca.ntop.org/0.mp3][StatusCode: 200][ContentType: audio/mpeg][UserAgent: Wget/1.16.3 (darwin14.1.0)][PLAIN TEXT (GET /0.mp)] + 1 TCP 192.168.80.160:55804 <-> 46.101.157.119:80 [proto: 7.26/HTTP.ntop][cat: Media/1][9 pkts/754 bytes <-> 10 pkts/9889 bytes][Goodput ratio: 19.6/93.2][0.18 sec][Host: luca.ntop.org][bytes ratio: -0.858 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 25.4/5.9 77/41 28.4/14.3][Pkt Len c2s/s2c min/avg/max/stddev: 66/68 83.8/988.9 214/1502 46.2/649.2][URL: luca.ntop.org/0.mp3][StatusCode: 200][ContentType: audio/mpeg][UserAgent: Wget/1.16.3 (darwin14.1.0)][PLAIN TEXT (GET /0.mp)] diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out index c8cbf739e..5db8503ec 100644 --- a/tests/result/nest_log_sink.pcap.out +++ b/tests/result/nest_log_sink.pcap.out @@ -1,17 +1,18 @@ DNS 15 1612 1 -NestLogSink 759 116848 13 +NestLogSink 457 44483 6 +Google 302 72365 7 - 1 TCP 192.168.242.15:63342 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][cat: Cloud/13][37 pkts/14650 bytes <-> 35 pkts/4115 bytes][Goodput ratio: 86.1/54.0][4.71 sec][bytes ratio: 0.561 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/0 142.2/150.2 1347/1490 250.6/289.6][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 395.9/117.6 585/733 191.9/107.5][PLAIN TEXT (05CA02AC4414028)] - 2 TCP 192.168.242.15:63345 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][cat: Cloud/13][36 pkts/14613 bytes <-> 35 pkts/4114 bytes][Goodput ratio: 86.4/53.9][4.14 sec][bytes ratio: 0.561 (Upload)][IAT c2s/s2c min/avg/max/stddev: 11/0 131.6/134.1 1166/1477 228.8/290.3][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 405.9/117.5 584/732 185.3/107.3][PLAIN TEXT (05CA02AC4414028)] - 3 TCP 192.168.242.15:63351 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][cat: Cloud/13][25 pkts/9229 bytes <-> 24 pkts/2916 bytes][Goodput ratio: 85.0/55.4][3.56 sec][bytes ratio: 0.520 (Upload)][IAT c2s/s2c min/avg/max/stddev: 5/0 163.8/174.5 1319/1484 293.5/350.4][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 369.2/121.5 584/733 204.4/129.6][PLAIN TEXT (05CA02AC4414028)] - 4 TCP 192.168.242.15:63348 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][cat: Cloud/13][25 pkts/9114 bytes <-> 24 pkts/2915 bytes][Goodput ratio: 84.8/55.4][3.42 sec][bytes ratio: 0.515 (Upload)][IAT c2s/s2c min/avg/max/stddev: 10/0 157.7/169.4 1167/1475 265.8/349.4][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 364.6/121.5 584/732 204.5/129.4][PLAIN TEXT (05CA02AC4414028)] + 1 TCP 192.168.242.15:63342 <-> 35.188.154.186:11095 [proto: 43.126/NestLogSink.Google][cat: Cloud/13][37 pkts/14650 bytes <-> 35 pkts/4115 bytes][Goodput ratio: 86.1/54.0][4.71 sec][bytes ratio: 0.561 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4/0 142.2/150.2 1347/1490 250.6/289.6][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 395.9/117.6 585/733 191.9/107.5][PLAIN TEXT (05CA02AC4414028)] + 2 TCP 192.168.242.15:63345 <-> 35.188.154.186:11095 [proto: 43.126/NestLogSink.Google][cat: Cloud/13][36 pkts/14613 bytes <-> 35 pkts/4114 bytes][Goodput ratio: 86.4/53.9][4.14 sec][bytes ratio: 0.561 (Upload)][IAT c2s/s2c min/avg/max/stddev: 11/0 131.6/134.1 1166/1477 228.8/290.3][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 405.9/117.5 584/732 185.3/107.3][PLAIN TEXT (05CA02AC4414028)] + 3 TCP 192.168.242.15:63351 <-> 35.188.154.186:11095 [proto: 43.126/NestLogSink.Google][cat: Cloud/13][25 pkts/9229 bytes <-> 24 pkts/2916 bytes][Goodput ratio: 85.0/55.4][3.56 sec][bytes ratio: 0.520 (Upload)][IAT c2s/s2c min/avg/max/stddev: 5/0 163.8/174.5 1319/1484 293.5/350.4][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 369.2/121.5 584/733 204.4/129.6][PLAIN TEXT (05CA02AC4414028)] + 4 TCP 192.168.242.15:63348 <-> 35.188.154.186:11095 [proto: 43.126/NestLogSink.Google][cat: Cloud/13][25 pkts/9114 bytes <-> 24 pkts/2915 bytes][Goodput ratio: 84.8/55.4][3.42 