From 9ff4bece33bc5e8601208e59ecb2f8bc66b4daaa Mon Sep 17 00:00:00 2001
From: Vladimir Gavrilov <105977161+0xA50C1A1@users.noreply.github.com>
Date: Wed, 10 Apr 2024 19:04:02 +0300
Subject: Add The Elder Scrolls Online support (#2376)
* Add The Elder Scrolls Online support
* Use ndpi_memmem instead of memmem from libc
* Add protocol description
* Change selection bitmask to V4_V6
* Update protocols.rst
---
doc/protocols.rst | 9 ++
src/include/ndpi_private.h | 1 +
src/include/ndpi_protocol_ids.h | 1 +
src/lib/ndpi_content_match.c.inc | 1 +
src/lib/ndpi_main.c | 7 ++
src/lib/protocols/teso.c | 91 +++++++++++++++++++++
tests/cfgs/caches_cfg/result/ookla.pcap.out | 2 +-
tests/cfgs/caches_cfg/result/teams.pcap.out | 2 +-
tests/cfgs/caches_global/result/ookla.pcap.out | 2 +-
tests/cfgs/caches_global/result/teams.pcap.out | 2 +-
tests/cfgs/default/pcap/teso.pcapng | Bin 0 -> 2680 bytes
tests/cfgs/default/result/1kxun.pcap.out | 2 +-
tests/cfgs/default/result/443-chrome.pcap.out | 2 +-
tests/cfgs/default/result/443-opvn.pcap.out | 2 +-
tests/cfgs/default/result/KakaoTalk_chat.pcap.out | 2 +-
tests/cfgs/default/result/KakaoTalk_talk.pcap.out | 2 +-
tests/cfgs/default/result/Oscar.pcap.out | 2 +-
tests/cfgs/default/result/alexa-app.pcapng.out | 2 +-
tests/cfgs/default/result/amqp.pcap.out | 2 +-
tests/cfgs/default/result/anyconnect-vpn.pcap.out | 2 +-
.../default/result/bittorrent_tcp_miss.pcapng.out | 2 +-
tests/cfgs/default/result/cassandra.pcap.out | 2 +-
tests/cfgs/default/result/cloudflare-warp.pcap.out | 2 +-
.../custom_rules_same-ip_multiple_ports.pcapng.out | 4 +-
tests/cfgs/default/result/edonkey.pcap.out | 2 +-
tests/cfgs/default/result/elf.pcap.out | 2 +-
tests/cfgs/default/result/emotet.pcap.out | 2 +-
tests/cfgs/default/result/fastcgi.pcap.out | 2 +-
tests/cfgs/default/result/ftp-start-tls.pcap.out | 2 +-
tests/cfgs/default/result/ftp.pcap.out | 2 +-
tests/cfgs/default/result/ftp_failed.pcap.out | 2 +-
.../default/result/fuzz-2006-06-26-2594.pcap.out | 2 +-
.../default/result/fuzz-2006-09-29-28586.pcap.out | 2 +-
tests/cfgs/default/result/fuzz-2021-10-13.pcap.out | 2 +-
.../default/result/gaijin_mobile_mixed.pcap.out | 2 +-
tests/cfgs/default/result/google_ssl.pcap.out | 2 +-
.../http_guessed_host_and_guessed.pcapng.out | 2 +-
tests/cfgs/default/result/imap-starttls.pcap.out | 2 +-
tests/cfgs/default/result/imap.pcap.out | 2 +-
tests/cfgs/default/result/instagram.pcap.out | 2 +-
tests/cfgs/default/result/irc.pcap.out | 2 +-
tests/cfgs/default/result/iso9506-1-mms.pcap.out | 2 +-
tests/cfgs/default/result/jabber.pcap.out | 2 +-
tests/cfgs/default/result/kafka.pcapng.out | 2 +-
tests/cfgs/default/result/kerberos.pcap.out | 2 +-
.../default/result/log4j-webapp-exploit.pcap.out | 2 +-
tests/cfgs/default/result/memcached.cap.out | 2 +-
.../default/result/mongo_false_positive.pcapng.out | 2 +-
tests/cfgs/default/result/mssql_tds.pcap.out | 2 +-
tests/cfgs/default/result/nest_log_sink.pcap.out | 2 +-
tests/cfgs/default/result/netbios.pcap.out | 2 +-
tests/cfgs/default/result/nntp.pcap.out | 2 +-
tests/cfgs/default/result/ookla.pcap.out | 2 +-
tests/cfgs/default/result/openvpn.pcap.out | 2 +-
.../default/result/openvpn_nohmac_tcp.pcapng.out | 2 +-
tests/cfgs/default/result/oracle12.pcapng.out | 2 +-
.../result/ossfuzz_seed_fake_traces_1.pcapng.out | 2 +-
.../result/ossfuzz_seed_fake_traces_2.pcapng.out | 2 +-
tests/cfgs/default/result/pgsql.pcap.out | 2 +-
tests/cfgs/default/result/pop3.pcap.out | 2 +-
tests/cfgs/default/result/pop3_stls.pcap.out | 2 +-
.../default/result/portable_executable.pcap.out | 2 +-
tests/cfgs/default/result/protobuf.pcap.out | 2 +-
tests/cfgs/default/result/radmin3.pcapng.out | 2 +-
tests/cfgs/default/result/raft.pcap.out | 2 +-
.../default/result/reasm_crash_anon.pcapng.out | 2 +-
.../cfgs/default/result/reasm_segv_anon.pcapng.out | 2 +-
tests/cfgs/default/result/riot.pcapng.out | 2 +-
tests/cfgs/default/result/rsh.pcap.out | 2 +-
tests/cfgs/default/result/rtmp.pcap.out | 2 +-
tests/cfgs/default/result/s7comm-plus.pcap.out | 2 +-
tests/cfgs/default/result/s7comm.pcap.out | 2 +-
tests/cfgs/default/result/shadowsocks.pcap.out | 2 +-
tests/cfgs/default/result/shell.pcap.out | 2 +-
tests/cfgs/default/result/smb_frags.pcap.out | 2 +-
tests/cfgs/default/result/smbv1.pcap.out | 2 +-
tests/cfgs/default/result/smtp-starttls.pcap.out | 2 +-
tests/cfgs/default/result/smtp.pcap.out | 2 +-
tests/cfgs/default/result/soap.pcap.out | 2 +-
tests/cfgs/default/result/socks.pcap.out | 2 +-
.../cfgs/default/result/starcraft_battle.pcap.out | 2 +-
tests/cfgs/default/result/synscan.pcap.out | 4 +-
tests/cfgs/default/result/teams.pcap.out | 2 +-
.../default/result/telegram_videocall.pcapng.out | 2 +-
tests/cfgs/default/result/telnet.pcap.out | 2 +-
tests/cfgs/default/result/teso.pcapng.out | 29 +++++++
tests/cfgs/default/result/threema.pcap.out | 2 +-
tests/cfgs/default/result/tinc.pcap.out | 2 +-
tests/cfgs/default/result/tls-appdata.pcap.out | 2 +-
.../result/tls_certificate_too_long.pcap.out | 2 +-
.../default/result/tls_false_positives.pcapng.out | 2 +-
.../cfgs/default/result/tls_invalid_reads.pcap.out | 2 +-
.../default/result/tls_missing_ch_frag.pcap.out | 2 +-
tests/cfgs/default/result/viber.pcap.out | 2 +-
tests/cfgs/default/result/vnc.pcap.out | 2 +-
tests/cfgs/default/result/wa_video.pcap.out | 2 +-
tests/cfgs/default/result/waze.pcap.out | 2 +-
tests/cfgs/default/result/wechat.pcap.out | 2 +-
tests/cfgs/default/result/whatsapp.pcap.out | 2 +-
.../default/result/whatsapp_login_chat.pcap.out | 2 +-
tests/cfgs/default/result/whois.pcapng.out | 2 +-
tests/cfgs/default/result/z3950.pcapng.out | 2 +-
tests/cfgs/default/result/zoom.pcap.out | 2 +-
.../disable_aggressiveness/result/ookla.pcap.out | 2 +-
tests/cfgs/disable_protocols/result/soap.pcap.out | 2 +-
.../cfgs/enable_payload_stat/result/1kxun.pcap.out | 2 +-
tests/cfgs/ip_lists_disable/result/1kxun.pcap.out | 2 +-
.../result/teams.pcap.out | 2 +-
windows/nDPI.vcxproj | 1 +
windows/nDPI.vcxproj.filters | 1 +
110 files changed, 243 insertions(+), 102 deletions(-)
create mode 100644 src/lib/protocols/teso.c
create mode 100644 tests/cfgs/default/pcap/teso.pcapng
create mode 100644 tests/cfgs/default/result/teso.pcapng.out
diff --git a/doc/protocols.rst b/doc/protocols.rst
index 3812dada2..40307a124 100644
--- a/doc/protocols.rst
+++ b/doc/protocols.rst
@@ -706,3 +706,12 @@ References: `RFC <https://datatracker.ietf.org/doc/html/rfc6726>`_
League of Legends: Wild Rift is a mobile MOBA game.
