aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h6
-rw-r--r--src/include/ndpi_protocols.h1
-rw-r--r--src/include/ndpi_typedefs.h4
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_content_match.c.inc1419
-rw-r--r--src/lib/ndpi_main.c22
-rw-r--r--src/lib/protocols/skype.c16
-rw-r--r--src/lib/protocols/starcraft.c155
-rw-r--r--src/lib/protocols/starcraft2.c157
9 files changed, 900 insertions, 881 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index e724f452d..d1b0792ff 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -199,7 +199,7 @@
#define NDPI_PROTOCOL_TELEGRAM 185 /* Gianluca Costa <g.costa@xplico.org> */
#define NDPI_PROTOCOL_QUIC 188 /* Andrea Buscarinu <andrea.buscarinu@gmail.com> - Michele Campus <michelecampus5@gmail.com> */
#define NDPI_PROTOCOL_WHATSAPP_VOICE 189
-#define NDPI_PROTOCOL_STARCRAFT2 214 /* matteobracci1@gmail.com */
+#define NDPI_PROTOCOL_STARCRAFT 214 /* Matteo Bracci <matteobracci1@gmail.com> */
#define NDPI_CONTENT_AVI 39
@@ -260,10 +260,10 @@
#define NDPI_SERVICE_DEEZER 210
#define NDPI_SERVICE_INSTAGRAM 211 /* Andrea Buscarinu <andrea.buscarinu@gmail.com> */
#define NDPI_SERVICE_MICROSOFT 212
-#define NDPI_SERVICE_BATTLENET 213 /* matteobracci1@gmail.com */
+#define NDPI_SERVICE_BATTLENET 213 /* Matteo Bracci <matteobracci1@gmail.com> */
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_STARCRAFT2
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_STARCRAFT
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 904ae956e..e3449cecd 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -330,5 +330,6 @@ void init_xdmcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in
void init_yahoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_zattoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_zmq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_stracraft2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
#endif /* __NDPI_PROTOCOLS_INCLUDE_FILE__ */
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 08ed60086..7b6b90121 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -804,8 +804,8 @@ typedef struct ndpi_flow_struct {
u_int32_t pplive_stage2:2; // 0 - 2
u_int32_t pplive_stage3:2; // 0 - 2
#endif
-#ifdef NDPI_PROTOCOL_STARCRAFT2
- u_int32_t starcraft2_udp_stage : 3; // 0-7
+#ifdef NDPI_PROTOCOL_STARCRAFT
+ u_int32_t starcraft_udp_stage : 3; // 0-7
#endif
/* internal structures to save functions calls */
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 36341dde5..941b5048c 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -121,6 +121,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/ssdp.c \
protocols/ssh.c \
protocols/ssl.c \
+ protocols/starcraft.c \
protocols/stealthnet.c \
protocols/steam.c \
protocols/stun.c \
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 03f133549..dbb317178 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -3,9 +3,6 @@
*
* Copyright (C) 2011-15 - ntop.org
*
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
@@ -72,10 +69,10 @@ static ndpi_network host_protocol_list[] = {
{ 0x6CA0A000 /* 108.160.160.0 */, 20, NDPI_PROTOCOL_DROPBOX },
/*
- Skype (Microsoft CDN)
- 157.56.0.0/14, 157.60.0.0/16, 157.54.0.0/15
- 111.221.64.0 - 111.221.127.255
- 91.190.216.0/21 (AS198015 Skype Communications Sarl)
+ Skype (Microsoft CDN)
+ 157.56.0.0/14, 157.60.0.0/16, 157.54.0.0/15
+ 111.221.64.0 - 111.221.127.255
+ 91.190.216.0/21 (AS198015 Skype Communications Sarl)
*/
{ 0x9D380000 /* 157.56.0.0 */, 14, NDPI_PROTOCOL_SKYPE },
{ 0x9D3C0000 /* 157.60.0.0 */, 16, NDPI_PROTOCOL_SKYPE },
@@ -84,6 +81,13 @@ static ndpi_network host_protocol_list[] = {
{ 0x5BBED800 /* 91.190.216.0 */, 21, NDPI_PROTOCOL_SKYPE },
/*
+ route: 5.42.160.0/19
+ descr: Blizzard Entertainment, Inc
+ origin: AS57976
+ */
+ { 0x052AA000 /* 5.42.160.0 */, 19, NDPI_PROTOCOL_STARCRAFT },
+
+ /*
Google
173.194.0.0/16
*/
@@ -6643,649 +6647,649 @@ static ndpi_network host_protocol_list[] = {
{ 0xC6493247, 32, NDPI_PROTOCOL_TOR },
{ 0xC64A38BF, 32, NDPI_PROTOCOL_TOR },
{ 0xC64A3A10, 32, NDPI_PROTOCOL_TOR },
-{ 0xC64A3ACE, 32, NDPI_PROTOCOL_TOR },
-{ 0xC64A3C1A, 32, NDPI_PROTOCOL_TOR },
-{ 0xC64A3E6B, 32, NDPI_PROTOCOL_TOR },
-{ 0xC654A10C, 32, NDPI_PROTOCOL_TOR },
-{ 0xC654F0E5, 32, NDPI_PROTOCOL_TOR },
-{ 0xC654F96A, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6609B03, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6623103, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6623495, 32, NDPI_PROTOCOL_TOR },
-{ 0xC662358D, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6649014, 32, NDPI_PROTOCOL_TOR },
-{ 0xC664904B, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6649470, 32, NDPI_PROTOCOL_TOR },
-{ 0xC664947B, 32, NDPI_PROTOCOL_TOR },
-{ 0xC664959F, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6649B36, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6649BC2, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6697D25, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6697DB2, 32, NDPI_PROTOCOL_TOR },
-{ 0xC669D0A4, 32, NDPI_PROTOCOL_TOR },
-{ 0xC669DF92, 32, NDPI_PROTOCOL_TOR },
-{ 0xC68F88ED, 32, NDPI_PROTOCOL_TOR },
-{ 0xC693141D, 32, NDPI_PROTOCOL_TOR },
-{ 0xC693174D, 32, NDPI_PROTOCOL_TOR },
-{ 0xC69451A7, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6A7895C, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6A78F95, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6B49609, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6C74845, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6C76BDC, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6C77079, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6C77231, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6C775A4, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6C77A11, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6CD713B, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6D36392, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6D37ABF, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6D37B5C, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6D37CD6, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6D37DF2, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6D37E53, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6F464C8, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6F46963, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6F53294, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6F53C28, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6F53C93, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6F53CC2, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6F53E68, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6F53FE4, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6FC9957, 32, NDPI_PROTOCOL_TOR },
-{ 0xC6FC996B, 32, NDPI_PROTOCOL_TOR },
-{ 0xC710BF3A, 32, NDPI_PROTOCOL_TOR },
-{ 0xC71355FC, 32, NDPI_PROTOCOL_TOR },
-{ 0xC713D5B0, 32, NDPI_PROTOCOL_TOR },
-{ 0xC726567A, 32, NDPI_PROTOCOL_TOR },
-{ 0xC73A530A, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7579AFF, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7737387, 32, NDPI_PROTOCOL_TOR },
-{ 0xC773CDF1, 32, NDPI_PROTOCOL_TOR },
-{ 0xC773CDF2, 32, NDPI_PROTOCOL_TOR },
-{ 0xC773CDF3, 32, NDPI_PROTOCOL_TOR },
-{ 0xC773CDF5, 32, NDPI_PROTOCOL_TOR },
-{ 0xC773CDF8, 32, NDPI_PROTOCOL_TOR },
-{ 0xC77FE240, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7A78088, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7A7A1C3, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7A7C679, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7BC649A, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7BCC235, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7C173D1, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7C1FD31, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7C3C116, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7C3F83C, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7C3F890, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7C3F9D4, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7CA151D, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7FEEE2C, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7FEEE34, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7FEEE34, 32, NDPI_PROTOCOL_TOR },
-{ 0xC7FFDF58, 32, NDPI_PROTOCOL_TOR },
-{ 0xC811D20C, 32, NDPI_PROTOCOL_TOR },
-{ 0xC8628B17, 32, NDPI_PROTOCOL_TOR },
-{ 0xC86CEC4B, 32, NDPI_PROTOCOL_TOR },
-{ 0xC8B55A41, 32, NDPI_PROTOCOL_TOR },
-{ 0xC8DFD4D2, 32, NDPI_PROTOCOL_TOR },
-{ 0xC906897F, 32, NDPI_PROTOCOL_TOR },
-{ 0xC91BEB7F, 32, NDPI_PROTOCOL_TOR },
-{ 0xC9AA12B7, 32, NDPI_PROTOCOL_TOR },
-{ 0xC9D46CB8, 32, NDPI_PROTOCOL_TOR },
-{ 0xC9DA72A2, 32, NDPI_PROTOCOL_TOR },
-{ 0xCA07F408, 32, NDPI_PROTOCOL_TOR },
-{ 0xCA3C4220, 32, NDPI_PROTOCOL_TOR },
-{ 0xCA4A2C0F, 32, NDPI_PROTOCOL_TOR },
-{ 0xCA536AB3, 32, NDPI_PROTOCOL_TOR },
-{ 0xCA55E922, 32, NDPI_PROTOCOL_TOR },
-{ 0xCAAB9C54, 32, NDPI_PROTOCOL_TOR },
-{ 0xCAAC1039, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB56CAA7, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB56CD2E, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB6DE90F, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB71AC95, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB71AC98, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB71AC9A, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB7B3001, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB7E7B52, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB8A63DA, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB98C302, 32, NDPI_PROTOCOL_TOR },
-{ 0xCB99CEA6, 32, NDPI_PROTOCOL_TOR },
-{ 0xCBA16711, 32, NDPI_PROTOCOL_TOR },
-{ 0xCBB2850B, 32, NDPI_PROTOCOL_TOR },
-{ 0xCBCEEDC5, 32, NDPI_PROTOCOL_TOR },
-{ 0xCBD9AD92, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC089C8E, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC093747, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC0B3283, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC1025F4, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC11382A, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC11382A, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC1B382D, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC1B382D, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC1B3ACA, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC2D1E7A, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC2D1E7D, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC2DB6E2, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC534638, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC55BF1E, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC59C10A, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC7C5382, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC7C5382, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC7C5386, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC7C5386, 32, NDPI_PROTOCOL_TOR },
-{ 0xCC91512D, 32, NDPI_PROTOCOL_TOR },
-{ 0xCCC21D04, 32, NDPI_PROTOCOL_TOR },
-{ 0xCCF67A48, 32, NDPI_PROTOCOL_TOR },
-{ 0xCDA85485, 32, NDPI_PROTOCOL_TOR },
-{ 0xCDB973EA, 32, NDPI_PROTOCOL_TOR },
-{ 0xCDB97A98, 32, NDPI_PROTOCOL_TOR },
-{ 0xCE2876E5, 32, NDPI_PROTOCOL_TOR },
-{ 0xCE374A00, 32, NDPI_PROTOCOL_TOR },
-{ 0xCE374A01, 32, NDPI_PROTOCOL_TOR },
-{ 0xCE48C698, 32, NDPI_PROTOCOL_TOR },
-{ 0xCEAE7054, 32, NDPI_PROTOCOL_TOR },
-{ 0xCEBE9906, 32, NDPI_PROTOCOL_TOR },
-{ 0xCF268613, 32, NDPI_PROTOCOL_TOR },
-{ 0xCF6CDABA, 32, NDPI_PROTOCOL_TOR },
-{ 0xCF9E0F72, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFACD159, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFBD72D7, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFC046FA, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFC9DFC3, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFC9DFC4, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFC9DFC5, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFE54199, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFF44B8E, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFF4526D, 32, NDPI_PROTOCOL_TOR },
-{ 0xCFF4526D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD041B5BD, 32, NDPI_PROTOCOL_TOR },
-{ 0xD0421E1B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD049CCE4, 32, NDPI_PROTOCOL_TOR },
-{ 0xD04FD17C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD04FD34D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD0509A27, 32, NDPI_PROTOCOL_TOR },
-{ 0xD0526625, 32, NDPI_PROTOCOL_TOR },
-{ 0xD053DF22, 32, NDPI_PROTOCOL_TOR },
-{ 0xD053DFE5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD0549BCD, 32, NDPI_PROTOCOL_TOR },