sec][bytes ratio: 0.515 (Upload)][IAT c2s/s2c min/avg/max/stddev: 10/0 157.7/169.4 1167/1475 265.8/349.4][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 364.6/121.5 584/732 204.5/129.4][PLAIN TEXT (05CA02AC4414028)] 5 TCP 192.168.242.15:63343 <-> 35.174.82.237:11095 [proto: 43/NestLogSink][cat: Cloud/13][60 pkts/5549 bytes <-> 56 pkts/5094 bytes][Goodput ratio: 36.1/40.5][1799.54 sec][bytes ratio: 0.043 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/16 33934.9/28186.7 60073/60075 29484.2/29644.5][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 92.5/91.0 585/731 96.8/125.8][PLAIN TEXT (05CA02AC4414028)] 6 TCP 192.168.242.15:63352 <-> 35.174.82.237:11095 [proto: 43/NestLogSink][cat: Cloud/13][50 pkts/4894 bytes <-> 46 pkts/4392 bytes][Goodput ratio: 39.7/43.3][1508.66 sec][bytes ratio: 0.054 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/17 33170.0/30242.3 60184/60262 29629.6/29816.1][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 97.9/95.5 586/730 105.0/136.5][PLAIN TEXT (05CA02AC4414028)] 7 TCP 192.168.242.15:63346 <-> 35.174.82.237:11095 [proto: 43/NestLogSink][cat: Cloud/13][41 pkts/4409 bytes <-> 37 pkts/3907 bytes][Goodput ratio: 45.4/48.7][1042.88 sec][bytes ratio: 0.060 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/15 27923.8/26021.8 60088/60136 29300.8/29455.1][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 107.5/105.6 585/731 114.0/150.6][PLAIN TEXT (05CA02AC4414028)] 8 TCP 192.168.242.15:63349 <-> 35.174.82.237:11095 [proto: 43/NestLogSink][cat: Cloud/13][28 pkts/3254 bytes <-> 24 pkts/3040 bytes][Goodput ratio: 49.8/57.2][602.97 sec][bytes ratio: 0.034 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/14 24649.0/24894.2 60122/60151 29303.3/29368.4][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 116.2/126.7 584/732 117.5/180.8][PLAIN TEXT (05CA02AC4414028)] 9 TCP 192.168.242.15:63350 <-> 35.174.82.237:11095 [proto: 43/NestLogSink][cat: Cloud/13][18 pkts/2655 bytes <-> 14 pkts/2499 bytes][Goodput ratio: 61.1/69.6][153.64 sec][bytes ratio: 0.030 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 7/15 10959.9/13629.3 60124/60155 21488.4/24847.0][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 147.5/178.5 585/731 137.0/222.5][PLAIN TEXT (05CA02AC4414028)] 10 TCP 192.168.242.15:63340 <-> 35.174.82.237:11095 [proto: 43/NestLogSink][cat: Cloud/13][42 pkts/2576 bytes <-> 41 pkts/2214 bytes][Goodput ratio: 2.4/0.0][1615.16 sec][bytes ratio: 0.076 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/143 39827.0/40755.2 60071/60122 27934.1/27879.7][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 61.3/54.0 116/54 8.5/0.0] - 11 TCP 192.168.242.15:63344 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][cat: Cloud/13][11 pkts/2565 bytes <-> 10 pkts/1389 bytes][Goodput ratio: 75.6/60.8][5.29 sec][bytes ratio: 0.297 (Upload)][IAT c2s/s2c min/avg/max/stddev: 61/0 640.5/729.1 2711/3410 865.2/1201.7][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 233.2/138.9 584/732 216.6/199.2][PLAIN TEXT (05CA02AC4414028)] - 12 TCP 192.168.242.15:63347 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][cat: Cloud/13][10 pkts/1983 bytes <-> 10 pkts/1390 bytes][Goodput ratio: 71.2/60.8][2.81 sec][bytes ratio: 0.176 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 63/0 341.6/348.9 1182/1489 362.6/517.3][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 198.3/139.0 586/733 195.5/199.5][PLAIN TEXT (05CA02AC4414028)] - 13 TCP 192.168.242.15:63353 <-> 35.188.154.186:11095 [proto: 43/NestLogSink][cat: Cloud/13][10 pkts/1983 bytes <-> 10 pkts/1389 bytes][Goodput ratio: 71.2/60.8][2.65 sec][bytes ratio: 0.176 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 70/0 321.0/347.6 1162/1502 365.5/527.2][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 198.3/138.9 586/732 195.5/199.2][PLAIN TEXT (05CA02AC4414028)] + 11 TCP 192.168.242.15:63344 <-> 