From d98f9997b17422716cda1c2cbd494aa29743aea7 Mon Sep 17 00:00:00 2001 From: 0xA50C1A1 Date: Sat, 23 Dec 2023 04:24:49 +0300 Subject: [PATCH 1/7] Add IEC62056 (DLMS/COSEM) protocol dissector --- doc/protocols.rst | 9 +++ src/include/ndpi_api.h | 1 + src/include/ndpi_protocol_ids.h | 1 + src/lib/ndpi_analyze.c | 9 +++ src/lib/ndpi_main.c | 7 ++ src/lib/ndpi_private.h | 1 + src/lib/protocols/iec62056.c | 74 ++++++++++++++++++ tests/cfgs/caches_cfg/result/ookla.pcap.out | 2 +- tests/cfgs/caches_cfg/result/teams.pcap.out | 2 +- tests/cfgs/default/pcap/dlms.pcapng | Bin 0 -> 35756 bytes tests/cfgs/default/result/1kxun.pcap.out | 2 +- tests/cfgs/default/result/443-chrome.pcap.out | 2 +- tests/cfgs/default/result/443-opvn.pcap.out | 2 +- tests/cfgs/default/result/4in4tunnel.pcap.out | 2 +- tests/cfgs/default/result/6in6tunnel.pcap.out | 2 +- tests/cfgs/default/result/EAQ.pcap.out | 2 +- .../FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out | 2 +- .../default/result/KakaoTalk_chat.pcap.out | 2 +- .../default/result/KakaoTalk_talk.pcap.out | 2 +- tests/cfgs/default/result/Oscar.pcap.out | 2 +- .../cfgs/default/result/alexa-app.pcapng.out | 2 +- tests/cfgs/default/result/amqp.pcap.out | 2 +- .../default/result/anyconnect-vpn.pcap.out | 2 +- .../result/bittorrent_tcp_miss.pcapng.out | 2 +- tests/cfgs/default/result/cassandra.pcap.out | 2 +- .../default/result/cloudflare-warp.pcap.out | 2 +- tests/cfgs/default/result/collectd.pcap.out | 2 +- .../result/custom_rules_ipv6.pcapng.out | 10 +-- ...om_rules_same-ip_multiple_ports.pcapng.out | 6 +- .../cfgs/default/result/dhcp-fuzz.pcapng.out | 2 +- tests/cfgs/default/result/discord.pcap.out | 2 +- .../default/result/discord_mid_flow.pcap.out | 2 +- tests/cfgs/default/result/dlms.pcapng.out | 26 ++++++ .../dnscrypt-v1-and-resolver-pings.pcap.out | 2 +- .../cfgs/default/result/dnscrypt-v2.pcap.out | 2 +- .../dnscrypt_skype_false_positive.pcapng.out | 2 +- tests/cfgs/default/result/edonkey.pcap.out | 2 +- tests/cfgs/default/result/emotet.pcap.out | 2 +- .../cfgs/default/result/epicgames.pcapng.out | 2 +- tests/cfgs/default/result/fastcgi.pcap.out | 2 +- .../default/result/ftp-start-tls.pcap.out | 2 +- tests/cfgs/default/result/ftp.pcap.out | 2 +- tests/cfgs/default/result/ftp_failed.pcap.out | 2 +- .../result/fuzz-2006-06-26-2594.pcap.out | 2 +- .../result/fuzz-2006-09-29-28586.pcap.out | 2 +- .../result/fuzz-2020-02-16-11740.pcap.out | 2 +- .../default/result/fuzz-2021-10-13.pcap.out | 2 +- tests/cfgs/default/result/gnutella.pcap.out | 2 +- tests/cfgs/default/result/google_ssl.pcap.out | 2 +- .../result/gtp_false_positive.pcapng.out | 2 +- tests/cfgs/default/result/h323.pcap.out | 2 +- .../http_guessed_host_and_guessed.pcapng.out | 2 +- tests/cfgs/default/result/http_ipv6.pcap.out | 2 +- .../default/result/imap-starttls.pcap.out | 2 +- tests/cfgs/default/result/imap.pcap.out | 2 +- tests/cfgs/default/result/imo.pcap.out | 2 +- tests/cfgs/default/result/instagram.pcap.out | 2 +- tests/cfgs/default/result/iphone.pcap.out | 2 +- .../cfgs/default/result/ipv6_in_gtp.pcap.out | 2 +- tests/cfgs/default/result/irc.pcap.out | 2 +- .../default/result/iso9506-1-mms.pcap.out | 2 +- tests/cfgs/default/result/jabber.pcap.out | 2 +- tests/cfgs/default/result/kerberos.pcap.out | 2 +- tests/cfgs/default/result/kontiki.pcap.out | 2 +- .../result/linecall_falsepositve.pcap.out | 2 +- .../result/log4j-webapp-exploit.pcap.out | 2 +- .../default/result/lru_ipv6_caches.pcapng.out | 2 +- tests/cfgs/default/result/memcached.cap.out | 2 +- .../result/mongo_false_positive.pcapng.out | 2 +- tests/cfgs/default/result/mssql_tds.pcap.out | 2 +- .../default/result/mullvad_wireguard.pcap.out | 2 +- .../default/result/nest_log_sink.pcap.out | 2 +- tests/cfgs/default/result/netbios.pcap.out | 2 +- tests/cfgs/default/result/nintendo.pcap.out | 2 +- tests/cfgs/default/result/nntp.pcap.out | 2 +- tests/cfgs/default/result/ookla.pcap.out | 2 +- .../default/result/openvpn-tlscrypt.pcap.out | 2 +- tests/cfgs/default/result/openvpn.pcap.out | 2 +- .../default/result/openvpn_nohmac.pcapng.out | 2 +- .../result/openvpn_nohmac_tcp.pcapng.out | 2 +- tests/cfgs/default/result/oracle12.pcapng.out | 2 +- .../ossfuzz_seed_fake_traces_1.pcapng.out | 2 +- .../ossfuzz_seed_fake_traces_2.pcapng.out | 2 +- .../ossfuzz_seed_fake_traces_4.pcapng.out | 2 +- tests/cfgs/default/result/pgsql.pcap.out | 2 +- tests/cfgs/default/result/pop3.pcap.out | 2 +- tests/cfgs/default/result/pop3_stls.pcap.out | 2 +- tests/cfgs/default/result/pps.pcap.out | 2 +- tests/cfgs/default/result/protobuf.pcap.out | 2 +- tests/cfgs/default/result/protonvpn.pcap.out | 2 +- tests/cfgs/default/result/quic.pcap.out | 2 +- tests/cfgs/default/result/quic_0RTT.pcap.out | 2 +- tests/cfgs/default/result/raknet.pcap.out | 2 +- tests/cfgs/default/result/rdp2.pcap.out | 2 +- .../result/reasm_crash_anon.pcapng.out | 2 +- .../default/result/reasm_segv_anon.pcapng.out | 2 +- tests/cfgs/default/result/riot.pcapng.out | 2 +- tests/cfgs/default/result/rsh.pcap.out | 2 +- tests/cfgs/default/result/rtmp.pcap.out | 2 +- tests/cfgs/default/result/rtp.pcapng.out | 2 +- tests/cfgs/default/result/rx.pcap.out | 2 +- .../cfgs/default/result/s7comm-plus.pcap.out | 2 +- tests/cfgs/default/result/s7comm.pcap.out | 2 +- tests/cfgs/default/result/sflow.pcap.out | 2 +- .../cfgs/default/result/shadowsocks.pcap.out | 2 +- tests/cfgs/default/result/sip.pcap.out | 2 +- .../cfgs/default/result/sip_hello.pcapng.out | 2 +- tests/cfgs/default/result/skinny.pcap.out | 2 +- tests/cfgs/default/result/skype.pcap.out | 2 +- .../default/result/skype_no_unknown.pcap.out | 2 +- tests/cfgs/default/result/skype_udp.pcap.out | 2 +- tests/cfgs/default/result/smb_frags.pcap.out | 2 +- tests/cfgs/default/result/smbv1.pcap.out | 2 +- .../default/result/smtp-starttls.pcap.out | 2 +- tests/cfgs/default/result/smtp.pcap.out | 2 +- tests/cfgs/default/result/soap.pcap.out | 2 +- tests/cfgs/default/result/socks.pcap.out | 2 +- tests/cfgs/default/result/softether.pcap.out | 2 +- .../default/result/starcraft_battle.pcap.out | 2 +- tests/cfgs/default/result/synscan.pcap.out | 4 +- tests/cfgs/default/result/teams.pcap.out | 2 +- tests/cfgs/default/result/teamspeak3.pcap.out | 2 +- tests/cfgs/default/result/teamviewer.pcap.out | 2 +- tests/cfgs/default/result/telegram.pcap.out | 2 +- .../result/telegram_videocall.pcapng.out | 2 +- tests/cfgs/default/result/telnet.pcap.out | 2 +- tests/cfgs/default/result/tftp.pcap.out | 2 +- tests/cfgs/default/result/threema.pcap.out | 2 +- tests/cfgs/default/result/tinc.pcap.out | 2 +- .../cfgs/default/result/tls-appdata.pcap.out | 2 +- .../result/tls_certificate_too_long.pcap.out | 2 +- .../result/tls_false_positives.pcapng.out | 2 +- .../default/result/tls_invalid_reads.pcap.out | 2 +- .../result/tls_missing_ch_frag.pcap.out | 2 +- tests/cfgs/default/result/toca-boca.pcap.out | 2 +- tests/cfgs/default/result/viber.pcap.out | 2 +- tests/cfgs/default/result/vnc.pcap.out | 2 +- tests/cfgs/default/result/wa_video.pcap.out | 2 +- tests/cfgs/default/result/waze.pcap.out | 2 +- tests/cfgs/default/result/webex.pcap.out | 2 +- tests/cfgs/default/result/wechat.pcap.out | 2 +- tests/cfgs/default/result/weibo.pcap.out | 2 +- tests/cfgs/default/result/whatsapp.pcap.out | 2 +- .../result/whatsapp_login_chat.pcap.out | 2 +- tests/cfgs/default/result/whois.pcapng.out | 2 +- tests/cfgs/default/result/wireguard.pcap.out | 2 +- tests/cfgs/default/result/z3950.pcapng.out | 2 +- tests/cfgs/default/result/zoom.pcap.out | 2 +- tests/cfgs/default/result/zoom2.pcap.out | 2 +- tests/cfgs/default/result/zoom_p2p.pcapng.out | 2 +- .../result/ookla.pcap.out | 2 +- .../result/dns_long_domainname.pcap.out | 2 +- .../result/quic-mvfst-27.pcapng.out | 2 +- .../disable_protocols/result/soap.pcap.out | 2 +- .../enable_payload_stat/result/1kxun.pcap.out | 2 +- windows/nDPI.vcxproj | 1 + windows/nDPI.vcxproj.filters | 1 + 157 files changed, 283 insertions(+), 153 deletions(-) create mode 100644 src/lib/protocols/iec62056.c create mode 100644 tests/cfgs/default/pcap/dlms.pcapng create mode 100644 tests/cfgs/default/result/dlms.pcapng.out diff --git a/doc/protocols.rst b/doc/protocols.rst index a1a89115e63..a60c6fc2b61 100644 --- a/doc/protocols.rst +++ b/doc/protocols.rst @@ -408,3 +408,12 @@ Notes: Apache Kafka is a distributed event store and stream-processing platform. References: `Official site `_ and `Github `_. + + +.. _Proto 378: + +`NDPI_PROTOCOL_IEC62056` +============================ +DLMS/COSEM (IEC 62056-4-7) is a protocol used to communicate with water, gas and electricity meters. + +References: `Paid Specs: `_. diff --git a/src/include/ndpi_api.h b/src/include/ndpi_api.h index 080f8d92419..fa845a62642 100644 --- a/src/include/ndpi_api.h +++ b/src/include/ndpi_api.h @@ -1790,6 +1790,7 @@ extern "C" { u_int16_t ndpi_crc16_ccit(const void* data, size_t n_bytes); u_int16_t ndpi_crc16_ccit_false(const void *data, size_t n_bytes); u_int16_t ndpi_crc16_xmodem(const void *data, size_t n_bytes); + u_int16_t ndpi_crc16_x25(const void* data, size_t n_bytes); u_int32_t ndpi_crc32(const void* data, size_t n_bytes); u_int32_t ndpi_nearest_power_of_two(u_int32_t x); diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index a7deb2b641c..f045011b774 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -406,6 +406,7 @@ typedef enum { NDPI_PROTOCOL_JSON_RPC = 375, NDPI_PROTOCOL_WEBDAV = 376, NDPI_PROTOCOL_APACHE_KAFKA = 377, + NDPI_PROTOCOL_IEC62056 = 378, #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" diff --git a/src/lib/ndpi_analyze.c b/src/lib/ndpi_analyze.c index bb0b74fd470..47a6d0fa7f8 100644 --- a/src/lib/ndpi_analyze.c +++ b/src/lib/ndpi_analyze.c @@ -1765,6 +1765,15 @@ u_int16_t ndpi_crc16_xmodem(const void *data, size_t n_bytes) { return __crc16(0, data, n_bytes); } +u_int16_t ndpi_crc16_x25(const void* data, size_t n_bytes) { + u_int16_t crc = 0xFFFF; + u_int8_t* b = (u_int8_t*)data; + while (n_bytes--) { + crc = (crc >> 8) ^ crc16_ccitt_table[(crc ^ *b++) & 0xFF]; + } + return (crc ^ 0xFFFF); +} + /* ********************************************************** */ /* http://home.thep.lu.se/~bjorn/crc/crc32_fast.c */ /* ********************************************************** */ diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index e80cef78e49..ecd33835223 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -2217,6 +2217,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Kafka", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 9092, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IEC62056, + "IEC62056", NDPI_PROTOCOL_CATEGORY_IOT_SCADA, + ndpi_build_default_ports(ports_a, 4059, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_b, 4059, 0, 0, 0, 0) /* UDP */); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main.c" @@ -5723,6 +5727,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* Apache Kafka */ init_kafka_dissector(ndpi_str, &a); + /* IEC 62056 */ + init_iec62056_dissector(ndpi_str, &a); + #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main_init.c" #endif diff --git a/src/lib/ndpi_private.h b/src/lib/ndpi_private.h index a906bc56653..8beffbfc0b5 100644 --- a/src/lib/ndpi_private.h +++ b/src/lib/ndpi_private.h @@ -640,6 +640,7 @@ void init_uftp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int void init_openflow_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_json_rpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_kafka_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); +void init_iec62056_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); #endif diff --git a/src/lib/protocols/iec62056.c b/src/lib/protocols/iec62056.c new file mode 100644 index 00000000000..3ef66c84250 --- /dev/null +++ b/src/lib/protocols/iec62056.c @@ -0,0 +1,74 @@ +/* + * iec62056.c + * + * IEC 62056-4-7 DLMS/COSEM transport layer for IP networks + * + * Copyright (C) 2023 - ntop.org + * Copyright (C) 2023 - V.G + * + * This file is part of nDPI, an open source deep packet inspection + * library based on the OpenDPI and PACE technology by ipoque GmbH + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see . + * + */ + +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_IEC62056 + +#include "ndpi_api.h" +#include "ndpi_private.h" + +static void ndpi_int_iec62056_add_connection(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + NDPI_LOG_INFO(ndpi_struct, "found IEC62056\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, + NDPI_PROTOCOL_IEC62056, NDPI_PROTOCOL_UNKNOWN, + NDPI_CONFIDENCE_DPI); +} + +static void ndpi_search_iec62056(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + struct ndpi_packet_struct const * const packet = &ndpi_struct->packet; + + NDPI_LOG_DBG(ndpi_struct, "search IEC62056\n"); + + if (packet->payload_packet_len > 8 && /* Smallest suitable packet (SNRM request) is 9 bytes long */ + packet->payload[0] == 0x7E && packet->payload[1] == 0xA0 && /* HDLC frame start */ + packet->payload[packet->payload_packet_len-1] == 0x7E) /* HDLC frame end */ + { + u_int16_t fcs = ndpi_crc16_x25(&packet->payload[1], packet->payload_packet_len-4); + if (fcs == get_u_int16_t(packet->payload, packet->payload_packet_len-3)) { + ndpi_int_iec62056_add_connection(ndpi_struct, flow); + return; + } + } + + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); +} + +void init_iec62056_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id) +{ + ndpi_set_bitmask_protocol_detection("IEC62056", ndpi_struct, *id, + NDPI_PROTOCOL_IEC62056, + ndpi_search_iec62056, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + + *id += 1; +} diff --git a/tests/cfgs/caches_cfg/result/ookla.pcap.out b/tests/cfgs/caches_cfg/result/ookla.pcap.out index 3c76e701c40..bb8d44e242e 100644 --- a/tests/cfgs/caches_cfg/result/ookla.pcap.out +++ b/tests/cfgs/caches_cfg/result/ookla.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 40 (6.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 543 (90.50 diss/flow) +Num dissector calls: 546 (91.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/caches_cfg/result/teams.pcap.out b/tests/cfgs/caches_cfg/result/teams.pcap.out index ee624330ac4..8e99536a472 100644 --- a/tests/cfgs/caches_cfg/result/teams.pcap.out +++ b/tests/cfgs/caches_cfg/result/teams.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 80 (flows) -Num dissector calls: 526 (6.34 diss/flow) +Num dissector calls: 528 (6.