-{ 0xD0549BF3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD0549BF7, 32, NDPI_PROTOCOL_TOR },
-{ 0xD056FB58, 32, NDPI_PROTOCOL_TOR },
-{ 0xD05B798E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD065161A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD06F2350, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1063507, 32, NDPI_PROTOCOL_TOR },
-{ 0xD106441D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD10685EE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD111BF75, 32, NDPI_PROTOCOL_TOR },
-{ 0xD12C72B2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD133A319, 32, NDPI_PROTOCOL_TOR },
-{ 0xD133BFBE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1709F3C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC25, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC25, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC26, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC26, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC27, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC27, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC28, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC28, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC29, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC29, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC2A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD177BC2A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD17BA242, 32, NDPI_PROTOCOL_TOR },
-{ 0xD17E47E9, 32, NDPI_PROTOCOL_TOR },
-{ 0xD17E4854, 32, NDPI_PROTOCOL_TOR },
-{ 0xD17E6907, 32, NDPI_PROTOCOL_TOR },
-{ 0xD18D23E8, 32, NDPI_PROTOCOL_TOR },
-{ 0xD18D242A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD18D2ECC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD18D328A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD18D34EF, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1942E81, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1942E82, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1942E82, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1945576, 32, NDPI_PROTOCOL_TOR },
-{ 0xD19F8A13, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1A221CF, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1B5E383, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1D01A29, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1D04F05, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1D2D215, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1DE08C4, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1DE1EF1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD1FA02FE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD217021E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD23625E2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD2A6194E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD2C33DFC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD2D37ACC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD2FBD989, 32, NDPI_PROTOCOL_TOR },
-{ 0xD31AF36D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD31C8EEF, 32, NDPI_PROTOCOL_TOR },
-{ 0xD31FC4F8, 32, NDPI_PROTOCOL_TOR },
-{ 0xD3CA291F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD407C247, 32, NDPI_PROTOCOL_TOR },
-{ 0xD407DC06, 32, NDPI_PROTOCOL_TOR },
-{ 0xD40A5604, 32, NDPI_PROTOCOL_TOR },
-{ 0xD40CCB27, 32, NDPI_PROTOCOL_TOR },
-{ 0xD41010B8, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4106821, 32, NDPI_PROTOCOL_TOR },
-{ 0xD411664D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD41824CD, 32, NDPI_PROTOCOL_TOR },
-{ 0xD41890BC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD421F581, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE209, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE3AC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE3AC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE445, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE459, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE5D1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE5D1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE745, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE784, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE80D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE8F6, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FE97E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FEA54, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FEB57, 32, NDPI_PROTOCOL_TOR },
-{ 0xD42FECDB, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4305435, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4339C5A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4339C8F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4339C9E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4339C9E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4339F4E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4339F72, 32, NDPI_PROTOCOL_TOR },
-{ 0xD438D698, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4402044, 32, NDPI_PROTOCOL_TOR },
-{ 0xD447EECB, 32, NDPI_PROTOCOL_TOR },
-{ 0xD447F805, 32, NDPI_PROTOCOL_TOR },
-{ 0xD447F945, 32, NDPI_PROTOCOL_TOR },
-{ 0xD447F945, 32, NDPI_PROTOCOL_TOR },
-{ 0xD447F981, 32, NDPI_PROTOCOL_TOR },
-{ 0xD447FC6D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD447FC74, 32, NDPI_PROTOCOL_TOR },
-{ 0xD447FDE2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD44AFEF3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD44DE210, 32, NDPI_PROTOCOL_TOR },
-{ 0xD44DE2F5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4532F5B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD45394CD, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4539A21, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4539A21, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4539E05, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4539E14, 32, NDPI_PROTOCOL_TOR },
-{ 0xD453A298, 32, NDPI_PROTOCOL_TOR },
-{ 0xD453A7AF, 32, NDPI_PROTOCOL_TOR },
-{ 0xD453AAFC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD453B07A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD453B07D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD453BECB, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4554F44, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4554F47, 32, NDPI_PROTOCOL_TOR },
-{ 0xD45CDB0F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD467903A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD46A09CE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD46B9591, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4722F34, 32, NDPI_PROTOCOL_TOR },
-{ 0xD472303A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4726D21, 32, NDPI_PROTOCOL_TOR },
-{ 0xD472FA12, 32, NDPI_PROTOCOL_TOR },
-{ 0xD472FE5B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4758F4A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD475B46B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4763E03, 32, NDPI_PROTOCOL_TOR },
-{ 0xD47CB453, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4810454, 32, NDPI_PROTOCOL_TOR },
-{ 0xD48110B6, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4811AF6, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4812A09, 32, NDPI_PROTOCOL_TOR },
-{ 0xD48132F6, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4813431, 32, NDPI_PROTOCOL_TOR },
-{ 0xD495D15B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD49F5B16, 32, NDPI_PROTOCOL_TOR },
-{ 0xD49F70C4, 32, NDPI_PROTOCOL_TOR },
-{ 0xD49F8F53, 32, NDPI_PROTOCOL_TOR },
-{ 0xD49FB1C6, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4A4EF79, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4B733DE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4BA59A2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4BBC8AA, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4C04A64, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4C04A65, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4C63318, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4C6C924, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4C6E391, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4E054E3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4E059FD, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4E326F7, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4E38BC3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4E3F876, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4E81D65, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4FAA0B2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD4FAA0BB, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5095DAE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD52C58EA, 32, NDPI_PROTOCOL_TOR },
-{ 0xD52F2397, 32, NDPI_PROTOCOL_TOR },
-{ 0xD52F4B43, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5317328, 32, NDPI_PROTOCOL_TOR },
-{ 0xD53D957D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD53D957E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD540E2E6, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5430E91, 32, NDPI_PROTOCOL_TOR },
-{ 0xD54951D2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5497087, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5582A31, 32, NDPI_PROTOCOL_TOR },
-{ 0xD55F1536, 32, NDPI_PROTOCOL_TOR },
-{ 0xD55F153B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD56B4D04, 32, NDPI_PROTOCOL_TOR },
-{ 0xD56C6947, 32, NDPI_PROTOCOL_TOR },
-{ 0xD56C69FD, 32, NDPI_PROTOCOL_TOR },
-{ 0xD56CD7EE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD56FF097, 32, NDPI_PROTOCOL_TOR },
-{ 0xD57086D3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD570C73F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5713D6A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5717790, 32, NDPI_PROTOCOL_TOR },
-{ 0xD571D5BE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5724869, 32, NDPI_PROTOCOL_TOR },
-{ 0xD57293E0, 32, NDPI_PROTOCOL_TOR },
-{ 0xD572966F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD572E864, 32, NDPI_PROTOCOL_TOR },
-{ 0xD57F85A7, 32, NDPI_PROTOCOL_TOR },
-{ 0xD57F921B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD585639C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5856D29, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5856DA5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5857B97, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58845ED, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5884715, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5884B2A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5885261, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5885674, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58857F5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5885A9B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5885CA9, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58A653C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58A66D1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58A6E58, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58A71E8, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58D8818, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58D8D93, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58D95E3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58D9EED, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58E2E79, 32, NDPI_PROTOCOL_TOR },
-{ 0xD58F7A02, 32, NDPI_PROTOCOL_TOR },
-{ 0xD59B0490, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A3482F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A348A2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A54610, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A54F22, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A54FF3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A55106, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A5551E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A55546, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5A555F9, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5AFD83B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5B39EF1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5B73821, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5B7388C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5B9E355, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5BA07E8, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5BB54BE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5BB6FFE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5BC77C9, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5C489E3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5C5167C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5C52469, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5D0BCCB, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5D3FC58, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5DE7461, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5E3FAF5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFC519, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFD329, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFD414, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFD6AF, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFD8DE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFD912, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFDA14, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFDA93, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5EFF9DB, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5F05E3A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5F06C19, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5F53D3D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5FBBB37, 32, NDPI_PROTOCOL_TOR },