References: `Main site <https://wildrift.leagueoflegends.com/>`_
+
+
+.. _Proto 408:
+
+`NDPI_PROTOCOL_TESO`
+============================
+The Elder Scrolls Online is a MMORPG set in the fantasy world of Tamriel.
+
+References: `Main site <https://www.elderscrollsonline.com/>`_
diff --git a/src/include/ndpi_private.h b/src/include/ndpi_private.h
index 92afa1d24..efcd0f1d2 100644
--- a/src/include/ndpi_private.h
+++ b/src/include/ndpi_private.h
@@ -912,6 +912,7 @@ void init_pathofexile_dissector(struct ndpi_detection_module_struct *ndpi_struct
void init_pfcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_flute_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_lolwildrift_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
+void init_teso_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
#endif
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index a84bda3f1..b2e77d135 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -436,6 +436,7 @@ typedef enum {
NDPI_PROTOCOL_PFCP = 405,
NDPI_PROTOCOL_FLUTE = 406,
NDPI_PROTOCOL_LOLWILDRIFT = 407,
+ NDPI_PROTOCOL_TESO = 408,
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 31ecb4b7a..e37d04b5e 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -1610,6 +1610,7 @@ static ndpi_protocol_match host_match[] =
{ "easebar.com", "NetEaseGames", NDPI_PROTOCOL_NETEASE_GAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
{ "pathofexile.com", "PathofExile", NDPI_PROTOCOL_PATHOFEXILE, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "elderscrollsonline.com", "TES_Online", NDPI_PROTOCOL_TESO, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_content_match_host_match.c.inc"
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 67eff0e99..8f9e0c399 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -2292,6 +2292,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"LoLWildRift", NDPI_PROTOCOL_CATEGORY_GAME,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_TESO,
+ "TES_Online", NDPI_PROTOCOL_CATEGORY_GAME,
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -6166,6 +6170,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
/* League of Legends: Wild Rift */
init_lolwildrift_dissector(ndpi_str, &a);
+ /* The Elder Scrolls Online */
+ init_teso_dissector(ndpi_str, &a);
+
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
#endif
diff --git a/src/lib/protocols/teso.c b/src/lib/protocols/teso.c
new file mode 100644
index 000000000..89a5ba902
--- /dev/null
+++ b/src/lib/protocols/teso.c
@@ -0,0 +1,91 @@
+/*
+ * teso.c
+ *
+ * The Elder Scrolls Online
+ *
+ * Copyright (C) 2024 - ntop.org
+ * Copyright (C) 2024 - V.G <jacendi@protonmail.com>
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_TESO
+
+#include "ndpi_api.h"
+#include "ndpi_private.h"
+
+static void ndpi_int_teso_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
+ struct ndpi_flow_struct * const flow)
+{
+ NDPI_LOG_INFO(ndpi_struct, "found TES Online\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TESO,
+ NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+}
+
+static void ndpi_search_teso(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search TES Online\n");
+
+ if (packet->payload_packet_len < 600 ||
+ ntohl(get_u_int32_t(packet->payload, 0)) != (u_int32_t)(packet->payload_packet_len-4))
+ {
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ return;
+ }
+
+ /*
+ * I'd like to use just memcmp and a couple ifs here, but the offset to
+ * the string "eso.live" or the 0x8B789C01 byte sequence can be different -
+ * it varies by the amount of characters in the account name, weather on Mars,
+ * etc.
+ */
+
+ const u_int8_t magic[] = { 0x8B, 0x78, 0x9C, 0x01 };
+
+ if (ndpi_memmem(packet->payload, packet->payload_packet_len, "eso.live",
+ NDPI_STATICSTRING_LEN("eso.live")))
+ {
+ ndpi_int_teso_add_connection(ndpi_struct, flow);
+ return;
+ }
+ else if (ndpi_memmem(packet->payload, packet->payload_packet_len, magic,
+ sizeof(magic)))
+ {
+ ndpi_int_teso_add_connection(ndpi_struct, flow);
+ return;
+ }
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void init_teso_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id)
+{
+ ndpi_set_bitmask_protocol_detection("TES_Online", ndpi_struct, *id,
+ NDPI_PROTOCOL_TESO,
+ ndpi_search_teso,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
diff --git a/tests/cfgs/caches_cfg/result/ookla.pcap.out b/tests/cfgs/caches_cfg/result/ookla.pcap.out
index c9fbb1f15..cb53e8209 100644
--- a/tests/cfgs/caches_cfg/result/ookla.pcap.out
+++ b/tests/cfgs/caches_cfg/result/ookla.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 5 (flows)
-Num dissector calls: 574 (95.67 diss/flow)
+Num dissector calls: 577 (96.17 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/caches_cfg/result/teams.pcap.out b/tests/cfgs/caches_cfg/result/teams.pcap.out
index 06c86757f..120183547 100644
--- a/tests/cfgs/caches_cfg/result/teams.pcap.out
+++ b/tests/cfgs/caches_cfg/result/teams.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
Confidence Match by port : 1 (flows)
Confidence DPI (partial) : 1 (flows)
Confidence DPI : 80 (flows)
-Num dissector calls: 535 (6.45 diss/flow)
+Num dissector calls: 536 (6.46 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/caches_global/result/ookla.pcap.out b/tests/cfgs/caches_global/result/ookla.pcap.out
index 607990b08..d79472415 100644
--- a/tests/cfgs/caches_global/result/ookla.pcap.out
+++ b/tests/cfgs/caches_global/result/ookla.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence DPI (partial cache): 1 (flows)
Confidence DPI : 4 (flows)
Confidence DPI (aggressive) : 1 (flows)
-Num dissector calls: 574 (95.67 diss/flow)
+Num dissector calls: 577 (96.17 diss/flow)
LRU cache ookla: 4/2/2 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/caches_global/result/teams.pcap.out b/tests/cfgs/caches_global/result/teams.pcap.out
index 169f9343c..b45b5f898 100644
--- a/tests/cfgs/caches_global/result/teams.pcap.out
+++ b/tests/cfgs/caches_global/result/teams.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
Confidence Match by port : 1 (flows)
Confidence DPI (partial) : 5 (flows)
Confidence DPI : 76 (flows)
-Num dissector calls: 535 (6.45 diss/flow)
+Num dissector calls: 536 (6.46 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/pcap/teso.pcapng b/tests/cfgs/default/pcap/teso.pcapng
new file mode 100644
index 000000000..6e48739d3
Binary files /dev/null and b/tests/cfgs/default/pcap/teso.pcapng differ
diff --git a/tests/cfgs/default/result/1kxun.pcap.out b/tests/cfgs/default/result/1kxun.pcap.out
index 6c2de6f47..27ce3d153 100644
--- a/tests/cfgs/default/result/1kxun.pcap.out
+++ b/tests/cfgs/default/result/1kxun.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
Confidence Unknown : 14 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 177 (flows)
-Num dissector calls: 5052 (25.64 diss/flow)
+Num dissector calls: 5055 (25.66 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/60/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/443-chrome.pcap.out b/tests/cfgs/default/result/443-chrome.pcap.out
index d9a6bacdc..704411c8a 100644
--- a/tests/cfgs/default/result/443-chrome.pcap.out
+++ b/tests/cfgs/default/result/443-chrome.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 1 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
-Num dissector calls: 147 (147.00 diss/flow)
+Num dissector calls: 148 (148.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/443-opvn.pcap.out b/tests/cfgs/default/result/443-opvn.pcap.out
index 7178e3b5c..9abb898c3 100644
--- a/tests/cfgs/default/result/443-opvn.pcap.out
+++ b/tests/cfgs/default/result/443-opvn.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 148 (148.00 diss/flow)
+Num dissector calls: 149 (149.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/KakaoTalk_chat.pcap.out b/tests/cfgs/default/result/KakaoTalk_chat.pcap.out
index 56826e061..063da4ad1 100644