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/pcap/dlms.pcapng b/tests/cfgs/default/pcap/dlms.pcapng new file mode 100644 index 0000000000000000000000000000000000000000..786a3d04e5b34a80746da97f5811208355315f68 GIT binary patch literal 35756 zcmd6w34Bf0`u_JhCo?LEAc{zoiXmx&8fvJS7)zCkDM-viM2zK#p;fA_sXCyI)>TDO zHB%Qg6GCtlyLZ+;d!KzyyZ*QT`{}-SIVYld_WOO_wf4K#+WRD^ zSh1i9ilTIASp88OUJJCtp_EqI4;eXjLS*gO_*$`XF}3Q%3`!Z9k~U<3;-l14T8tf$ zI-p-_WOVl-X(?j{_e&dAHL_-G&Dc7T(XEH1M|MdW7x~=CVIxP49~n6?ZPbX!vFaC9 zA)$~SX|>T_75qfI;-`!so?3TIoT3EcyMg##Q7`9!Z}Wfehu2j40!ODu%9rdHd~Z)j zyr;IP{A1fQ|1qGAZ zD~jF6cazQG@U__jf*SqM`!;>g$4-Be4(Sc2FL03F>L>5-X^Z#NR3%lF^%`n=JxPl+ zi=R8aE;qh>M`$j{3>_W$bEc~2V-E=0d0}z{=|S6H)gY~8G&)GjRx4z0GrXtf7F%si zYk(=X1<>o15gc4HV=SnvG5tYW>d!XE6MZgpZ#(>aYHk{hG>t?{jqu=-?Q0k{oSFWP zsD;ICPG)9~Cw_7X5sw?Y+C6TOSG`A@*mVNCB^klWmDiW4T8O0rxc#BWGZW`d2Qhnm zYU#cG@t&HSM%Ny{vc@x(8sW;7qZf=C&di7?$C%G2P0I-NwPpC(GW>n;b8P|q=d%r* zibC4vIPFi@6LGpR_2k;h0QYz63hou*?Hy-k-6%)g z@X6nOuk@?xaz5`n>^9{C-{tf|=N2H&45#ORX{D3T$?Qkg(O&X?9EKmO;791xZv?A* z@S~#cM+Rc0gW?~#J7sTgyr<^oM<>mXHYPt*jqu>mTCI&5&df57sG6g`h97%udzIpf z5{;qSuFQWHDW_zhQH)p7=pg;MOUCWphxgRn_;2d*8}aY;lZpQ-@V`R*kHBQg2gLU{ z_}_D`az;72%$*JX`|W#4!=_Ak{9-F*_X$;shu8xl&u3(}6|p;t+e$eUyx7$jhx+29 zzWAyye(HPr#4*!=AFxor_7#b);LPR?R^AFt%bM?}NNN2azAj2}>( zx{t2oyKl!g<;O!+BRu$#HiC2JgAJzMM8Desx85gr`WGRLUFo{cVXz}mB>FYfZ@*&poL z4U=co&weA%&a4uiRfA^*?AhWKfha;k6`N{FHPsTk(Gr{fPtaHG?3$N+PRx z%=O^erp_1TJ^L*;z5?|#KWEKCo_%ca4B=RLwr%%CdCydh@L<0NM~xcn+5GYqtv&nY z?j>)Y-C@tJ8$GK){p=xmwyu)!ET+*9eQfO6wy!ZN+Ww3%jPm$T9OSmmR#e>~M358)a0Gy9Ye1y3J%7Gv#Mu{I_4 zN!N<1MtHEjeq*Bsd-h2MhqY%jwuJ5Tay`4tp8dz<8TwhCKY4b2u<$Gnp82q6dB>;G zG~{m??{Jy=YvZhci1Oo49z0vMteLcDdH%Wak?3c|A5JMRc>2M!IBUL0LQ)-z2b zJXmR5OK1d;27C5JnIvn^s?P}8@5Qrw?AbM=XOZYR^jHlJddN{DWr?^x)ZVN|pVx{VXpSo}r%=&!5~) z@T^R6T6Q)|zDPmlKI*?sox2a{*i&&rTzjZdmth~-&$ zR+&AExN76k%hDJ1I#xoZANDu(M!q)smcHo0Gh1vcdC$t^#z#><%YWgB;8}&@wD#=T z9j)X&Q#IgO(;h|*_AI0%<}+4xW8=1Mym^+-o_%lhEQh9-QihP zXJ$Xl&u+gDitdvxwTqRqaD7J)}i$fNleg-1Q$QFZQDn2)J*Xe!9< z%5>X@?lrkfkylprz^;yqg`LEUY1P&Lpp1D!(EAGy{pywKAISUH1pd9k{^|8V4E)2W zWmVf>nz~ZHU#S{27Pb)nu?F`mkMps#&p-6$Spj=?)#TYL@GOBmD~Xj?ZQY|MJd0t^ zFdySy#r??VOO-I}Q#{S5s_{RuX+vj_Hndr~hQIWzH+~+2) z6g;1RXFaVwyMI4R-ZNDLp4ENIsKK6joR2Mu&-UV3BKPlJSB#!LM*XY{dDc}M+Yw72 zc=iN)hWQxKx~wPJ9EOTdT?s+m7tLPzmkH#$&tKXr*C|k{$<*$vZpT+P?ztskvRh7AM-MpY>Ku zo>4#RNuKRpr)nXVBzP9@%uI@MZ7R1J9Yg*G065o_=|@K-G-YU{ub zb-lo$RKcuSUkA=0aU7)oRkL8B@8(mdL_7P`%H-3J@M#?R6n94W)Su1)`caPj@}21# zhIMGW-IsJil*b--)la6s#6kMkZdR3NJT5oBQUDkiOc)^;*9PPM){F;bcM>tW)dwEd z+VfNmFy7qWsKJcy)c-_dj0kBU_fh&cca1TFBUEGT9Q~Zow_xmG#x0GED+Pe@d}7?8 zu3$U}jB7LF2-_QfopJdpugWu?55|u%W329IwQ+qg9%Rip@0(XejDMN2ssY9+Q;izT z_|eK^jf?}7egAP~JlTcu2Xp2hKzX51b7R~t(T5q+eu~R}Ql-bhcr7t5T~;t22FCTB znI*BGlyFpIOantum93;rn&xq$aq32SzH7nvDdIc+HxYXS@WpJL`Uh!bpwU77Bzobe z@_bbd@Qv(e)L_01L*k8m1C>XAb>-_?W5+ewcA&7vcH^6n=*xT)OnjdL-$TT=?q$Ju z1o$>Ujg9%pp}iVktYy#1)N5?l@nO+}ujJVt0$c29gY8}scO$UHXko>+%jC22Y*h`g z?Tr;{t$(lvv+d(MT4U?4u0}bOx$|7vE>*2%Z~y)D~rUR zLu`j15^Ph!wvjWlPLw14k7SK4W(%|$Ojk}D#;M}=P!y*48%N=4GXKq20XR82Cv$F( z>~&9`|2N=23;Z9BA1c^94gRUt{I9ok9F)EWsv6+`bF@)|`KM0YuJJFeZdwH>S+o?+ zeTrgq&F!V1`5*L>+y2bIwTb^M@P9!3v$XXy#FqyCPjhZBzS&gd_Jrddt#fsIXv*F;oh4_wpAow-|-*juf*OHq`^VKxKw+*mqV+U(6-%XwC8~J+M#~)C&^TBLY;@~m%3;n_rZ)`C65zQ}!)})X!RyXY;i^Zp88e#l)Ur z-$UP|R}_>H9yfn^s~?wd^Rk`3?xfxgKx;~W_ET&g_wgq*c~9Q6mbvkdb3Yr~TJUU5 zaawz}Ytwu3o~at}?5Wd64ff3AzQ=~Z<=#9i%ATDzdiFT=vySB1x1Wf9HW{9^X3wzi zfxrC|pU5bW|KxAp$FFj8yS!%|;TiX{^j(5y8+e9`XkmTqIyUa?wL{)BRRf;Y!;q?7 z<5+_|Gwgd@Mbgqiz*55h5K1LcJ4Kv3GfURgq3F*#V^WxrfR^mMkq^NHP|zc_obanyX4KYN7%DdM$f8H zKT9Idh9K2Q3$aXtX9?^X_Cfwx`}nn6{VwlW5>2HYc)XWWz1010_whFclstq) zR;anvbRO<;Iy)pcKAQX47_H7id>!D~3~SG(O(=Otx^7f8;8~o$M$8)Qna6z)$C*-x z_8}H(7PWpbdv?<3Sv2*tH1cdAc5<|SHj`pv&#(`o?pNWOMVGAq`o_-xb|3#g^IFJz zmIlwbpQUN@8N}BSp3SuO>{Mb)dCyc0coth;^fT6A&kXw@v=2@PUC&Pc-ue*j;Zt+- z?9Idw_Uxv~GwNqAkY|x&g=e!UCf>)-+qBwpuTbq`|DX2pGbZ$t_vMA$_^M^7o=?;F zr#i!zS-LN->o7Bu`X4G>hjHt#35r6j%=`FfRSozOzCrlH8oZDH)%AbTT-y6S{-*B3 zy!ES4_UH?vM^($fqj}^}o7KXjIq;}6_bbfD)HyU2yG zo`rwtWmYxE-G%ey`<1FeW8p&KA8T;G@;D!h?XbX`XC>IP9Fu2n!?U-^v*TX~&*s9j zXW28l4~_1Q;ePZ_*vId8?EM;56`;uK7N-@yZ^WQ_)CW6%X_j0p4_LgZ`5tUs|P%puX~aK zCUg*|teg3VWcM)6sv7WQWxi2^*MXm}6=qxqb|?w-sFRX`Mr+-)=1m9b9~z|`MuDeL zbMvV~Vkz>ecWqPOx(}ZYl24JRgij0MQx9imY3w0Y_(NM~x7$M$Y#TMe1B|3;UT0rY zt^8rCv8lOTw>{O_2Xo`AhkxzT($g9+u{-YJl%&mxV@e z(qO)m9xG+!>!URFcjf!CD$n|}rnWttg0HE$@$H^in)y~W@~s{QzL$ybu!e%~Tj1N< znHd%3SUjwDAz$3}&xGlP{@0}(od@ZgS$EAGCeQjZSl0#Xhoi;_4t>GlEo;^pRffy6 zRyDwS*tbRvX1%oRA|q>G&$!%dq(}Z9;16w{CrT1Qaa=RA$U|WP+3&dY03J7EicQn&IjvW%sN(Z=m*wItXc1U zeYQMnRRgRm4m4^o>)k~b8(I4)ztr}`I<4I6-txK(v#w%d-RoSpbES#(7uN*qWnkTp z^E%J5OFpl&-&!xt`dn$So=U7o-VhuHfb}wK)-TW5AkA9S0PAUbeaaflI%iBdBWr)9 zYK$vu*D?CLdYiqC(T_6gI1}rsU|o|~uk#VC-vjFbJVxjDEznp8`nDdMHgIJ%apro!FDjQ%~&khegL+Em~GtPWrew`v@PX*=LUoA9%kE7 z#61{nKd@#SSS;j-Y;B=wfbEobjT+3hPP=!FY=e}}%MhZd-CWt;C{^-^m%J^{Y-^g> z?g85w#P%aBH)%EYO0XTwY`aW8ud%f$bH4V#_T0PG<=M^v+gxV*sEB(g*sio@`~9Js z@@!QNuf$2G?3u1?UB}!FAJ;jO2=3I}#)S5X5zIEm#5Naf-zB!EvFfX_ zT?Mv7otdRj7q7Ukv8B2=NNG=dFr;Z77h1gBQJ(L+;CqAkj<_OX9}d2&toaVT)lr_W zssX+;kcQfPlQo#HUKeBWigu-K%B0nv`0i-kpJgPy(#_3K(M9e#`pQeNakC?$hU?c_~sJdcPj|K zYr%JfGqWOU;k+}2<8E;4F3-n5`DE?d%Js%$W=_S&6upBJv6^>$+vHVw*12F^4XhuI z7$P`~0_(NbtapXJCeK>c0P9CP8#S1J&HH>1cn_m|9u2E9({uI2^IG-bS@Mrw+*sPvFmm-$=Y@1~} zDqFXmuMEB~Qa%p{Q7zZf!56a+E53a?mN+U~w`m&S`_)pT2J_WxVvVm|DTUPmy>4^m zo42Oa(H{67HMe|jmsrViym%3O`T5Vm7zMT3Vhi}DyFGJYo3gqC-Ii@xTO513nLJ-S zGg*W09UiV<_s4_p7Hhs0sy3JBt7?F6-I0PXYcOBEE@r+qjK>FjJn@aF(fVjF#81tQ zZ^y*S%(s$hyuiJ~=lL13qMr%AJHU55=WmxUZTfhO0ohhCC)6^3uYNl~o-dxuszLkE z1;ZPP*e8MS4r{(wHzv#TRW-nOV5(7r`RcW?#@DWV9P5d1(q}`x+=Wz2NKQ{M{C~PvoysZ^6vdp7J+w>v?&;cpj_9L+1O2 zhuU-#VR}}gb0GrY+*%RM)+THM$zg3xUq$z(Nf-gVw z^~E?jzZ> zd?$Zy)L_1PJ*@GyD~<8=k9GY}c6g;@UaoJ|n6GJW7ZVP?{M=V@AHnx9_|9a$`71k! z>zle2*I?i%?96B__K54dIc5cZ&Ckm9HIWfvEfR= zekCmoCqdf8fLPE$44(aIy)@?wc*ZMcICEYu7`zJ3+18wY_-cbRXH5f~n=UYFFlW6E z);K$qZH8y`UDt=Z)ZTKe@V+=V&IySz%sI-$c{n)pGhX+q3C>@F^Q)$3Z-W(OCn|8# zGqYVhEJvO#o{5T?#%za+xL*g`FRj`3-IOcOR@DI8q)A2%W~Jnb39TC$x6w)~7p3YIdoIb1H-zRqj!>22QDayUdO+W~oN#db#s@R|I;q6GzkHh=y&`u)ncA9xra7R|0I&l&e;$809f zL+%I$i@+IAAJN!j9)~-Rt|re})d1(pVMYz+tk=OBXJ}6G#JSJEW4&>XW6mW^oHv8> zOj_ruRZMWs1LsA|d0RQV7>5fA9D?)o1s*teezBcA=b7MqiaBo+3>JfPo;ByMliJI3 zRyDx6=V7A;bJpu&jkCY^~5P~evdd$S}Zu91Lws& zR^&B2rExBrkG$?t$%* zgYU|--2t`_n5|aBKywM$UbJR=V9ZK+wyFl$h6D-!ScBQR)xm+v;fJ2s-m9?I8{1mU zww#IW1F$_sY`?uG*nUHCGTXm)UxeeBJlj*b@v$Myww#E28Q6Yf&34!i*~j~$&rox_ z_YgZm6x&w%{34gn{=1-RfNkH8jT+9(vW}>*7s4#6A7uU{pR=k4xL*EUaAgh7S+|R;H@I=OtAgV zn(feTVOdG=m6}`5cF}T{J`c(zXEhD5U5}oit!=P|Gqao{>iOhJ#+-F1!3Fyha-A8_ zp!{*o+3YjnSzdCs4zn$591mh~f8|B~Y|&aT3AWe3Hj{HUy>X`ZoZVKjfjn1yMrUjS zbDb_?eji+s!B%xxhoTL$Wb56Fss^|Y(!FC1&RMs5*V{ZTZbp-=?qE&LZ7fJgtjk)6cSAZ>cHVfI#L>zR` zIF~rRe^!6Ir{K)ylxI5-Y*U$SX%Y8Iu>DDA zn}PV~Ahw&on<<~Sss`9bB^fn1Z}qxXu=Tu;xzT@imY03Z`pnfde~3*5*J;FcPKe<8 zGq|qgb@aUQ)3w@*EzRjfwaH{O`jYaC4vKwpr_J(wr-3hhzEr^=eGO|B_@WB5%H2t) zH_PX)ssX-1R|Q|z;M~pW(#|z^@o^6nnSE=u_dMk8g9h8Zm&cb63>>+bLN7 z)~;o&VXAF8cZsd%J)nq<7ro_f1LhiH8WZq*(#2iGwbgvV^>=Vx!?_#rWZ~SGExpU1 zIcSx;*EZgf=erAhH!$Bc5&OsBi;Af*cU}2zs(e?Tuc`sQ562ian6JLZi_xhRuc4nZ zJoiGe(n0-m>5cp>nB-{>z9I81X5za6d`}bKCEDBt@!bL6k9iF}?qE}GY@qx5=mh-c zTCSl_DIb2K8MLXnU2|$H>NUso`|K{B2H&I1_bCzkI?}i1`^=Y7C!}izRRer0-7;!0 zU%k%N_}Z1v49^6(&U^hsDxK(t_^7$n3~dq{G2c)V-=pBm^M{BLsy^bo2fph}b#5u& z-LyDIdggJr-CGUh*;0Lff!S*JZ9;PcX;}YU40Nahsc5&C<+PDznneD8(FUhlw&W(S9@A(~=DdOHl+SY7)|NN3XTU7&W zpFd*MV7B^tuEy3^*^J+cqwfp5vb|j}`$TtqkDA++QLHh(D3wmI0A<-FDRd$y3aHQV(1o8;N58eseM zEWwsFn5|yxYHabSUD>|UbDKA|O_{CfdiF$FulK-kIN)I^R=w(XuoXPI^ohp zux-g~@e{QgbSG(BvwiM;ziin$LDK-++g}?sn618stFiU=8MQO4CvyE7vAlQ2RjM~rIR+eYG2y7FHZORD|_b#vvv}Sv9Yh`)1 zss`9@dc>%~Y~5MNvCi8Ljhf4|T@SYSy}w}lj);3VX&|A*7 zwj2)@pX+wnkJz>^E7*pD?LN-g#TDuE*uCUzi?wT{xnA}ISNi>B1<9BtXgRwdTruWY z@x*0^84+?NJf;0k93TX1gsRCtG$O^0KM{woP!isOBGQ@IK`3DfIi*X&+J> zXYnkGtt)oWGccZ-$Ju37bG_wkg5`Md8Q3-^wiSO6Y)gaf0nXXHwl}=z?6k^v<+(Nn z*KFqcril3OviFL zvNf%y0k*rJ6#lUWv(;EbnxZ-K9Z}7*pGp4IcvUcw>OdJt7?Gn2%Rr$Fkii{ z)%e<#ao1e=y3WV?G;W^bC3o9%?wWpwnG1v)d1V(r;QrSR$sT(*gBMTKfAJZ&E1I)Q*ylQ znRVdYEimS89PazLyqehV)W?NLu+8Fqhc3MfpJnwcYFo8uWg2OdCXMyPfDWpu5C1qr zp6_b#rQc6mFkp{}JsW%@b-pi?01nc)`qa!E6sZa|w|PUNqOQF+LVPawC|p)Gz&B3k z%NopAuWvQJdvIyf-uf!@);mex9BW|v7e%aY^WNHt9XW?fnmFTk*Iv%a2vM%2>FYHW z!P({hZdabU7nTbRw^(ayv6}W7F6V$}Rs1e=WxyiA^9%5-sPoJ~JaiDx`gtG8=c}p# zo&i&g8q8C#y)=k^N~zae^YwXEp7qC!Se=85p+e1#WAyAViDS$%6Gx14it>yP2w<+M zDD?BlA1r3@L2=cXwk~HYzM|&F?jx1mmY+;{a-G?g!RJq0wTMe!&(q@aS5CZ%$Fs^f zqV!9*_N@TLFHHTG+m$C!xll~~mfN5iq-?2zZ}~f-o^>2@ay%55E3cjY>%H+h$-I{S zIWJ%Q+~H_+d@{&axq0)~-8QA1(tOm|k?AREVbe_~|v*b%7%`lZ@& h;~D+i4*er{JGA$H`0sr1J^~k2I(+HoG?#-k{tvH2o6-OP literal 0 HcmV?d00001 diff --git a/tests/cfgs/default/result/1kxun.pcap.out b/tests/cfgs/default/result/1kxun.pcap.out index 3a874189fa8..afda1d371fb 100644 --- a/tests/cfgs/default/result/1kxun.pcap.out +++ b/tests/cfgs/default/result/1kxun.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow) Confidence Unknown : 14 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 177 (flows) -Num dissector calls: 4756 (24.14 diss/flow) +Num dissector calls: 4773 (24.23 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/60/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/443-chrome.pcap.out b/tests/cfgs/default/result/443-chrome.pcap.out index ef0dccfbe06..5f83c040142 100644 --- a/tests/cfgs/default/result/443-chrome.pcap.out +++ b/tests/cfgs/default/result/443-chrome.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 134 (134.00 diss/flow) +Num dissector calls: 135 (135.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/443-opvn.pcap.out b/tests/cfgs/default/result/443-opvn.pcap.out index aeee7001646..e6145b1a52f 100644 --- a/tests/cfgs/default/result/443-opvn.pcap.out +++ b/tests/cfgs/default/result/443-opvn.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 135 (135.00 diss/flow) +Num dissector calls: 136 (136.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/4in4tunnel.pcap.out b/tests/cfgs/default/result/4in4tunnel.pcap.out index 1c0b3490854..d35393fcdf1 100644 --- a/tests/cfgs/default/result/4in4tunnel.pcap.out +++ b/tests/cfgs/default/result/4in4tunnel.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 5 (5.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 189 (189.00 diss/flow) +Num dissector calls: 190 (190.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/6in6tunnel.pcap.out b/tests/cfgs/default/result/6in6tunnel.pcap.out index 25ed3b9d0a0..f2893e63629 100644 --- a/tests/cfgs/default/result/6in6tunnel.pcap.out +++ b/tests/cfgs/default/result/6in6tunnel.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 138 (138.00 diss/flow) +Num dissector calls: 139 (139.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/EAQ.pcap.out b/tests/cfgs/default/result/EAQ.pcap.out index 24736c7e111..4a38dfe5744 100644 --- a/tests/cfgs/default/result/EAQ.pcap.out +++ b/tests/cfgs/default/result/EAQ.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 12 (6.00 pkts/flow) DPI Packets (UDP): 116 (4.00 pkts/flow) Confidence DPI : 31 (flows) -Num dissector calls: 4689 (151.26 diss/flow) +Num dissector calls: 4718 (152.19 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out b/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out index ffe65dfa266..364bdf50498 100644 --- a/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out +++ b/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 7 (1.40 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 147 (29.40 diss/flow) +Num dissector calls: 148 (29.60 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/KakaoTalk_chat.pcap.out b/tests/cfgs/default/result/KakaoTalk_chat.pcap.out index b5e2edcd074..60c29cb27d4 100644 --- a/tests/cfgs/default/result/KakaoTalk_chat.pcap.out +++ b/tests/cfgs/default/result/KakaoTalk_chat.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 5 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 569 (14.97 diss/flow) +Num dissector calls: 571 (15.03 diss/flow) LRU cache ookla: 0/1/0 (insert/search/found) LRU cache bittorrent: 0/15/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/KakaoTalk_talk.pcap.out b/tests/cfgs/default/result/KakaoTalk_talk.pcap.out index 784327c2de2..43b1615f6a7 100644 --- a/tests/cfgs/default/result/KakaoTalk_talk.pcap.out +++ b/tests/cfgs/default/result/KakaoTalk_talk.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 10 (2.00 pkts/flow) Confidence Match by port : 8 (flows) Confidence DPI : 11 (flows) Confidence Match by IP : 1 (flows) -Num dissector calls: 1163 (58.15 diss/flow) +Num dissector calls: 1169 (58.45 diss/flow) LRU cache ookla: 0/2/0 (insert/search/found) LRU cache bittorrent: 0/27/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/Oscar.pcap.out b/tests/cfgs/default/result/Oscar.pcap.out index e094daf5b04..5c274d2677c 100644 --- a/tests/cfgs/default/result/Oscar.pcap.out +++ b/tests/cfgs/default/result/Oscar.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 21 (21.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 264 (264.00 diss/flow) +Num dissector calls: 265 (265.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/alexa-app.pcapng.out b/tests/cfgs/default/result/alexa-app.pcapng.out index 8ddd3263d47..513772060bf 100644 --- a/tests/cfgs/default/result/alexa-app.pcapng.out +++ b/tests/cfgs/default/result/alexa-app.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow) DPI Packets (other): 6 (1.00 pkts/flow) Confidence Match by port : 14 (flows) Confidence DPI : 146 (flows) -Num dissector calls: 529 (3.31 diss/flow) +Num dissector calls: 530 (3.31 diss/flow) LRU cache ookla: 0/5/0 (insert/search/found) LRU cache bittorrent: 0/42/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/amqp.pcap.out b/tests/cfgs/default/result/amqp.pcap.out index c99cc8c93c2..922d82ce1e2 100644 --- a/tests/cfgs/default/result/amqp.pcap.out +++ b/tests/cfgs/default/result/amqp.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 9 (3.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 383 (127.67 diss/flow) +Num dissector calls: 384 (128.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/anyconnect-vpn.pcap.out b/tests/cfgs/default/result/anyconnect-vpn.pcap.out index 75ee7d45095..10dc53f1f6b 100644 --- a/tests/cfgs/default/result/anyconnect-vpn.pcap.out +++ b/tests/cfgs/default/result/anyconnect-vpn.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 61 (flows) -Num dissector calls: 862 (12.49 diss/flow) +Num dissector calls: 864 (12.52 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/24/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out b/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out index 4de0b1b30a4..7fffea6c5dd 100644 --- a/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out +++ b/tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 239 (239.00 diss/flow) +Num dissector calls: 240 (240.