From 2d1906e901bb3206a7e4a1e408b2a8f0d40033cd Mon Sep 17 00:00:00 2001 From: Toni Uhlig Date: Wed, 10 Jan 2024 13:42:34 +0100 Subject: [PATCH] Improved uTorrent via utp (TCP-like streams over UDP). Signed-off-by: Toni Uhlig --- src/lib/protocols/bittorrent.c | 28 ++++++++++++++---- tests/cfgs/default/pcap/bittorrent_utp.pcap | Bin 42889 -> 45104 bytes .../default/result/bittorrent_utp.pcap.out | 15 +++++----- .../default/result/lru_ipv6_caches.pcapng.out | 14 ++++----- 4 files changed, 38 insertions(+), 19 deletions(-) diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c index 2d687654e36..630a4113c4c 100644 --- a/src/lib/protocols/bittorrent.c +++ b/src/lib/protocols/bittorrent.c @@ -2,7 +2,7 @@ * bittorrent.c * * Copyright (C) 2009-11 - ipoque GmbH - * Copyright (C) 2011-22 - ntop.org + * Copyright (C) 2011-24 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH @@ -34,12 +34,20 @@ // #define BITTORRENT_CACHE_DEBUG 1 +PACK_ON struct ndpi_utp_hdr { - u_int8_t h_version:4, h_type:4, next_extension; +#if defined(__BIG_ENDIAN__) + u_int8_t h_type:4, h_version:4; +#elif defined(__LITTLE_ENDIAN__) + u_int8_t h_version:4, h_type:4; +#else +#error "Missing endian macro definitions." +#endif + u_int8_t next_extension; u_int16_t connection_id; u_int32_t ts_usec, tdiff_usec, window_size; u_int16_t sequence_nr, ack_nr; -}; +} PACK_OFF; /* Forward declaration */ @@ -68,7 +76,13 @@ static u_int8_t is_utpv1_pkt(const u_int8_t *payload, u_int payload_len) { if(h->h_version != 1) return(0); if(h->h_type > 4) return(0); if(h->next_extension > 2) return(0); - if(ntohl(h->window_size) > 65565) return(0); + if(h->window_size == 0) return(0); + if(h->h_type == 4 /* SYN */ && (h->tdiff_usec != 0 || + payload_len != sizeof(struct ndpi_utp_hdr))) return(0); + if(h->h_type == 0 /* DATA */ && + payload_len == sizeof(struct ndpi_utp_hdr)) return(0); + if(h->connection_id == 0) return(0); + if(h->ts_usec == 0) return(0); if((h->window_size == 0) && (payload_len != sizeof(struct ndpi_utp_hdr))) return(0); @@ -531,7 +545,11 @@ static void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_str if(is_utpv1_pkt(packet->payload, packet->payload_packet_len)) { bt_proto = ndpi_strnstr((const char *)&packet->payload[20], BITTORRENT_PROTO_STRING, packet->payload_packet_len-20); - goto bittorrent_found; + if(flow->packet_counter > 2 || bt_proto != NULL) { + goto bittorrent_found; + } else { + return; + } } else if((packet->payload[0]== 0x60) && (packet->payload[1]== 0x0) && (packet->payload[2]== 0x0) diff --git a/tests/cfgs/default/pcap/bittorrent_utp.pcap b/tests/cfgs/default/pcap/bittorrent_utp.pcap index c5aad330d4c66418107bcda90c40ae28adc61a8d..c2154473cd3ed1bbc744f28c10cbf16936074014 100644 GIT binary patch delta 3697 zcmaJ@3rtg27``nOSjVF`B0>wZSTc(U0@5Lh%c#RS#o?w4PNNno6sDr$BgSnMHHtbH zm17VPe8d+^G+|zy#`vBEGA7Q=g}Io;EORqcvrRX*_`v=DIqmkh_U=z^?!D*#&i8%) zf6jeuxUB8Cp>^w{qV$U-Nt&FWX4Js>sW(ETNU5l*df5u|OBq=iBXdKgJZW-yjjP;Q zy2xxTsj4YoQdwFvFV&m_=}fbAIX~ApGt;xPM&_iuY__bjin(RZ+)?G(slbbYI;aur zJxfw(0>24^funF>u;DuCm*wq-t>zY^7!AzcdG9u4ja#qR5rBhF7SpG^^~k^$gd16{ zX82%9!W42;63AVEOo00dOj8@ndNjF7m_<|~I)p$UdyP*FkKy_;tJB3Yi}rRrW)Wr8 zB1WM0o1PeyxR4la0w2b-19K2alDMzmz&>dc> ziM=~iki^EQk{tR1Fh~+LFgVHa89G5yHc*x1(j34Pn2LhBC^_jR=rE}gJUqh*jO^p& z>?B_)b)?qjsxa9B_YS^xkCThzF&kL0#KMHv>LIF9Up4{;3wBw97c8F-la)QzdunYT z>hTgB%Lqg*+HbA=Hbr4IpUOY^QdqP+a%(!plNCWucHQ zx4e*+@f1RZW{!yzkFjTB8hO4bOKK@Vu;>Ak)L1+SLAzs%)$D$BJW^H`7h6c%Qgr`y zR(lf|%ub{7>D1ps!3gHCwG>mIA0;r|)BP~Co@(4{Q#Nvf$ZQ-avoqWG;{u$611adYyS6k=W>;EFY+X}M z0?!1BteQUvA4DU&-b6(lK!kxJ`EtDQF|3(F@b!