From 8c20706ca0c532e4baac0a8d1ac4b6f7b1fa4944 Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Wed, 26 Jun 2024 11:43:12 +0200 Subject: [PATCH] Improve detection of Twitter/X --- src/lib/ndpi_content_match.c.inc | 1 + tests/cfgs/default/result/anyconnect-vpn.pcap.out | 2 +- tests/cfgs/default/result/bt-http.pcapng.out | 2 +- tests/cfgs/default/result/dtls_certificate_fragments.pcap.out | 2 +- tests/cfgs/disable_protocols/result/pluralsight.pcap.out | 2 +- 5 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 5c0310c3a6e..7e9dc059891 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -667,6 +667,7 @@ static ndpi_protocol_match host_match[] = { "twitter.", "Twitter", NDPI_PROTOCOL_TWITTER, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "twimg.com", "Twitter", NDPI_PROTOCOL_TWITTER, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN , NDPI_PROTOCOL_DEFAULT_LEVEL}, { "t.co", "Twitter", NDPI_PROTOCOL_TWITTER, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN , NDPI_PROTOCOL_DEFAULT_LEVEL}, + { "x.com", "Twitter", NDPI_PROTOCOL_TWITTER, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN , NDPI_PROTOCOL_DEFAULT_LEVEL}, { "viber.com", "Viber", NDPI_PROTOCOL_VIBER, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "cdn.viber.com", "Viber", NDPI_PROTOCOL_VIBER, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL }, diff --git a/tests/cfgs/default/result/anyconnect-vpn.pcap.out b/tests/cfgs/default/result/anyconnect-vpn.pcap.out index 1ffca427b3b..286ee4b2e80 100644 --- a/tests/cfgs/default/result/anyconnect-vpn.pcap.out +++ b/tests/cfgs/default/result/anyconnect-vpn.pcap.out @@ -13,7 +13,7 @@ LRU cache stun: 0/0/0 (insert/search/found) LRU cache tls_cert: 0/11/0 (insert/search/found) LRU cache mining: 0/8/0 (insert/search/found) LRU cache msteams: 0/0/0 (insert/search/found) -Automa host: 69/15 (search/found) +Automa host: 69/19 (search/found) Automa domain: 69/0 (search/found) Automa tls cert: 4/0 (search/found) Automa risk mask: 22/1 (search/found) diff --git a/tests/cfgs/default/result/bt-http.pcapng.out b/tests/cfgs/default/result/bt-http.pcapng.out index e5ad18b6062..5ee8b0d5a23 100644 --- a/tests/cfgs/default/result/bt-http.pcapng.out +++ b/tests/cfgs/default/result/bt-http.pcapng.out @@ -7,7 +7,7 @@ LRU cache stun: 0/0/0 (insert/search/found) LRU cache tls_cert: 0/0/0 (insert/search/found) LRU cache mining: 0/0/0 (insert/search/found) LRU cache msteams: 0/0/0 (insert/search/found) -Automa host: 1/0 (search/found) +Automa host: 1/1 (search/found) Automa domain: 1/0 (search/found) Automa tls cert: 0/0 (search/found) Automa risk mask: 0/0 (search/found) diff --git a/tests/cfgs/default/result/dtls_certificate_fragments.pcap.out b/tests/cfgs/default/result/dtls_certificate_fragments.pcap.out index 0ef67b5893c..a1ea05cf936 100644 --- a/tests/cfgs/default/result/dtls_certificate_fragments.pcap.out +++ b/tests/cfgs/default/result/dtls_certificate_fragments.pcap.out @@ -7,7 +7,7 @@ LRU cache stun: 0/0/0 (insert/search/found) LRU cache tls_cert: 0/6/0 (insert/search/found) LRU cache mining: 0/0/0 (insert/search/found) LRU cache msteams: 0/0/0 (insert/search/found) -Automa host: 3/1 (search/found) +Automa host: 3/2 (search/found) Automa domain: 3/0 (search/found) Automa tls cert: 1/0 (search/found) Automa risk mask: 0/0 (search/found) diff --git a/tests/cfgs/disable_protocols/result/pluralsight.pcap.out b/tests/cfgs/disable_protocols/result/pluralsight.pcap.out index ca10108ec39..4dd89572ef3 100644 --- a/tests/cfgs/disable_protocols/result/pluralsight.pcap.out +++ b/tests/cfgs/disable_protocols/result/pluralsight.pcap.out @@ -7,7 +7,7 @@ LRU cache stun: 0/0/0 (insert/search/found) LRU cache tls_cert: 0/12/0 (insert/search/found) LRU cache mining: 0/0/0 (insert/search/found) LRU cache msteams: 0/0/0 (insert/search/found) -Automa host: 17/0 (search/found) +Automa host: 17/4 (search/found) Automa domain: 17/0 (search/found) Automa tls cert: 4/0 (search/found) Automa risk mask: 0/0 (search/found)