-{ 0xD5FBC7AE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD80CC652, 32, NDPI_PROTOCOL_TOR },
-{ 0xD80CC653, 32, NDPI_PROTOCOL_TOR },
-{ 0xD80F0122, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8116382, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8116390, 32, NDPI_PROTOCOL_TOR },
-{ 0xD811654F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD81169CB, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8116EE7, 32, NDPI_PROTOCOL_TOR },
-{ 0xD818AEF5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8425592, 32, NDPI_PROTOCOL_TOR },
-{ 0xD873031A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD873063A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD892E107, 32, NDPI_PROTOCOL_TOR },
-{ 0xD89A71F4, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8A13759, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8BAC1C9, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8BD9264, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8BD9575, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8BD9666, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8BD9718, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8C3851B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8DA860C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8DAD8C2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8DD24F4, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8E6E69C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8E6E6F7, 32, NDPI_PROTOCOL_TOR },
-{ 0xD8F455D3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90833AD, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90B39E2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90B7727, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90CC7BE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90CC7D1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90CCB2E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90CCC59, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90CCC68, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90CCC93, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90CD075, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90D4A29, 32, NDPI_PROTOCOL_TOR },
-{ 0xD90DC505, 32, NDPI_PROTOCOL_TOR },
-{ 0xD910B514, 32, NDPI_PROTOCOL_TOR },
-{ 0xD910B614, 32, NDPI_PROTOCOL_TOR },
-{ 0xD91318D8, 32, NDPI_PROTOCOL_TOR },
-{ 0xD91318E9, 32, NDPI_PROTOCOL_TOR },
-{ 0xD917011B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD91A1259, 32, NDPI_PROTOCOL_TOR },
-{ 0xD91BB67D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD92287E1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD92287E7, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9251373, 32, NDPI_PROTOCOL_TOR },
-{ 0xD92855C2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD928FEB1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD943154D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD945FE58, 32, NDPI_PROTOCOL_TOR },
-{ 0xD946BD91, 32, NDPI_PROTOCOL_TOR },
-{ 0xD946BF0D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD948141E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD94FB23C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD94FB532, 32, NDPI_PROTOCOL_TOR },
-{ 0xD94FB538, 32, NDPI_PROTOCOL_TOR },
-{ 0xD94FB65F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD94FBE19, 32, NDPI_PROTOCOL_TOR },
-{ 0xD954FBD5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD95597B5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD95EEEF5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD970833A, 32, NDPI_PROTOCOL_TOR },
-{ 0xD97293F5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD972DA12, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9730A85, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9730A86, 32, NDPI_PROTOCOL_TOR },
-{ 0xD97729D5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD97BFEEE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD98090A0, 32, NDPI_PROTOCOL_TOR },
-{ 0xD991C735, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9924B24, 32, NDPI_PROTOCOL_TOR },
-{ 0xD99454B4, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9A0122D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9A013EC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9A05C43, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9A07E32, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9A083B0, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9A276FE, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9AACD71, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9ACB392, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9ACBE13, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9ACBE13, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9ACFFE5, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9AD4A5B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9BCEA09, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9BDC5F4, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9BF49C3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9BF6813, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9BFF274, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9C3AA91, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9C504DC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9C553A2, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9C556AD, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9C55B91, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9C55B91, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9C55BA4, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9C5B52D, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9D075D3, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9D11257, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9D27158, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9D28C5F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9D2A52B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9D39FA1, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9E40B41, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9E46874, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9E76B72, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9E94FC8, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9E94FC8, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9EA6B0B, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9F595B7, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9F63320, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9F76904, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9F7DE9C, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9F7E61F, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9F9203E, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9FBD765, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9FD96F6, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9FD9F48, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9FE3DAC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9FE47CC, 32, NDPI_PROTOCOL_TOR },
-{ 0xD9FEB60F, 32, NDPI_PROTOCOL_TOR },
-{ 0xDAA1200E, 32, NDPI_PROTOCOL_TOR },
-{ 0xDAE7EBDB, 32, NDPI_PROTOCOL_TOR },
-{ 0xDAE868DC, 32, NDPI_PROTOCOL_TOR },
-{ 0xDAE868DD, 32, NDPI_PROTOCOL_TOR },
-{ 0xDAFAF536, 32, NDPI_PROTOCOL_TOR },
-{ 0xDB4F067A, 32, NDPI_PROTOCOL_TOR },
-{ 0xDB59C4CA, 32, NDPI_PROTOCOL_TOR },
-{ 0xDB6DCB40, 32, NDPI_PROTOCOL_TOR },
-{ 0xDB75CE2E, 32, NDPI_PROTOCOL_TOR },
-{ 0xDB791014, 32, NDPI_PROTOCOL_TOR },
-{ 0xDBA189F3, 32, NDPI_PROTOCOL_TOR },
-{ 0xDBA4C22E, 32, NDPI_PROTOCOL_TOR },
-{ 0xDBAD0E54, 32, NDPI_PROTOCOL_TOR },
-{ 0xDC39428E, 32, NDPI_PROTOCOL_TOR },
-{ 0xDC87FE3F, 32, NDPI_PROTOCOL_TOR },
-{ 0xDC898752, 32, NDPI_PROTOCOL_TOR },
-{ 0xDC9387F3, 32, NDPI_PROTOCOL_TOR },
-{ 0xDC9DC3F3, 32, NDPI_PROTOCOL_TOR },
-{ 0xDCE97BAC, 32, NDPI_PROTOCOL_TOR },
-{ 0xDCE9AF0E, 32, NDPI_PROTOCOL_TOR },
-{ 0xDCFD1CE1, 32, NDPI_PROTOCOL_TOR },
-{ 0xDCFF85C3, 32, NDPI_PROTOCOL_TOR },
-{ 0xDD7132CB, 32, NDPI_PROTOCOL_TOR },
-{ 0xDD9E95C5, 32, NDPI_PROTOCOL_TOR },
-{ 0xDE047C92, 32, NDPI_PROTOCOL_TOR },
-{ 0xDE0C7C9A, 32, NDPI_PROTOCOL_TOR },
-{ 0xDE7294F8, 32, NDPI_PROTOCOL_TOR },
-{ 0xDEEB761A, 32, NDPI_PROTOCOL_TOR },
-{ 0xDF1273E5, 32, NDPI_PROTOCOL_TOR },
-{ 0xDF85F4CA, 32, NDPI_PROTOCOL_TOR },
-{ 0xDFE57B41, 32, NDPI_PROTOCOL_TOR },
+ { 0xC64A3ACE, 32, NDPI_PROTOCOL_TOR },
+ { 0xC64A3C1A, 32, NDPI_PROTOCOL_TOR },
+ { 0xC64A3E6B, 32, NDPI_PROTOCOL_TOR },
+ { 0xC654A10C, 32, NDPI_PROTOCOL_TOR },
+ { 0xC654F0E5, 32, NDPI_PROTOCOL_TOR },
+ { 0xC654F96A, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6609B03, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6623103, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6623495, 32, NDPI_PROTOCOL_TOR },
+ { 0xC662358D, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6649014, 32, NDPI_PROTOCOL_TOR },
+ { 0xC664904B, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6649470, 32, NDPI_PROTOCOL_TOR },
+ { 0xC664947B, 32, NDPI_PROTOCOL_TOR },
+ { 0xC664959F, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6649B36, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6649BC2, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6697D25, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6697DB2, 32, NDPI_PROTOCOL_TOR },
+ { 0xC669D0A4, 32, NDPI_PROTOCOL_TOR },
+ { 0xC669DF92, 32, NDPI_PROTOCOL_TOR },
+ { 0xC68F88ED, 32, NDPI_PROTOCOL_TOR },
+ { 0xC693141D, 32, NDPI_PROTOCOL_TOR },
+ { 0xC693174D, 32, NDPI_PROTOCOL_TOR },
+ { 0xC69451A7, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6A7895C, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6A78F95, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6B49609, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6C74845, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6C76BDC, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6C77079, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6C77231, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6C775A4, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6C77A11, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6CD713B, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6D36392, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6D37ABF, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6D37B5C, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6D37CD6, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6D37DF2, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6D37E53, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6F464C8, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6F46963, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6F53294, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6F53C28, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6F53C93, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6F53CC2, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6F53E68, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6F53FE4, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6FC9957, 32, NDPI_PROTOCOL_TOR },
+ { 0xC6FC996B, 32, NDPI_PROTOCOL_TOR },
+ { 0xC710BF3A, 32, NDPI_PROTOCOL_TOR },
+ { 0xC71355FC, 32, NDPI_PROTOCOL_TOR },
+ { 0xC713D5B0, 32, NDPI_PROTOCOL_TOR },
+ { 0xC726567A, 32, NDPI_PROTOCOL_TOR },
+ { 0xC73A530A, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7579AFF, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7737387, 32, NDPI_PROTOCOL_TOR },
+ { 0xC773CDF1, 32, NDPI_PROTOCOL_TOR },