35.188.154.186:11095 [proto: 43.126/NestLogSink.Google][cat: Cloud/13][11 pkts/2565 bytes <-> 10 pkts/1389 bytes][Goodput ratio: 75.6/60.8][5.29 sec][bytes ratio: 0.297 (Upload)][IAT c2s/s2c min/avg/max/stddev: 61/0 640.5/729.1 2711/3410 865.2/1201.7][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 233.2/138.9 584/732 216.6/199.2][PLAIN TEXT (05CA02AC4414028)] + 12 TCP 192.168.242.15:63347 <-> 35.188.154.186:11095 [proto: 43.126/NestLogSink.Google][cat: Cloud/13][10 pkts/1983 bytes <-> 10 pkts/1390 bytes][Goodput ratio: 71.2/60.8][2.81 sec][bytes ratio: 0.176 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 63/0 341.6/348.9 1182/1489 362.6/517.3][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 198.3/139.0 586/733 195.5/199.5][PLAIN TEXT (05CA02AC4414028)] + 13 TCP 192.168.242.15:63353 <-> 35.188.154.186:11095 [proto: 43.126/NestLogSink.Google][cat: Cloud/13][10 pkts/1983 bytes <-> 10 pkts/1389 bytes][Goodput ratio: 71.2/60.8][2.65 sec][bytes ratio: 0.176 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 70/0 321.0/347.6 1162/1502 365.5/527.2][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 198.3/138.9 586/732 195.5/199.2][PLAIN TEXT (05CA02AC4414028)] 14 UDP 192.168.242.15:52849 <-> 192.168.242.1:53 [proto: 5/DNS][cat: Network/14][8 pkts/713 bytes <-> 7 pkts/899 bytes][Goodput ratio: 52.8/67.2][3600.37 sec][Host: weave-logsink.nest.com][bytes ratio: -0.115 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 22/4311 596403.3/515880.4 1795476/1795277 670695.5/701384.1][Pkt Len c2s/s2c min/avg/max/stddev: 82/98 89.1/128.4 101/169 9.2/35.1][PLAIN TEXT (logsink)] diff --git a/tests/result/nintendo.pcap.out b/tests/result/nintendo.pcap.out index 98bd3f2e8..34143be84 100644 --- a/tests/result/nintendo.pcap.out +++ b/tests/result/nintendo.pcap.out @@ -1,6 +1,6 @@ ICMP 30 2100 2 -Nintendo 890 320242 12 -Amazon 76 10811 7 +Nintendo 887 319888 11 +Amazon 79 11165 8 JA3 Host Stats: IP Address # JA3C @@ -23,7 +23,7 @@ JA3 Host Stats: 14 UDP 192.168.12.114:55915 <-> 35.158.74.61:10025 [proto: 178/Amazon][cat: Web/5][5 pkts/290 bytes <-> 5 pkts/290 bytes][Goodput ratio: 27.5/27.5][0.06 sec][bytes ratio: 0.000 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1.0/0.8 4/3 1.7/1.3][Pkt Len c2s/s2c min/avg/max/stddev: 58/58 58.0/58.0 58/58 0.0/0.0] 15 UDP 192.168.12.114:18874 <-> 192.168.12.1:53 [proto: 5.173/DNS.Nintendo][cat: Game/8][1 pkts/110 bytes <-> 1 pkts/281 bytes][Goodput ratio: 61.3/84.8][0.03 sec][Host: e0d67c509fb203858ebcb2fe3f88c2aa.baas.nintendo.com][PLAIN TEXT (fb203858ebc)] 16 UDP 192.168.12.114:51035 <-> 192.168.12.1:53 [proto: 5.173/DNS.Nintendo][cat: Game/8][1 pkts/110 bytes <-> 1 pkts/281 bytes][Goodput ratio: 61.3/84.8][< 1 sec][Host: e0d67c509fb203858ebcb2fe3f88c2aa.baas.nintendo.com][PLAIN TEXT (fb203858ebc)] - 17 UDP 192.168.12.114:52119 -> 35.158.74.61:33335 [proto: 173/Nintendo][cat: Game/8][3 pkts/354 bytes -> 0 pkts/0 bytes][Goodput ratio: 64.2/0.0][0.00 sec] + 17 UDP 192.168.12.114:52119 -> 35.158.74.61:33335 [proto: 173.178/Nintendo.Amazon][cat: Game/8][3 pkts/354 bytes -> 0 pkts/0 bytes][Goodput ratio: 64.2/0.0][0.00 sec] 18 UDP 192.168.12.114:55915 -> 35.158.74.61:33335 [proto: 178/Amazon][cat: Web/5][3 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 60.2/0.0][0.00 sec][PLAIN TEXT (NATTestId)] 19 UDP 192.168.12.114:55915 -> 52.10.205.177:34343 [proto: 178/Amazon][cat: Web/5][1 pkts/298 bytes -> 0 pkts/0 bytes][Goodput ratio: 85.6/0.0][< 1 sec] 20 UDP 192.168.12.114:55915 -> 35.158.74.61:33334 [proto: 178/Amazon][cat: Web/5][5 pkts/290 bytes -> 0 pkts/0 bytes][Goodput ratio: 27.5/0.0][0.00 sec] diff --git a/tests/result/ookla.pcap.out b/tests/result/ookla.pcap.out index d49e5e26d..031500eec 100644 --- a/tests/result/ookla.pcap.out +++ b/tests/result/ookla.pcap.out @@ -1,4 +1,4 @@ Ookla 5086 4689745 2 1 TCP 192.168.1.7:51215 <-> 46.44.253.187:8080 [proto: 