&>knfX>GMn8zDS>~u0yPr5Oh`aK zq}#+?KDoUvNoG%*-;c+^XXY9P3-PuVDo%^M@_8~ASsc8;52slKfqe)4!}*&S7=J27 z?t}Y2{?XaIqccImbfA@{KCY zD7gTdSipNadsilIQ3M2bbzS~wVWndiwbDxd({{f-MrQ7PMx}q3OM^U^L>>yts(4+1 z>i4LF><1hIWZ0_?>bka0R^0nmsY<0Bz9d+N9B^se#E%26F`A;oq(_khPP`1)c+iND z3gIvG;AgK$9dgQFFdG>(7d)$NQeyvz0;$k-*V)j>XBZ^O(ur3NIB4IH|5%jZcdH0o zio z?jNa<3M=ofd?yK}97F+2S7Alj{8Ih1tB)dUucrP_m)f0Nq{OG;SH#L0X`pe(?X99K zcoi><&Ob2@aCp$*RoL2pMgdE&Pk&QD delta 1470 zcmYk6Sxi$w6o%*CF5DI_ML~_N8bXchMKM({(FbC%E{GH!G-||Fj2cBngP0gGMWc<0 zMC>FQ2*pxbH;5AMgFg6R(BO+`jY|w}V2lO~ic2)$63?8ONc(jEf4+0hoSD<<=#x)9 zlrx{)>1>gSk&OL}L;_)Lf3R*>UkagXB>UM;zhVQeH5!<1RMJ3r<{3#)cH{RDd{eLN zQQ1Q44-@$f8Gh3eDTDUQ9}$WDG!gxs!6u`c;!h$$pPkMyYp7qgSP1nOIcUH<7maff zFz%acP!#GGqHjx@B%zvFp3K?n3TK~#!IGs~c(V7~0f24Oy%s<2Xs|Ga44McTr2U)H z^-OE83GFSO6jA^iEuiDf88kc1h3>MbngG|Q3Ap{TngE9;a`;AW>KNQPNw7UjQWIEp zDreW9OJMcNsRABtOoVHkE_ECn;sygDUf7!#_tx($M)$S`P5f`fI~`ImxIPD(_}|E$ zIXuOqjfrr4j(|UuCBm0N3}yQKeClOBh2Zm<*?%gjDG$x0snDXIs7dk;P66lD(g7>w%bbdc%6VV zMg@GF3ivQM!3NHb^rS$W4SQug)V8uzY)Wp@aH59i+eio|DumobH95?yCAX_^ieX-@JKY9H5q_hjL&D^K7*iRBszpPcc?hbrgxiQmicz!;@T#S)JXCoHj|U6YTX|^7K9vNcZY2ZitUkfsxoEM< z#Dgf7!MB5g25V&)k?|)i2eevBpr^~^^2EwNXkTT iy1qku%vp8?oXOw>d=So@*H^)r22ON 192.168.1.5:40959 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: Download/7][47 pkts/36653 bytes <-> 39 pkts/4836 bytes][Goodput ratio: 95/66][19.22 sec][bytes ratio: 0.767 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/11 223/425 4392/4641 701/934][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 780/124 1514/519 609/123][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][PLAIN TEXT (hash20)][Plen Bins: 52,1,2,4,0,1,1,1,0,0,5,0,0,0,1,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,6,0,0,0,6,0,0,0,8,0] + 2 UDP 127.0.0.1:49861 <-> 127.0.0.1:33333 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 6][cat: Download/7][3 pkts/195 bytes <-> 3 pkts/186 bytes][Goodput ratio: 35/32][2.70 sec][bytes ratio: 0.024 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1205/1205 1348/1348 1492/1492 144/144][Pkt Len c2s/s2c min/avg/max/stddev: 62/62 65/62 67/62 2/0][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out b/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out index 77da1f64275..727f7d8e3cf 100644 --- a/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out +++ b/tests/cfgs/default/result/lru_ipv6_caches.pcapng.out @@ -1,10 +1,10 @@ DPI Packets (TCP): 9 (3.00 pkts/flow) -DPI Packets (UDP): 36 (4.00 pkts/flow) -Confidence DPI (cache) : 6 (flows) -Confidence DPI : 6 (flows) -Num dissector calls: 791 (65.92 diss/flow) +DPI Packets (UDP): 32 (3.56 pkts/flow) +Confidence DPI (cache) : 4 (flows) +Confidence DPI : 8 (flows) +Num dissector calls: 731 (60.92 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) -LRU cache bittorrent: 25/12/4 (insert/search/found) +LRU cache bittorrent: 25/7/2 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) LRU cache stun: 6/8/0 (insert/search/found) LRU cache tls_cert: 