+ { 0xC773CDF2, 32, NDPI_PROTOCOL_TOR },
+ { 0xC773CDF3, 32, NDPI_PROTOCOL_TOR },
+ { 0xC773CDF5, 32, NDPI_PROTOCOL_TOR },
+ { 0xC773CDF8, 32, NDPI_PROTOCOL_TOR },
+ { 0xC77FE240, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7A78088, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7A7A1C3, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7A7C679, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7BC649A, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7BCC235, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7C173D1, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7C1FD31, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7C3C116, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7C3F83C, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7C3F890, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7C3F9D4, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7CA151D, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7FEEE2C, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7FEEE34, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7FEEE34, 32, NDPI_PROTOCOL_TOR },
+ { 0xC7FFDF58, 32, NDPI_PROTOCOL_TOR },
+ { 0xC811D20C, 32, NDPI_PROTOCOL_TOR },
+ { 0xC8628B17, 32, NDPI_PROTOCOL_TOR },
+ { 0xC86CEC4B, 32, NDPI_PROTOCOL_TOR },
+ { 0xC8B55A41, 32, NDPI_PROTOCOL_TOR },
+ { 0xC8DFD4D2, 32, NDPI_PROTOCOL_TOR },
+ { 0xC906897F, 32, NDPI_PROTOCOL_TOR },
+ { 0xC91BEB7F, 32, NDPI_PROTOCOL_TOR },
+ { 0xC9AA12B7, 32, NDPI_PROTOCOL_TOR },
+ { 0xC9D46CB8, 32, NDPI_PROTOCOL_TOR },
+ { 0xC9DA72A2, 32, NDPI_PROTOCOL_TOR },
+ { 0xCA07F408, 32, NDPI_PROTOCOL_TOR },
+ { 0xCA3C4220, 32, NDPI_PROTOCOL_TOR },
+ { 0xCA4A2C0F, 32, NDPI_PROTOCOL_TOR },
+ { 0xCA536AB3, 32, NDPI_PROTOCOL_TOR },
+ { 0xCA55E922, 32, NDPI_PROTOCOL_TOR },
+ { 0xCAAB9C54, 32, NDPI_PROTOCOL_TOR },
+ { 0xCAAC1039, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB56CAA7, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB56CD2E, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB6DE90F, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB71AC95, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB71AC98, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB71AC9A, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB7B3001, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB7E7B52, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB8A63DA, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB98C302, 32, NDPI_PROTOCOL_TOR },
+ { 0xCB99CEA6, 32, NDPI_PROTOCOL_TOR },
+ { 0xCBA16711, 32, NDPI_PROTOCOL_TOR },
+ { 0xCBB2850B, 32, NDPI_PROTOCOL_TOR },
+ { 0xCBCEEDC5, 32, NDPI_PROTOCOL_TOR },
+ { 0xCBD9AD92, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC089C8E, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC093747, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC0B3283, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC1025F4, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC11382A, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC11382A, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC1B382D, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC1B382D, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC1B3ACA, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC2D1E7A, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC2D1E7D, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC2DB6E2, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC534638, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC55BF1E, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC59C10A, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC7C5382, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC7C5382, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC7C5386, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC7C5386, 32, NDPI_PROTOCOL_TOR },
+ { 0xCC91512D, 32, NDPI_PROTOCOL_TOR },
+ { 0xCCC21D04, 32, NDPI_PROTOCOL_TOR },
+ { 0xCCF67A48, 32, NDPI_PROTOCOL_TOR },
+ { 0xCDA85485, 32, NDPI_PROTOCOL_TOR },
+ { 0xCDB973EA, 32, NDPI_PROTOCOL_TOR },
+ { 0xCDB97A98, 32, NDPI_PROTOCOL_TOR },
+ { 0xCE2876E5, 32, NDPI_PROTOCOL_TOR },
+ { 0xCE374A00, 32, NDPI_PROTOCOL_TOR },
+ { 0xCE374A01, 32, NDPI_PROTOCOL_TOR },
+ { 0xCE48C698, 32, NDPI_PROTOCOL_TOR },
+ { 0xCEAE7054, 32, NDPI_PROTOCOL_TOR },
+ { 0xCEBE9906, 32, NDPI_PROTOCOL_TOR },
+ { 0xCF268613, 32, NDPI_PROTOCOL_TOR },
+ { 0xCF6CDABA, 32, NDPI_PROTOCOL_TOR },
+ { 0xCF9E0F72, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFACD159, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFBD72D7, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFC046FA, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFC9DFC3, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFC9DFC4, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFC9DFC5, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFE54199, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFF44B8E, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFF4526D, 32, NDPI_PROTOCOL_TOR },
+ { 0xCFF4526D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD041B5BD, 32, NDPI_PROTOCOL_TOR },
+ { 0xD0421E1B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD049CCE4, 32, NDPI_PROTOCOL_TOR },
+ { 0xD04FD17C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD04FD34D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD0509A27, 32, NDPI_PROTOCOL_TOR },
+ { 0xD0526625, 32, NDPI_PROTOCOL_TOR },
+ { 0xD053DF22, 32, NDPI_PROTOCOL_TOR },
+ { 0xD053DFE5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD0549BCD, 32, NDPI_PROTOCOL_TOR },
+ { 0xD0549BF3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD0549BF7, 32, NDPI_PROTOCOL_TOR },
+ { 0xD056FB58, 32, NDPI_PROTOCOL_TOR },
+ { 0xD05B798E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD065161A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD06F2350, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1063507, 32, NDPI_PROTOCOL_TOR },
+ { 0xD106441D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD10685EE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD111BF75, 32, NDPI_PROTOCOL_TOR },
+ { 0xD12C72B2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD133A319, 32, NDPI_PROTOCOL_TOR },
+ { 0xD133BFBE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1709F3C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC25, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC25, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC26, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC26, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC27, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC27, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC28, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC28, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC29, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC29, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC2A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD177BC2A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD17BA242, 32, NDPI_PROTOCOL_TOR },
+ { 0xD17E47E9, 32, NDPI_PROTOCOL_TOR },
+ { 0xD17E4854, 32, NDPI_PROTOCOL_TOR },
+ { 0xD17E6907, 32, NDPI_PROTOCOL_TOR },
+ { 0xD18D23E8, 32, NDPI_PROTOCOL_TOR },
+ { 0xD18D242A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD18D2ECC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD18D328A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD18D34EF, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1942E81, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1942E82, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1942E82, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1945576, 32, NDPI_PROTOCOL_TOR },
+ { 0xD19F8A13, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1A221CF, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1B5E383, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1D01A29, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1D04F05, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1D2D215, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1DE08C4, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1DE1EF1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD1FA02FE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD217021E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD23625E2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD2A6194E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD2C33DFC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD2D37ACC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD2FBD989, 32, NDPI_PROTOCOL_TOR },
+ { 0xD31AF36D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD31C8EEF, 32, NDPI_PROTOCOL_TOR },
+ { 0xD31FC4F8, 32, NDPI_PROTOCOL_TOR },
+ { 0xD3CA291F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD407C247, 32, NDPI_PROTOCOL_TOR },
+ { 0xD407DC06, 32, NDPI_PROTOCOL_TOR },
+ { 0xD40A5604, 32, NDPI_PROTOCOL_TOR },
+ { 0xD40CCB27, 32, NDPI_PROTOCOL_TOR },
+ { 0xD41010B8, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4106821, 32, NDPI_PROTOCOL_TOR },
+ { 0xD411664D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD41824CD, 32, NDPI_PROTOCOL_TOR },
+ { 0xD41890BC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD421F581, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE209, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE3AC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE3AC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE445, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE459, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE5D1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE5D1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE745, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE784, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE80D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE8F6, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FE97E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FEA54, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FEB57, 32, NDPI_PROTOCOL_TOR },
+ { 0xD42FECDB, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4305435, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4339C5A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4339C8F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4339C9E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4339C9E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4339F4E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4339F72, 32, NDPI_PROTOCOL_TOR },
+ { 0xD438D698, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4402044, 32, NDPI_PROTOCOL_TOR },
+ { 0xD447EECB, 32, NDPI_PROTOCOL_TOR },
+ { 0xD447F805, 32, NDPI_PROTOCOL_TOR },
+ { 0xD447F945, 32, NDPI_PROTOCOL_TOR },
+ { 0xD447F945, 32, NDPI_PROTOCOL_TOR },
+ { 0xD447F981, 32, NDPI_PROTOCOL_TOR },
+ { 0xD447FC6D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD447FC74, 32, NDPI_PROTOCOL_TOR },
+ { 0xD447FDE2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD44AFEF3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD44DE210, 32, NDPI_PROTOCOL_TOR },
+ { 0xD44DE2F5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4532F5B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD45394CD, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4539A21, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4539A21, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4539E05, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4539E14, 32, NDPI_PROTOCOL_TOR },
+ { 0xD453A298, 32, NDPI_PROTOCOL_TOR },
+ { 0xD453A7AF, 32, NDPI_PROTOCOL_TOR },
+ { 0xD453AAFC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD453B07A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD453B07D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD453BECB, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4554F44, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4554F47, 32, NDPI_PROTOCOL_TOR },
+ { 0xD45CDB0F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD467903A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD46A09CE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD46B9591, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4722F34, 32, NDPI_PROTOCOL_TOR },
+ { 0xD472303A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4726D21, 32, NDPI_PROTOCOL_TOR },
+ { 0xD472FA12, 32, NDPI_PROTOCOL_TOR },
+ { 0xD472FE5B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4758F4A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD475B46B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4763E03, 32, NDPI_PROTOCOL_TOR },
+ { 0xD47CB453, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4810454, 32, NDPI_PROTOCOL_TOR },