191/Ookla][cat: Network/14][2202 pkts/1032520 bytes <-> 2864 pkts/3652905 bytes][Goodput ratio: 85.6/94.8][40.14 sec][bytes ratio: -0.559 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 14.8/11.5 2086/2226 59.5/54.4][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 468.9/1275.5 1506/1506 642.3/526.9][PLAIN TEXT ( 6HELLO 2.4 2016)] - 2 TCP 192.168.1.7:51207 <-> 46.44.253.187:80 [proto: 191/Ookla][cat: Network/14][12 pkts/2238 bytes <-> 8 pkts/2082 bytes][Goodput ratio: 64.0/74.2][5.33 sec][bytes ratio: 0.036 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/4 527.8/46.8 5005/84 1492.6/27.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 186.5/260.2 430/523 168.4/194.4][PLAIN TEXT (GET /crossdomain.xml HTTP/1.1)] + 2 TCP 192.168.1.7:51207 <-> 46.44.253.187:80 [proto: 7.191/HTTP.Ookla][cat: Network/14][12 pkts/2238 bytes <-> 8 pkts/2082 bytes][Goodput ratio: 64.0/74.2][5.33 sec][bytes ratio: 0.036 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/4 527.8/46.8 5005/84 1492.6/27.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 186.5/260.2 430/523 168.4/194.4][PLAIN TEXT (GET /crossdomain.xml HTTP/1.1)] diff --git a/tests/result/signal.pcap.out b/tests/result/signal.pcap.out index 32651a1fe..8a4d57ee4 100644 --- a/tests/result/signal.pcap.out +++ b/tests/result/signal.pcap.out @@ -28,5 +28,5 @@ JA3 Host Stats: 15 TCP 192.168.2.17:56996 <-> 17.248.146.144:443 [proto: 91.140/TLS.Apple][cat: Web/5][4 pkts/341 bytes <-> 4 pkts/264 bytes][Goodput ratio: 22.5/0.0][0.03 sec][bytes ratio: 0.127 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 25/0 8.3/0.0 25/0 11.8/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 85.2/66.0 112/66 20.0/0.0] 16 TCP 192.168.2.17:57017 <-> 2.18.232.118:443 [proto: 91/TLS][cat: Web/5][5 pkts/317 bytes <-> 3 pkts/221 bytes][Goodput ratio: 7.2/10.4][0.03 sec][bytes ratio: 0.178 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 6.0/0.0 24/0 10.4/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 63.4/73.7 89/89 13.6/10.8] 17 UDP 192.168.2.17:56263 <-> 192.168.2.1:53 [proto: 5.39/DNS.Signal][cat: Chat/9][1 pkts/97 bytes <-> 1 pkts/193 bytes][Goodput ratio: 56.1/77.8][0.03 sec][Host: textsecure-service.whispersystems.org][PLAIN TEXT (textsecure)] - 18 UDP 192.168.2.17:60793 <-> 192.168.2.1:53 [proto: 5/DNS][cat: Media/1][1 pkts/85 bytes <-> 1 pkts/101 bytes][Goodput ratio: 50.0/57.8][0.04 sec][Host: e673.dsce9.akamaiedge.net][PLAIN TEXT (akamaiedge)] + 18 UDP 192.168.2.17:60793 <-> 192.168.2.1:53 [proto: 5/DNS][cat: Network/14][1 pkts/85 bytes <-> 1 pkts/101 bytes][Goodput ratio: 50.0/57.8][0.04 sec][Host: e673.dsce9.akamaiedge.net][PLAIN TEXT (akamaiedge)] 19 ICMP 192.168.2.17:0 -> 192.168.2.1:0 [proto: 81/ICMP][cat: Network/14][1 pkts/70 bytes -> 0 pkts/0 bytes][Goodput ratio: 39.4/0.0][< 1 sec] diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out index 45d402e2a..db6d78183 100644 --- a/tests/result/skype.pcap.out +++ b/tests/result/skype.pcap.out @@ -1,7 +1,6 @@ Unknown 753 81587 37 DNS 2 267 1 MDNS 8 1736 2 -NTP 2 180 1 SSDP 101 38156 6 SkypeCall 152 10704 144 ICMP 8 656 1 @@ -9,10 +8,9 @@ IGMP 5 258 4 TLS 96 8876 7 Dropbox 38 17948 5 Skype 1796 451121 80 -Apple 3 168 1 +Apple 17 2225 3 AppleiCloud 88 20520 2 Spotify 5 430 1 -ApplePush 12 1877 1 JA3 Host Stats: IP Address # JA3C @@ -33,7 +31,7 @@ JA3 Host Stats: 12 UDP 192.168.1.92:17500 -> 192.168.1.255:17500 [proto: 121/Dropbox][cat: Cloud/13][5 pkts/2720 bytes -> 0 pkts/0 bytes][Goodput ratio: 92.2/0.0][120.16 sec][PLAIN TEXT ( 3375359593)] 13 UDP 192.168.1.92:17500 -> 255.255.255.255:17500 [proto: 121/Dropbox][cat: Cloud/13][5 pkts/2720 bytes -> 0 pkts/0 bytes][Goodput ratio: 92.2/0.0][120.15 sec][PLAIN TEXT ( 3375359593)] 14 TCP 192.168.1.34:50090 <-> 23.206.33.166:443 [proto: 91.125/TLS.Skype][cat: VoIP/10][12 pkts/2140 bytes <-> 3 pkts/200 bytes][Goodput ratio: 62.4/0.0][20.12 sec][bytes ratio: 0.829 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1686.5/0.0 6249/0 2226.