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 5/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/cassandra.pcap.out b/tests/cfgs/default/result/cassandra.pcap.out index de7c31b5b3e..19188930647 100644 --- a/tests/cfgs/default/result/cassandra.pcap.out +++ b/tests/cfgs/default/result/cassandra.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 16 (8.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 322 (161.00 diss/flow) +Num dissector calls: 324 (162.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/cloudflare-warp.pcap.out b/tests/cfgs/default/result/cloudflare-warp.pcap.out index fb4d5476093..83ccd218e41 100644 --- a/tests/cfgs/default/result/cloudflare-warp.pcap.out +++ b/tests/cfgs/default/result/cloudflare-warp.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow) Confidence Match by port : 2 (flows) Confidence DPI : 5 (flows) Confidence Match by IP : 1 (flows) -Num dissector calls: 193 (24.12 diss/flow) +Num dissector calls: 194 (24.25 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/collectd.pcap.out b/tests/cfgs/default/result/collectd.pcap.out index 7d2786b9158..017eaf7f8e7 100644 --- a/tests/cfgs/default/result/collectd.pcap.out +++ b/tests/cfgs/default/result/collectd.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 13 (1.62 pkts/flow) Confidence Match by port : 3 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 444 (55.50 diss/flow) +Num dissector calls: 447 (55.88 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/custom_rules_ipv6.pcapng.out b/tests/cfgs/default/result/custom_rules_ipv6.pcapng.out index 1247a0b8342..3756194c10f 100644 --- a/tests/cfgs/default/result/custom_rules_ipv6.pcapng.out +++ b/tests/cfgs/default/result/custom_rules_ipv6.pcapng.out @@ -27,8 +27,8 @@ CustomProtocolF 1 1287 1 CustomProtocolG 1 318 1 CustomProtocolH 1 318 1 - 1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 388/CustomProtocolE][IP: 388/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0] - 2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 389/CustomProtocolF][IP: 389/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0] - 3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 387/CustomProtocolD][IP: 387/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 390/CustomProtocolG][IP: 390/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 391/CustomProtocolH][IP: 391/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 389/CustomProtocolE][IP: 389/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0] + 2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 390/CustomProtocolF][IP: 390/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0] + 3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 388/CustomProtocolD][IP: 388/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 391/CustomProtocolG][IP: 391/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 392/CustomProtocolH][IP: 392/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out b/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out index 3122e4dabdd..2e5c65cc0d0 100644 --- a/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out +++ b/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out @@ -25,6 +25,6 @@ CustomProtocolA 3 222 1 CustomProtocolB 2 148 1 Unknown 3 222 1 - 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.384/TLS.CustomProtocolA][IP: 384/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 386/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 385/CustomProtocolB][IP: 385/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.385/TLS.CustomProtocolA][IP: 385/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 387/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 386/CustomProtocolB][IP: 386/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dhcp-fuzz.pcapng.out b/tests/cfgs/default/result/dhcp-fuzz.pcapng.out index 945b0a627ab..8ade808c97d 100644 --- a/tests/cfgs/default/result/dhcp-fuzz.pcapng.out +++ b/tests/cfgs/default/result/dhcp-fuzz.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 124 (124.00 diss/flow) +Num dissector calls: 125 (125.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/discord.pcap.out b/tests/cfgs/default/result/discord.pcap.out index da723c38a85..6b42286b642 100644 --- a/tests/cfgs/default/result/discord.pcap.out +++ b/tests/cfgs/default/result/discord.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 5 (5.00 pkts/flow) DPI Packets (UDP): 60 (1.82 pkts/flow) Confidence DPI : 34 (flows) -Num dissector calls: 4378 (128.76 diss/flow) +Num dissector calls: 4405 (129.56 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/discord_mid_flow.pcap.out b/tests/cfgs/default/result/discord_mid_flow.pcap.out index 825314e1b78..b3ee88f8d07 100644 --- a/tests/cfgs/default/result/discord_mid_flow.pcap.out +++ b/tests/cfgs/default/result/discord_mid_flow.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 159 (159.00 diss/flow) +Num dissector calls: 160 (160.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/dlms.pcapng.out b/tests/cfgs/default/result/dlms.pcapng.out new file mode 100644 index 00000000000..943384cf100 --- /dev/null +++ b/tests/cfgs/default/result/dlms.pcapng.out @@ -0,0 +1,26 @@ +DPI Packets (TCP): 4 (4.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 135 (135.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 0/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 2/0 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +IEC62056 284 25819 1 + + 1 TCP 192.168.1.4:55214 <-> 192.168.1.12:4060 [proto: 378/IEC62056][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: IoT-Scada/31][188 pkts/14674 bytes <-> 96 pkts/11145 bytes][Goodput ratio: 15/43][0.26 sec][bytes ratio: 0.137 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 1/3 29/32 2/4][Pkt Len c2s/s2c min/avg/max/stddev: 66/54 78/116 183/194 15/46][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Plen Bins: 76,8,0,2,13,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/dnscrypt-v1-and-resolver-pings.pcap.out b/tests/cfgs/default/result/dnscrypt-v1-and-resolver-pings.pcap.out index 8ed029a4def..92ff7d16ab8 100644 --- a/tests/cfgs/default/result/dnscrypt-v1-and-resolver-pings.pcap.out +++ b/tests/cfgs/default/result/dnscrypt-v1-and-resolver-pings.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 256 (1.04 pkts/flow) Confidence DPI : 245 (flows) -Num dissector calls: 20485 (83.61 diss/flow) +Num dissector calls: 20496 (83.66 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/513/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/dnscrypt-v2.pcap.out b/tests/cfgs/default/result/dnscrypt-v2.pcap.out index d5ce672494c..cc07bc02037 100644 --- a/tests/cfgs/default/result/dnscrypt-v2.pcap.out +++ b/tests/cfgs/default/result/dnscrypt-v2.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 6 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 417 (139.00 diss/flow) +Num dissector calls: 420 (140.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/dnscrypt_skype_false_positive.pcapng.out b/tests/cfgs/default/result/dnscrypt_skype_false_positive.pcapng.out index 5d8ffc8dd31..523f04061c7 100644 --- a/tests/cfgs/default/result/dnscrypt_skype_false_positive.pcapng.out +++ b/tests/cfgs/default/result/dnscrypt_skype_false_positive.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 140 (140.00 diss/flow) +Num dissector calls: 141 (141.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/edonkey.pcap.out b/tests/cfgs/default/result/edonkey.pcap.out index 0d4062945d1..57ab8721314 100644 --- a/tests/cfgs/default/result/edonkey.pcap.out +++ b/tests/cfgs/default/result/edonkey.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 137 (137.00 diss/flow) +Num dissector calls: 138 (138.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/emotet.pcap.out b/tests/cfgs/default/result/emotet.pcap.out index 5b95f8452a2..d12cdefaaad 100644 --- a/tests/cfgs/default/result/emotet.pcap.out +++ b/tests/cfgs/default/result/emotet.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 48 (8.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 207 (34.50 diss/flow) +Num dissector calls: 208 (34.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/epicgames.pcapng.out b/tests/cfgs/default/result/epicgames.pcapng.out index b19de141acc..bdf478625a8 100644 --- a/tests/cfgs/default/result/epicgames.pcapng.out +++ b/tests/cfgs/default/result/epicgames.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 12 (3.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 646 (161.50 diss/flow) +Num dissector calls: 650 (162.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/fastcgi.pcap.out b/tests/cfgs/default/result/fastcgi.pcap.out index 5a51b7ae471..6b236f22368 100644 --- a/tests/cfgs/default/result/fastcgi.pcap.out +++ b/tests/cfgs/default/result/fastcgi.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 161 (161.00 diss/flow) +Num dissector calls: 162 (162.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/ftp-start-tls.pcap.out b/tests/cfgs/default/result/ftp-start-tls.pcap.out index 62db07db3eb..5cd781b46ea 100644 --- a/tests/cfgs/default/result/ftp-start-tls.pcap.out +++ b/tests/cfgs/default/result/ftp-start-tls.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 17 (17.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 163 (163.00 diss/flow) +Num dissector calls: 164 (164.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/ftp.pcap.out b/tests/cfgs/default/result/ftp.pcap.out index 2c1166cbb26..ad82517e9d7 100644 --- a/tests/cfgs/default/result/ftp.pcap.out +++ b/tests/cfgs/default/result/ftp.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 39 (13.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 538 (179.33 diss/flow) +Num dissector calls: 540 (180.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/ftp_failed.pcap.out b/tests/cfgs/default/result/ftp_failed.pcap.out index 84d435cf4ec..aa6416a33c0 100644 --- a/tests/cfgs/default/result/ftp_failed.pcap.out +++ b/tests/cfgs/default/result/ftp_failed.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 162 (162.00 diss/flow) +Num dissector calls: 163 (163.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out b/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out index 3cb0d365341..ada9c2a07b1 100644 --- a/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out +++ b/tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 34 (flows) Confidence Match by port : 27 (flows) Confidence DPI : 190 (flows) -Num dissector calls: 6786 (27.04 diss/flow) +Num dissector calls: 6836 (27.24 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/189/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out b/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out index 4791a730833..bfc476a2c6c 100644 --- a/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out +++ b/tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out @@ -5,7 +5,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 3 (flows) Confidence Match by port : 26 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 1052 (26.30 diss/flow) +Num dissector calls: 1058 (26.45 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/87/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/fuzz-2020-02-16-11740.pcap.out b/tests/cfgs/default/result/fuzz-2020-02-16-11740.pcap.out index 9716a8519da..361e88c8dbb 100644 --- a/tests/cfgs/default/result/fuzz-2020-02-16-11740.pcap.out +++ b/tests/cfgs/default/result/fuzz-2020-02-16-11740.pcap.out @@ -5,7 +5,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Unknown : 19 (flows) Confidence Match by port : 3 (flows) Confidence DPI : 55 (flows) -Num dissector calls: 2045 (26.56 diss/flow) +Num dissector calls: 2061 (26.77 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/66/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out b/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out index cb1d76892cd..660a553f423 100644 --- a/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out +++ b/tests/cfgs/default/result/fuzz-2021-10-13.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 133 (133.00 diss/flow) +Num dissector calls: 134 (134.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/gnutella.pcap.out b/tests/cfgs/default/result/gnutella.pcap.out index c999431a141..46d1a66a882 100644 --- a/tests/cfgs/default/result/gnutella.pcap.out +++ b/tests/cfgs/default/result/gnutella.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow) Confidence Unknown : 389 (flows) Confidence Match by port : 1 (flows) Confidence DPI : 370 (flows) -Num dissector calls: 46412 (61.07 diss/flow) +Num dissector calls: 46721 (61.47 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/1170/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/google_ssl.pcap.out b/tests/cfgs/default/result/google_ssl.pcap.out index cfa375e88db..b1688a75f86 100644 --- a/tests/cfgs/default/result/google_ssl.pcap.out +++ b/tests/cfgs/default/result/google_ssl.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 24 (24.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 203 (203.00 diss/flow) +Num dissector calls: 204 (204.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/gtp_false_positive.pcapng.out b/tests/cfgs/default/result/gtp_false_positive.pcapng.out index 368cbd07e8b..5f523976238 100644 --- a/tests/cfgs/default/result/gtp_false_positive.pcapng.out +++ b/tests/cfgs/default/result/gtp_false_positive.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (UDP): 7 (2.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) -Num dissector calls: 439 (146.33 diss/flow) +Num dissector calls: 442 (147.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/h323.pcap.out b/tests/cfgs/default/result/h323.pcap.out index 7af4c6c949f..66aab9bba9c 100644 --- a/tests/cfgs/default/result/h323.pcap.out +++ b/tests/cfgs/default/result/h323.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 1 (1.00 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 126 (63.00 diss/flow) +Num dissector calls: 127 (63.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out b/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out index 3b70b493410..bf7accff800 100644 --- a/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out +++ b/tests/cfgs/default/result/http_guessed_host_and_guessed.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 134 (134.00 diss/flow) +Num dissector calls: 135 (135.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/http_ipv6.pcap.out b/tests/cfgs/default/result/http_ipv6.pcap.out index e3a13b1838f..c68d4f568cf 100644 --- a/tests/cfgs/default/result/http_ipv6.pcap.out +++ b/tests/cfgs/default/result/http_ipv6.