--- a/tests/cfgs/default/result/KakaoTalk_chat.pcap.out
+++ b/tests/cfgs/default/result/KakaoTalk_chat.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 5 (flows)
Confidence DPI : 33 (flows)
-Num dissector calls: 578 (15.21 diss/flow)
+Num dissector calls: 580 (15.26 diss/flow)
LRU cache ookla: 0/1/0 (insert/search/found)
LRU cache bittorrent: 0/15/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/KakaoTalk_talk.pcap.out b/tests/cfgs/default/result/KakaoTalk_talk.pcap.out
index 5bfa0ac3f..e08c52ada 100644
--- a/tests/cfgs/default/result/KakaoTalk_talk.pcap.out
+++ b/tests/cfgs/default/result/KakaoTalk_talk.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 10 (2.00 pkts/flow)
Confidence Match by port : 8 (flows)
Confidence DPI : 11 (flows)
Confidence Match by IP : 1 (flows)
-Num dissector calls: 1228 (61.40 diss/flow)
+Num dissector calls: 1232 (61.60 diss/flow)
LRU cache ookla: 0/2/0 (insert/search/found)
LRU cache bittorrent: 0/27/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/Oscar.pcap.out b/tests/cfgs/default/result/Oscar.pcap.out
index e4e7e5b1e..de8e16c4e 100644
--- a/tests/cfgs/default/result/Oscar.pcap.out
+++ b/tests/cfgs/default/result/Oscar.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 21 (21.00 pkts/flow)
Confidence Match by port : 1 (flows)
-Num dissector calls: 266 (266.00 diss/flow)
+Num dissector calls: 267 (267.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/alexa-app.pcapng.out b/tests/cfgs/default/result/alexa-app.pcapng.out
index 2cf4d296b..43b72a018 100644
--- a/tests/cfgs/default/result/alexa-app.pcapng.out
+++ b/tests/cfgs/default/result/alexa-app.pcapng.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow)
DPI Packets (other): 6 (1.00 pkts/flow)
Confidence Match by port : 14 (flows)
Confidence DPI : 146 (flows)
-Num dissector calls: 561 (3.51 diss/flow)
+Num dissector calls: 562 (3.51 diss/flow)
LRU cache ookla: 0/5/0 (insert/search/found)
LRU cache bittorrent: 0/42/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/amqp.pcap.out b/tests/cfgs/default/result/amqp.pcap.out
index c0cb78114..48032189e 100644
--- a/tests/cfgs/default/result/amqp.pcap.out
+++ b/tests/cfgs/default/result/amqp.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 9 (3.00 pkts/flow)
Confidence DPI : 3 (flows)
-Num dissector calls: 388 (129.33 diss/flow)
+Num dissector calls: 389 (129.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/anyconnect-vpn.pcap.out b/tests/cfgs/default/result/anyconnect-vpn.pcap.out
index b57176fa4..1da80ca25 100644
--- a/tests/cfgs/default/result/anyconnect-vpn.pcap.out
+++ b/tests/cfgs/default/result/anyconnect-vpn.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 61 (flows)
-Num dissector calls: 865 (12.54 diss/flow)
+Num dissector calls: 866 (12.55 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/24/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out b/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out
index 9a192e2d0..efcd8f4a1 100644
--- a/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out
+++ b/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 10 (10.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 246 (246.00 diss/flow)
+Num dissector calls: 247 (247.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 5/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/cassandra.pcap.out b/tests/cfgs/default/result/cassandra.pcap.out
index 166d9866c..79f1e1584 100644
--- a/tests/cfgs/default/result/cassandra.pcap.out
+++ b/tests/cfgs/default/result/cassandra.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 16 (5.33 pkts/flow)
Confidence DPI : 3 (flows)
-Num dissector calls: 297 (99.00 diss/flow)
+Num dissector calls: 299 (99.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/cloudflare-warp.pcap.out b/tests/cfgs/default/result/cloudflare-warp.pcap.out
index b1f5150af..ba0d0d27a 100644
--- a/tests/cfgs/default/result/cloudflare-warp.pcap.out
+++ b/tests/cfgs/default/result/cloudflare-warp.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow)
Confidence Match by port : 2 (flows)
Confidence DPI : 5 (flows)
Confidence Match by IP : 1 (flows)
-Num dissector calls: 203 (25.38 diss/flow)
+Num dissector calls: 204 (25.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out b/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out
index 3c7b385f6..730482156 100644
--- a/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out
+++ b/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out
@@ -27,6 +27,6 @@ CustomProtocolC 3 222 1
Acceptable 8 592 3
- 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.414/TLS.CustomProtocolA][IP: 414/CustomProtocolA][Encrypted][Confidence: Match by custom rule][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.415/TLS.CustomProtocolA][IP: 415/CustomProtocolA][Encrypted][Confidence: Match by custom rule][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 800/CustomProtocolC][IP: 800/CustomProtocolC][ClearText][Confidence: Match by custom rule][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 415/CustomProtocolB][IP: 415/CustomProtocolB][ClearText][Confidence: Match by custom rule][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 416/CustomProtocolB][IP: 416/CustomProtocolB][ClearText][Confidence: Match by custom rule][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/cfgs/default/result/edonkey.pcap.out b/tests/cfgs/default/result/edonkey.pcap.out
index 09ab44fa9..4d555ceae 100644
--- a/tests/cfgs/default/result/edonkey.pcap.out
+++ b/tests/cfgs/default/result/edonkey.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 5 (5.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 150 (150.00 diss/flow)
+Num dissector calls: 151 (151.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/elf.pcap.out b/tests/cfgs/default/result/elf.pcap.out
index e05890415..51302c0fb 100644
--- a/tests/cfgs/default/result/elf.pcap.out
+++ b/tests/cfgs/default/result/elf.pcap.out
@@ -1,7 +1,7 @@
DPI Packets (TCP): 10 (10.00 pkts/flow)
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence Unknown : 2 (flows)
-Num dissector calls: 331 (165.50 diss/flow)
+Num dissector calls: 332 (166.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/emotet.pcap.out b/tests/cfgs/default/result/emotet.pcap.out
index 3455d47db..558315bdd 100644
--- a/tests/cfgs/default/result/emotet.pcap.out
+++ b/tests/cfgs/default/result/emotet.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 48 (8.00 pkts/flow)
Confidence DPI : 6 (flows)
-Num dissector calls: 221 (36.83 diss/flow)
+Num dissector calls: 222 (37.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/fastcgi.pcap.out b/tests/cfgs/default/result/fastcgi.pcap.out
index 188347b97..8da38a33c 100644
--- a/tests/cfgs/default/result/fastcgi.pcap.out
+++ b/tests/cfgs/default/result/fastcgi.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 172 (172.00 diss/flow)
+Num dissector calls: 173 (173.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/ftp-start-tls.pcap.out b/tests/cfgs/default/result/ftp-start-tls.pcap.out
index ec61f55f1..51b5f32dc 100644
--- a/tests/cfgs/default/result/ftp-start-tls.pcap.out
+++ b/tests/cfgs/default/result/ftp-start-tls.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 17 (17.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 174 (174.00 diss/flow)
+Num dissector calls: 175 (175.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/ftp.pcap.out b/tests/cfgs/default/result/ftp.pcap.out
index 18c82eef4..47eb990e3 100644
--- a/tests/cfgs/default/result/ftp.pcap.out
+++ b/tests/cfgs/default/result/ftp.pcap.out
@@ -1,7 +1,7 @@
DPI Packets (TCP): 39 (13.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence DPI : 2 (flows)
-Num dissector calls: 541 (180.33 diss/flow)
+Num dissector calls: 543 (181.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/ftp_failed.pcap.out b/tests/cfgs/default/result/ftp_failed.pcap.out