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/60 178.3/66.7 233/74 77.4/5.7][TLSv1][Client: apps.skype.com] - 15 TCP 17.143.160.22:5223 <-> 192.168.1.34:49447 [proto: 238/ApplePush][cat: Cloud/13][6 pkts/1211 bytes <-> 6 pkts/666 bytes][Goodput ratio: 67.2/40.5][66.95 sec][bytes ratio: 0.290 (Upload)][IAT c2s/s2c min/avg/max/stddev: 228/1 16680.0/16680.0 43974/44201 18098.6/18356.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 201.8/111.0 471/156 151.4/45.0] + 15 TCP 17.143.160.22:5223 <-> 192.168.1.34:49447 [proto: 238.140/ApplePush.Apple][cat: Cloud/13][6 pkts/1211 bytes <-> 6 pkts/666 bytes][Goodput ratio: 67.2/40.5][66.95 sec][bytes ratio: 0.290 (Upload)][IAT c2s/s2c min/avg/max/stddev: 228/1 16680.0/16680.0 43974/44201 18098.6/18356.6][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 201.8/111.0 471/156 151.4/45.0] 16 TCP 192.168.1.34:50091 <-> 157.55.235.146:443 [proto: 91.125/TLS.Skype][cat: VoIP/10][13 pkts/1554 bytes <-> 3 pkts/200 bytes][Goodput ratio: 44.0/0.0][29.28 sec][bytes ratio: 0.772 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/73 2359.7/73.0 8785/73 2805.7/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/60 119.5/66.7 138/74 27.3/5.7] 17 TCP 192.168.1.34:50039 <-> 213.199.179.175:443 [proto: 91/TLS][cat: Web/5][13 pkts/1392 bytes <-> 3 pkts/200 bytes][Goodput ratio: 37.5/0.0][25.19 sec][bytes ratio: 0.749 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/66 2027.6/66.0 7535/66 2315.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 66/60 107.1/66.7 138/74 21.3/5.7] 18 TCP 192.168.1.34:50101 <-> 157.55.235.176:443 [proto: 91.125/TLS.Skype][cat: VoIP/10][12 pkts/1305 bytes <-> 3 pkts/285 bytes][Goodput ratio: 39.3/27.6][17.34 sec][bytes ratio: 0.642 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/77 1416.3/77.0 5596/77 1925.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 108.8/95.0 138/145 30.7/35.5] @@ -124,7 +122,7 @@ JA3 Host Stats: 103 UDP 192.168.1.34:13021 -> 176.26.55.167:63773 [proto: 125.38/Skype.SkypeCall][cat: VoIP/10][5 pkts/300 bytes -> 0 pkts/0 bytes][Goodput ratio: 29.9/0.0][20.13 sec] 104 UDP 192.168.1.34:58681 <-> 192.168.1.1:53 [proto: 5/DNS][cat: Network/14][1 pkts/101 bytes <-> 1 pkts/166 bytes][Goodput ratio: 57.8/74.3][0.07 sec][Host: db3msgr5011709.gateway.messenger.live.com][PLAIN TEXT (MSGR5011709)] 105 UDP 192.168.1.34:62454 <-> 192.168.1.1:53 [proto: 5.143/DNS.AppleiCloud][cat: Web/5][1 pkts/101 bytes <-> 1 pkts/133 bytes][Goodput ratio: 57.8/67.9][0.05 sec][Host: p05-keyvalueservice.icloud.com.akadns.net][PLAIN TEXT (valueservice)] - 106 UDP 192.168.1.34:123 <-> 17.253.48.245:123 [proto: 9/NTP][cat: System/18][1 pkts/90 bytes <-> 1 pkts/90 bytes][Goodput ratio: 52.7/52.7][0.05 sec] + 106 UDP 192.168.1.34:123 <-> 17.253.48.245:123 [proto: 9.140/NTP.Apple][cat: System/18][1 pkts/90 bytes <-> 1 pkts/90 bytes][Goodput ratio: 52.7/52.7][0.05 sec] 107 UDP 192.168.1.34:51879 <-> 192.168.1.1:53 [proto: 5.125/DNS.Skype][cat: VoIP/10][1 pkts/82 bytes <-> 1 pkts/98 bytes][Goodput ratio: 48.2/56.6][0.05 sec][Host: e4593.g.akamaiedge.net][PLAIN TEXT (akamaiedge)] 108 UDP 192.168.1.34:63321 <-> 192.168.1.1:53 [proto: 5.125/DNS.Skype][cat: VoIP/10][1 pkts/82 bytes <-> 1 pkts/98 bytes][Goodput ratio: 48.2/56.6][0.05 sec][Host: e4593.g.akamaiedge.net][PLAIN TEXT (akamaiedge)] 109 UDP 192.168.1.34:64085 <-> 192.168.1.1:53 [proto: 5.125/DNS.Skype][cat: VoIP/10][1 pkts/82 bytes <-> 1 pkts/98 bytes][Goodput ratio: 48.2/56.6][0.06 sec][Host: e7768.b.akamaiedge.net][PLAIN TEXT (akamaiedge)] diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out index 962935d87..01e22efd3 100644 --- a/tests/result/skype_no_unknown.pcap.out +++ b/tests/result/skype_no_unknown.pcap.out @@ -9,8 +9,7 @@ IGMP 4 226 4 TLS 79 7742 6 Dropbox 16 7342 5 Skype 1185 331827 60 -Apple 76 