+ { 0xD48110B6, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4811AF6, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4812A09, 32, NDPI_PROTOCOL_TOR },
+ { 0xD48132F6, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4813431, 32, NDPI_PROTOCOL_TOR },
+ { 0xD495D15B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD49F5B16, 32, NDPI_PROTOCOL_TOR },
+ { 0xD49F70C4, 32, NDPI_PROTOCOL_TOR },
+ { 0xD49F8F53, 32, NDPI_PROTOCOL_TOR },
+ { 0xD49FB1C6, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4A4EF79, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4B733DE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4BA59A2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4BBC8AA, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4C04A64, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4C04A65, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4C63318, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4C6C924, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4C6E391, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4E054E3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4E059FD, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4E326F7, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4E38BC3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4E3F876, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4E81D65, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4FAA0B2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD4FAA0BB, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5095DAE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD52C58EA, 32, NDPI_PROTOCOL_TOR },
+ { 0xD52F2397, 32, NDPI_PROTOCOL_TOR },
+ { 0xD52F4B43, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5317328, 32, NDPI_PROTOCOL_TOR },
+ { 0xD53D957D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD53D957E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD540E2E6, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5430E91, 32, NDPI_PROTOCOL_TOR },
+ { 0xD54951D2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5497087, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5582A31, 32, NDPI_PROTOCOL_TOR },
+ { 0xD55F1536, 32, NDPI_PROTOCOL_TOR },
+ { 0xD55F153B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD56B4D04, 32, NDPI_PROTOCOL_TOR },
+ { 0xD56C6947, 32, NDPI_PROTOCOL_TOR },
+ { 0xD56C69FD, 32, NDPI_PROTOCOL_TOR },
+ { 0xD56CD7EE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD56FF097, 32, NDPI_PROTOCOL_TOR },
+ { 0xD57086D3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD570C73F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5713D6A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5717790, 32, NDPI_PROTOCOL_TOR },
+ { 0xD571D5BE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5724869, 32, NDPI_PROTOCOL_TOR },
+ { 0xD57293E0, 32, NDPI_PROTOCOL_TOR },
+ { 0xD572966F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD572E864, 32, NDPI_PROTOCOL_TOR },
+ { 0xD57F85A7, 32, NDPI_PROTOCOL_TOR },
+ { 0xD57F921B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD585639C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5856D29, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5856DA5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5857B97, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58845ED, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5884715, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5884B2A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5885261, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5885674, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58857F5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5885A9B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5885CA9, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58A653C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58A66D1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58A6E58, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58A71E8, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58D8818, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58D8D93, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58D95E3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58D9EED, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58E2E79, 32, NDPI_PROTOCOL_TOR },
+ { 0xD58F7A02, 32, NDPI_PROTOCOL_TOR },
+ { 0xD59B0490, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A3482F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A348A2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A54610, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A54F22, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A54FF3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A55106, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A5551E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A55546, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5A555F9, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5AFD83B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5B39EF1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5B73821, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5B7388C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5B9E355, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5BA07E8, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5BB54BE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5BB6FFE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5BC77C9, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5C489E3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5C5167C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5C52469, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5D0BCCB, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5D3FC58, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5DE7461, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5E3FAF5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFC519, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFD329, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFD414, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFD6AF, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFD8DE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFD912, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFDA14, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFDA93, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5EFF9DB, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5F05E3A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5F06C19, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5F53D3D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5FBBB37, 32, NDPI_PROTOCOL_TOR },
+ { 0xD5FBC7AE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD80CC652, 32, NDPI_PROTOCOL_TOR },
+ { 0xD80CC653, 32, NDPI_PROTOCOL_TOR },
+ { 0xD80F0122, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8116382, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8116390, 32, NDPI_PROTOCOL_TOR },
+ { 0xD811654F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD81169CB, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8116EE7, 32, NDPI_PROTOCOL_TOR },
+ { 0xD818AEF5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8425592, 32, NDPI_PROTOCOL_TOR },
+ { 0xD873031A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD873063A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD892E107, 32, NDPI_PROTOCOL_TOR },
+ { 0xD89A71F4, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8A13759, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8BAC1C9, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8BD9264, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8BD9575, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8BD9666, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8BD9718, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8C3851B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8DA860C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8DAD8C2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8DD24F4, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8E6E69C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8E6E6F7, 32, NDPI_PROTOCOL_TOR },
+ { 0xD8F455D3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90833AD, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90B39E2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90B7727, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90CC7BE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90CC7D1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90CCB2E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90CCC59, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90CCC68, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90CCC93, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90CD075, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90D4A29, 32, NDPI_PROTOCOL_TOR },
+ { 0xD90DC505, 32, NDPI_PROTOCOL_TOR },
+ { 0xD910B514, 32, NDPI_PROTOCOL_TOR },
+ { 0xD910B614, 32, NDPI_PROTOCOL_TOR },
+ { 0xD91318D8, 32, NDPI_PROTOCOL_TOR },
+ { 0xD91318E9, 32, NDPI_PROTOCOL_TOR },
+ { 0xD917011B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD91A1259, 32, NDPI_PROTOCOL_TOR },
+ { 0xD91BB67D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD92287E1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD92287E7, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9251373, 32, NDPI_PROTOCOL_TOR },
+ { 0xD92855C2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD928FEB1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD943154D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD945FE58, 32, NDPI_PROTOCOL_TOR },
+ { 0xD946BD91, 32, NDPI_PROTOCOL_TOR },
+ { 0xD946BF0D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD948141E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD94FB23C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD94FB532, 32, NDPI_PROTOCOL_TOR },
+ { 0xD94FB538, 32, NDPI_PROTOCOL_TOR },
+ { 0xD94FB65F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD94FBE19, 32, NDPI_PROTOCOL_TOR },
+ { 0xD954FBD5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD95597B5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD95EEEF5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD970833A, 32, NDPI_PROTOCOL_TOR },
+ { 0xD97293F5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD972DA12, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9730A85, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9730A86, 32, NDPI_PROTOCOL_TOR },
+ { 0xD97729D5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD97BFEEE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD98090A0, 32, NDPI_PROTOCOL_TOR },
+ { 0xD991C735, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9924B24, 32, NDPI_PROTOCOL_TOR },
+ { 0xD99454B4, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9A0122D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9A013EC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9A05C43, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9A07E32, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9A083B0, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9A276FE, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9AACD71, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9ACB392, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9ACBE13, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9ACBE13, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9ACFFE5, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9AD4A5B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9BCEA09, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9BDC5F4, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9BF49C3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9BF6813, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9BFF274, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9C3AA91, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9C504DC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9C553A2, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9C556AD, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9C55B91, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9C55B91, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9C55BA4, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9C5B52D, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9D075D3, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9D11257, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9D27158, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9D28C5F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9D2A52B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9D39FA1, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9E40B41, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9E46874, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9E76B72, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9E94FC8, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9E94FC8, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9EA6B0B, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9F595B7, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9F63320, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9F76904, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9F7DE9C, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9F7E61F, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9F9203E, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9FBD765, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9FD96F6, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9FD9F48, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9FE3DAC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9FE47CC, 32, NDPI_PROTOCOL_TOR },