index 2b155ec65..cf5380030 100644
--- a/tests/cfgs/default/result/ftp_failed.pcap.out
+++ b/tests/cfgs/default/result/ftp_failed.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 8 (8.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 173 (173.00 diss/flow)
+Num dissector calls: 174 (174.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out b/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out
index 1663cc972..2c040fb8d 100644
--- a/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out
+++ b/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow)
Confidence Unknown : 34 (flows)
Confidence Match by port : 27 (flows)
Confidence DPI : 190 (flows)
-Num dissector calls: 7499 (29.88 diss/flow)
+Num dissector calls: 7511 (29.92 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/189/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out b/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out
index ff9770e54..02f76e1cc 100644
--- a/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out
+++ b/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Unknown : 3 (flows)
Confidence Match by port : 26 (flows)
Confidence DPI : 11 (flows)
-Num dissector calls: 1133 (28.33 diss/flow)
+Num dissector calls: 1139 (28.48 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/87/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out b/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out
index 51a06e46d..ddff7044b 100644
--- a/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out
+++ b/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 1 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
-Num dissector calls: 146 (146.00 diss/flow)
+Num dissector calls: 147 (147.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/gaijin_mobile_mixed.pcap.out b/tests/cfgs/default/result/gaijin_mobile_mixed.pcap.out
index 3cbf416ff..0d74d24b8 100644
--- a/tests/cfgs/default/result/gaijin_mobile_mixed.pcap.out
+++ b/tests/cfgs/default/result/gaijin_mobile_mixed.pcap.out
@@ -1,7 +1,7 @@
DPI Packets (TCP): 13 (6.50 pkts/flow)
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 3 (flows)
-Num dissector calls: 150 (50.00 diss/flow)
+Num dissector calls: 151 (50.33 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/google_ssl.pcap.out b/tests/cfgs/default/result/google_ssl.pcap.out
index 2e40919ed..27a1e535a 100644
--- a/tests/cfgs/default/result/google_ssl.pcap.out
+++ b/tests/cfgs/default/result/google_ssl.pcap.out
@@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 24 (24.00 pkts/flow)
Confidence Match by port : 1 (flows)
-Num dissector calls: 210 (210.00 diss/flow)
+Num dissector calls: 211 (211.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out b/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out
index 61fc038f4..7f1590ac6 100644
--- a/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out
+++ b/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 1 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
-Num dissector calls: 147 (147.00 diss/flow)
+Num dissector calls: 148 (148.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/imap-starttls.pcap.out b/tests/cfgs/default/result/imap-starttls.pcap.out
index 402b85d42..fe337d542 100644
--- a/tests/cfgs/default/result/imap-starttls.pcap.out
+++ b/tests/cfgs/default/result/imap-starttls.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 19 (19.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 222 (222.00 diss/flow)
+Num dissector calls: 223 (223.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/imap.pcap.out b/tests/cfgs/default/result/imap.pcap.out
index e08882128..f66c647bd 100644
--- a/tests/cfgs/default/result/imap.pcap.out
+++ b/tests/cfgs/default/result/imap.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 11 (11.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 222 (222.00 diss/flow)
+Num dissector calls: 223 (223.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/instagram.pcap.out b/tests/cfgs/default/result/instagram.pcap.out
index e7ecd3b06..1e939be5a 100644
--- a/tests/cfgs/default/result/instagram.pcap.out
+++ b/tests/cfgs/default/result/instagram.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 7 (flows)
Confidence DPI : 30 (flows)
-Num dissector calls: 1401 (36.87 diss/flow)
+Num dissector calls: 1405 (36.97 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/24/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/irc.pcap.out b/tests/cfgs/default/result/irc.pcap.out
index 142f2b566..2328d7c4e 100644
--- a/tests/cfgs/default/result/irc.pcap.out
+++ b/tests/cfgs/default/result/irc.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 178 (178.00 diss/flow)
+Num dissector calls: 179 (179.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/iso9506-1-mms.pcap.out b/tests/cfgs/default/result/iso9506-1-mms.pcap.out
index d0f6e7041..3b058d2e4 100644
--- a/tests/cfgs/default/result/iso9506-1-mms.pcap.out
+++ b/tests/cfgs/default/result/iso9506-1-mms.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 195 (195.00 diss/flow)
+Num dissector calls: 196 (196.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/jabber.pcap.out b/tests/cfgs/default/result/jabber.pcap.out
index 42141223f..03d1c9fa0 100644
--- a/tests/cfgs/default/result/jabber.pcap.out
+++ b/tests/cfgs/default/result/jabber.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 74 (6.17 pkts/flow)
Confidence DPI : 12 (flows)
-Num dissector calls: 1620 (135.00 diss/flow)
+Num dissector calls: 1629 (135.75 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/kafka.pcapng.out b/tests/cfgs/default/result/kafka.pcapng.out
index b106e7959..fd0591d12 100644
--- a/tests/cfgs/default/result/kafka.pcapng.out
+++ b/tests/cfgs/default/result/kafka.pcapng.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 148 (148.00 diss/flow)
+Num dissector calls: 149 (149.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/kerberos.pcap.out b/tests/cfgs/default/result/kerberos.pcap.out
index c346a0246..2da774ccf 100644
--- a/tests/cfgs/default/result/kerberos.pcap.out
+++ b/tests/cfgs/default/result/kerberos.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (2.14 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence Match by port : 23 (flows)
Confidence DPI : 11 (flows)
-Num dissector calls: 4454 (123.72 diss/flow)
+Num dissector calls: 4479 (124.42 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/75/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out b/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out
index 81019d86d..91f619b4b 100644
--- a/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out
+++ b/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out
@@ -1,7 +1,7 @@
DPI Packets (TCP): 56 (8.00 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence DPI : 5 (flows)
-Num dissector calls: 364 (52.00 diss/flow)
+Num dissector calls: 365 (52.14 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/memcached.cap.out b/tests/cfgs/default/result/memcached.cap.out
index 4488fd313..565b437db 100644
--- a/tests/cfgs/default/result/memcached.cap.out
+++ b/tests/cfgs/default/result/memcached.cap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 148 (148.00 diss/flow)
+Num dissector calls: 149 (149.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/mongo_false_positive.pcapng.out b/tests/cfgs/default/result/mongo_false_positive.pcapng.out
index fc66c89c5..9a4379e62 100644
--- a/tests/cfgs/default/result/mongo_false_positive.pcapng.out
+++ b/tests/cfgs/default/result/mongo_false_positive.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 14 (14.00 pkts/flow)
Confidence Match by port : 1 (flows)
-Num dissector calls: 279 (279.00 diss/flow)
+Num dissector calls: 280 (280.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/mssql_tds.pcap.out b/tests/cfgs/default/result/mssql_tds.pcap.out
index a50990524..c5203b4d9 100644