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (5.92 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence Match by port : 7 (flows) Confidence DPI : 8 (flows) -Num dissector calls: 161 (10.73 diss/flow) +Num dissector calls: 162 (10.80 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/21/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/imap-starttls.pcap.out b/tests/cfgs/default/result/imap-starttls.pcap.out index d39604dfa77..1abda3548cb 100644 --- a/tests/cfgs/default/result/imap-starttls.pcap.out +++ b/tests/cfgs/default/result/imap-starttls.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 19 (19.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 213 (213.00 diss/flow) +Num dissector calls: 214 (214.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/imap.pcap.out b/tests/cfgs/default/result/imap.pcap.out index 3aeb7211836..e76368b1b2c 100644 --- a/tests/cfgs/default/result/imap.pcap.out +++ b/tests/cfgs/default/result/imap.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 213 (213.00 diss/flow) +Num dissector calls: 214 (214.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/imo.pcap.out b/tests/cfgs/default/result/imo.pcap.out index 497bae1d34b..0262af7825e 100644 --- a/tests/cfgs/default/result/imo.pcap.out +++ b/tests/cfgs/default/result/imo.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 7 (3.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 315 (157.50 diss/flow) +Num dissector calls: 317 (158.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/instagram.pcap.out b/tests/cfgs/default/result/instagram.pcap.out index 48a4433b114..c36fde34a65 100644 --- a/tests/cfgs/default/result/instagram.pcap.out +++ b/tests/cfgs/default/result/instagram.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 7 (flows) Confidence DPI : 30 (flows) -Num dissector calls: 1407 (37.03 diss/flow) +Num dissector calls: 1412 (37.16 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/24/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/iphone.pcap.out b/tests/cfgs/default/result/iphone.pcap.out index 863fe57e331..613ae451d03 100644 --- a/tests/cfgs/default/result/iphone.pcap.out +++ b/tests/cfgs/default/result/iphone.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 55 (1.77 pkts/flow) DPI Packets (other): 5 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 50 (flows) -Num dissector calls: 353 (6.92 diss/flow) +Num dissector calls: 354 (6.94 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/ipv6_in_gtp.pcap.out b/tests/cfgs/default/result/ipv6_in_gtp.pcap.out index 49c15a4c39b..ae7ffcdf5d8 100644 --- a/tests/cfgs/default/result/ipv6_in_gtp.pcap.out +++ b/tests/cfgs/default/result/ipv6_in_gtp.pcap.out @@ -2,7 +2,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 121 (60.50 diss/flow) +Num dissector calls: 122 (61.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/irc.pcap.out b/tests/cfgs/default/result/irc.pcap.out index b27949f205c..daf93dc4992 100644 --- a/tests/cfgs/default/result/irc.pcap.out +++ b/tests/cfgs/default/result/irc.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 168 (168.00 diss/flow) +Num dissector calls: 169 (169.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/iso9506-1-mms.pcap.out b/tests/cfgs/default/result/iso9506-1-mms.pcap.out index 3314dbc4957..137f30e7e7f 100644 --- a/tests/cfgs/default/result/iso9506-1-mms.pcap.out +++ b/tests/cfgs/default/result/iso9506-1-mms.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 185 (185.00 diss/flow) +Num dissector calls: 186 (186.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/jabber.pcap.out b/tests/cfgs/default/result/jabber.pcap.out index eb0e1f00502..9fc2ad00ac6 100644 --- a/tests/cfgs/default/result/jabber.pcap.out +++ b/tests/cfgs/default/result/jabber.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 74 (6.17 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1517 (126.42 diss/flow) +Num dissector calls: 1526 (127.17 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/kerberos.pcap.out b/tests/cfgs/default/result/kerberos.pcap.out index ba60f08e439..a3124085719 100644 --- a/tests/cfgs/default/result/kerberos.pcap.out +++ b/tests/cfgs/default/result/kerberos.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (2.14 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 23 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 4184 (116.22 diss/flow) +Num dissector calls: 4209 (116.92 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/75/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/kontiki.pcap.out b/tests/cfgs/default/result/kontiki.pcap.out index 7e707a9ad14..15e1a27c401 100644 --- a/tests/cfgs/default/result/kontiki.pcap.out +++ b/tests/cfgs/default/result/kontiki.pcap.out @@ -2,7 +2,7 @@ DPI Packets (UDP): 6 (1.50 pkts/flow) DPI Packets (other): 4 (1.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 6 (flows) -Num dissector calls: 347 (43.38 diss/flow) +Num dissector calls: 349 (43.62 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/linecall_falsepositve.pcap.out b/tests/cfgs/default/result/linecall_falsepositve.pcap.out index 08222f35727..27252a32c8f 100644 --- a/tests/cfgs/default/result/linecall_falsepositve.pcap.out +++ b/tests/cfgs/default/result/linecall_falsepositve.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 13 (13.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 215 (215.00 diss/flow) +Num dissector calls: 216 (216.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out b/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out index 227508848ce..2a7f7383624 100644 --- a/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out +++ b/tests/cfgs/default/result/log4j-webapp-exploit.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 56 (8.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 361 (51.57 diss/flow) +Num dissector calls: 362 (51.71 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out b/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out index baca607cc70..c91c11db3bd 100644 --- a/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out +++ b/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out @@ -2,7 +2,7 @@ DPI Packets (TCP): 9 (3.00 pkts/flow) DPI Packets (UDP): 36 (4.00 pkts/flow) Confidence DPI (cache) : 6 (flows) Confidence DPI : 6 (flows) -Num dissector calls: 782 (65.17 diss/flow) +Num dissector calls: 785 (65.42 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 25/12/4 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/memcached.cap.out b/tests/cfgs/default/result/memcached.cap.out index d38b1bd8de8..86a97a3da34 100644 --- a/tests/cfgs/default/result/memcached.cap.out +++ b/tests/cfgs/default/result/memcached.cap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 135 (135.00 diss/flow) +Num dissector calls: 136 (136.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/mongo_false_positive.pcapng.out b/tests/cfgs/default/result/mongo_false_positive.pcapng.out index b6c8b1859d3..f1d30a8bba0 100644 --- a/tests/cfgs/default/result/mongo_false_positive.pcapng.out +++ b/tests/cfgs/default/result/mongo_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 14 (14.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 277 (277.00 diss/flow) +Num dissector calls: 278 (278.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/mssql_tds.pcap.out b/tests/cfgs/default/result/mssql_tds.pcap.out index 4b6271ef48a..1d3904e080f 100644 --- a/tests/cfgs/default/result/mssql_tds.pcap.out +++ b/tests/cfgs/default/result/mssql_tds.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 18 (1.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 278 (23.17 diss/flow) +Num dissector calls: 279 (23.25 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/mullvad_wireguard.pcap.out b/tests/cfgs/default/result/mullvad_wireguard.pcap.out index 886c3350c8c..ebc184abc2f 100644 --- a/tests/cfgs/default/result/mullvad_wireguard.pcap.out +++ b/tests/cfgs/default/result/mullvad_wireguard.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 144 (144.00 diss/flow) +Num dissector calls: 145 (145.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/nest_log_sink.pcap.out b/tests/cfgs/default/result/nest_log_sink.pcap.out index 75c0c20fb9c..0ca1d3b2bbc 100644 --- a/tests/cfgs/default/result/nest_log_sink.pcap.out +++ b/tests/cfgs/default/result/nest_log_sink.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 130 (10.00 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 1981 (141.50 diss/flow) +Num dissector calls: 1993 (142.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/netbios.pcap.out b/tests/cfgs/default/result/netbios.pcap.out index 6fdaf9d5d42..e32bce4bd51 100644 --- a/tests/cfgs/default/result/netbios.pcap.out +++ b/tests/cfgs/default/result/netbios.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 14 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 14 (flows) -Num dissector calls: 148 (9.87 diss/flow) +Num dissector calls: 149 (9.93 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/nintendo.pcap.out b/tests/cfgs/default/result/nintendo.pcap.out index d525e706461..4638478a154 100644 --- a/tests/cfgs/default/result/nintendo.pcap.out +++ b/tests/cfgs/default/result/nintendo.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 15 (flows) Confidence Match by IP : 5 (flows) -Num dissector calls: 1302 (62.00 diss/flow) +Num dissector calls: 1307 (62.24 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/18/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/nntp.pcap.out b/tests/cfgs/default/result/nntp.pcap.out index b12ed29b531..5c68b37c986 100644 --- a/tests/cfgs/default/result/nntp.pcap.out +++ b/tests/cfgs/default/result/nntp.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 141 (141.00 diss/flow) +Num dissector calls: 142 (142.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/ookla.pcap.out b/tests/cfgs/default/result/ookla.pcap.out index 2b224b4c758..3aa37d8dd0c 100644 --- a/tests/cfgs/default/result/ookla.pcap.out +++ b/tests/cfgs/default/result/ookla.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow) Confidence DPI (partial cache): 1 (flows) Confidence DPI : 4 (flows) Confidence DPI (aggressive) : 1 (flows) -Num dissector calls: 543 (90.50 diss/flow) +Num dissector calls: 546 (91.00 diss/flow) LRU cache ookla: 4/2/2 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/openvpn-tlscrypt.pcap.out b/tests/cfgs/default/result/openvpn-tlscrypt.pcap.out index f1025eb2ad3..af2f92f4953 100644 --- a/tests/cfgs/default/result/openvpn-tlscrypt.pcap.out +++ b/tests/cfgs/default/result/openvpn-tlscrypt.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 158 (158.00 diss/flow) +Num dissector calls: 159 (159.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/openvpn.pcap.out b/tests/cfgs/default/result/openvpn.pcap.out index 7739ae00ec0..2222b087fa2 100644 --- a/tests/cfgs/default/result/openvpn.pcap.out +++ b/tests/cfgs/default/result/openvpn.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 24 (8.00 pkts/flow) DPI Packets (UDP): 15 (3.00 pkts/flow) Confidence DPI : 8 (flows) -Num dissector calls: 1254 (156.75 diss/flow) +Num dissector calls: 1262 (157.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/openvpn_nohmac.pcapng.out b/tests/cfgs/default/result/openvpn_nohmac.pcapng.out index 4ff91680bfb..4ffc6f558fa 100644 --- a/tests/cfgs/default/result/openvpn_nohmac.pcapng.out +++ b/tests/cfgs/default/result/openvpn_nohmac.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 125 (125.00 diss/flow) +Num dissector calls: 126 (126.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out b/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out index f9e63247d56..20f0cbde799 100644 --- a/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out +++ b/tests/cfgs/default/result/openvpn_nohmac_tcp.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 135 (135.00 diss/flow) +Num dissector calls: 136 (136.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/oracle12.pcapng.out b/tests/cfgs/default/result/oracle12.pcapng.out index 7d34289e818..a3d0225a677 100644 --- a/tests/cfgs/default/result/oracle12.pcapng.out +++ b/tests/cfgs/default/result/oracle12.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 20 (20.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 269 (269.00 diss/flow) +Num dissector calls: 270 (270.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out index 447ee81a880..7cdffce1c53 100644 --- a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out +++ b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_1.pcapng.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 8 (1.33 pkts/flow) DPI Packets (UDP): 9 (2.25 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 740 (74.00 diss/flow) +Num dissector calls: 745 (74.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out index e1605d01d66..70c397dc43a 100644 --- a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out +++ b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_2.pcapng.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 18 (6.00 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 685 (137.00 diss/flow) +Num dissector calls: 690 (138.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_4.pcapng.out b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_4.pcapng.out index 7290eb464c5..88c2ae0242c 100644 --- a/tests/cfgs/default/result/ossfuzz_seed_fake_traces_4.pcapng.out +++ b/tests/cfgs/default/result/ossfuzz_seed_fake_traces_4.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 140 (140.00 diss/flow) +Num dissector calls: 141 (141.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/pgsql.pcap.out b/tests/cfgs/default/result/pgsql.pcap.out index c69b9fa25c7..fe27d66bd2f 100644 --- a/tests/cfgs/default/result/pgsql.pcap.out +++ b/tests/cfgs/default/result/pgsql.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 36 (6.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 810 (135.00 diss/flow) +Num dissector calls: 816 (136.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/pop3.pcap.out b/tests/cfgs/default/result/pop3.pcap.out index 31d82599044..fcb687d3620 100644 --- a/tests/cfgs/default/result/pop3.pcap.out +++ b/tests/cfgs/default/result/pop3.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 83 (13.83 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 1211 (201.83 diss/flow) +Num dissector calls: 1217 (202.83 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/pop3_stls.pcap.out b/tests/cfgs/default/result/pop3_stls.pcap.out index c47559541a2..69d785503e4 100644 --- a/tests/cfgs/default/result/pop3_stls.pcap.out +++ b/tests/cfgs/default/result/pop3_stls.