+ { 0xD9FEB60F, 32, NDPI_PROTOCOL_TOR },
+ { 0xDAA1200E, 32, NDPI_PROTOCOL_TOR },
+ { 0xDAE7EBDB, 32, NDPI_PROTOCOL_TOR },
+ { 0xDAE868DC, 32, NDPI_PROTOCOL_TOR },
+ { 0xDAE868DD, 32, NDPI_PROTOCOL_TOR },
+ { 0xDAFAF536, 32, NDPI_PROTOCOL_TOR },
+ { 0xDB4F067A, 32, NDPI_PROTOCOL_TOR },
+ { 0xDB59C4CA, 32, NDPI_PROTOCOL_TOR },
+ { 0xDB6DCB40, 32, NDPI_PROTOCOL_TOR },
+ { 0xDB75CE2E, 32, NDPI_PROTOCOL_TOR },
+ { 0xDB791014, 32, NDPI_PROTOCOL_TOR },
+ { 0xDBA189F3, 32, NDPI_PROTOCOL_TOR },
+ { 0xDBA4C22E, 32, NDPI_PROTOCOL_TOR },
+ { 0xDBAD0E54, 32, NDPI_PROTOCOL_TOR },
+ { 0xDC39428E, 32, NDPI_PROTOCOL_TOR },
+ { 0xDC87FE3F, 32, NDPI_PROTOCOL_TOR },
+ { 0xDC898752, 32, NDPI_PROTOCOL_TOR },
+ { 0xDC9387F3, 32, NDPI_PROTOCOL_TOR },
+ { 0xDC9DC3F3, 32, NDPI_PROTOCOL_TOR },
+ { 0xDCE97BAC, 32, NDPI_PROTOCOL_TOR },
+ { 0xDCE9AF0E, 32, NDPI_PROTOCOL_TOR },
+ { 0xDCFD1CE1, 32, NDPI_PROTOCOL_TOR },
+ { 0xDCFF85C3, 32, NDPI_PROTOCOL_TOR },
+ { 0xDD7132CB, 32, NDPI_PROTOCOL_TOR },
+ { 0xDD9E95C5, 32, NDPI_PROTOCOL_TOR },
+ { 0xDE047C92, 32, NDPI_PROTOCOL_TOR },
+ { 0xDE0C7C9A, 32, NDPI_PROTOCOL_TOR },
+ { 0xDE7294F8, 32, NDPI_PROTOCOL_TOR },
+ { 0xDEEB761A, 32, NDPI_PROTOCOL_TOR },
+ { 0xDF1273E5, 32, NDPI_PROTOCOL_TOR },
+ { 0xDF85F4CA, 32, NDPI_PROTOCOL_TOR },
+ { 0xDFE57B41, 32, NDPI_PROTOCOL_TOR },
-/*
- Twitch ingestion servers :
+ /*
+ Twitch ingestion servers :
https://api.twitch.tv/kraken/ingests
- Edoardo Dominici edoaramis@gmail.com
-*/
-{ 0xB92ACC5D, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACC92, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACCA4, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACCCD, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACC30, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FE15, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FE19, 32, NDPI_SERVICE_TWITCH },
-{ 0xBCACD305, 32, NDPI_SERVICE_TWITCH },
-{ 0xC0104616, 32, NDPI_SERVICE_TWITCH },
-{ 0xC010461D, 32, NDPI_SERVICE_TWITCH },
-{ 0xC0104650, 32, NDPI_SERVICE_TWITCH },
-{ 0xC0104651, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FEA3, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FE87, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACD85, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACDA4, 32, NDPI_SERVICE_TWITCH },
-{ 0xC010419A, 32, NDPI_SERVICE_TWITCH },
-{ 0xC01041AD, 32, NDPI_SERVICE_TWITCH },
-{ 0xC0104172, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACD68, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACD55, 32, NDPI_SERVICE_TWITCH },
-{ 0xC0104219, 32, NDPI_SERVICE_TWITCH },
-{ 0xC010421A, 32, NDPI_SERVICE_TWITCH },
-{ 0xC010421B, 32, NDPI_SERVICE_TWITCH },
-{ 0xBCACD205, 32, NDPI_SERVICE_TWITCH },
-{ 0xBCACCB05, 32, NDPI_SERVICE_TWITCH },
-{ 0xC010413C, 32, NDPI_SERVICE_TWITCH },
-{ 0xC010413D, 32, NDPI_SERVICE_TWITCH },
-{ 0xC010413E, 32, NDPI_SERVICE_TWITCH },
-{ 0xBCACD105, 32, NDPI_SERVICE_TWITCH },
-{ 0xBCACD005, 32, NDPI_SERVICE_TWITCH },
-{ 0xBCACCA05, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACD06, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACD14, 32, NDPI_SERVICE_TWITCH },
-{ 0xB92ACCF3, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F9C7, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F9C9, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F9CB, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBA4, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBA6, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBAA, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBB1, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBE8, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBE9, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBEA, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBEB, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBFB, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBFC, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBFD, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FBFE, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FF4B, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709FF4C, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F974, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F976, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F978, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F97D, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F985, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F986, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F987, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F98C, 32, NDPI_SERVICE_TWITCH },
-{ 0xC709F9C5, 32, NDPI_SERVICE_TWITCH },
+ Edoardo Dominici edoaramis@gmail.com
+ */
+ { 0xB92ACC5D, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACC92, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACCA4, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACCCD, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACC30, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FE15, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FE19, 32, NDPI_SERVICE_TWITCH },
+ { 0xBCACD305, 32, NDPI_SERVICE_TWITCH },
+ { 0xC0104616, 32, NDPI_SERVICE_TWITCH },
+ { 0xC010461D, 32, NDPI_SERVICE_TWITCH },
+ { 0xC0104650, 32, NDPI_SERVICE_TWITCH },
+ { 0xC0104651, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FEA3, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FE87, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACD85, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACDA4, 32, NDPI_SERVICE_TWITCH },
+ { 0xC010419A, 32, NDPI_SERVICE_TWITCH },
+ { 0xC01041AD, 32, NDPI_SERVICE_TWITCH },
+ { 0xC0104172, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACD68, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACD55, 32, NDPI_SERVICE_TWITCH },
+ { 0xC0104219, 32, NDPI_SERVICE_TWITCH },
+ { 0xC010421A, 32, NDPI_SERVICE_TWITCH },
+ { 0xC010421B, 32, NDPI_SERVICE_TWITCH },
+ { 0xBCACD205, 32, NDPI_SERVICE_TWITCH },
+ { 0xBCACCB05, 32, NDPI_SERVICE_TWITCH },
+ { 0xC010413C, 32, NDPI_SERVICE_TWITCH },
+ { 0xC010413D, 32, NDPI_SERVICE_TWITCH },
+ { 0xC010413E, 32, NDPI_SERVICE_TWITCH },
+ { 0xBCACD105, 32, NDPI_SERVICE_TWITCH },
+ { 0xBCACD005, 32, NDPI_SERVICE_TWITCH },
+ { 0xBCACCA05, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACD06, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACD14, 32, NDPI_SERVICE_TWITCH },
+ { 0xB92ACCF3, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F9C7, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F9C9, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F9CB, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBA4, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBA6, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBAA, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBB1, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBE8, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBE9, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBEA, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBEB, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBFB, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBFC, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBFD, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FBFE, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FF4B, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709FF4C, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F974, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F976, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F978, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F97D, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F985, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F986, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F987, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F98C, 32, NDPI_SERVICE_TWITCH },
+ { 0xC709F9C5, 32, NDPI_SERVICE_TWITCH },
-/* Simet - 200.160.4.0/24 */
-{ 0xC8A00400, 24, NDPI_SERVICE_SIMET },
+ /* Simet - 200.160.4.0/24 */
+ { 0xC8A00400, 24, NDPI_SERVICE_SIMET },
-{ 0x0, 0, 0 }
+ { 0x0, 0, 0 }
};
/* ****************************************************** */
@@ -7295,7 +7299,7 @@ static ndpi_network host_protocol_list[] = {
HTTP: Server: field
HTTPS: Server certificate name
- */
+*/
ndpi_protocol_match host_match[] = {
{ "amazon.", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
@@ -7402,7 +7406,8 @@ ndpi_protocol_match host_match[] = {
{ "update.microsoft.com", "WindowsUpdate", NDPI_SERVICE_WINDOWS_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
{ ".windowsupdate.com", "WindowsUpdate", NDPI_SERVICE_WINDOWS_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
{ ".battle.net", "Battle.net", NDPI_SERVICE_BATTLENET, NDPI_PROTOCOL_FUN },
- { "bnetcmsus-a.akamaihd.net", "Battle.net", NDPI_SERVICE_BATTLENET, NDPI_PROTOCOL_FUN },
+ { "bnetcmsus-a.akamaihd.net", "Battle.net", NDPI_SERVICE_BATTLENET, NDPI_PROTOCOL_FUN },
+ { "worldofwarcraft.com", "Battle.net", NDPI_SERVICE_BATTLENET, NDPI_PROTOCOL_FUN },
{ NULL, 0 }
};
@@ -7454,71 +7459,71 @@ ndpi_protocol_match content_match[] = {
/* ****************************************************** */
/*
- Tor
- The tor protocol uses SSL to contact peers so it could be exchanged with
- standard SSL. However the host names such as
+ Tor
+ The tor protocol uses SSL to contact peers so it could be exchanged with
+ standard SSL. However the host names such as
- - www.fgd2iwya7vinfutj5wq5we.com
- - www.qbtxzhetq4s2f.com
- - www.fgd2iwya7vinfutj5wq5we.net
+ - www.fgd2iwya7vinfutj5wq5we.com
+ - www.qbtxzhetq4s2f.com
+ - www.fgd2iwya7vinfutj5wq5we.net
- In essence www.<name>.com|net
+ In essence www.<name>.com|net
- To do things properly we should check if host name in the certificate
- exists or if the IP address of the SSL peer resolves to a name. Unfortunately
- for performance reasons we can't afford to do a DNS lookup in nDPI (however apps
- can do it if possible) and thus we have created a heuristic algorithm that tries
- to check the host name (in the SSL certificate) to see if it looks like a
- random name or a real name. We cannot use a dictionary (how can the kernel read a file?)
- and this we use bigrams distribution to decide if the string looks like a
- word or just random chars.
+ To do things properly we should check if host name in the certificate
+ exists or if the IP address of the SSL peer resolves to a name. Unfortunately
+ for performance reasons we can't afford to do a DNS lookup in nDPI (however apps
+ can do it if possible) and thus we have created a heuristic algorithm that tries
+ to check the host name (in the SSL certificate) to see if it looks like a
+ random name or a real name. We cannot use a dictionary (how can the kernel read a file?)
+ and this we use bigrams distribution to decide if the string looks like a
+ word or just random chars.
- http://www3.nd.edu/~busiforc/handouts/cryptography/Letter%20Frequencies.html
+ http://www3.nd.edu/~busiforc/handouts/cryptography/Letter%20Frequencies.html
*/
static const char *ndpi_en_bigrams[] = {
- "aa", "ba", "ca", "da", "ea", "fa", "ga", "ha", "ia", "ja", "ka", "la", "ma", "na", "oa", "pa", "qa",
- "ra", "sa", "ta", "ua", "va", "wa", "xa", "ya", "za", "ab", "bb", "db", "eb", "fb", "gb", "hb", "ib",
- "kb", "lb", "mb", "nb", "ob", "pb", "rb", "sb", "tb", "ub", "wb", "yb", "ac", "bc", "cc", "dc", "ec",
- "fc", "gc", "hc", "ic", "kc", "lc", "mc", "nc", "oc", "pc", "rc", "sc", "tc", "uc", "wc", "xc", "yc",