--- a/tests/cfgs/default/result/mssql_tds.pcap.out
+++ b/tests/cfgs/default/result/mssql_tds.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 18 (1.50 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 11 (flows)
-Num dissector calls: 279 (23.25 diss/flow)
+Num dissector calls: 280 (23.33 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/nest_log_sink.pcap.out b/tests/cfgs/default/result/nest_log_sink.pcap.out
index b3b3653a6..0bd1c2851 100644
--- a/tests/cfgs/default/result/nest_log_sink.pcap.out
+++ b/tests/cfgs/default/result/nest_log_sink.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP): 130 (10.00 pkts/flow)
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 13 (flows)
-Num dissector calls: 2113 (150.93 diss/flow)
+Num dissector calls: 2125 (151.79 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/netbios.pcap.out b/tests/cfgs/default/result/netbios.pcap.out
index c9cf379be..9fcc16331 100644
--- a/tests/cfgs/default/result/netbios.pcap.out
+++ b/tests/cfgs/default/result/netbios.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP): 2 (2.00 pkts/flow)
DPI Packets (UDP): 14 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 14 (flows)
-Num dissector calls: 161 (10.73 diss/flow)
+Num dissector calls: 162 (10.80 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/nntp.pcap.out b/tests/cfgs/default/result/nntp.pcap.out
index 9c0a1eaa9..a70d9f438 100644
--- a/tests/cfgs/default/result/nntp.pcap.out
+++ b/tests/cfgs/default/result/nntp.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 154 (154.00 diss/flow)
+Num dissector calls: 155 (155.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/ookla.pcap.out b/tests/cfgs/default/result/ookla.pcap.out
index 607990b08..d79472415 100644
--- a/tests/cfgs/default/result/ookla.pcap.out
+++ b/tests/cfgs/default/result/ookla.pcap.out
@@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence DPI (partial cache): 1 (flows)
Confidence DPI : 4 (flows)
Confidence DPI (aggressive) : 1 (flows)
-Num dissector calls: 574 (95.67 diss/flow)
+Num dissector calls: 577 (96.17 diss/flow)
LRU cache ookla: 4/2/2 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/openvpn.pcap.out b/tests/cfgs/default/result/openvpn.pcap.out
index be89ec748..1110ba2f8 100644
--- a/tests/cfgs/default/result/openvpn.pcap.out
+++ b/tests/cfgs/default/result/openvpn.pcap.out
@@ -1,7 +1,7 @@
DPI Packets (TCP): 24 (8.00 pkts/flow)
DPI Packets (UDP): 15 (3.00 pkts/flow)
Confidence DPI : 8 (flows)
-Num dissector calls: 1343 (167.88 diss/flow)
+Num dissector calls: 1346 (168.25 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out b/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out
index dea731715..de78facba 100644
--- a/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out
+++ b/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 148 (148.00 diss/flow)
+Num dissector calls: 149 (149.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/oracle12.pcapng.out b/tests/cfgs/default/result/oracle12.pcapng.out
index 62b0a5227..55f486035 100644
--- a/tests/cfgs/default/result/oracle12.pcapng.out
+++ b/tests/cfgs/default/result/oracle12.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 20 (20.00 pkts/flow)
Confidence Match by port : 1 (flows)
-Num dissector calls: 262 (262.00 diss/flow)
+Num dissector calls: 263 (263.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out
index d9d7bc56b..2f07773bc 100644
--- a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out
+++ b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out
@@ -2,7 +2,7 @@ DPI Packets (TCP): 8 (1.33 pkts/flow)
DPI Packets (UDP): 9 (2.25 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence DPI : 9 (flows)
-Num dissector calls: 808 (80.80 diss/flow)
+Num dissector calls: 810 (81.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out
index b2c1414e4..227250bf8 100644
--- a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out
+++ b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out
@@ -4,7 +4,7 @@ DPI Packets (TCP): 38 (6.33 pkts/flow)
DPI Packets (UDP): 4 (2.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 7 (flows)
-Num dissector calls: 1006 (125.75 diss/flow)
+Num dissector calls: 1010 (126.25 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/pgsql.pcap.out b/tests/cfgs/default/result/pgsql.pcap.out
index 3ed01893c..93a44d47d 100644
--- a/tests/cfgs/default/result/pgsql.pcap.out
+++ b/tests/cfgs/default/result/pgsql.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 36 (6.00 pkts/flow)
Confidence DPI : 6 (flows)
-Num dissector calls: 888 (148.00 diss/flow)
+Num dissector calls: 894 (149.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/pop3.pcap.out b/tests/cfgs/default/result/pop3.pcap.out
index 59c46374d..1af027cad 100644
--- a/tests/cfgs/default/result/pop3.pcap.out
+++ b/tests/cfgs/default/result/pop3.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 83 (13.83 pkts/flow)
Confidence DPI : 6 (flows)
-Num dissector calls: 1266 (211.00 diss/flow)
+Num dissector calls: 1272 (212.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/pop3_stls.pcap.out b/tests/cfgs/default/result/pop3_stls.pcap.out
index 2a993b961..6ff59da59 100644
--- a/tests/cfgs/default/result/pop3_stls.pcap.out
+++ b/tests/cfgs/default/result/pop3_stls.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 18 (18.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 210 (210.00 diss/flow)
+Num dissector calls: 211 (211.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/portable_executable.pcap.out b/tests/cfgs/default/result/portable_executable.pcap.out
index 223f46309..c10735069 100644
--- a/tests/cfgs/default/result/portable_executable.pcap.out
+++ b/tests/cfgs/default/result/portable_executable.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 30 (15.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 1 (flows)
-Num dissector calls: 504 (252.00 diss/flow)
+Num dissector calls: 506 (253.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/protobuf.pcap.out b/tests/cfgs/default/result/protobuf.pcap.out
index d2a9074f2..e5bb23bea 100644
--- a/tests/cfgs/default/result/protobuf.pcap.out
+++ b/tests/cfgs/default/result/protobuf.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 26 (5.20 pkts/flow)
Confidence DPI : 5 (flows)
-Num dissector calls: 706 (141.20 diss/flow)
+Num dissector calls: 707 (141.40 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/radmin3.pcapng.out b/tests/cfgs/default/result/radmin3.pcapng.out
index 858426016..1cddc5bc8 100644
--- a/tests/cfgs/default/result/radmin3.pcapng.out
+++ b/tests/cfgs/default/result/radmin3.pcapng.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 12 (6.00 pkts/flow)
Confidence DPI : 2 (flows)
-Num dissector calls: 296 (148.00 diss/flow)
+Num dissector calls: 298 (149.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/raft.pcap.out b/tests/cfgs/default/result/raft.pcap.out
index 42f3590aa..fcb6c0a7e 100644
--- a/tests/cfgs/default/result/raft.pcap.out
+++ b/tests/cfgs/default/result/raft.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 12 (6.00 pkts/flow)
Confidence DPI : 2 (flows)
-Num dissector calls: 348 (174.00 diss/flow)
+Num dissector calls: 350 (175.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/reasm_crash_anon.pcapng.out b/tests/cfgs/default/result/reasm_crash_anon.pcapng.out
index b75ba7f16..b6914de85 100644
--- a/tests/cfgs/default/result/reasm_crash_anon.pcapng.out
+++ b/tests/cfgs/default/result/reasm_crash_anon.pcapng.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 23 (23.00 pkts/flow)
Confidence Unknown : 1 (flows)
-Num dissector calls: 259 (259.00 diss/flow)
+Num dissector calls: 260 (260.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/reasm_segv_anon.pcapng.out b/tests/cfgs/default/result/reasm_segv_anon.pcapng.out
index 9e6f56a70..0fa8a1d6b 100644
--- a/tests/cfgs/default/result/reasm_segv_anon.pcapng.out