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 18 (18.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 201 (201.00 diss/flow) +Num dissector calls: 202 (202.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/pps.pcap.out b/tests/cfgs/default/result/pps.pcap.out index 0d3c606cfeb..f688d8f7014 100644 --- a/tests/cfgs/default/result/pps.pcap.out +++ b/tests/cfgs/default/result/pps.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 136 (3.09 pkts/flow) Confidence Unknown : 29 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 76 (flows) -Num dissector calls: 5819 (54.38 diss/flow) +Num dissector calls: 5848 (54.65 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/93/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/protobuf.pcap.out b/tests/cfgs/default/result/protobuf.pcap.out index 1b33d2e1cbd..48d3be95b80 100644 --- a/tests/cfgs/default/result/protobuf.pcap.out +++ b/tests/cfgs/default/result/protobuf.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 26 (5.20 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 703 (140.60 diss/flow) +Num dissector calls: 704 (140.80 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/protonvpn.pcap.out b/tests/cfgs/default/result/protonvpn.pcap.out index c88e1186889..c74d03d7abe 100644 --- a/tests/cfgs/default/result/protonvpn.pcap.out +++ b/tests/cfgs/default/result/protonvpn.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 12 (6.00 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 140 (46.67 diss/flow) +Num dissector calls: 141 (47.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/quic.pcap.out b/tests/cfgs/default/result/quic.pcap.out index 0a4045ce53d..aa4c0a366d9 100644 --- a/tests/cfgs/default/result/quic.pcap.out +++ b/tests/cfgs/default/result/quic.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 12 (1.20 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 9 (flows) -Num dissector calls: 225 (22.50 diss/flow) +Num dissector calls: 226 (22.60 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/quic_0RTT.pcap.out b/tests/cfgs/default/result/quic_0RTT.pcap.out index 8c4c2826e56..b114e420a8c 100644 --- a/tests/cfgs/default/result/quic_0RTT.pcap.out +++ b/tests/cfgs/default/result/quic_0RTT.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 201 (100.50 diss/flow) +Num dissector calls: 202 (101.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/raknet.pcap.out b/tests/cfgs/default/result/raknet.pcap.out index 969786c9844..c10b56706a4 100644 --- a/tests/cfgs/default/result/raknet.pcap.out +++ b/tests/cfgs/default/result/raknet.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 24 (2.00 pkts/flow) Confidence DPI : 12 (flows) -Num dissector calls: 1487 (123.92 diss/flow) +Num dissector calls: 1493 (124.42 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/rdp2.pcap.out b/tests/cfgs/default/result/rdp2.pcap.out index b47abf478e5..3f5da21ea5f 100644 --- a/tests/cfgs/default/result/rdp2.pcap.out +++ b/tests/cfgs/default/result/rdp2.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 8 (2.67 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 413 (137.67 diss/flow) +Num dissector calls: 416 (138.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/reasm_crash_anon.pcapng.out b/tests/cfgs/default/result/reasm_crash_anon.pcapng.out index 47228b5de1a..bac5cea2ddd 100644 --- a/tests/cfgs/default/result/reasm_crash_anon.pcapng.out +++ b/tests/cfgs/default/result/reasm_crash_anon.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 23 (23.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 257 (257.00 diss/flow) +Num dissector calls: 258 (258.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/reasm_segv_anon.pcapng.out b/tests/cfgs/default/result/reasm_segv_anon.pcapng.out index 7cbfecd7965..64c3603ce96 100644 --- a/tests/cfgs/default/result/reasm_segv_anon.pcapng.out +++ b/tests/cfgs/default/result/reasm_segv_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 21 (21.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 204 (204.00 diss/flow) +Num dissector calls: 205 (205.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/riot.pcapng.out b/tests/cfgs/default/result/riot.pcapng.out index d8e1b789cb0..8c87f980584 100644 --- a/tests/cfgs/default/result/riot.pcapng.out +++ b/tests/cfgs/default/result/riot.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 7 (3.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 194 (97.00 diss/flow) +Num dissector calls: 195 (97.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/rsh.pcap.out b/tests/cfgs/default/result/rsh.pcap.out index 13a4ac653f3..b989c751504 100644 --- a/tests/cfgs/default/result/rsh.pcap.out +++ b/tests/cfgs/default/result/rsh.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 316 (158.00 diss/flow) +Num dissector calls: 318 (159.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/rtmp.pcap.out b/tests/cfgs/default/result/rtmp.pcap.out index 8c436fb8c41..c0083f35365 100644 --- a/tests/cfgs/default/result/rtmp.pcap.out +++ b/tests/cfgs/default/result/rtmp.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 165 (165.00 diss/flow) +Num dissector calls: 166 (166.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/rtp.pcapng.out b/tests/cfgs/default/result/rtp.pcapng.out index 8e4ecc27065..6e060cba59e 100644 --- a/tests/cfgs/default/result/rtp.pcapng.out +++ b/tests/cfgs/default/result/rtp.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 9 (3.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 445 (148.33 diss/flow) +Num dissector calls: 448 (149.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/rx.pcap.out b/tests/cfgs/default/result/rx.pcap.out index 11ec1d73f30..6d87cf6f6e0 100644 --- a/tests/cfgs/default/result/rx.pcap.out +++ b/tests/cfgs/default/result/rx.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 10 (2.00 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 690 (138.00 diss/flow) +Num dissector calls: 695 (139.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/s7comm-plus.pcap.out b/tests/cfgs/default/result/s7comm-plus.pcap.out index c20a054a43c..8eef9c35bf0 100644 --- a/tests/cfgs/default/result/s7comm-plus.pcap.out +++ b/tests/cfgs/default/result/s7comm-plus.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 179 (179.00 diss/flow) +Num dissector calls: 180 (180.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/s7comm.pcap.out b/tests/cfgs/default/result/s7comm.pcap.out index 0f3b335b5ab..d5edd09b147 100644 --- a/tests/cfgs/default/result/s7comm.pcap.out +++ b/tests/cfgs/default/result/s7comm.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 181 (181.00 diss/flow) +Num dissector calls: 182 (182.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/sflow.pcap.out b/tests/cfgs/default/result/sflow.pcap.out index 8e04d2d7456..f4061c29c43 100644 --- a/tests/cfgs/default/result/sflow.pcap.out +++ b/tests/cfgs/default/result/sflow.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 125 (125.00 diss/flow) +Num dissector calls: 126 (126.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/shadowsocks.pcap.out b/tests/cfgs/default/result/shadowsocks.pcap.out index 7e8ac585ff6..3cf6281e09e 100644 --- a/tests/cfgs/default/result/shadowsocks.pcap.out +++ b/tests/cfgs/default/result/shadowsocks.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 21 (10.50 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 352 (176.00 diss/flow) +Num dissector calls: 354 (177.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/sip.pcap.out b/tests/cfgs/default/result/sip.pcap.out index 249dd46862e..aa8551f7c46 100644 --- a/tests/cfgs/default/result/sip.pcap.out +++ b/tests/cfgs/default/result/sip.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 6 (1.50 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 200 (50.00 diss/flow) +Num dissector calls: 201 (50.25 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/sip_hello.pcapng.out b/tests/cfgs/default/result/sip_hello.pcapng.out index 86c6d57237e..8d514bc4acc 100644 --- a/tests/cfgs/default/result/sip_hello.pcapng.out +++ b/tests/cfgs/default/result/sip_hello.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 200 (200.00 diss/flow) +Num dissector calls: 201 (201.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/skinny.pcap.out b/tests/cfgs/default/result/skinny.pcap.out index 688e89ee92b..d803d8d100f 100644 --- a/tests/cfgs/default/result/skinny.pcap.out +++ b/tests/cfgs/default/result/skinny.pcap.out @@ -2,7 +2,7 @@ DPI Packets (TCP): 3 (1.00 pkts/flow) DPI Packets (UDP): 15 (3.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 719 (79.89 diss/flow) +Num dissector calls: 724 (80.44 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/skype.pcap.out b/tests/cfgs/default/result/skype.pcap.out index 3a70ae8fc8f..3029d65db64 100644 --- a/tests/cfgs/default/result/skype.pcap.out +++ b/tests/cfgs/default/result/skype.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 59 (flows) Confidence Match by port : 28 (flows) Confidence DPI : 206 (flows) -Num dissector calls: 27806 (94.90 diss/flow) +Num dissector calls: 27892 (95.19 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/261/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/skype_no_unknown.pcap.out b/tests/cfgs/default/result/skype_no_unknown.pcap.out index 19c837e780d..51ae5642d39 100644 --- a/tests/cfgs/default/result/skype_no_unknown.pcap.out +++ b/tests/cfgs/default/result/skype_no_unknown.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 44 (flows) Confidence Match by port : 22 (flows) Confidence DPI : 201 (flows) -Num dissector calls: 23073 (86.42 diss/flow) +Num dissector calls: 23137 (86.66 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/198/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/skype_udp.pcap.out b/tests/cfgs/default/result/skype_udp.pcap.out index 1e2597ff452..06a7a3e9318 100644 --- a/tests/cfgs/default/result/skype_udp.pcap.out +++ b/tests/cfgs/default/result/skype_udp.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 175 (175.00 diss/flow) +Num dissector calls: 176 (176.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/smb_frags.pcap.out b/tests/cfgs/default/result/smb_frags.pcap.out index a91e599da73..436bd9fd761 100644 --- a/tests/cfgs/default/result/smb_frags.pcap.out +++ b/tests/cfgs/default/result/smb_frags.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 164 (164.00 diss/flow) +Num dissector calls: 165 (165.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/smbv1.pcap.out b/tests/cfgs/default/result/smbv1.pcap.out index f68d9304497..074a0143ce3 100644 --- a/tests/cfgs/default/result/smbv1.pcap.out +++ b/tests/cfgs/default/result/smbv1.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 166 (166.00 diss/flow) +Num dissector calls: 167 (167.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/smtp-starttls.pcap.out b/tests/cfgs/default/result/smtp-starttls.pcap.out index 1bb634d1f16..fa7d97ccd65 100644 --- a/tests/cfgs/default/result/smtp-starttls.pcap.out +++ b/tests/cfgs/default/result/smtp-starttls.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 162 (81.00 diss/flow) +Num dissector calls: 163 (81.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/smtp.pcap.out b/tests/cfgs/default/result/smtp.pcap.out index 8c209103f2c..38b820a7929 100644 --- a/tests/cfgs/default/result/smtp.pcap.out +++ b/tests/cfgs/default/result/smtp.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 207 (207.00 diss/flow) +Num dissector calls: 208 (208.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/soap.pcap.out b/tests/cfgs/default/result/soap.pcap.out index 801d9471a39..8ecd4aa6070 100644 --- a/tests/cfgs/default/result/soap.pcap.out +++ b/tests/cfgs/default/result/soap.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 20 (6.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 397 (132.33 diss/flow) +Num dissector calls: 399 (133.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/socks.pcap.out b/tests/cfgs/default/result/socks.pcap.out index 3a3b565f5a6..21be5ccb95b 100644 --- a/tests/cfgs/default/result/socks.pcap.out +++ b/tests/cfgs/default/result/socks.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 23 (5.75 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 542 (135.50 diss/flow) +Num dissector calls: 546 (136.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/softether.pcap.out b/tests/cfgs/default/result/softether.pcap.out index 66b4acc0356..a7320839b2c 100644 --- a/tests/cfgs/default/result/softether.pcap.out +++ b/tests/cfgs/default/result/softether.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 31 (10.33 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 395 (98.75 diss/flow) +Num dissector calls: 397 (99.25 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/starcraft_battle.pcap.out b/tests/cfgs/default/result/starcraft_battle.pcap.out index a51b8529df5..4a7f583de05 100644 --- a/tests/cfgs/default/result/starcraft_battle.pcap.out +++ b/tests/cfgs/default/result/starcraft_battle.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 12 (flows) Confidence DPI : 39 (flows) Confidence Match by IP : 1 (flows) -Num dissector calls: 1580 (30.38 diss/flow) +Num dissector calls: 1588 (30.54 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/39/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/synscan.pcap.out b/tests/cfgs/default/result/synscan.pcap.out index 98677950e80..003c7fb32cf 100644 --- a/tests/cfgs/default/result/synscan.pcap.out +++ b/tests/cfgs/default/result/synscan.pcap.out @@ -129,7 +129,7 @@ iSCSI 2 116 2 45 TCP 172.16.0.8:36050 -> 64.13.134.52:2605 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 46 TCP 172.16.0.8:36050 -> 64.13.134.52:3000 [proto: 26/ntop][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 47 TCP 172.16.0.8:36050 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 48 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 378/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 48 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 379/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 49 TCP 172.16.0.8:36050 -> 64.13.134.52:3306 [proto: 20/MySQL][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 50 TCP 172.16.0.8:36050 -> 64.13.134.52:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 51 TCP 172.16.0.8:36050 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] @@ -194,7 +194,7 @@ iSCSI 2 116 2 110 TCP 172.16.0.8:36051 -> 64.13.134.52:2605 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 111 TCP 172.16.0.8:36051 -> 64.13.134.52:3000 [proto: 26/ntop][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 112 TCP 172.16.0.8:36051 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 113 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 378/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 113 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 379/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 114 TCP 172.16.0.8:36051 -> 64.13.134.52:3306 [proto: 20/MySQL][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 115 TCP 172.16.0.8:36051 -> 64.13.134.52:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 116 TCP 172.16.0.8:36051 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/teams.pcap.out b/tests/cfgs/default/result/teams.pcap.out index 6fee02f18f2..53f6b90b95f 100644 --- a/tests/cfgs/default/result/teams.pcap.out +++ b/tests/cfgs/default/result/teams.