- "ad", "bd", "cd", "dd", "ed", "fd", "gd", "hd", "id", "kd", "ld", "md", "nd", "od", "pd", "rd", "sd",
- "td", "ud", "wd", "xd", "yd", "zd", "ae", "be", "ce", "de", "ee", "fe", "ge", "he", "ie", "je", "ke",
- "le", "me", "ne", "oe", "pe", "re", "se", "te", "ue", "ve", "we", "xe", "ye", "ze", "af", "bf", "df",
- "ef", "ff", "gf", "hf", "if", "kf", "lf", "mf", "nf", "of", "pf", "rf", "sf", "tf", "uf", "wf", "xf",
- "yf", "zf", "ag", "bg", "dg", "eg", "fg", "gg", "hg", "ig", "kg", "lg", "ng", "og", "pg", "rg", "sg",
- "tg", "ug", "wg", "yg", "ah", "bh", "ch", "dh", "eh", "fh", "gh", "hh", "ih", "kh", "lh", "mh", "nh",
- "oh", "ph", "rh", "sh", "th", "uh", "wh", "xh", "yh", "ai", "bi", "ci", "di", "ei", "fi", "gi", "hi",
- "ii", "ji", "ki", "li", "mi", "ni", "oi", "pi", "qi", "ri", "si", "ti", "ui", "vi", "wi", "xi", "yi",
- "zi", "aj", "bj", "dj", "ej", "fj", "gj", "hj", "ij", "jj", "kj", "lj", "nj", "oj", "pj", "rj", "sj",
- "tj", "uj", "wj", "yj", "ak", "ck", "dk", "ek", "gk", "ik", "kk", "lk", "mk", "nk", "ok", "pk", "rk",
- "sk", "tk", "uk", "wk", "yk", "zk", "al", "bl", "cl", "dl", "el", "fl", "gl", "hl", "il", "kl", "ll",
- "ml", "nl", "ol", "pl", "rl", "sl", "tl", "ul", "vl", "wl", "xl", "yl", "zl", "am", "bm", "cm", "dm",
- "em", "fm", "gm", "hm", "im", "km", "lm", "mm", "nm", "om", "pm", "rm", "sm", "tm", "um", "wm", "xm",
- "ym", "zm", "an", "bn", "cn", "dn", "en", "fn", "gn", "hn", "in", "kn", "ln", "mn", "nn", "on", "pn",
- "rn", "sn", "tn", "un", "wn", "xn", "yn", "ao", "bo", "co", "do", "eo", "fo", "go", "ho", "io", "jo",
- "ko", "lo", "mo", "no", "oo", "po", "ro", "so", "to", "uo", "vo", "wo", "xo", "yo", "zo", "ap", "bp",
- "dp", "ep", "fp", "gp", "hp", "ip", "kp", "lp", "mp", "np", "op", "pp", "rp", "sp", "tp", "up", "wp",
- "xp", "yp", "zp", "aq", "cq", "dq", "eq", "hq", "iq", "nq", "oq", "qq", "rq", "sq", "uq", "xq", "ar",
- "br", "cr", "dr", "er", "fr", "gr", "hr", "ir", "kr", "lr", "mr", "nr", "or", "pr", "rr", "sr", "tr",
- "ur", "vr", "wr", "xr", "yr", "as", "bs", "cs", "ds", "es", "fs", "gs", "hs", "is", "ks", "ls", "ms",
- "ns", "os", "ps", "rs", "ss", "ts", "us", "vs", "ws", "xs", "ys", "at", "bt", "ct", "dt", "et", "ft",
- "gt", "ht", "it", "kt", "lt", "mt", "nt", "ot", "pt", "rt", "st", "tt", "ut", "wt", "xt", "yt", "zt",
- "au", "bu", "cu", "du", "eu", "fu", "gu", "hu", "iu", "ju", "ku", "lu", "mu", "nu", "ou", "pu", "qu",
- "ru", "su", "tu", "uu", "vu", "wu", "xu", "yu", "zu", "av", "bv", "dv", "ev", "iv", "lv", "mv", "nv",
- "ov", "rv", "sv", "tv", "uv", "vv", "zv", "aw", "bw", "dw", "ew", "fw", "gw", "hw", "iw", "kw", "lw",
- "mw", "nw", "ow", "pw", "rw", "sw", "tw", "uw", "ww", "xw", "yw", "zw", "ax", "ex", "ix", "nx", "ox",
- "rx", "ux", "xx", "yx", "ay", "by", "cy", "dy", "ey", "fy", "gy", "hy", "ky", "ly", "my", "ny", "oy",
- "py", "ry", "sy", "ty", "uy", "vy", "wy", "xy", "yy", "zy", "az", "bz", "cz", "dz", "ez", "gz", "iz",
- "lz", "nz", "oz", "pz", "rz", "tz", "uz", "zz", NULL };
+ "aa", "ba", "ca", "da", "ea", "fa", "ga", "ha", "ia", "ja", "ka", "la", "ma", "na", "oa", "pa", "qa",
+ "ra", "sa", "ta", "ua", "va", "wa", "xa", "ya", "za", "ab", "bb", "db", "eb", "fb", "gb", "hb", "ib",
+ "kb", "lb", "mb", "nb", "ob", "pb", "rb", "sb", "tb", "ub", "wb", "yb", "ac", "bc", "cc", "dc", "ec",
+ "fc", "gc", "hc", "ic", "kc", "lc", "mc", "nc", "oc", "pc", "rc", "sc", "tc", "uc", "wc", "xc", "yc",
+ "ad", "bd", "cd", "dd", "ed", "fd", "gd", "hd", "id", "kd", "ld", "md", "nd", "od", "pd", "rd", "sd",
+ "td", "ud", "wd", "xd", "yd", "zd", "ae", "be", "ce", "de", "ee", "fe", "ge", "he", "ie", "je", "ke",
+ "le", "me", "ne", "oe", "pe", "re", "se", "te", "ue", "ve", "we", "xe", "ye", "ze", "af", "bf", "df",
+ "ef", "ff", "gf", "hf", "if", "kf", "lf", "mf", "nf", "of", "pf", "rf", "sf", "tf", "uf", "wf", "xf",
+ "yf", "zf", "ag", "bg", "dg", "eg", "fg", "gg", "hg", "ig", "kg", "lg", "ng", "og", "pg", "rg", "sg",
+ "tg", "ug", "wg", "yg", "ah", "bh", "ch", "dh", "eh", "fh", "gh", "hh", "ih", "kh", "lh", "mh", "nh",
+ "oh", "ph", "rh", "sh", "th", "uh", "wh", "xh", "yh", "ai", "bi", "ci", "di", "ei", "fi", "gi", "hi",
+ "ii", "ji", "ki", "li", "mi", "ni", "oi", "pi", "qi", "ri", "si", "ti", "ui", "vi", "wi", "xi", "yi",
+ "zi", "aj", "bj", "dj", "ej", "fj", "gj", "hj", "ij", "jj", "kj", "lj", "nj", "oj", "pj", "rj", "sj",
+ "tj", "uj", "wj", "yj", "ak", "ck", "dk", "ek", "gk", "ik", "kk", "lk", "mk", "nk", "ok", "pk", "rk",
+ "sk", "tk", "uk", "wk", "yk", "zk", "al", "bl", "cl", "dl", "el", "fl", "gl", "hl", "il", "kl", "ll",
+ "ml", "nl", "ol", "pl", "rl", "sl", "tl", "ul", "vl", "wl", "xl", "yl", "zl", "am", "bm", "cm", "dm",
+ "em", "fm", "gm", "hm", "im", "km", "lm", "mm", "nm", "om", "pm", "rm", "sm", "tm", "um", "wm", "xm",
+ "ym", "zm", "an", "bn", "cn", "dn", "en", "fn", "gn", "hn", "in", "kn", "ln", "mn", "nn", "on", "pn",
+ "rn", "sn", "tn", "un", "wn", "xn", "yn", "ao", "bo", "co", "do", "eo", "fo", "go", "ho", "io", "jo",
+ "ko", "lo", "mo", "no", "oo", "po", "ro", "so", "to", "uo", "vo", "wo", "xo", "yo", "zo", "ap", "bp",
+ "dp", "ep", "fp", "gp", "hp", "ip", "kp", "lp", "mp", "np", "op", "pp", "rp", "sp", "tp", "up", "wp",
+ "xp", "yp", "zp", "aq", "cq", "dq", "eq", "hq", "iq", "nq", "oq", "qq", "rq", "sq", "uq", "xq", "ar",
+ "br", "cr", "dr", "er", "fr", "gr", "hr", "ir", "kr", "lr", "mr", "nr", "or", "pr", "rr", "sr", "tr",
+ "ur", "vr", "wr", "xr", "yr", "as", "bs", "cs", "ds", "es", "fs", "gs", "hs", "is", "ks", "ls", "ms",
+ "ns", "os", "ps", "rs", "ss", "ts", "us", "vs", "ws", "xs", "ys", "at", "bt", "ct", "dt", "et", "ft",
+ "gt", "ht", "it", "kt", "lt", "mt", "nt", "ot", "pt", "rt", "st", "tt", "ut", "wt", "xt", "yt", "zt",
+ "au", "bu", "cu", "du", "eu", "fu", "gu", "hu", "iu", "ju", "ku", "lu", "mu", "nu", "ou", "pu", "qu",
+ "ru", "su", "tu", "uu", "vu", "wu", "xu", "yu", "zu", "av", "bv", "dv", "ev", "iv", "lv", "mv", "nv",
+ "ov", "rv", "sv", "tv", "uv", "vv", "zv", "aw", "bw", "dw", "ew", "fw", "gw", "hw", "iw", "kw", "lw",
+ "mw", "nw", "ow", "pw", "rw", "sw", "tw", "uw", "ww", "xw", "yw", "zw", "ax", "ex", "ix", "nx", "ox",
+ "rx", "ux", "xx", "yx", "ay", "by", "cy", "dy", "ey", "fy", "gy", "hy", "ky", "ly", "my", "ny", "oy",
+ "py", "ry", "sy", "ty", "uy", "vy", "wy", "xy", "yy", "zy", "az", "bz", "cz", "dz", "ez", "gz", "iz",
+ "lz", "nz", "oz", "pz", "rz", "tz", "uz", "zz", NULL };
static const char *ndpi_en_impossible_bigrams[] = {
- "bk", "bq", "bx", "cb", "cf", "cg", "cj", "cp", "cv", "cw", "cx", "dx", "fk", "fq", "fv", "fx", "ee",
- "fz", "gq", "gv", "gx", "hh", "hk", "hv", "hx", "hz", "iy", "jb", "jc", "jd", "jf", "jg", "jh", "jk",
- "jl", "jm", "jn", "jp", "jq", "jr", "js", "jt", "jv", "jw", "jx", "jy", "jz", "kg", "kq", "kv", "kx",
- "kz", "lq", "lx", "mg", "mj", "mq", "mx", "mz", "pq", "pv", "px", "qb", "qc", "qd", "qe", "qf", "ii",
- "qg", "qh", "qj", "qk", "ql", "qm", "qn", "qo", "qp", "qr", "qs", "qt", "qv", "qw", "qx", "qy", "uu",
- "qz", "sx", "sz", "tq", "tx", "vb", "vc", "vd", "vf", "vg", "vh", "vj", "vk", "vm", "vn", "vp", "bw",
- "vq", "vt", "vw", "vx", "vz", "wq", "wv", "wx", "wz", "xb", "xg", "xj", "xk", "xv", "xz", "xw", "yd", "yp",
- "yj", "yq", "yv", "yz", "yw", "zb", "zc", "zg", "zh", "zj", "zn", "zq", "zr", "zs", "zx", "wh", "wk",
- "wb", "zk", "kp", "zk", "xy",
- NULL };
+ "bk", "bq", "bx", "cb", "cf", "cg", "cj", "cp", "cv", "cw", "cx", "dx", "fk", "fq", "fv", "fx", "ee",
+ "fz", "gq", "gv", "gx", "hh", "hk", "hv", "hx", "hz", "iy", "jb", "jc", "jd", "jf", "jg", "jh", "jk",
+ "jl", "jm", "jn", "jp", "jq", "jr", "js", "jt", "jv", "jw", "jx", "jy", "jz", "kg", "kq", "kv", "kx",
+ "kz", "lq", "lx", "mg", "mj", "mq", "mx", "mz", "pq", "pv", "px", "qb", "qc", "qd", "qe", "qf", "ii",
+ "qg", "qh", "qj", "qk", "ql", "qm", "qn", "qo", "qp", "qr", "qs", "qt", "qv", "qw", "qx", "qy", "uu",
+ "qz", "sx", "sz", "tq", "tx", "vb", "vc", "vd", "vf", "vg", "vh", "vj", "vk", "vm", "vn", "vp", "bw",
+ "vq", "vt", "vw", "vx", "vz", "wq", "wv", "wx", "wz", "xb", "xg", "xj", "xk", "xv", "xz", "xw", "yd", "yp",
+ "yj", "yq", "yv", "yz", "yw", "zb", "zc", "zg", "zh", "zj", "zn", "zq", "zr", "zs", "zx", "wh", "wk",
+ "wb", "zk", "kp", "zk", "xy",
+ NULL };
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index feb613733..f36537b49 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1607,11 +1607,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "VHUA",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 58267, 0, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_STARCRAFT2,
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_STARCRAFT,
no_master,
- no_master, "Starcraft 2",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
+ no_master, "Starcraft",
+ ndpi_build_default_ports(ports_a, 1119, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 1119, 0, 0, 0, 0)); /* UDP */
/* calling function for host and content matched protocols */
init_string_based_protocols(ndpi_mod);
@@ -2217,6 +2217,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* SKYPE */
init_skype_dissector(ndpi_struct, &a, detection_bitmask);
+ /* Stracraft */
+ init_starcraft_dissector(ndpi_struct, &a, detection_bitmask);
+
/* SSL */
init_ssl_dissector(ndpi_struct, &a, detection_bitmask);
@@ -3392,9 +3395,12 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
}
ret_protocols:
- if(flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN)
+ if(flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN) {
ret.master_protocol = flow->detected_protocol_stack[1], ret.protocol = flow->detected_protocol_stack[0];
- else
+
+ if(ret.protocol == ret.master_protocol)
+ ret.master_protocol = NDPI_PROTOCOL_UNKNOWN;
+ } else
ret.protocol = flow->detected_protocol_stack[0];
return(ret);
@@ -4178,6 +4184,10 @@ ndpi_protocol ndpi_guess_undetected_protocol(struct ndpi_detection_module_struct
if(rc != NDPI_PROTOCOL_UNKNOWN) {
ret.protocol = rc,
ret.master_protocol = ndpi_guess_protocol_id(ndpi_struct, proto, sport, dport);
+
+ if(ret.protocol == ret.master_protocol)
+ ret.master_protocol = NDPI_PROTOCOL_UNKNOWN;
+
return(ret);
}
diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c
index 270a85fba..7f201569c 100644
--- a/src/lib/protocols/skype.c
+++ b/src/lib/protocols/skype.c
@@ -68,13 +68,17 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
flow->l4.udp.skype_packet_id++;
if(flow->l4.udp.skype_packet_id < 5) {
+ u_int16_t dport = ntohs(packet->udp->dest);
+
/* skype-to-skype */
- if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d))
- || ((payload_len >= 16)
- && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */
- && (packet->payload[2] == 0x02))) {
- NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found skype.\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
+ if(dport != 1119) /* It can be confused with battle.net */ {
+ if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d))
+ || ((payload_len >= 16)
+ && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */
+ && (packet->payload[2] == 0x02))) {
+ NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found skype.\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
+ }
}
return;
diff --git a/src/lib/protocols/starcraft.c b/src/lib/protocols/starcraft.c
new file mode 100644
index 000000000..157bc6da0
--- /dev/null
+++ b/src/lib/protocols/starcraft.c
@@ -0,0 +1,155 @@
+/*
+* starcraft.c
+*
+* Copyright (C) 2015 - Matteo Bracci <matteobracci1@gmail.com>
+* Copyright (C) 2015 - ntop.org
+*
+* nDPI is free software: you can redistribute it and/or modify
+* it under the terms of the GNU Lesser General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* nDPI is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+* GNU Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public License
+* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+*
+*/
+
+
+#include "ndpi_protocols.h"
+
+#ifdef NDPI_PROTOCOL_STARCRAFT
+
+/* Sender or receiver are one of the known login portals? */
+u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet)
+{
+ if (packet->iph == NULL)
+ return 0;
+
+ u_int32_t source_ip = ntohl(packet->iph->saddr);
+ u_int32_t dest_ip = ntohl(packet->iph->daddr);
+ return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32) // EU 213.248.127.130
+ || ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32) // US 12.129.206.130
+ || ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32) // KR 121.254.200.130
+ || ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32) // SG 202.9.66.76
+ || ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32)); // BETA 12.129.236.254
+}
+
+/*
+ The main TCP flow starts with the user login and stays alive until the logout.