1/3/2 (insert/search/found) @@ -38,10 +38,10 @@ JA3 Host Stats: 2 TCP [2001:db8:200::1]:443 -> [2001:db8:1::1]:44144 [proto: 91.220/TLS.Cloudflare][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 3][cat: Web/5][3 pkts/2954 bytes -> 0 pkts/0 bytes][Goodput ratio: 92/0][0.16 sec][(Negotiated) ALPN: h2][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][TLSv1.2][ServerNames: *.bikroy.com,sni.cloudflaressl.com,bikroy.com][JA3S: 9ebc57def2efb523f25c77af13aa6d48][Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3][Subject: C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com][Certificate SHA-1: FA:93:76:9C:39:4D:08:97:FA:8F:CE:80:E4:7A:8F:8E:CF:71:30:A0][Validity: 2021-06-29 00:00:00 - 2022-06-28 23:59:59][Cipher: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0] 3 TCP [2001:db8:200::1]:443 -> [2001:db8:1::1]:44150 [proto: 91.220/TLS.Cloudflare][IP: 0/Unknown][Encrypted][Confidence: DPI (cache)][DPI packets: 3][cat: Web/5][3 pkts/2954 bytes -> 0 pkts/0 bytes][Goodput ratio: 92/0][0.15 sec][(Negotiated) ALPN: h2][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][TLSv1.2][ServerNames: *.bikroy.com,sni.cloudflaressl.com,bikroy.com][JA3S: 9ebc57def2efb523f25c77af13aa6d48][Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3][Subject: C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com][Certificate SHA-1: FA:93:76:9C:39:4D:08:97:FA:8F:CE:80:E4:7A:8F:8E:CF:71:30:A0][Validity: 2021-06-29 00:00:00 - 2022-06-28 23:59:59][Cipher: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0] 4 TCP [2001:db8:200::1]:443 -> [2001:db8:1::1]:44192 [proto: 91.220/TLS.Cloudflare][IP: 0/Unknown][Encrypted][Confidence: DPI (cache)][DPI packets: 3][cat: Web/5][3 pkts/2954 bytes -> 0 pkts/0 bytes][Goodput ratio: 92/0][0.15 sec][(Negotiated) ALPN: h2][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][TLSv1.2][ServerNames: *.bikroy.com,sni.cloudflaressl.com,bikroy.com][JA3S: 9ebc57def2efb523f25c77af13aa6d48][Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3][Subject: C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com][Certificate SHA-1: FA:93:76:9C:39:4D:08:97:FA:8F:CE:80:E4:7A:8F:8E:CF:71:30:A0][Validity: 2021-06-29 00:00:00 - 2022-06-28 23:59:59][Cipher: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0] - 5 UDP [2a2f:8509:1cb2:466d:ecbf:69d6:109c:608]:62229 -> [3991:72d:336e:65ec:c5bf:a5fa:83ad:23de]:6881 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI (cache)][DPI packets: 8][cat: Download/7][9 pkts/2397 bytes -> 0 pkts/0 bytes][Goodput ratio: 77/0][9.99 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1249/0 8358/0 2694/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 266/0 610/0 243/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (added.f)][Plen Bins: 44,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 UDP [2a2f:8509:1cb2:466d:ecbf:69d6:109c:608]:62229 -> [3991:72d:336e:65ec:c5bf:a5fa:83ad:23de]:6881 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 6][cat: Download/7][9 pkts/2397 bytes -> 0 pkts/0 bytes][Goodput ratio: 77/0][9.99 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 1249/0 8358/0 2694/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 266/0 610/0 243/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (added.f)][Plen Bins: 