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI (partial) : 4 (flows) Confidence DPI : 76 (flows) -Num dissector calls: 526 (6.34 diss/flow) +Num dissector calls: 528 (6.36 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/teamspeak3.pcap.out b/tests/cfgs/default/result/teamspeak3.pcap.out index 9e85729c6ee..e8dceb4951f 100644 --- a/tests/cfgs/default/result/teamspeak3.pcap.out +++ b/tests/cfgs/default/result/teamspeak3.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 209 (104.50 diss/flow) +Num dissector calls: 210 (105.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/teamviewer.pcap.out b/tests/cfgs/default/result/teamviewer.pcap.out index 0028530dd5d..1f72fef8e5b 100644 --- a/tests/cfgs/default/result/teamviewer.pcap.out +++ b/tests/cfgs/default/result/teamviewer.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 168 (84.00 diss/flow) +Num dissector calls: 169 (84.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/telegram.pcap.out b/tests/cfgs/default/result/telegram.pcap.out index 9aaa9e73400..b61d6eeb673 100644 --- a/tests/cfgs/default/result/telegram.pcap.out +++ b/tests/cfgs/default/result/telegram.pcap.out @@ -1,7 +1,7 @@ DPI Packets (UDP): 82 (1.71 pkts/flow) Confidence Unknown : 3 (flows) Confidence DPI : 45 (flows) -Num dissector calls: 1566 (32.62 diss/flow) +Num dissector calls: 1569 (32.69 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/9/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/telegram_videocall.pcapng.out b/tests/cfgs/default/result/telegram_videocall.pcapng.out index e93dab54cef..ce2fc86d4ff 100644 --- a/tests/cfgs/default/result/telegram_videocall.pcapng.out +++ b/tests/cfgs/default/result/telegram_videocall.pcapng.out @@ -7,7 +7,7 @@ Confidence Match by port : 8 (flows) Confidence DPI (cache) : 10 (flows) Confidence DPI : 15 (flows) Confidence Match by IP : 1 (flows) -Num dissector calls: 1973 (58.03 diss/flow) +Num dissector calls: 1981 (58.26 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/27/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/telnet.pcap.out b/tests/cfgs/default/result/telnet.pcap.out index d7fcdded416..c1201236dfc 100644 --- a/tests/cfgs/default/result/telnet.pcap.out +++ b/tests/cfgs/default/result/telnet.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 162 (162.00 diss/flow) +Num dissector calls: 163 (163.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/tftp.pcap.out b/tests/cfgs/default/result/tftp.pcap.out index 886d82bd838..8d9b18bd7a0 100644 --- a/tests/cfgs/default/result/tftp.pcap.out +++ b/tests/cfgs/default/result/tftp.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (UDP): 15 (1.67 pkts/flow) Confidence Match by port : 2 (flows) Confidence DPI : 7 (flows) -Num dissector calls: 627 (69.67 diss/flow) +Num dissector calls: 631 (70.11 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/threema.pcap.out b/tests/cfgs/default/result/threema.pcap.out index 5f9c6133465..628f4b9012e 100644 --- a/tests/cfgs/default/result/threema.pcap.out +++ b/tests/cfgs/default/result/threema.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 66 (11.00 pkts/flow) Confidence DPI : 4 (flows) Confidence Match by IP : 2 (flows) -Num dissector calls: 1308 (218.00 diss/flow) +Num dissector calls: 1314 (219.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/tinc.pcap.out b/tests/cfgs/default/result/tinc.pcap.out index 8073bb61cc3..02da536868e 100644 --- a/tests/cfgs/default/result/tinc.pcap.out +++ b/tests/cfgs/default/result/tinc.pcap.out @@ -2,7 +2,7 @@ DPI Packets (TCP): 19 (9.50 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI (cache) : 2 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 523 (130.75 diss/flow) +Num dissector calls: 525 (131.25 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/tls-appdata.pcap.out b/tests/cfgs/default/result/tls-appdata.pcap.out index f82f74ddd95..9d29094e159 100644 --- a/tests/cfgs/default/result/tls-appdata.pcap.out +++ b/tests/cfgs/default/result/tls-appdata.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 17 (8.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 136 (68.00 diss/flow) +Num dissector calls: 137 (68.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/tls_certificate_too_long.pcap.out b/tests/cfgs/default/result/tls_certificate_too_long.pcap.out index ec95d1c20ed..0fce5ee79b7 100644 --- a/tests/cfgs/default/result/tls_certificate_too_long.pcap.out +++ b/tests/cfgs/default/result/tls_certificate_too_long.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 615 (17.57 diss/flow) +Num dissector calls: 618 (17.66 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/tls_false_positives.pcapng.out b/tests/cfgs/default/result/tls_false_positives.pcapng.out index 8b7c0fe3cdb..4930721ecfd 100644 --- a/tests/cfgs/default/result/tls_false_positives.pcapng.out +++ b/tests/cfgs/default/result/tls_false_positives.pcapng.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 13 (13.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 264 (264.00 diss/flow) +Num dissector calls: 265 (265.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/tls_invalid_reads.pcap.out b/tests/cfgs/default/result/tls_invalid_reads.pcap.out index ab0bb6e5539..8822470a7e8 100644 --- a/tests/cfgs/default/result/tls_invalid_reads.pcap.out +++ b/tests/cfgs/default/result/tls_invalid_reads.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 10 (3.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 136 (45.33 diss/flow) +Num dissector calls: 137 (45.67 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out b/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out index 8fe745ed13d..41f22d1f999 100644 --- a/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out +++ b/tests/cfgs/default/result/tls_missing_ch_frag.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 135 (135.00 diss/flow) +Num dissector calls: 136 (136.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/toca-boca.pcap.out b/tests/cfgs/default/result/toca-boca.pcap.out index 7f2a57b1e76..db194764fd0 100644 --- a/tests/cfgs/default/result/toca-boca.pcap.out +++ b/tests/cfgs/default/result/toca-boca.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 4 DPI Packets (UDP): 21 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence DPI : 17 (flows) -Num dissector calls: 513 (24.43 diss/flow) +Num dissector calls: 517 (24.62 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/12/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/viber.pcap.out b/tests/cfgs/default/result/viber.pcap.out index f5b2ca68bc8..1a44f2486f9 100644 --- a/tests/cfgs/default/result/viber.pcap.out +++ b/tests/cfgs/default/result/viber.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (1.93 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence DPI : 25 (flows) -Num dissector calls: 460 (15.86 diss/flow) +Num dissector calls: 462 (15.93 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/12/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/vnc.pcap.out b/tests/cfgs/default/result/vnc.pcap.out index 80af5a137ce..86e70a89e7d 100644 --- a/tests/cfgs/default/result/vnc.pcap.out +++ b/tests/cfgs/default/result/vnc.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 280 (140.00 diss/flow) +Num dissector calls: 282 (141.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/wa_video.pcap.out b/tests/cfgs/default/result/wa_video.pcap.out index c46d71f30a8..2a84cb0839a 100644 --- a/tests/cfgs/default/result/wa_video.pcap.out +++ b/tests/cfgs/default/result/wa_video.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 13 (1.00 pkts/flow) Confidence DPI (cache) : 2 (flows) Confidence DPI : 11 (flows) Confidence Match by IP : 1 (flows) -Num dissector calls: 403 (28.79 diss/flow) +Num dissector calls: 404 (28.86 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/waze.pcap.out b/tests/cfgs/default/result/waze.pcap.out index 1e8ea89d805..d9bfa0a59f6 100644 --- a/tests/cfgs/default/result/waze.pcap.out +++ b/tests/cfgs/default/result/waze.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 9 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 370 (11.21 diss/flow) +Num dissector calls: 371 (11.24 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/30/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/webex.pcap.out b/tests/cfgs/default/result/webex.pcap.out index aeb2f1de7ca..296bc82590a 100644 --- a/tests/cfgs/default/result/webex.pcap.out +++ b/tests/cfgs/default/result/webex.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 14 (7.00 pkts/flow) Confidence Match by port : 3 (flows) Confidence DPI : 53 (flows) Confidence Match by IP : 1 (flows) -Num dissector calls: 284 (4.98 diss/flow) +Num dissector calls: 285 (5.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/12/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/wechat.pcap.out b/tests/cfgs/default/result/wechat.pcap.out index 8c6d40b97a8..6cb4861641c 100644 --- a/tests/cfgs/default/result/wechat.pcap.out +++ b/tests/cfgs/default/result/wechat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Match by port : 24 (flows) Confidence DPI : 78 (flows) Confidence Match by IP : 1 (flows) -Num dissector calls: 317 (3.08 diss/flow) +Num dissector calls: 318 (3.09 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/75/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/weibo.pcap.out b/tests/cfgs/default/result/weibo.pcap.out index 9be6c96352b..8ca69c4be6a 100644 --- a/tests/cfgs/default/result/weibo.pcap.out +++ b/tests/cfgs/default/result/weibo.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 100 (3.33 pkts/flow) DPI Packets (UDP): 43 (3.07 pkts/flow) Confidence Match by port : 21 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 559 (12.70 diss/flow) +Num dissector calls: 561 (12.75 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/63/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/whatsapp.pcap.out b/tests/cfgs/default/result/whatsapp.pcap.out index a6ec0f9c143..57329feae2e 100644 --- a/tests/cfgs/default/result/whatsapp.pcap.out +++ b/tests/cfgs/default/result/whatsapp.pcap.out @@ -1,6 +1,6 @@ DPI Packets (TCP): 344 (4.00 pkts/flow) Confidence DPI : 86 (flows) -Num dissector calls: 13158 (153.00 diss/flow) +Num dissector calls: 13244 (154.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/whatsapp_login_chat.pcap.out b/tests/cfgs/default/result/whatsapp_login_chat.pcap.out index f79e61a134e..5d11d311f2f 100644 --- a/tests/cfgs/default/result/whatsapp_login_chat.pcap.out +++ b/tests/cfgs/default/result/whatsapp_login_chat.pcap.out @@ -1,7 +1,7 @@ DPI Packets (TCP): 17 (5.67 pkts/flow) DPI Packets (UDP): 7 (1.17 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 290 (32.22 diss/flow) +Num dissector calls: 291 (32.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/whois.pcapng.out b/tests/cfgs/default/result/whois.pcapng.out index 8bcb9a31db7..8ec834d6fe1 100644 --- a/tests/cfgs/default/result/whois.pcapng.out +++ b/tests/cfgs/default/result/whois.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 16 (5.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 195 (65.00 diss/flow) +Num dissector calls: 196 (65.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/wireguard.pcap.out b/tests/cfgs/default/result/wireguard.pcap.out index 5b521ba816c..357163cd20c 100644 --- a/tests/cfgs/default/result/wireguard.pcap.out +++ b/tests/cfgs/default/result/wireguard.pcap.out @@ -1,6 +1,6 @@ DPI Packets (UDP): 6 (3.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 287 (143.50 diss/flow) +Num dissector calls: 289 (144.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/z3950.pcapng.out b/tests/cfgs/default/result/z3950.pcapng.out index 857fdc5a495..603b2b80b9b 100644 --- a/tests/cfgs/default/result/z3950.pcapng.out +++ b/tests/cfgs/default/result/z3950.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 473 (236.50 diss/flow) +Num dissector calls: 475 (237.50 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/zoom.pcap.out b/tests/cfgs/default/result/zoom.pcap.out index db98592ef4a..5cd5e5e1643 100644 --- a/tests/cfgs/default/result/zoom.pcap.out +++ b/tests/cfgs/default/result/zoom.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 23 (1.35 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by port : 2 (flows) Confidence DPI : 31 (flows) -Num dissector calls: 678 (20.55 diss/flow) +Num dissector calls: 680 (20.61 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 7/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/zoom2.pcap.out b/tests/cfgs/default/result/zoom2.pcap.out index 7ae15a6298f..e35d2e2d735 100644 --- a/tests/cfgs/default/result/zoom2.pcap.out +++ b/tests/cfgs/default/result/zoom2.pcap.out @@ -2,7 +2,7 @@ DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 15 (5.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 530 (106.00 diss/flow) +Num dissector calls: 533 (106.60 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 1/0/0 (insert/search/found) diff --git a/tests/cfgs/default/result/zoom_p2p.pcapng.out b/tests/cfgs/default/result/zoom_p2p.pcapng.out index 7c900fb4477..648d0ca445f 100644 --- a/tests/cfgs/default/result/zoom_p2p.pcapng.out +++ b/tests/cfgs/default/result/zoom_p2p.pcapng.out @@ -4,7 +4,7 @@ DPI Packets (UDP): 52 (5.20 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence DPI (partial cache): 4 (flows) Confidence DPI : 8 (flows) -Num dissector calls: 852 (71.00 diss/flow) +Num dissector calls: 856 (71.33 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/12/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out b/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out index 009258e2b54..7c16796412b 100644 --- a/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out +++ b/tests/cfgs/disable_aggressiveness/result/ookla.