+++ b/tests/cfgs/default/result/reasm_segv_anon.pcapng.out
@@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 21 (21.00 pkts/flow)
Confidence Match by port : 1 (flows)
-Num dissector calls: 207 (207.00 diss/flow)
+Num dissector calls: 208 (208.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/riot.pcapng.out b/tests/cfgs/default/result/riot.pcapng.out
index 0ea08e8b4..bba28ca73 100644
--- a/tests/cfgs/default/result/riot.pcapng.out
+++ b/tests/cfgs/default/result/riot.pcapng.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 7 (3.50 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 1 (flows)
-Num dissector calls: 203 (101.50 diss/flow)
+Num dissector calls: 204 (102.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/rsh.pcap.out b/tests/cfgs/default/result/rsh.pcap.out
index 3ad957aa3..e573c4548 100644
--- a/tests/cfgs/default/result/rsh.pcap.out
+++ b/tests/cfgs/default/result/rsh.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 12 (6.00 pkts/flow)
Confidence DPI : 2 (flows)
-Num dissector calls: 338 (169.00 diss/flow)
+Num dissector calls: 340 (170.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/rtmp.pcap.out b/tests/cfgs/default/result/rtmp.pcap.out
index f89a1015e..9eb284b48 100644
--- a/tests/cfgs/default/result/rtmp.pcap.out
+++ b/tests/cfgs/default/result/rtmp.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 8 (8.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 176 (176.00 diss/flow)
+Num dissector calls: 177 (177.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/s7comm-plus.pcap.out b/tests/cfgs/default/result/s7comm-plus.pcap.out
index 2283e2d6c..39dd97b3e 100644
--- a/tests/cfgs/default/result/s7comm-plus.pcap.out
+++ b/tests/cfgs/default/result/s7comm-plus.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 9 (9.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 189 (189.00 diss/flow)
+Num dissector calls: 190 (190.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/s7comm.pcap.out b/tests/cfgs/default/result/s7comm.pcap.out
index 26f04b3ac..1383be9e9 100644
--- a/tests/cfgs/default/result/s7comm.pcap.out
+++ b/tests/cfgs/default/result/s7comm.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 3 (3.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 191 (191.00 diss/flow)
+Num dissector calls: 192 (192.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/shadowsocks.pcap.out b/tests/cfgs/default/result/shadowsocks.pcap.out
index f95142815..5e55350c4 100644
--- a/tests/cfgs/default/result/shadowsocks.pcap.out
+++ b/tests/cfgs/default/result/shadowsocks.pcap.out
@@ -1,7 +1,7 @@
DPI Packets (TCP): 21 (10.50 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence DPI : 1 (flows)
-Num dissector calls: 373 (186.50 diss/flow)
+Num dissector calls: 375 (187.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/shell.pcap.out b/tests/cfgs/default/result/shell.pcap.out
index 75afae9c5..9db83750b 100644
--- a/tests/cfgs/default/result/shell.pcap.out
+++ b/tests/cfgs/default/result/shell.pcap.out
@@ -1,7 +1,7 @@
DPI Packets (TCP): 16 (8.00 pkts/flow)
DPI Packets (UDP): 2 (1.00 pkts/flow)
Confidence Unknown : 4 (flows)
-Num dissector calls: 572 (143.00 diss/flow)
+Num dissector calls: 574 (143.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/12/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/smb_frags.pcap.out b/tests/cfgs/default/result/smb_frags.pcap.out
index e3e75d3b9..c17bf728b 100644
--- a/tests/cfgs/default/result/smb_frags.pcap.out
+++ b/tests/cfgs/default/result/smb_frags.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 5 (5.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 175 (175.00 diss/flow)
+Num dissector calls: 176 (176.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/smbv1.pcap.out b/tests/cfgs/default/result/smbv1.pcap.out
index 50e45f05d..2e3d403c8 100644
--- a/tests/cfgs/default/result/smbv1.pcap.out
+++ b/tests/cfgs/default/result/smbv1.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 3 (3.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 177 (177.00 diss/flow)
+Num dissector calls: 178 (178.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/smtp-starttls.pcap.out b/tests/cfgs/default/result/smtp-starttls.pcap.out
index 930efc3b6..eba99f445 100644
--- a/tests/cfgs/default/result/smtp-starttls.pcap.out
+++ b/tests/cfgs/default/result/smtp-starttls.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 26 (13.00 pkts/flow)
Confidence DPI : 2 (flows)
-Num dissector calls: 173 (86.50 diss/flow)
+Num dissector calls: 174 (87.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/smtp.pcap.out b/tests/cfgs/default/result/smtp.pcap.out
index becab71ae..87a505e26 100644
--- a/tests/cfgs/default/result/smtp.pcap.out
+++ b/tests/cfgs/default/result/smtp.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 11 (11.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 216 (216.00 diss/flow)
+Num dissector calls: 217 (217.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/soap.pcap.out b/tests/cfgs/default/result/soap.pcap.out
index 17103c1c6..72df0c4cd 100644
--- a/tests/cfgs/default/result/soap.pcap.out
+++ b/tests/cfgs/default/result/soap.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 20 (6.67 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 2 (flows)
-Num dissector calls: 417 (139.00 diss/flow)
+Num dissector calls: 419 (139.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/socks.pcap.out b/tests/cfgs/default/result/socks.pcap.out
index 6d3e5fed4..c25018fe1 100644
--- a/tests/cfgs/default/result/socks.pcap.out
+++ b/tests/cfgs/default/result/socks.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 23 (5.75 pkts/flow)
Confidence DPI : 4 (flows)
-Num dissector calls: 594 (148.50 diss/flow)
+Num dissector calls: 598 (149.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/starcraft_battle.pcap.out b/tests/cfgs/default/result/starcraft_battle.pcap.out
index bb95cd372..34e3adabd 100644
--- a/tests/cfgs/default/result/starcraft_battle.pcap.out
+++ b/tests/cfgs/default/result/starcraft_battle.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 12 (flows)
Confidence DPI : 39 (flows)
Confidence Match by IP : 1 (flows)
-Num dissector calls: 1686 (32.42 diss/flow)
+Num dissector calls: 1689 (32.48 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/39/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/synscan.pcap.out b/tests/cfgs/default/result/synscan.pcap.out
index 95b179e06..3f25a9395 100644
--- a/tests/cfgs/default/result/synscan.pcap.out
+++ b/tests/cfgs/default/result/synscan.pcap.out
@@ -142,7 +142,7 @@ Unrated 1852 107424 1848
46 TCP 172.16.0.8:36050 -> 64.13.134.52:2605 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
47 TCP 172.16.0.8:36050 -> 64.13.134.52:3000 [proto: 26/ntop][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
48 TCP 172.16.0.8:36050 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 49 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 408/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by custom rule][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 49 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 409/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by custom rule][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
50 TCP 172.16.0.8:36050 -> 64.13.134.52:3300 [proto: 381/Ceph][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: DataTransfer/4][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
51 TCP 172.16.0.8:36050 -> 64.13.134.52:3306 [proto: 20/MySQL][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
52 TCP 172.16.0.8:36050 -> 64.13.134.52:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
@@ -213,7 +213,7 @@ Unrated 1852 107424 1848
117 TCP 172.16.0.8:36051 -> 64.13.134.52:2605 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
118 TCP 172.16.0.8:36051 -> 64.13.134.52:3000 [proto: 26/ntop][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