+ Although hard to read, judging from what happens elsewhere this flow probably contains all the data
+ transfer generated by the user interaction with the client, e.g. chatting or looking at someone's
+ match history. The current way to detect this is plain dumb packet matching.
+*/
+u_int8_t ndpi_check_starcraft_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ if (sc2_match_logon_ip(&flow->packet)
+ && flow->packet.tcp->dest == htons(1119) //bnetgame port
+ && flow->packet.payload_packet_len >= 10
+ && (match_first_bytes(flow->packet.payload, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")
+ || match_first_bytes(flow->packet.payload, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")))
+ return 1;
+ else
+ return -1;
+}
+
+/*
+ UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the
+ real key point here is to make sure that it's actually Starcraft 2 that is using the port and not
+ some other Blizzard software.
+ The flow is taken if a pattern in the size of some subsequent packets is found.
+*/
+u_int8_t ndpi_check_starcraft_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ struct ndpi_packet_struct* packet = &flow->packet;
+
+ /* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */
+ if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119))
+ return -1;
+
+ /* Then try to detect the size pattern */
+ switch (flow->starcraft_udp_stage)
+ {
+ case 0:
+ if (packet->payload_packet_len == 20)
+ flow->starcraft_udp_stage = 1;
+ break;
+ case 1:
+ if (packet->payload_packet_len == 20)
+ flow->starcraft_udp_stage = 2;
+ break;
+ case 2:
+ if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85)
+ flow->starcraft_udp_stage = 3;
+ break;
+ case 3:
+ if (packet->payload_packet_len == 20)
+ flow->starcraft_udp_stage = 4;
+ break;
+ case 4:
+ if (packet->payload_packet_len == 548)
+ flow->starcraft_udp_stage = 5;
+ break;
+ case 5:
+ if (packet->payload_packet_len == 548)
+ flow->starcraft_udp_stage = 6;
+ break;
+ case 6:
+ if (packet->payload_packet_len == 548)
+ flow->starcraft_udp_stage = 7;
+ break;
+ case 7:
+ if (packet->payload_packet_len == 484)
+ return 1;
+ break;
+ }
+}
+
+void ndpi_search_starcraft(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft protocol detection...\n");
+ if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT) {
+ struct ndpi_packet_struct* packet = &flow->packet;
+ int8_t result = 0;
+
+ if (packet->udp != NULL) {
+ result = ndpi_check_starcraft_udp(ndpi_struct, flow);
+ if (result == 1) {
+ //printf("Found Starcraft 2 [Game, UDP]\n");
+ NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Game, UDP]\n");
+ }
+ }
+ else if (packet->tcp != NULL) {
+ result = ndpi_check_starcraft_tcp(ndpi_struct, flow);
+ if (result == 1) {
+ //printf("Found Starcraft 2 [Client, TCP]\n");
+ NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Client, TCP]\n");
+ }
+ }
+
+ if (result == 1) {
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT, NDPI_PROTOCOL_UNKNOWN);
+ }
+ else if (result == -1) {
+ NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft excluded\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STARCRAFT);
+ }
+ }
+}
+
+void init_starcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("Starcraft", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_STARCRAFT, ndpi_search_starcraft,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
+#endif
diff --git a/src/lib/protocols/starcraft2.c b/src/lib/protocols/starcraft2.c
deleted file mode 100644
index 6372c78ca..000000000
--- a/src/lib/protocols/starcraft2.c
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
-* starcraft2.c
-*
-* Copyright (C) 2009-2011 by ipoque GmbH
-* Copyright (C) 2011-15 - ntop.org
-*
-* This file is part of nDPI, an open source deep packet inspection
-* library based on the OpenDPI and PACE technology by ipoque GmbH
-*
-* nDPI is free software: you can redistribute it and/or modify
-* it under the terms of the GNU Lesser General Public License as published by
-* the Free Software Foundation, either version 3 of the License, or
-* (at your option) any later version.
-*
-* nDPI is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Lesser General Public License for more details.
-*
-* You should have received a copy of the GNU Lesser General Public License
-* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
-*
-*/
-
-
-#include "ndpi_protocols.h"
-#ifdef NDPI_PROTOCOL_STARCRAFT2
-
-/* Sender or receiver are one of the known login portals? */
-u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet)
-{
- if (packet->iph == NULL)
- return 0;
-
- u_int32_t source_ip = ntohl(packet->iph->saddr);
- u_int32_t dest_ip = ntohl(packet->iph->daddr);
- return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32) // EU 213.248.127.130
- || ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32) // US 12.129.206.130
- || ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32) // KR 121.254.200.130
- || ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32) // SG 202.9.66.76
- || ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32)); // BETA 12.129.236.254
-}
-
-/*
-The main TCP flow starts with the user login and stays alive until the logout.
-Although hard to read, judging from what happens elsewhere this flow probably contains all the data
-transfer generated by the user interaction with the client, e.g. chatting or looking at someone's
-match history. The current way to detect this is plain dumb packet matching.
-*/
-u_int8_t ndpi_check_starcraft2_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
-{
- if (sc2_match_logon_ip(&flow->packet)
- && flow->packet.tcp->dest == htons(1119) //bnetgame port
- && flow->packet.payload_packet_len >= 10
- && (match_first_bytes(flow->packet.payload, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")
- || match_first_bytes(flow->packet.payload, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")))
- return 1;
- else
- return -1;
-}
-
-/*
-UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the
-real key point here is to make sure that it's actually Starcraft 2 that is using the port and not
-some other Blizzard software.
-The flow is taken if a pattern in the size of some subsequent packets is found.
-*/
-u_int8_t ndpi_check_starcraft2_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
-{
- struct ndpi_packet_struct* packet = &flow->packet;
-
- /* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */
- if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119))
- return -1;
-
- /* Then try to detect the size pattern */
- switch (flow->starcraft2_udp_stage)
- {
- case 0:
- if (packet->payload_packet_len == 20)
- flow->starcraft2_udp_stage = 1;
- break;
- case 1:
- if (packet->payload_packet_len == 20)
- flow->starcraft2_udp_stage = 2;
- break;
- case 2:
- if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85)
- flow->starcraft2_udp_stage = 3;
- break;
- case 3:
- if (packet->payload_packet_len == 20)
- flow->starcraft2_udp_stage = 4;
- break;
- case 4:
- if (packet->payload_packet_len == 548)
- flow->starcraft2_udp_stage = 5;
- break;
- case 5:
- if (packet->payload_packet_len == 548)
- flow->starcraft2_udp_stage = 6;
- break;
- case 6:
- if (packet->payload_packet_len == 548)
- flow->starcraft2_udp_stage = 7;
- break;
- case 7:
- if (packet->payload_packet_len == 484)
- return 1;
- break;
- }
-}
-
-void ndpi_search_starcraft2(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
-{
- NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 protocol detection...\n");
- if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT2) {
- struct ndpi_packet_struct* packet = &flow->packet;
- int8_t result = 0;
-
- if (packet->udp != NULL) {
- result = ndpi_check_starcraft2_udp(ndpi_struct, flow);
- if (result == 1) {
- //printf("Found Starcraft 2 [Game, UDP]\n");
- NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Game, UDP]\n");
- }
- }
- else if (packet->tcp != NULL) {
- result = ndpi_check_starcraft2_tcp(ndpi_struct, flow);
- if (result == 1) {
- //printf("Found Starcraft 2 [Client, TCP]\n");
- NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Client, TCP]\n");
- }
- }
-
- if (result == 1) {
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT2, NDPI_PROTOCOL_UNKNOWN);
- }
- else if (result == -1) {
- NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 excluded\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STARCRAFT2);
- }
- }
-}
-
-void init_starcraft2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
- ndpi_set_bitmask_protocol_detection("STARCRAFT2", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_STARCRAFT2, ndpi_search_starcraft2,
- NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
-
- *id += 1;
-}
-
-#endif
Powered by cgit, Themed by Ted Yin.