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 40 (6.67 pkts/flow) Confidence DPI (partial cache): 1 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 543 (90.50 diss/flow) +Num dissector calls: 546 (91.00 diss/flow) LRU cache ookla: 4/1/1 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out b/tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out index 5a4411a7799..6c6ab589b6a 100644 --- a/tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out +++ b/tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Match by IP : 1 (flows) -Num dissector calls: 139 (139.00 diss/flow) +Num dissector calls: 140 (140.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out b/tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out index e50898fedab..8cacbf738ff 100644 --- a/tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out +++ b/tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 13 (13.00 pkts/flow) Confidence Match by IP : 1 (flows) -Num dissector calls: 201 (201.00 diss/flow) +Num dissector calls: 202 (202.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/3/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/disable_protocols/result/soap.pcap.out b/tests/cfgs/disable_protocols/result/soap.pcap.out index 5890812d6bc..d4043158aa7 100644 --- a/tests/cfgs/disable_protocols/result/soap.pcap.out +++ b/tests/cfgs/disable_protocols/result/soap.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 20 (6.67 pkts/flow) Confidence Match by port : 2 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 388 (129.33 diss/flow) +Num dissector calls: 390 (130.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/6/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out b/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out index 7373fc85251..c90ed7f4ed0 100644 --- a/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out +++ b/tests/cfgs/enable_payload_stat/result/1kxun.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow) Confidence Unknown : 14 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 177 (flows) -Num dissector calls: 4756 (24.14 diss/flow) +Num dissector calls: 4773 (24.23 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/60/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) diff --git a/windows/nDPI.vcxproj b/windows/nDPI.vcxproj index cde56e680f6..906bf029279 100644 --- a/windows/nDPI.vcxproj +++ b/windows/nDPI.vcxproj @@ -348,6 +348,7 @@ + diff --git a/windows/nDPI.vcxproj.filters b/windows/nDPI.vcxproj.filters index 227d4f8166e..ec10e1518a0 100644 --- a/windows/nDPI.vcxproj.filters +++ b/windows/nDPI.vcxproj.filters @@ -129,6 +129,7 @@ + From dcca29b38cdebff960a3543a08e7d639df66280a Mon Sep 17 00:00:00 2001 From: Vladimir Gavrilov <105977161+0xA50C1A1@users.noreply.github.com> Date: Sat, 23 Dec 2023 15:22:15 +0300 Subject: [PATCH 2/7] Fix detection on big endian architectures --- src/lib/protocols/iec62056.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/protocols/iec62056.c b/src/lib/protocols/iec62056.c index 3ef66c84250..10542c7ba47 100644 --- a/src/lib/protocols/iec62056.c +++ b/src/lib/protocols/iec62056.c @@ -51,7 +51,7 @@ static void ndpi_search_iec62056(struct ndpi_detection_module_struct *ndpi_struc packet->payload[0] == 0x7E && packet->payload[1] == 0xA0 && /* HDLC frame start */ packet->payload[packet->payload_packet_len-1] == 0x7E) /* HDLC frame end */ { - u_int16_t fcs = ndpi_crc16_x25(&packet->payload[1], packet->payload_packet_len-4); + u_int16_t fcs = le16toh(ndpi_crc16_x25(&packet->payload[1], packet->payload_packet_len-4)); if (fcs == get_u_int16_t(packet->payload, packet->payload_packet_len-3)) { ndpi_int_iec62056_add_connection(ndpi_struct, flow); return; From afc1bd8ec1de0d9ac3cc40a1bdd602c6daeddd10 Mon Sep 17 00:00:00 2001 From: Vladimir Gavrilov <105977161+0xA50C1A1@users.noreply.github.com> Date: Sat, 23 Dec 2023 17:14:46 +0300 Subject: [PATCH 3/7] Update protocols.rst --- doc/protocols.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/protocols.rst b/doc/protocols.rst index a60c6fc2b61..da4f32b87d5 100644 --- a/doc/protocols.rst +++ b/doc/protocols.rst @@ -414,6 +414,6 @@ References: `Official site `_ and `Github `_. From 3bb0fb7bc3e5ea19bbdbce083a3e08256303910f Mon Sep 17 00:00:00 2001 From: 0xA50C1A1 Date: Tue, 2 Jan 2024 15:26:51 +0300 Subject: [PATCH 4/7] Add ndpi_crc16_x25 to fuzz/fuzz_alg_crc32_md5.c --- fuzz/fuzz_alg_crc32_md5.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fuzz/fuzz_alg_crc32_md5.c b/fuzz/fuzz_alg_crc32_md5.c index 8f5ee36c06d..265bc041782 100644 --- a/fuzz/fuzz_alg_crc32_md5.c +++ b/fuzz/fuzz_alg_crc32_md5.c @@ -12,6 +12,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { ndpi_crc16_ccit(data, size); ndpi_crc16_ccit_false(data, size); ndpi_crc16_xmodem(data, size); + ndpi_crc16_x25(data, size); ndpi_crc32(data, size); ndpi_md5(data, size, hash); From d29ac16dcf17d8e593e866a9f210be3b0d7bcbfd Mon Sep 17 00:00:00 2001 From: 0xA50C1A1 Date: Tue, 2 Jan 2024 15:39:39 +0300 Subject: [PATCH 5/7] Update pcap sample --- tests/cfgs/default/pcap/dlms.pcap | Bin 0 -> 4703 bytes tests/cfgs/default/pcap/dlms.pcapng | Bin 41744 -> 0 bytes tests/cfgs/default/result/dlms.pcap.out | 28 ++++++++++++++++++++++++ 3 files changed, 28 insertions(+) create mode 100644 tests/cfgs/default/pcap/dlms.pcap delete mode 100644 tests/cfgs/default/pcap/dlms.pcapng create mode 100644 tests/cfgs/default/result/dlms.pcap.out diff --git a/tests/cfgs/default/pcap/dlms.pcap b/tests/cfgs/default/pcap/dlms.pcap new file mode 100644 index 0000000000000000000000000000000000000000..f7b433e1a75722652b70e11dac660c63380c2ef6 GIT binary patch literal 4703 zcmbW5d2Ccw6voeech*+zOqoK<(mD{rDi$auC?KfSKog`E_o%f< z3vL*csa0HpEQ)(*s7PEQ1~-CGG>R5ClqC@x(ea#n4s-kFSx_4;yv}d#cg}a-UHNSL zOHB^=!2b9^;V&aAp1F3wa)2rLOzojD-)&gb*!H~d?qkbBPysN3{!9q0dwAP(4KZw6 z57p7S1ObfaJr2p=5ttm0jf{N->I=K$1v*nO{2b= zlqo`9+oAgC!Qxvm!q8Oy+_Q(RW_6zv%9*wL%5O*=BLyk%p-%x^h^o{)d6$WDQ&!$X zQGI4I5-Di86+rSGPs*gY3Kc6+jhaVsoG3o_kBWtnf@S^PiiuQE$5-X41WCW%DOpb$ z$~qdT3@`S`D#J`H!>D8g4(!AtQ?i)o_gI4Qq`0;jpcWIQ=24v1v5XYg|MriHg>WGB zsar9TDvs-U+w1O1=KEDLpprovEGlIFu0G#*@O|+=3O))8ejgS*)-o(po~h)6JXG!n zn2m9$c?y1$6nuVG!CA2|63e;7t(Zs+(ecP18{6BVrcYCDAXu|>zCWZ?OT>2;4feo| zC1|I(PddHhTVv=041Xa4YMv67bu2e8r68+>_u)&aO-Avh^v#s;IKGsrWN7C>tLQP* z)tIcs5;ahXw*HbaRE;G%PKvSb0j|gVsCg7GlM>yNRU%fz63wl4D<)D!IzD3d9xTx| z)e3n40|C+wG*+8}T!6vKF%UIRK?Z(k#?;=vSp{jpFT+%6xQ-tte*(u{Rs)~M_F!O0{w;lY@*rzW)Y%bCK@NrQMKOE^bksqQ3>-b@K zk9+Z zXa5Cm6oR*ZWHdH9+>OG}^BAKW{Bs2b6--wYYsG_%<}7?eP!E9a7%K!jcQINyqh64_ zOa&ba8EvT=<3{E^n=+oZR{y5vSkK)*JwqYf_3WztShTB0#@s1sm^7KQt?Sp_jeIaM z$Y@Qkhup{ytBV=63VZGFF|xh{Iq>2zMxA__Jg`?N&Zv_wMh?{EGP1sg02CQt zSKiFX`V!>8_$iF6uMp2Qj8)3W`Vxe(dNQ)U1Zj9(Ca?7+$OoGwmh~mb4>PY~LF-FU z0HB_c^(80>dpy1bg&=Z}dwG0?;k~~Q_0sX!IW)6cagomS(rSGj_wzUt$=*1_Zmx6p z(-29&GwCz#=rJcHDc12d=WUmcnE`_Kz~9ltU9H0mHvf0zw* zZ~S!o$2e5E8bedd-aqIZIe`wO%ia6Ojs4C3fm`0?U%B@WQ$v%ogBu-Ma$Xy}*6enZ zPMz%vinI6Z(`9=W?s`$pEjwF{pOZ@SCt2B^Z?Y|l#D=ZRWIK(ve6zLKVUfxE{%}ty_PB9Ju`lM)ti4(y-w$BWq5O z57upEWZ#=0KO~-JWSt2LK=%h2+4m+W2p>Jl$odi#fJd=^fR}Q>701=)a zs`a~Onw8=NImMy!elyKVPBqQ?UfOakt_46BOKLd|{p8@}z)KO`Qv2uQ**YCv`2c-J z6d-ROL@Syp5xr_fG(p|X4{6cXc=Ar_(HbjSceu0$K5`7NNLtUE@L^Y1BvQt}Fh`n4 zxmJ{`T*^}luTP{d);cnS4mmaDP2tSNWtkI9F6Uc}qt@pnL#4w~ErfC?t*ubA>AG z1N9KBdf9}e8zQ~}(>x(ZOUOm8kp0GgWLA;3lHF*z(?!Ib(8vcKsbQQnkLbA~y2K^g ztNFG>DjL@(c5Fc(@2FO#=iO~Gq;2fKW>`{68R|FJZ<7pzc+*x2&*aTvBZ|MnE7Cj} zJ}ViX;mUATur={qgVuX1dQgVu(2O^SyOL_Gf^`f*h%#_>a0hh literal 0 HcmV?d00001 diff --git a/tests/cfgs/default/pcap/dlms.pcapng b/tests/cfgs/default/pcap/dlms.pcapng deleted file mode 100644 index 703a2124ec311bf76535fcba9e508592436c3c51..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 41744 zcmd6w2VfM{`u5N4Cc8-hNkV`i5D2{`CRFJly(&dYXrW0j(m_~5m!ed$02;)L2ndKY zLAii*2%rX$fE2;P1sh^P1NlGiJG0YwuakSf`#JX>vb%}%%=taLs8ySnaQFNL7wJ-<2srAu8dEWsa(t*)G$DQ$&tg@kUG-0o0G3X7=!ZLhoZyAT)s zOFE=CoZes~y$v<~+}|3nsmMyQD(lr#^m>pMY39FlesgAW@%GSMnjZah$sf~Yy%1Me z#NNwO<46zMURi^*2B6SJT2i&B1CQY~6-(W!D_Z?cbz2I($I~Js3#N?+Ik`^1k(Rt~ zbA2jYiayW=`=?^jsIO?G*lNT^7HnI^sNqZZy5pDSmwe33T%Y8r1=RXj*j4X-hrH_b zw29s0V7D?YQe0oOTGm2cN`TvMT772W*l8nX<(@5kpdVgSv1oMe{xfSlVXF}&*sm1E|8}bD6N0qO^>j6SRIR6lX&~QL!naZIEhY_C zD8Btpb=B&*7+SPZJwGj8`@kr?ree|PtN2#a^gPhA+K{JHG0u&*8^@>43;DL54jGIh9qXVf07Eh zLZU_fC|5Y-`G{On9+x}6RLCvx!zKT4%RfToAEELOkNm?c{|J+Rgv&o7 z3tOX-R5!Dazn@*<+{f#g$#E6n<3rCjRTdTKuE`}ffHFFEfIWsTU#hgzl>HMl?Q z5QR2F8fMSthrAlhvtQY>?~Iie?$1+ zQ2y70e_>+bC_yF`qOfvF;s2qD(&TCZJbU5kJOURnIEHvmEwp#hc+s zLZXEvTT)53#AUQZ(*6W()y1v_`4j52$=G0jvMn=!XWKhmaqihKnaL%noq2p!{XBb1 z@C?2jtB6J+L>$GTPn{Gc$Q%AS-zG94m!>iWsTTKSM3Hy4fgEa5^j6XX6}qR z8036*k3IXB$uqRGEH8O>Yq08B5aX>)-YD_i_W?Xxzxpx9 zo@IG6lS`tV<$o}(xXRN5&ywst`>bEsA*Y@x8nKb0K{Zt)j5OG@kBg+*dsca7#GxRb z{lT8yGS^y;iJ|44dnRkZv%15K8tmCm zMH}0D_UpI`!94quJ^R+=8MU(_23ESo+1#^_l*wX;&>*`*g$&z^*5<=L~OmygSq{I@ztOM@$D*nf!9;3BsM@T_3# z0nR-u1<$yhJ%gDTd3@WuB0PK2-m^bH8sOYBS%dnOZBWPJgewS?~C!--8VqdI_Q#{SRq^9LH>g% z`9G*gZL(=M*dplo&110ZHD);XrE+F+sXWw{rkqllRfaEJHD4w{i#B34bL)&l_?4hy z$z@szL9BMQ2P@s2UY4u@Uy98$YWUI%xZ^wjvMy(s|Vb! zzA}1LDi1trL>?`Xf`1FxKP?|ffPd(<>~j07&#rUcu4E1B3!AF`u?DxRfa9?- zAH5aKvmEy9hRL%9@T?ViRuD6<%DhJpc$UDPVLZmIirZ1hCo*B!CjyP9D)FC4O4k{o zbZxe-;lqFvB6}JH@T~jw!_GZxm6=?c+uY=JD$hsYSr2>9{`@n;xo5HlJgZg5sKK5E z9FMI`J`=>V6mH)=uNyrpP3^2BdDdC!+fkR^@az%x4C67N)y*eKZbQZ=&x9cFtH54) zi-dFD=XLCren=J_B{Bo$iM5*DbnaP4c*gB)a;(ZTnd)ip*|JJMIrmJ~fM?Y=8a3E6 z!+7iv1wA(EllQi}bLdUHreZmNtw@omo%IqX�aCAkPkLmbFlqRCt!`OHYk=XXW2X zQ&3gp&Mp^LgxFZ@!dO7Md&oz}Za#NKyp{K`G*8l?MH_J% zlAQ0b(|O=5Sp%MYtn^1<#2P#g{8_Wf$~>@Jo-c5V@)$L1^T25&j*av`dn{7bxA^pU zii>?}Zu03n_%wlhO1hx>)Q^q<`tk1U;vMK5hIwe0E0lDiMCo#R{Q>kLHqyWOLq+F| zCuAm<2?OJtNh4Io)xo%*J>x-V9#`vV$qxd|wP(p1V7#NPQG*%(Ui)2zF=|L1d5GxO zL|?}=uAyAV4i%nM^=%ltnQ=2C<1%4jyo4CHtEDm?1jf~wah&wxUuRsr{PWHkF9GAy z%owvfN^V>mj0f2>&ie9swT^$8v8(~c1D`c&Fyn{IjyEz669@mLXFOHMcowJoSz_u4=td;h`8qBtL=+g>YuRI&&77G{a z*{+hUWpDr4@Y>-icu&Q`c6f@1*_Ji2#X5J^m&A7XQI+jzu&wV)uNm(i_uBx4Ek+A8 z8%$?T3H?-lS2Pk+eB$=cCi5qsh2h}nn9Q*~vgaSp`F{!ibHV??#GxvihTuQip8u_8 z?jw%RfwBhp|5(AO!Td*0eqZ5VSYEUW6B#rW&TWe7sE_ScA9{}jiES_QZ(-s;7yR!N z{|sgR4D}lW{tY>{SNzaejqORN+S|wWx>+TUIL^uHe4&wJz87P`cPH_ka9`#782FB}=X-NN zW5;|I4e)IVY)aq38q9ZlhuTKI!PfEnSL|@)AnH!V!gqU0IPvY7W#YRNe5(=PXXmSY zCxY)|JT}6*2l4&;tm7A4HQ2e2)iRUI)`XAQ6H-;iP2uB2%}1ImrH#(7&Bu&7(gv@o zSn`+pLJ-GYrt6w6${O&o)&!#lkBtJZdz`BHbTH2%*s}{p&&t+>XZ6UlJ_S|JCd0F) z>>1WQ{@VJ||7sn7>9RS_J*x-LsO@EsSJnwozvl34vb|^dqUSpIOxA#B)xT9eV-5B! z;JQcmH|GWOEDwA3xydtXXU)j7CCVB%>hcWLi9N%*hqg#B1k#9ri@&_okJGn#+D@By zlCK7!Ii-KM7b)O6{-j2)JNK+vW^y@hXX9I_JX=sb?LGTo`|Hj-+PydZiWK_UE`7f{Im;d2?=bp8P zXWY)leW3De3D0m6_2zHx8QJ76l2s_Wx z@?UZ8nXCcN>LV@HYp`bluS>f$=4vp{9%9eV89ggc?JSi%8-h?HE!1T?JZr_CVIAb} zwT@rC`LE7BOND3L&c?o>@@zx(wD)Z6!28ZUlQpPse9x%Co&{V7X*Vq=m}mLfvrLm` z)Xs*GXX9U2J(~&7+OTJ|4ifNMPWe>#zg@@Q9#-%u0$EV8eS_^5#pF@T z4XQ`;;ZX-}R~V1UV`xgq{|@W;>+a5X?%!hg_X_#u?DxRfa9^mc1weKR)9S_Yx3+Bc=if;cIso*vxV@i6MIJ2q0!Yb+>ZVZ>-g=r zY;f+`E1AiaxXq3JN#*$@JX>h**;D=Bb?%w00nch8lTq?S)?m*9j>pn}+ZN2T820Rp z(X&d_&fXx;7KW*wy#UXiWX~`j`+Ke9_x|Sv=bpU*&$yk9Mzd0Qc7b4&!UaaUrVB|AAJ+AsaVcmD^d!wXQulXDp5PzNS;l`%#D(B zEP-cTc^$vw-Z~&Wjps|BRu(&`o2+jRbJiU$r8P5V2A{h7(hFk^sl;!}JiE&kC9rH%7dJ4Hrg@%yWu@ZBD95H^Id2EbvyWsZ zSB?SSoKf$qb?*VbI13C=G}7>sHmYC#Tg{F+<|}J}?}yh^jb5a|e5aHyWaJwn8hiD8 zpOfWTf9|ubj}63oDi*$7QwlTRiblSbW5D+s@f}uA<@+-D_VT62$GcYytM2EEtNxiV z{hy`Gb4=kGJoVBb0)}@{@YB1}4 zc~%%%d&E!G1F;@cY*DbdF2bzKn^^a})a6oPV*T+=mGx?{?#pqV<^I5VT%UP)i(}T8 z3WN2t#Cqgyl|z59UTx3%x%pcivsN^~db*aMvIet0JGPjSwO3S3(6iR}(O*BhBUm5( zFtbiFv3?e;s}k$YAu8+F!MZ>9(b;`+6xQLPEyj--Kgrj}zK;$s@~LyaRl)aV>Z3=# zr}7;LzL@>7>!Zt@`_wsKSp$5}?=WgG-#h)|jC{kywat3I`tjq_?am*=4Ksp@rQc|o zQk40c&ViL*2H$qX_f|WV?;7wO=u3}|cgMv%sqif%3J3_3p1DsxeE56kY}1zE^6~NPBS-U3Y`AEyirCnPPVn z*bXMPX)9E=Yr%F9vrQVj+8?{3b)f)kmz0YwZOw0F)|)&Sp`2t#GO$r{X8 z%Zo92MXS=1n6e=d-#sll9`A{|Q?c-EpHhPPRx_=B%M zL9Rx_L^^=|U2U)LDVjOTIp6m)ldE``??$!mBfuB4cy{NsSKk`#oUg0_zCWEXYA|0d z7gqSXM0A>-uYTOIVf(n_Pk}8J3*T-jC7EvtBi||>@XaK?ua!{wZUWyCzVuSag|jaB z``ySE9lIshs8PMTxYc0ntY`60_z7OhNv7yf%PVP)*nQ_ z;GDIr0oD(9FlsPsEf=OsBXIeIBuX#Qv!-@S8;vnPU9&V;EXOnJ3MST-!1@Pbz5Y*? z^=7ah#j%{VG~CY`wOWGW|R7k7(IMo$>v>4PDm`7oS2kYZN>~b7CHuV-<-NU(=qQa zBEWkX#q)6Oyfg;9vGQQocihQy*)eZL1H1<N@vc%(<^3LbkKuTZ+r!WJ;l5cufR1@=<5`+3op74BeNh&CXHz^6 z2T>)~#(^(JA9j3uw=ZzQY2K!2fbVCkj2g^W%ZU}fE>Q@x16tmu=bN>$(24H&9TiJF zw@E2u+h5EEU%vlyFnU2Hx7Z23<1F_aNYgg7qsy{wbBmJ=A9KzZ_e@sdYlnwx=lzM` zyVIU;iHc2}^OZHgx7J9NFKaMgEiY!i68huAA%XbDRcUdeC+bhd!nb`&S>{{D)L-D* z;V<|evb-OveD{FwM2_E%pGaDNj1F1KnICN%zc;?>@0>60%c?@_&^g2Fsdb+MzI*KX z-q<$4IbT@=e4iR^)L_0^ZmjTiiFXnM@lE}3Xt4M#XWKtuZTbto_v>Hps(e2H-zglw z%&J>zWcy;swFp;58%s3ZR6Lo^=;>T zaX(g-Z;0=(47Kh)@ZD$6H_5flIbT@=e2=FZHJGn1H6Uz0K7bYrY~%N0|Cp1G^9S6Ml@QB(G2B=Bhgqa=&v)6pxRZ|a2U!Drr+#GAV7^*D ztnhV-2DtmjK7S}Wyv)fU=eJ7C*EF_Ehy`E1?<;?Z%J&%f&SJjV>)NU3H+d&oymK2C@$Xm^W z@vY2!zq=B`4%?uZF{N9Wxlto>k}&9GvK>`pPif3Gr}LgdA(n{qrH)du_EV?7!!koAZ=nm zENCMJoxb1VnDb@aO}JP*!i>^Xn?*;dD#6%BB1yws?{oV7ey;p`T>4fp8l z=Z8C1-+9u1U7Uq;tCR%h9B<-09Gv+cuRkiOoIe5Q=S}zCMhdYP893>g*{&FN);U|; z6O}NX*$!9hy$EbSv1i+7d!}=?vIf|uPBCgQTP+7x*oKI$hCW!&c8c%9Nla`6S~E(t zWjh^g`5uvhn95MbaG7Aci09tNwR}a1;V4nG9pcuG?X*W-r<|VOF5{kxgcq6ZqiVgE zf^DWf+oyN9PB}flDH>qAtB6s9*=qT(!ZuV4?i#3n$h*mNDoFqE2(yhb#qEn=%h#BH zQD0?y9&DF#|F9y}e@}jR-kh9p$;*$PKP0|d8=!w!KChy4&bU51VFz&@^1I4lIXL6) zBkFt1{cwk;D>>&ZYk+gv7^4Pr*79J5Gc>0K;@tb6iNQE0G3Np%&O5+)7R~ci%cpYA z0_Ww-d3Q0F+7IXCxK++GmImP5VRjqmoM(aaIp(}uWv~LAv+Oy4p4!$qXITTBdmJ-r zFlQ|vRycdb=Z1Wk+AeK$uDRT^!>J&BMKW_X=M(3^`E}wvWrfQ55;(8mz9OsMIfZk6 z@#OM2#h_|55KoU?r$Y;Q8#*=oIC2HQ*aYt%{g0H18nzb{V;1VTP+t>*oKM7 zZ}c&&XL~YgMliNjnQd`X4BrIXJ;XNjN0sdruzi`?W``|N*t$iXTLIV}Kk}M$wtK+# zKC@MF7-+5p+bi~L5072voUN<@wowtPf2_f5EqQRbIQAeA+doQd3dXh?vn^&~dmn7i z5!7 zqURUsp8a=O)&Sc+?-(_F=|$b~F$r|fzyZv0t8wd=Hcjz~G^K5h!%y0%PZ$$-?o?;I zreev>nx|B^i`&E~u)RZUJ13}YZ-DJ;UwR~-I}`UN;`T7~pP1((EpvY`|KabQbG-wu z{5+q*il5MX9b9kNb6uPMz4MrrHNf@SuPRs8;Fz`Kyutc|ALiT%7PB>&t7)w$5zq6v zl8?AfudQMfhgU9UdQgxkk#WOk+TQS!eYMtKz zS46N~9@Z{zy$q-M?iE=BTnB01u?EMiCEpD;PD`5ED5EP_Q?c{~tx{?+SJQYnu@$&B zrl>!$$iU7{&)ARCI&bRhoNaTk?agf4t8Cu{TdZvQ+0H^eXrq2EWk$b@ zet1pA60-;m-_u%^`$L;Rkn}Wyf?J~2RvwaF|M>E^PYQ5Ki?e`knG}Mna zV!Pw(SIPaY88nC5%k#YvTt=4-Z*#4}sO=I_D|6G|_&SO{B0NZJp{#MRq ztYOM+Id+L{;5DGQZC8TDZe8XYW$F`ff6|o?h->pDD%W4ZbtA`aTn+!&mo2@=&m6Ri z-J9Efch2_%@ZHLM$EbCG2Yit+`D0hlcYE1;&iTq3;QL^#QG@wvbG+!C3h^BJIm3M~ zR9D)leXhElodJ^qt-;r0zWGdiw}S6^;=58AyP$r*gYP>$hn{q#vC=ot^?h^zo`tq^ z=+lbFo_-A4R4nJ5>Owx}n7+^M%6afT!F=neb>B?-_I#iCB>uGHoI%zA-!gZM8q8PA za}~ZW@uA_K0R6bv8&&3X7u1i6C1+@vQlI%ooA{mpUmicijga+GzdyitvnkIl6uOTl z=Sa`o@3wilu5-4O-(P07%5|I2+)CQ^Y!^P)#5r4818kRndzR#0bN4{q$@no*5F1Z9`@oX^PuBU|WIu zg=R{>g!<)x?KWn+qH`~$Ux*6KcJ9JC&e>MTOn!u~`F$!