44,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 6 UDP [3069:c624:1d42:9469:98b1:67ff:fe43:325]:56131 -> [32fb:f967:681e:e96b:face:b00c::74fd]:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][11 pkts/1958 bytes -> 0 pkts/0 bytes][Goodput ratio: 65/0][2.35 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 7/0 236/0 1183/0 350/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 178/0 214/0 41/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (BHBeRjaHJ)][Plen Bins: 9,0,18,0,72,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 7 UDP [2118:ec33:112b:7908:2c80:27ff:fef7:d71f]:48415 -> [32fb:f967:681e:e96b:face:b00c::74fd]:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][11 pkts/1742 bytes -> 0 pkts/0 bytes][Goodput ratio: 61/0][2.97 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 279/0 1388/0 400/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 158/0 214/0 51/0][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (NGuJOnsW)][Plen Bins: 18,0,36,0,45,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 8 UDP [3991:72d:336e:65ec:c5bf:a5fa:83ad:23de]:6881 -> [3024:e5ee:ac2f:cd76:5dd6:a7a1:f17f:5c27]:60506 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI (cache)][DPI packets: 8][cat: Download/7][11 pkts/1319 bytes -> 0 pkts/0 bytes][Goodput ratio: 48/0][6.03 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 670/0 2769/0 758/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 120/0 431/0 99/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (added.f)][Plen Bins: 72,18,0,0,0,0,0,0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 8 UDP [3991:72d:336e:65ec:c5bf:a5fa:83ad:23de]:6881 -> [3024:e5ee:ac2f:cd76:5dd6:a7a1:f17f:5c27]:60506 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 6][cat: Download/7][11 pkts/1319 bytes -> 0 pkts/0 bytes][Goodput ratio: 48/0][6.03 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 670/0 2769/0 758/0][Pkt Len c2s/s2c min/avg/max/stddev: 82/0 120/0 431/0 99/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (added.f)][Plen Bins: 72,18,0,0,0,0,0,0,0,0,0,9,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 9 UDP [3991:72d:336e:65ec:c5bf:a5fa:83ad:23de]:6881 -> [2fda:1f8a:c107:88a4:e509:d2e1:445f:f34c]:6881 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: Download/7][2 pkts/332 bytes -> 0 pkts/0 bytes][Goodput ratio: 62/0][8.49 sec][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (hash20)][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 10 UDP [3991:72d:336e:65ec:c5bf:a5fa:83ad:23de]:6881 -> [38b2:46b7:27a4:94c3:c134:948:e069:d71f]:1 [proto: 37/BitTorrent][IP: 0/Unknown][ClearText][Confidence: DPI (cache)][DPI packets: 2][cat: Download/7][2 pkts/332 bytes -> 0 pkts/0 bytes][Goodput ratio: 62/0][20.08 sec][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (hash20)][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 11 UDP [3297:a1af:5121:cfc:360b:2e07:872f:1ea0]:43865 -> [32fb:f967:681e:e96b:face:b00c::74fd]:3478 [proto: 78.45/STUN.WhatsAppCall][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][2 pkts/296 bytes -> 0 pkts/0 bytes][Goodput ratio: 58/0][0.26 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (BZ9/sp6)][Plen Bins: 50,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]