19581 1 -ApplePush 8 1118 1 +Apple 84 20699 2 JA3 Host Stats: IP Address # JA3C @@ -57,7 +56,7 @@ JA3 Host Stats: 38 TCP 192.168.1.34:51267 <-> 111.221.74.18:40025 [proto: 125/Skype][cat: VoIP/10][10 pkts/785 bytes <-> 4 pkts/378 bytes][Goodput ratio: 15.9/28.0][17.94 sec][bytes ratio: 0.350 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 1703.2/147.5 4607/294 1700.3/146.5][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 78.5/94.5 159/164 27.6/40.3] 39 TCP 192.168.1.34:51232 <-> 157.56.52.28:443 [proto: 91.125/TLS.Skype][cat: VoIP/10][10 pkts/872 bytes <-> 3 pkts/285 bytes][Goodput ratio: 24.3/27.6][18.79 sec][bytes ratio: 0.507 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/199 2007.5/199.0 5293/199 1964.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 87.2/95.0 138/145 22.1/35.5] 40 UDP 192.168.1.1:137 <-> 192.168.1.34:137 [proto: 10/NetBIOS][cat: System/18][6 pkts/958 bytes <-> 2 pkts/184 bytes][Goodput ratio: 73.6/54.1][1.27 sec][Host: __msbrowse__][bytes ratio: 0.678 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1258 253.0/1258.0 1243/1258 495.0/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 104/92 159.7/92.0 271/92 78.7/0.0][PLAIN TEXT (FPFPENFDECFCEPFHFDEFFPFPACAB)] - 41 TCP 17.143.160.149:5223 <-> 192.168.1.34:50407 [proto: 238/ApplePush][cat: Cloud/13][4 pkts/674 bytes <-> 4 pkts/444 bytes][Goodput ratio: 60.7/40.4][10.70 sec][bytes ratio: 0.206 (Upload)][IAT c2s/s2c min/avg/max/stddev: 215/1 3565.3/3493.7 10265/10480 4737.4/4940.1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 168.5/111.0 279/156 102.7/45.0] + 41 TCP 17.143.160.149:5223 <-> 192.168.1.34:50407 [proto: 238.140/ApplePush.Apple][cat: Cloud/13][4 pkts/674 bytes <-> 4 pkts/444 bytes][Goodput ratio: 60.7/40.4][10.70 sec][bytes ratio: 0.206 (Upload)][IAT c2s/s2c min/avg/max/stddev: 215/1 3565.3/3493.7 10265/10480 4737.4/4940.1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 168.5/111.0 279/156 102.7/45.0] 42 UDP 192.168.1.34:17500 -> 192.168.1.255:17500 [proto: 121/Dropbox][cat: Cloud/13][2 pkts/1088 bytes -> 0 pkts/0 bytes][Goodput ratio: 92.2/0.0][30.07 sec][PLAIN TEXT ( 1573195445)] 43 UDP 192.168.1.34:17500 -> 255.255.255.255:17500 [proto: 121/Dropbox][cat: Cloud/13][2 pkts/1088 bytes -> 0 pkts/0 bytes][Goodput ratio: 92.2/0.0][30.07 sec][PLAIN TEXT ( 1573195445)] 44 UDP 192.168.1.92:17500 -> 192.168.1.255:17500 [proto: 121/Dropbox][cat: Cloud/13][2 pkts/1088 bytes -> 0 pkts/0 bytes][Goodput ratio: 92.2/0.0][30.05 sec][PLAIN TEXT ( 3375359593)] diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out index 2da823c1b..e3aceafa2 100644 --- a/tests/result/whatsapp_login_call.pcap.out +++ b/tests/result/whatsapp_login_call.pcap.out @@ -5,10 +5,9 @@ WhatsAppCall 803 102942 20 ICMP 10 700 1 TLS 8 589 2 Dropbox 4 2176 1 -Apple 190 50263 21 +Apple 212 56189 22 WhatsApp 182 25154 2 Spotify 3 258 1 -ApplePush 22 5926 1 JA3 Host Stats: IP Address # JA3C @@ -21,7 +20,7 @@ JA3 Host Stats: 4 TCP 192.168.2.4:49204 <-> 17.173.66.102:443 [proto: 91.140/TLS.Apple][cat: Web/5][29 pkts/11770 bytes <-> 24 pkts/6612 bytes][Goodput ratio: 86.5/80.2][34.28 sec][bytes ratio: 0.281 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 121.7/107.9 1665/1391 339.6/319.1][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 405.9/275.5 1494/1002 488.5/347.9][TLSv1.2][Client: p53-buy.itunes.apple.com][JA3C: 799135475da362592a4be9199d258726][JA3S: c253ec3ad88e42f8da4032682892f9a0 (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5] 5 TCP 192.168.2.4:49201 <-> 17.178.104.12:443 [proto: 91.140/TLS.Apple][cat: Web/5][21 pkts/7644 bytes <-> 17 pkts/9576 bytes][Goodput ratio: 84.8/90.3][32.84 sec][bytes ratio: -0.112 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1908.9/36.8 30435/294 7133.2/81.8][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 364.0/563.3 1494/1494 552.5/634.4][TLSv1.2][Client: query.ess.apple.com][JA3C: 799135475da362592a4be9199d258726][Server: *.ess.apple.com][JA3S: c253ec3ad88e42f8da4032682892f9a0 (INSECURE)][Organization: Apple Inc.][Certificate SHA-1: BD:E0:62:C3:F2:9D:09:5D:52:D4:AA:60:11:1B:36:1B:03:24:F1:9B][Validity: 2014-03-08 01:53:04 - 2029-03-08 01:53:04][Cipher: TLS_RSA_WITH_RC4_128_MD5] 6 TCP 192.168.2.4:49205 <-> 17.173.66.102:443 [proto: 91.140/TLS.Apple][cat: Web/5][17 pkts/6166 bytes <-> 15 pkts/3539 bytes][Goodput ratio: 84.7/76.8][0.94 sec][bytes ratio: 0.271 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 35.8/42.0 225/228 76.0/80.9][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 362.7/235.9 1494/1002 464.1/321.5][TLSv1.2][Client: p53-buy.itunes.apple.com][JA3C: 799135475da362592a4be9199d258726][JA3S: c253ec3ad88e42f8da4032682892f9a0 (INSECURE)][Cipher: TLS_RSA_WITH_RC4_128_MD5] - 7 TCP 192.168.2.4:49193 <-> 17.110.229.14:5223 [proto: 238/ApplePush][cat: Cloud/13][11 pkts/4732 bytes <-> 11 pkts/1194 bytes][Goodput ratio: 84.6/39.2][125.45 sec][bytes ratio: 0.597 (Upload)][IAT c2s/s2c min/avg/max/stddev: 53/0 12859.6/12856.5 101116/101113 33358.6/33358.7][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 430.2/108.5 1506/300 466.8/82.6][PLAIN TEXT (yfV.nY)] + 7 TCP 192.168.2.4:49193 <-> 17.110.229.14:5223 [proto: 238.140/ApplePush.Apple][cat: Cloud/13][11 pkts/4732 bytes <-> 11 pkts/1194 bytes][Goodput ratio: 84.6/39.2][125.45 sec][bytes ratio: 0.597 (Upload)][IAT c2s/s2c min/avg/max/stddev: 53/0 12859.6/12856.5 101116/101113 33358.6/33358.7][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 430.2/108.5 1506/300 466.8/82.6][PLAIN TEXT (yfV.nY)] 8 UDP 192.168.2.4:51518 <-> 31.13.93.48:3478 [proto: 78.45/STUN.WhatsAppCall][cat: VoIP/10][12 pkts/2341 bytes <-> 12 pkts/2484 bytes][Goodput ratio: 78.4/79.7][29.18 sec][bytes ratio: -0.030 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 2192.2/2121.8 18656/18299 5822.2/5720.0][Pkt Len c2s/s2c min/avg/max/stddev: 64/68 195.1/207.0 331/358 97.6/107.5] 9 UDP 0.0.0.0:68 -> 255.255.255.255:67 [proto: 18/DHCP][cat: Network/14][10 pkts/3420 bytes -> 0 pkts/0 bytes][Goodput ratio: 87.7/0.0][59.94 sec][Host: lucas-imac][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1255/0 6659.6/0.0 9061/0 2879.9/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 342/0 342.0/0.0 342/0 0.0/0.0][DHCP Fingerprint: 1,3,6,15,119,95,252,44,46] 10 UDP 192.168.2.4:52794 <-> 31.13.84.48:3478 [proto: 78.45/STUN.WhatsAppCall][cat: VoIP/10][9 pkts/1842 bytes <-> 11 pkts/1151 bytes][Goodput ratio: 79.4/59.8][14.33 sec][bytes ratio: 0.231 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/1 1922.9/792.0 6986/6468 2906.0/2008.5][Pkt Len c2s/s2c min/avg/max/stddev: 68/64 204.7/104.6 331/128 81.8/22.8] diff --git a/tests/result/whatsapp_login_chat.pcap.out b/tests/result/whatsapp_login_chat.pcap.out index 6d642ec2b..59a9dce17 100644 --- a/tests/result/whatsapp_login_chat.pcap.out +++ b/tests/result/whatsapp_login_chat.pcap.out @@ -1,14 +1,13 @@ MDNS 2 202 2 DHCP 6 2052 1 Dropbox 2 1088 1 -Apple 44 21371 1 +Apple 50 23466 2 WhatsApp 32 3243 2 Spotify 1 86 1 -ApplePush 6 2095 1 1 TCP 192.168.2.4:49205 <-> 17.173.66.102:443 [proto: 91.140/TLS.Apple][cat: Web/5][24 pkts/15117 bytes <-> 20 pkts/6254 bytes][Goodput ratio: 91.4/82.7][3.89 sec][bytes ratio: 0.415 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 179.5/27.0 2803/212 622.4/56.6][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 629.9/312.7 1494/1002 544.4/369.6][PLAIN TEXT (BjmkLnl)] 2 TCP 192.168.2.4:49206 <-> 158.85.58.15:5222 [proto: 142/WhatsApp][cat: Chat/9][17 pkts/1794 bytes <-> 13 pkts/1169 bytes][Goodput ratio: 36.8/25.9][19.72 sec][bytes ratio: 0.211 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/10 1370.8/2065.9 10513/10479 2987.9/3556.1][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 105.5/89.9 267/144 67.5/22.2][PLAIN TEXT (iPhone)] - 3 TCP 17.110.229.14:5223 -> 192.168.2.4:49193 [proto: 238/ApplePush][cat: Cloud/13][6 pkts/2095 bytes -> 0 pkts/0 bytes][Goodput ratio: 81.1/0.0][20.