~t@n1)wrAVx$2rc~${JwX z?YL2c*=qB-3foYz1K*0Htqbef-p!eJx+{K1#nLCVN@>JwA2PCi1lRmtZ9;4>w3hYv zUY;g_?RFkV>|W--ZZBG-<*8vmju^J%E$3{TfNfEZTW!5(Cu!TW9anq1bGEVu*fyN2 zvSkfstL3^1TaWm{aG$K6?SdY=gRyPQY)$90M~Z@NZ(@7nJ(X<;*zRPuS#ysoaT|nf z&CA!Fv+WJGNzAsUTJQJ4HpHIokxI9mvz0Z#cJo%F2D8=Xa22**5o-8ONj=;86Tb__ z_AzEl&tKL(gZYspu$@e7k1BaK>K6vK?=#!%_nueT#%1GinWSevmlb{5bH-_&aCI`+ zHeTogPWsK32c592 zS_t>M_Ho;;eiP?xw}36a_ZMtmRqMTvwC&mE&uDTc6){7_l0yfWYrHCJfbH=fMh%{8 ztXb?wW$dfOtw%&l;_(f>G-y!U9EU<1jUP^5Y;gwDLxJYUo7wgW_@3XZ8N_x#3zh9d zV7rgUy&WTNAZ~-qk5Ah()H&A-aOLY32I3Zfr9apYu81zXaoPL*hdGZ~Sp!@P4>oFW z%vy5WVCS*xo{_;~wmEYRGsP^fTe$iyaeb@5$~6*P_jAmS`+2s%Kaj-5_4YBlw#0MJ z*?tSQD>!D8)p{QU+emx1F|8Llk6Bp*YzJs#GS=Xjoic8cF=j(4W@qlQjoAtz%Ywyh z3)}u+#icISJjAwbQI%~p*dFAVT~Ugj#~vhRn{L|ZnCmqUxYGBRa-52 z^s~4ZMe2+d^fdIR=6-f{#mrza+sd{-_z-Lx5ZhAUs%#5`?O~4Dtk$=K$L#d7_ndQW z0Ip}4>q}~#kAN%cXcx2V$KP`vv$6)b{-Nc~tidsB$!UYl&%84r`%IAenbyoT)D*L4 zz_mMZy|7s2S_E8=@HkhyE}@Y0YE*zZgwxT*&N|I$uXP98>&#Z^-=TRNY;h%*9or|` z7dz`Tr&Tn-c3%zEKh|KjT25OD0nKxZaUbdPF8$o%=k?>x2ANxILu`9KFtNQ3w&RFx z(KwZDF{-Ea`dmJMg9U8o7Vpkzv*|4lz zU*~KWWhN)_bsznIRoP~MEnK#X-Jibh>zu8u0k%!f8#S1%HgBu2b&JhE>e=dJck+XQ zXM?Pnwd2^$F~)8ZuKT#Qf!OZV`h}8Uo5AZ29eerjW%cBh*6&|8hO|kO`g&qO8|Bo; zzMJWs?*{Ot@2Ab_zhABU8SpKs@qLa2u#v`%Ic{jno9oW;pdP_b~VFz*xMn6TQ!5xtxcPlSK~ z#+pLV{>UFpX7EP!sxp1^*uII*%iU_CvMo(OPkMA>g5%uU&8HK zMcnb)sayF~nDE5Nzp|Wp!o}r$@~4Os<2$*J`nWz+FFmil-Yvm+eagI6 z{WV@av2UCU#hSsPB5mQ<-`2xxDiL^Cvda~LRZir7qL~n7qY-U6QA=N-&*-;8{Tu5R3ZznwRPyJ45bXuy`3}}tUdny*Keu`EHgI4=kJom1t+Z{QOo&}d$b4|F% zn>u@3XqY6;cX`tm$ZuTIriiq#q~xmAs@JGlYhPr@LsUIapAtA8UkOZJU-Z#&P~B&t z`0G9s$AhFtP_Z1(lgjb*HXKjm?EAj-T5fmJ4|Gj=--^29dBcq_dS4s5hJMf?Ak6px zVvCDu!rS3JpL%@?^^g8zn1y42i{zyB7-}iUFx7Ajr5l{)z`j)CGcchJF~1NM5Cs0` zh|&J3uBj+~o!QW-kM~q8b$vw9nPt!^x)%5EN8x!1hqudPe91kQpN&BKrTy#cF(()G zD3L_VG=j$5n^r>OPUgZd7CJ?27Z2i{Y$)Z;Cs9(fJ*Smr(8TR+e3 z&T3Ye>f!&6qUmW;y}(~{hF~^*@fkjmj9-O@Ph6Hy+?G#5v`Uio7~^rbJ3FZ^`L8{1oAyh5^u901h3~!%?E8cM zqcz`M!sq`cJ5fAbJvN5KJKf`o-fLU=R@1F=g|_c3(IZYt@GUF4`ek8T$U(sg_)xu)Di_a1DPTv z)D#89BLjK9I2WEbbg}0hmfj8S`I20Cp3#mykLl`_M5sS<>;G))`O;i?-sCa%d~|32 zZdUfh-2_jz^T(9FoiEFU=S$DB=QYdM(b{>4&ht=z9IKv(TB0D-5(S}_DDYUKz+;Mn z{qqBPzC0J6SHu0;$l;c}#!r($1H|Uf;ZpJ1-_Bpmh3BR4JY%%;M{D1fgvTGbKkTvf zd_^uiU-lAvzOD6QwVj7#W7dI=+uY7y%7y3cudwGS?Urethw41{_~Tgh++&FXk0lB` zmMHL8qQGm4f^&Qijomr@`RzFN z{O+V(s^_8Of4BF1WiC9wwwFEk4ZEv(?$LSf^~bU5xz`c}UP}~sEm7dLM1j{71;zNe zoOYhC%7y2D^?bfM7oN9~+xh76rSQ}lf8NcOzuQyo>$J>Q?O_x$x- zcz$scd%iTBpFb#{&%HX&!~AiqdLCwpf-p-Igqfm1NWDupFr3fnlZJ**hT?86``kS} z7oPvs^ZA-wc>djPZs*JU%p}j1T;{WX+Is#*EbZB&MSIWJ=EC#t zq3rq2NA_v$JWTdHga;!YUGAlQ5{e~EiUQ>m-Oxl=gxM->K6Lr!#L$y?fq`JSs zC#JtqMtB#CqVdu(Qtt5_ivL*G<5&mcJr&Ebc2$nGr{P$eT&TEMl5#f}B^6Wj={WS` z|F>}*0muKPl;c=pIF5&!7shdXPAgX0=FboH``!?2-vQKvr`&B%}UKUeY7q^z*0hK({SEqhir* zpy-Y_=vJED5xNJ3z;svte%>6HB)MGS^yr$rQdClT>_|jOq(NHxIkwHvYKhONShVUW zT9XZ0<)UjrOLt$gOOTSwlM`MXGsW5*n?7E)K&KvlN5!I3TG3f-(8=FyFm&iz72W2K zmsEV__h~EkT_5kMSoR%Y9 192.168.137.189:4060 [proto: 379/IEC62056][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: IoT-Scada/31][10 pkts/2942 bytes <-> 8 pkts/520 bytes][Goodput ratio: 77/6][0.03 sec][bytes ratio: 0.700 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 3/2 13/5 4/2][Pkt Len c2s/s2c min/avg/max/stddev: 66/54 294/65 1514/98 458/14][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Plen Bins: 42,28,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0] + 2 UDP 10.1.1.1:0 -> 10.2.2.2:4059 [proto: 379/IEC62056][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: IoT-Scada/31][9 pkts/785 bytes -> 0 pkts/0 bytes][Goodput ratio: 49/0][< 1 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 60/0 87/0 181/0 37/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][PLAIN TEXT (01234567)][Plen Bins: 55,22,11,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] From f37c0bfd043062b330e32dcafa880c6784a13385 Mon Sep 17 00:00:00 2001 From: 0xA50C1A1 Date: Tue, 2 Jan 2024 15:43:49 +0300 Subject: [PATCH 6/7] Remove empty .out file --- tests/cfgs/default/result/dlms.pcapng.out | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 tests/cfgs/default/result/dlms.pcapng.out diff --git a/tests/cfgs/default/result/dlms.pcapng.out b/tests/cfgs/default/result/dlms.pcapng.out deleted file mode 100644 index e69de29bb2d..00000000000 From d004eb1ece4b13dc7ff7f73355a0f11922352783 Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Tue, 2 Jan 2024 15:17:18 +0100 Subject: [PATCH 7/7] iec62056: add some documentation --- doc/protocols.rst | 112 +++++++++++++++++++++++----------------------- 1 file changed, 57 insertions(+), 55 deletions(-) diff --git a/doc/protocols.rst b/doc/protocols.rst index 7a2dc29a1bc..ef3846d8051 100644 --- a/doc/protocols.rst +++ b/doc/protocols.rst @@ -8,10 +8,10 @@ Work in progress! .. _Proto 72: `NDPI_PROTOCOL_HART_IP` -============================ +======================= Highway Addressable Remote Transducer over IP -References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 96: @@ -26,19 +26,19 @@ References: `RFC1350 `_ and `RFC2 .. _Proto 127: `NDPI_PROTOCOL_MS_RPCH` -==================== +======================= A Remote Procedure Call protocol over HTTP from Microsoft. -References: `Protocol Specs: `_. +References: `Main site: `_ .. _Proto 338: @@ -47,7 +47,7 @@ References: `Main site: `_. ==================== The Secure Real-time Transport Protocol (SRTP) is a profile for Real-time Transport Protocol (RTP) intended to provide encryption, message authentication, integrity, and replay attack protection to the RTP data. -References: `RFC3711 `_. +References: `RFC3711 `_ Notes: @@ -61,7 +61,7 @@ Notes: ========================= Opera VPN is a free VPN included with Opera Browser. -References: `Main site `_. +References: `Main site `_ .. _Proto 340: @@ -70,7 +70,7 @@ References: `Main site `_. ========================= Epic Games is a video game company developing the Unreal Engine and some successful games as Fortnite and Gears of War. -References: `Main site `_ and `Fortnite `_. +References: `Main site `_ and `Fortnite `_ .. _Proto 341: @@ -79,7 +79,7 @@ References: `Main site `_ and `Fortnite `_. +References: `Main site `_ .. _Proto 342: @@ -88,7 +88,7 @@ References: `Main site `_. ====================== Generic web traffic from Nvidia sites. -References: `Main site `_. +References: `Main site `_ .. _Proto 343: @@ -97,7 +97,7 @@ References: `Main site `_. ======================= Bitcoin is one of the most common crypto currencies. -References: `Main site `_. +References: `Main site `_ Notes: @@ -112,7 +112,7 @@ Notes: ========================= Proton VPN is a VPN service operated by the Swiss company Proton AG, the company behind the email service Proton Mail -References: `Main site `_. +References: `Main site `_ .. _Proto 345: @@ -121,7 +121,7 @@ References: `Main site `_. ====================== Apache Thrift is a generic data interchange framework that supports a bunch of different languages and platforms. -References: `Official site `_ and `Github `_. +References: `Official site `_ and `Github `_ .. _Proto 346: @@ -130,7 +130,7 @@ References: `Official site `_ and `Github `_. +References: `Main site `_ Notes: @@ -143,7 +143,7 @@ Notes: ================================ The Service Location Protocol is a service discovery protocol that allows computers and other devices to find services in a local area network without prior configuration. -References: `SLPv1 `_ and `SLPv2 `_. +References: `SLPv1 `_ and `SLPv2 `_ .. _Proto 348: @@ -152,7 +152,7 @@ References: `SLPv1 `_ and `SLPv2 ======================= Mullvad is a VPN service operated by Mullvad VPN AB, based in Sweden -References: `Main site `_. +References: `Main site `_ .. _Proto 349: @@ -161,7 +161,7 @@ References: `Main site `_. ===================== HTTP/2 (originally named HTTP/2.0) is a major revision of the HTTP network protocol used by the World Wide Web. -References: `RFC `_. +References: `RFC `_ Notes: @@ -174,7 +174,7 @@ Notes: ======================= HAProxy is a free and open source software that provides a high availability load balancer and reverse proxy for TCP and HTTP-based applications that spreads requests across multiple servers. -References: `Main site: `_. +References: `Main site: `_ .. _Proto 351: @@ -183,7 +183,7 @@ References: `Main site: `_. ==================== The Intelligent Platform Management Interface (IPMI) is a set of computer interface specifications for an autonomous computer subsystem that provides management and monitoring capabilities independently of the host system's CPU, firmware (BIOS or UEFI) and operating system. -References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 352: @@ -192,7 +192,7 @@ References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 353: @@ -201,7 +201,7 @@ References: `Protocol Specs: `_. ======================== Protocol Buffers (Protobuf) is a free and open-source cross-platform data format used to serialize structured data. -References: `Encoding: `_. +References: `Encoding: `_ .. _Proto 354: @@ -210,8 +210,7 @@ References: `Encoding: `_. ======================= Ethereum is a decentralized, open-source blockchain with smart contract functionality. -References: `Main site `_. - +References: `Main site `_ Notes: @@ -224,7 +223,7 @@ Notes: ============================ Audio/video calls made using the telegram app. -References: `Wikipedia `_. +References: `Wikipedia `_ .. _Proto 356: @@ -233,7 +232,7 @@ References: `Wikipedia `_. ============================ Chinese microblogging (weibo) website. -References: `Wikipedia `_. +References: `Wikipedia `_ .. _Proto 358: @@ -242,7 +241,7 @@ References: `Wikipedia `_. ============================ IEEE 1588-2008 Precision Time Protocol (PTP) Version 2. -References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 359: @@ -251,7 +250,7 @@ References: `Protocol Specs: `_. ============================ Real-Time Publish Subscribe Protocol -References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 360: @@ -260,7 +259,7 @@ References: `Protocol Specs: `_. ============================ IEC62541 OPC Unified Architecture -References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 361: @@ -270,7 +269,7 @@ References: `Protocol Specs: `_. A proprietary protocol from Siemens used for data exchange between PLCs and access PLC data via SCADA systems. Completely different from classic S7Comm, but also uses TPKT/COTP as a transport. -References: `Unofficial description: `_. +References: `Unofficial description: `_ .. _Proto 362: @@ -279,7 +278,7 @@ References: `Unofficial description: `_. +References: `Protocol Specs: `_ .. _Proto 363: @@ -288,7 +287,7 @@ References: `Protocol Specs: `_. +References: `Wireshark wiki: `_ .. _Proto 364: @@ -297,7 +296,7 @@ References: `Wireshark wiki: `_. ============================ UMAS is a proprietary Schneider Electric protocol based on Modbus. It's used in Modicon M580 and Modicon M340 CPU-based PLCs. -References: `Unofficial article: `_. +References: `Unofficial article: `_ .. _Proto 365: @@ -306,17 +305,16 @@ References: `Unofficial article: `_. +References: `Protocol Specs: `_ .. _Proto 366: `NDPI_PROTOCOL_ISO9506_1_MMS` ============================ -The international standard MMS (Manufacturing Message Specification) is an OSI application layer messaging protocol origionally designed for the remote control and monitoring of devices such as Remote Terminal Units (RTU), -Programmable Logic Controllers (PLC), Numerical Controllers (NC), or Robot Controllers (RC). +The international standard MMS (Manufacturing Message Specification) is an OSI application layer messaging protocol origionally designed for the remote control and monitoring of devices such as Remote Terminal Units (RTU), Programmable Logic Controllers (PLC), Numerical Controllers (NC), or Robot Controllers (RC). -References: `Paid Specs: `_. +References: `Paid Specs: `_ .. _Proto 367: @@ -325,7 +323,7 @@ References: `Paid Specs: `_. ============================ IEEE Standard for Synchrophasor Data Transfer for Power Systems -References: `Paid Specs: `_. +References: `Paid Specs: `_ .. _Proto 368: @@ -334,7 +332,7 @@ References: `Paid Specs: `_. ============================ Ether-S-Bus is a proprietary protocol used for the communication with and between PLCs manufactured by Saia-Burgess Controls Ltd. -References: `Wireshark wiki: `_. +References: `Wireshark wiki: `_ .. _Proto 369: @@ -350,16 +348,16 @@ Monero is a private and decentralized cryptocurrency with focus on confidentiali ====================== DCE/RPC is a specification for a remote procedure call mechanism that defines both APIs and an over-the-network protocol. -References: `Wireshark wiki: `_. +References: `Wireshark wiki: `_ .. _Proto 371: `NDPI_PROTOCOL_PROFINET_IO` -====================== +=========================== PROFINET/IO is a field bus protocol based on connectionless DCE/RPC. -References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 372: @@ -368,13 +366,13 @@ References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 373: `NDPI_PROTOCOL_UFTP` -====================== +==================== Encrypted UDP based FTP with multicast. References: `Protocol Specs: `_. @@ -383,19 +381,19 @@ References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 375: `NDPI_PROTOCOL_JSON_RPC` -====================== +======================== JSON-RPC is a remote procedure call protocol encoded in JSON. -References: `Protocol Specs: `_. +References: `Protocol Specs: `_ .. _Proto 376: @@ -404,7 +402,7 @@ References: `Protocol Specs: `_. ====================== WebDAV is a set of extensions to the HTTP protocol that allows WebDAV clients to collaboratively edit and manage files on remote Web servers. -References: `RFC4918: `_. +References: `RFC4918: `_ Notes: @@ -414,25 +412,29 @@ Notes: .. _Proto 377: `NDPI_PROTOCOL_APACHE_KAFKA` -====================== +============================ Apache Kafka is a distributed event store and stream-processing platform. -References: `Official site `_ and `Github `_. +References: `Official site `_ and `Github `_ .. _Proto 378: `NDPI_PROTOCOL_NOMACHINE` -====================== +========================= NoMachine is a popular proprietary remote desktop software. -References: `Main site `_. +References: `Main site `_ .. _Proto 379: `NDPI_PROTOCOL_IEC62056` ============================ -IEC 62056-4-7 DLMS/COSEM transport layer for IP networks. +IEC 62056-4-7 DLMS/COSEM is a transport layer for IP networks. + +References: `Paid Specs: `_ + +Notes: -References: `Paid Specs: `_. +- Wireshark is not able to recognize this protocol. Some old plugins/code (with some documentation) are available `here ` and `here `.