119 TCP 172.16.0.8:36051 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 120 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 408/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by custom rule][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 120 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 409/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by custom rule][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
121 TCP 172.16.0.8:36051 -> 64.13.134.52:3300 [proto: 381/Ceph][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: DataTransfer/4][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
122 TCP 172.16.0.8:36051 -> 64.13.134.52:3306 [proto: 20/MySQL][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
123 TCP 172.16.0.8:36051 -> 64.13.134.52:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/cfgs/default/result/teams.pcap.out b/tests/cfgs/default/result/teams.pcap.out
index 169f9343c..b45b5f898 100644
--- a/tests/cfgs/default/result/teams.pcap.out
+++ b/tests/cfgs/default/result/teams.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
Confidence Match by port : 1 (flows)
Confidence DPI (partial) : 5 (flows)
Confidence DPI : 76 (flows)
-Num dissector calls: 535 (6.45 diss/flow)
+Num dissector calls: 536 (6.46 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/telegram_videocall.pcapng.out b/tests/cfgs/default/result/telegram_videocall.pcapng.out
index 535f7d252..4e24a9793 100644
--- a/tests/cfgs/default/result/telegram_videocall.pcapng.out
+++ b/tests/cfgs/default/result/telegram_videocall.pcapng.out
@@ -7,7 +7,7 @@ Confidence DPI (partial) : 1 (flows)
Confidence DPI (cache) : 10 (flows)
Confidence DPI : 15 (flows)
Confidence Match by IP : 8 (flows)
-Num dissector calls: 773 (22.74 diss/flow)
+Num dissector calls: 774 (22.76 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/telnet.pcap.out b/tests/cfgs/default/result/telnet.pcap.out
index 1963d8260..b010ebe6e 100644
--- a/tests/cfgs/default/result/telnet.pcap.out
+++ b/tests/cfgs/default/result/telnet.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 33 (33.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 173 (173.00 diss/flow)
+Num dissector calls: 174 (174.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/teso.pcapng.out b/tests/cfgs/default/result/teso.pcapng.out
new file mode 100644
index 000000000..1fa2d2d20
--- /dev/null
+++ b/tests/cfgs/default/result/teso.pcapng.out
@@ -0,0 +1,29 @@
+DPI Packets (TCP): 8 (4.00 pkts/flow)
+Confidence DPI : 2 (flows)
+Num dissector calls: 296 (148.00 diss/flow)
+LRU cache ookla: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache zoom: 0/0/0 (insert/search/found)
+LRU cache stun: 0/0/0 (insert/search/found)
+LRU cache tls_cert: 0/0/0 (insert/search/found)
+LRU cache mining: 0/0/0 (insert/search/found)
+LRU cache msteams: 0/0/0 (insert/search/found)
+LRU cache stun_zoom: 0/0/0 (insert/search/found)
+Automa host: 0/0 (search/found)
+Automa domain: 0/0 (search/found)
+Automa tls cert: 0/0 (search/found)
+Automa risk mask: 0/0 (search/found)
+Automa common alpns: 0/0 (search/found)
+Patricia risk mask: 0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
+Patricia risk: 0/0 (search/found)
+Patricia risk IPv6: 0/0 (search/found)
+Patricia protocols: 4/0 (search/found)
+Patricia protocols IPv6: 0/0 (search/found)
+
+TES_Online 8 2253 2
+
+Fun 8 2253 2
+
+ 1 TCP 192.168.88.231:56158 <-> 159.100.232.124:24120 [proto: 408/TES_Online][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][3 pkts/1064 bytes <-> 1 pkts/74 bytes][Goodput ratio: 81/0][0.05 sec][PLAIN TEXT (gachimuchileatherman)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 2 TCP 192.168.88.231:47860 <-> 159.100.232.114:24504 [proto: 408/TES_Online][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][3 pkts/1041 bytes <-> 1 pkts/74 bytes][Goodput ratio: 80/0][0.04 sec][PLAIN TEXT (eso.live.9.3.6.2849903)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/cfgs/default/result/threema.pcap.out b/tests/cfgs/default/result/threema.pcap.out
index 70283b505..8c6cf923f 100644
--- a/tests/cfgs/default/result/threema.pcap.out
+++ b/tests/cfgs/default/result/threema.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos: 2
DPI Packets (TCP): 66 (11.00 pkts/flow)
Confidence DPI : 4 (flows)
Confidence Match by IP : 2 (flows)
-Num dissector calls: 1358 (226.33 diss/flow)
+Num dissector calls: 1364 (227.33 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/tinc.pcap.out b/tests/cfgs/default/result/tinc.pcap.out
index 349c1a3ac..f4944ec23 100644
--- a/tests/cfgs/default/result/tinc.pcap.out
+++ b/tests/cfgs/default/result/tinc.pcap.out
@@ -2,7 +2,7 @@ DPI Packets (TCP): 19 (9.50 pkts/flow)
DPI Packets (UDP): 2 (1.00 pkts/flow)
Confidence DPI (cache) : 2 (flows)
Confidence DPI : 2 (flows)
-Num dissector calls: 541 (135.25 diss/flow)
+Num dissector calls: 543 (135.75 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/tls-appdata.pcap.out b/tests/cfgs/default/result/tls-appdata.pcap.out
index c8851199c..dea9bf31b 100644
--- a/tests/cfgs/default/result/tls-appdata.pcap.out
+++ b/tests/cfgs/default/result/tls-appdata.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 17 (8.50 pkts/flow)
Confidence DPI : 2 (flows)
-Num dissector calls: 149 (74.50 diss/flow)
+Num dissector calls: 150 (75.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/tls_certificate_too_long.pcap.out b/tests/cfgs/default/result/tls_certificate_too_long.pcap.out
index 63ade9ccc..873d773d4 100644
--- a/tests/cfgs/default/result/tls_certificate_too_long.pcap.out
+++ b/tests/cfgs/default/result/tls_certificate_too_long.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 1 (flows)
Confidence DPI : 33 (flows)
-Num dissector calls: 648 (18.51 diss/flow)
+Num dissector calls: 651 (18.60 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/tls_false_positives.pcapng.out b/tests/cfgs/default/result/tls_false_positives.pcapng.out
index e0270da73..44cb3e439 100644
--- a/tests/cfgs/default/result/tls_false_positives.pcapng.out
+++ b/tests/cfgs/default/result/tls_false_positives.pcapng.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 13 (13.00 pkts/flow)
Confidence Unknown : 1 (flows)
-Num dissector calls: 266 (266.00 diss/flow)
+Num dissector calls: 267 (267.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/tls_invalid_reads.pcap.out b/tests/cfgs/default/result/tls_invalid_reads.pcap.out
index dba3cca8e..617462e9a 100644
--- a/tests/cfgs/default/result/tls_invalid_reads.pcap.out
+++ b/tests/cfgs/default/result/tls_invalid_reads.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 10 (3.33 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 2 (flows)
-Num dissector calls: 149 (49.67 diss/flow)
+Num dissector calls: 150 (50.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out b/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out
index c88f02ccb..adb6d998d 100644
--- a/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out
+++ b/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 3 (3.00 pkts/flow)
Confidence DPI : 1 (flows)
-Num dissector calls: 148 (148.00 diss/flow)
+Num dissector calls: 149 (149.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/viber.pcap.out b/tests/cfgs/default/result/viber.pcap.out
index 61400fca9..dbf23d1e6 100644
--- a/tests/cfgs/default/result/viber.pcap.out
+++ b/tests/cfgs/default/result/viber.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (1.93 pkts/flow)
DPI Packets (other): 2 (1.00 pkts/flow)
Confidence Match by port : 4 (flows)
Confidence DPI : 25 (flows)
-Num dissector calls: 470 (16.21 diss/flow)
+Num dissector calls: 471 (16.24 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/12/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/vnc.pcap.out b/tests/cfgs/default/result/vnc.pcap.out
index c3dd00703..5453fee24 100644
--- a/tests/cfgs/default/result/vnc.pcap.out