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 659/0 4000.2/0.0 10199/0 3475.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 220/0 349.2/0.0 375/0 57.8/0.0] + 3 TCP 17.110.229.14:5223 -> 192.168.2.4:49193 [proto: 238.140/ApplePush.Apple][cat: Cloud/13][6 pkts/2095 bytes -> 0 pkts/0 bytes][Goodput ratio: 81.1/0.0][20.00 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 659/0 4000.2/0.0 10199/0 3475.6/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 220/0 349.2/0.0 375/0 57.8/0.0] 4 UDP 0.0.0.0:68 -> 255.255.255.255:67 [proto: 18/DHCP][cat: Network/14][6 pkts/2052 bytes -> 0 pkts/0 bytes][Goodput ratio: 87.7/0.0][25.29 sec][Host: lucas-imac][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1983/0 5058.0/0.0 8569/0 2765.5/0.0][Pkt Len c2s/s2c min/avg/max/stddev: 342/0 342.0/0.0 342/0 0.0/0.0][DHCP Fingerprint: 1,3,6,15,119,95,252,44,46] 5 UDP 192.168.2.1:17500 -> 192.168.2.255:17500 [proto: 121/Dropbox][cat: Cloud/13][2 pkts/1088 bytes -> 0 pkts/0 bytes][Goodput ratio: 92.2/0.0][30.04 sec][PLAIN TEXT ( 3375359593)] 6 UDP 192.168.2.4:61697 <-> 192.168.2.1:53 [proto: 5.142/DNS.WhatsApp][cat: Chat/9][1 pkts/76 bytes <-> 1 pkts/204 bytes][Goodput ratio: 44.2/79.0][0.03 sec][Host: e12.whatsapp.net][PLAIN TEXT (whatsapp)] diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out index df91995f4..a006ae7a6 100644 --- a/tests/result/zoom.pcap.out +++ b/tests/result/zoom.pcap.out @@ -5,11 +5,11 @@ SSDP 1 168 1 DHCP 1 321 1 ntop 20 4265 1 IMAPS 2 226 1 -ICMP 3 210 2 +ICMP 1 70 1 TLS 2 114 1 Google 26 8851 3 Spotify 1 86 1 -Zoom 635 354005 19 +Zoom 637 354145 20 JA3 Host Stats: IP Address # JA3C @@ -44,7 +44,7 @@ JA3 Host Stats: 26 UDP 192.168.1.117:57025 -> 239.255.255.250:1900 [proto: 12/SSDP][cat: System/18][1 pkts/168 bytes -> 0 pkts/0 bytes][Goodput ratio: 74.6/0.0][< 1 sec][PLAIN TEXT (SEARCH )] 27 UDP 192.168.1.117:62988 <-> 192.168.1.1:53 [proto: 5.189/DNS.Zoom][cat: Video/26][1 pkts/72 bytes <-> 1 pkts/88 bytes][Goodput ratio: 41.1/51.7][0.04 sec][Host: www3.zoom.us] 28 UDP 192.168.1.117:64352 <-> 192.168.1.1:53 [proto: 5.189/DNS.Zoom][cat: Video/26][1 pkts/71 bytes <-> 1 pkts/87 bytes][Goodput ratio: 40.3/51.1][0.04 sec][Host: log.zoom.us] - 29 ICMP 192.168.1.117:0 -> 162.255.38.14:0 [proto: 81/ICMP][cat: Network/14][2 pkts/140 bytes -> 0 pkts/0 bytes][Goodput ratio: 39.7/0.0][0.01 sec] + 29 ICMP 192.168.1.117:0 -> 162.255.38.14:0 [proto: 81.189/ICMP.Zoom][cat: Network/14][2 pkts/140 bytes -> 0 pkts/0 bytes][Goodput ratio: 39.7/0.0][0.01 sec] 30 TCP 192.168.1.117:54798 <-> 13.225.84.182:443 [proto: 91/TLS][cat: Web/5][1 pkts/54 bytes <-> 1 pkts/60 bytes][Goodput ratio: 0.0/0.0][0.04 sec] 31 UDP 192.168.1.117:5353 -> 224.0.0.251:5353 [proto: 8/MDNS][cat: Network/14][1 pkts/87 bytes -> 0 pkts/0 bytes][Goodput ratio: 51.1/0.0][< 1 sec][PLAIN TEXT (spotify)] 32 UDP 192.168.1.117:57621 -> 192.168.1.255:57621 [proto: 156/Spotify][cat: Music/25][1 pkts/86 bytes -> 0 pkts/0 bytes][Goodput ratio: 50.6/0.0][< 1 sec][PLAIN TEXT (SpotUdp)] diff --git a/tests/vagrind_test.sh b/tests/vagrind_test.sh new file mode 100755 index 000000000..aa04dab40 --- /dev/null +++ b/tests/vagrind_test.sh @@ -0,0 +1,33 @@ +#!/bin/sh + +READER="valgrind -q --leak-check=full ../example/ndpiReader -p ../example/protos.txt -c ../example/categories.txt" + +RC=0 +PCAPS=`cd pcap; /bin/ls *.pcap` + +check_results() { + for f in $PCAPS; do + CMD="$READER -q -i pcap/$f > /tmp/reader.out" + $CMD + NUM_DIFF=0 + + if [ -f /tmp/reader.out ]; then + NUM_DIFF=`wc -l /tmp/reader.out` + fi + + if [ $NUM_DIFF -eq 0 ]; then + printf "%-32s\tOK\n" "$f" + else + printf "%-32s\tERROR\n" "$f" + echo "$CMD" + cat /tmp/reader.out + RC=1 + fi + + /bin/rm -f /tmp/reader.out + done +} + +check_results + +exit $RC |