+++ b/tests/cfgs/default/result/vnc.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 10 (5.00 pkts/flow)
Confidence DPI : 2 (flows)
-Num dissector calls: 306 (153.00 diss/flow)
+Num dissector calls: 308 (154.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/wa_video.pcap.out b/tests/cfgs/default/result/wa_video.pcap.out
index c031f2b9c..c14bf1cea 100644
--- a/tests/cfgs/default/result/wa_video.pcap.out
+++ b/tests/cfgs/default/result/wa_video.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 31 (2.38 pkts/flow)
Confidence DPI (cache) : 2 (flows)
Confidence DPI : 11 (flows)
Confidence Match by IP : 1 (flows)
-Num dissector calls: 400 (28.57 diss/flow)
+Num dissector calls: 401 (28.64 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/waze.pcap.out b/tests/cfgs/default/result/waze.pcap.out
index 6ed8d2563..1aaf906e3 100644
--- a/tests/cfgs/default/result/waze.pcap.out
+++ b/tests/cfgs/default/result/waze.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 9 (flows)
Confidence DPI : 23 (flows)
-Num dissector calls: 388 (11.76 diss/flow)
+Num dissector calls: 389 (11.79 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/30/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/wechat.pcap.out b/tests/cfgs/default/result/wechat.pcap.out
index cc9beec71..72387d674 100644
--- a/tests/cfgs/default/result/wechat.pcap.out
+++ b/tests/cfgs/default/result/wechat.pcap.out
@@ -6,7 +6,7 @@ DPI Packets (other): 7 (1.00 pkts/flow)
Confidence Match by port : 24 (flows)
Confidence DPI : 78 (flows)
Confidence Match by IP : 1 (flows)
-Num dissector calls: 330 (3.20 diss/flow)
+Num dissector calls: 331 (3.21 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/75/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/whatsapp.pcap.out b/tests/cfgs/default/result/whatsapp.pcap.out
index cb0e653c2..bb46f1010 100644
--- a/tests/cfgs/default/result/whatsapp.pcap.out
+++ b/tests/cfgs/default/result/whatsapp.pcap.out
@@ -1,6 +1,6 @@
DPI Packets (TCP): 344 (4.00 pkts/flow)
Confidence DPI : 86 (flows)
-Num dissector calls: 14104 (164.00 diss/flow)
+Num dissector calls: 14190 (165.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/whatsapp_login_chat.pcap.out b/tests/cfgs/default/result/whatsapp_login_chat.pcap.out
index 918ad9f38..a8690c1f7 100644
--- a/tests/cfgs/default/result/whatsapp_login_chat.pcap.out
+++ b/tests/cfgs/default/result/whatsapp_login_chat.pcap.out
@@ -1,7 +1,7 @@
DPI Packets (TCP): 17 (5.67 pkts/flow)
DPI Packets (UDP): 7 (1.17 pkts/flow)
Confidence DPI : 9 (flows)
-Num dissector calls: 302 (33.56 diss/flow)
+Num dissector calls: 303 (33.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/whois.pcapng.out b/tests/cfgs/default/result/whois.pcapng.out
index 1b2810ddd..4a37c66c5 100644
--- a/tests/cfgs/default/result/whois.pcapng.out
+++ b/tests/cfgs/default/result/whois.pcapng.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 16 (5.33 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 2 (flows)
-Num dissector calls: 204 (68.00 diss/flow)
+Num dissector calls: 205 (68.33 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/z3950.pcapng.out b/tests/cfgs/default/result/z3950.pcapng.out
index 2aa610a8f..58dc6c9a8 100644
--- a/tests/cfgs/default/result/z3950.pcapng.out
+++ b/tests/cfgs/default/result/z3950.pcapng.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 26 (13.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 1 (flows)
-Num dissector calls: 486 (243.00 diss/flow)
+Num dissector calls: 488 (244.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/default/result/zoom.pcap.out b/tests/cfgs/default/result/zoom.pcap.out
index 5a751ae0f..6885140db 100644
--- a/tests/cfgs/default/result/zoom.pcap.out
+++ b/tests/cfgs/default/result/zoom.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 40 (2.22 pkts/flow)
DPI Packets (other): 2 (1.00 pkts/flow)
Confidence Match by port : 2 (flows)
Confidence DPI : 32 (flows)
-Num dissector calls: 1055 (31.03 diss/flow)
+Num dissector calls: 1057 (31.09 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 8/0/0 (insert/search/found)
diff --git a/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out b/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out
index 9f7213ed0..04811e159 100644
--- a/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out
+++ b/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence DPI (partial cache): 1 (flows)
Confidence DPI : 5 (flows)
-Num dissector calls: 574 (95.67 diss/flow)
+Num dissector calls: 577 (96.17 diss/flow)
LRU cache ookla: 4/1/1 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/disable_protocols/result/soap.pcap.out b/tests/cfgs/disable_protocols/result/soap.pcap.out
index 285131283..4d5cd5aa0 100644
--- a/tests/cfgs/disable_protocols/result/soap.pcap.out
+++ b/tests/cfgs/disable_protocols/result/soap.pcap.out
@@ -3,7 +3,7 @@ Guessed flow protos: 2
DPI Packets (TCP): 20 (6.67 pkts/flow)
Confidence Match by port : 2 (flows)
Confidence DPI : 1 (flows)
-Num dissector calls: 408 (136.00 diss/flow)
+Num dissector calls: 410 (136.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out b/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out
index 29e3df0e2..61bda5648 100644
--- a/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out
+++ b/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
Confidence Unknown : 14 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 177 (flows)
-Num dissector calls: 5052 (25.64 diss/flow)
+Num dissector calls: 5055 (25.66 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/60/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/ip_lists_disable/result/1kxun.pcap.out b/tests/cfgs/ip_lists_disable/result/1kxun.pcap.out
index 0c16d2881..a8ab4537a 100644
--- a/tests/cfgs/ip_lists_disable/result/1kxun.pcap.out
+++ b/tests/cfgs/ip_lists_disable/result/1kxun.pcap.out
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
Confidence Unknown : 14 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 177 (flows)
-Num dissector calls: 5052 (25.64 diss/flow)
+Num dissector calls: 5055 (25.66 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/60/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/stun_mapped_address_disabled/result/teams.pcap.out b/tests/cfgs/stun_mapped_address_disabled/result/teams.pcap.out
index 9cd32752a..a1360937b 100644
--- a/tests/cfgs/stun_mapped_address_disabled/result/teams.pcap.out
+++ b/tests/cfgs/stun_mapped_address_disabled/result/teams.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
Confidence Match by port : 1 (flows)
Confidence DPI (partial) : 5 (flows)
Confidence DPI : 76 (flows)
-Num dissector calls: 535 (6.45 diss/flow)
+Num dissector calls: 536 (6.46 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
diff --git a/windows/nDPI.vcxproj b/windows/nDPI.vcxproj
index 8c4788df3..9fad2cc96 100644
--- a/windows/nDPI.vcxproj
+++ b/windows/nDPI.vcxproj
@@ -373,6 +373,7 @@
<ClCompile Include="..\src\lib\protocols\pfcp.c" />
<ClCompile Include="..\src\lib\protocols\flute.c" />
<ClCompile Include="..\src\lib\protocols\lol_wild_rift.c" />
+ <ClCompile Include="..\src\lib\protocols\teso.c" />
<ClCompile Include="..\src\lib\third_party\src\gcrypt_light.c" />
<ClCompile Include="..\src\lib\third_party\src\libcache.c" />
<ClCompile Include="..\src\lib\third_party\src\libinjection_html5.c" />
diff --git a/windows/nDPI.vcxproj.filters b/windows/nDPI.vcxproj.filters
index a6334312f..0cbbf828c 100644
--- a/windows/nDPI.vcxproj.filters
+++ b/windows/nDPI.vcxproj.filters
@@ -148,6 +148,7 @@
<ClCompile Include="..\src\lib\protocols\pfcp.c" />
<ClCompile Include="..\src\lib\protocols\flute.c" />
<ClCompile Include="..\src\lib\protocols\lol_wild_rift.c" />
+ <ClCompile Include="..\src\lib\protocols\teso.c" />
<ClCompile Include="src\getopt.c" />
<ClCompile Include="src\win-gettimeofday.c" />
<ClCompile Include="..\src\lib\ndpi_analyze.c" />
--
cgit v1.2.3