vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-04-30 16:09:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Get rid of Apache Cassandra false positives (#2159)

Browse source 
* Rewrite Apache Cassandra dissector

* Replace memcmp with strncmp

* Add payload length check

* Update Cassandra dissector

* Update test results

---------

Co-authored-by: 0xA50C1A1 <mage.wizard88@gmail.com>
This commit is contained in:
Vladimir Gavrilov 2023-11-21 18:56:01 +03:00 • committed by GitHub
parent ae6e6d61f0
commit 35abafec4f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
61 changed files with 105 additions and 158 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/cfgs/default/result/1kxun.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
Confidence Unknown : 14 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 177 (flows)
Num dissector calls: 4513 (22.91 diss/flow)
Num dissector calls: 4515 (22.92 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/60/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/KakaoTalk_chat.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 5 (flows)
Confidence DPI : 33 (flows)
Num dissector calls: 538 (14.16 diss/flow)
Num dissector calls: 546 (14.37 diss/flow)
LRU cache ookla: 0/1/0 (insert/search/found)
LRU cache bittorrent: 0/15/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/KakaoTalk_talk.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 10 (2.00 pkts/flow)
Confidence Match by port : 8 (flows)
Confidence DPI : 11 (flows)
Confidence Match by IP : 1 (flows)
Num dissector calls: 1094 (54.70 diss/flow)
Num dissector calls: 1101 (55.05 diss/flow)
LRU cache ookla: 0/2/0 (insert/search/found)
LRU cache bittorrent: 0/27/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/Oscar.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 21 (21.00 pkts/flow)
Confidence Match by port : 1 (flows)
Num dissector calls: 250 (250.00 diss/flow)
Num dissector calls: 254 (254.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/anyconnect-vpn.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 61 (flows)
Num dissector calls: 845 (12.25 diss/flow)
Num dissector calls: 847 (12.28 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/24/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 10 (10.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 225 (225.00 diss/flow)
Num dissector calls: 229 (229.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 5/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

8
tests/cfgs/default/result/cassandra.pcap.out
View file

@ -1,8 +1,8 @@
Guessed flow protos: 0
DPI Packets (TCP): 18 (9.00 pkts/flow)
DPI Packets (TCP): 16 (8.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 342 (171.00 diss/flow)
Num dissector calls: 302 (151.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
@ -25,5 +25,5 @@ Patricia protocols IPv6: 0/0 (search/found)
Cassandra 286 126016 2
1 TCP 127.0.0.1:46536 <-> 127.0.0.1:9042 [proto: 264/Cassandra][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 9][cat: Database/11][75 pkts/9730 bytes <-> 69 pkts/78014 bytes][Goodput ratio: 49/94][200.04 sec][bytes ratio: -0.778 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 3063/2427 32715/30000 8555/7658][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 130/1131 462/25214 82/4102][PLAIN TEXT (COMPRESSION)][Plen Bins: 8,16,44,9,5,0,6,3,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,2]
2 TCP 127.0.0.1:46537 <-> 127.0.0.1:9042 [proto: 264/Cassandra][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 9][cat: Database/11][74 pkts/9855 bytes <-> 68 pkts/28417 bytes][Goodput ratio: 50/84][200.00 sec][bytes ratio: -0.485 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2835/2737 33012/33012 6521/6804][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 133/418 399/11512 80/1399][PLAIN TEXT (COMPRESSION)][Plen Bins: 13,13,32,12,5,2,1,6,0,1,1,0,0,0,0,0,0,0,0,0,2,2,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,3,0,0,0,1,0,0,0,0,0,1]
1 TCP 127.0.0.1:46536 <-> 127.0.0.1:9042 [proto: 264/Cassandra][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 8][cat: Database/11][75 pkts/9730 bytes <-> 69 pkts/78014 bytes][Goodput ratio: 49/94][200.04 sec][bytes ratio: -0.778 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 3063/2427 32715/30000 8555/7658][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 130/1131 462/25214 82/4102][PLAIN TEXT (COMPRESSION)][Plen Bins: 8,16,44,9,5,0,6,3,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,2]
2 TCP 127.0.0.1:46537 <-> 127.0.0.1:9042 [proto: 264/Cassandra][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 8][cat: Database/11][74 pkts/9855 bytes <-> 68 pkts/28417 bytes][Goodput ratio: 50/84][200.00 sec][bytes ratio: -0.485 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 2835/2737 33012/33012 6521/6804][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 133/418 399/11512 80/1399][PLAIN TEXT (COMPRESSION)][Plen Bins: 13,13,32,12,5,2,1,6,0,1,1,0,0,0,0,0,0,0,0,0,2,2,0,0,0,0,0,0,0,0,0,1,0,0,0,0,1,3,0,0,0,1,0,0,0,0,0,1]

2
tests/cfgs/default/result/cloudflare-warp.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow)
Confidence Match by port : 2 (flows)
Confidence DPI : 5 (flows)
Confidence Match by IP : 1 (flows)
Num dissector calls: 180 (22.50 diss/flow)
Num dissector calls: 182 (22.75 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/emotet.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 48 (8.00 pkts/flow)
Confidence DPI : 6 (flows)
Num dissector calls: 192 (32.00 diss/flow)
Num dissector calls: 193 (32.17 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/ftp-start-tls.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 17 (17.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 151 (151.00 diss/flow)
Num dissector calls: 152 (152.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/ftp.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 39 (13.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence DPI : 2 (flows)
Num dissector calls: 518 (172.67 diss/flow)
Num dissector calls: 522 (174.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/ftp_failed.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 8 (8.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 151 (151.00 diss/flow)
Num dissector calls: 152 (152.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow)
Confidence Unknown : 34 (flows)
Confidence Match by port : 27 (flows)
Confidence DPI : 190 (flows)
Num dissector calls: 6311 (25.14 diss/flow)
Num dissector calls: 6314 (25.16 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/189/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Unknown : 3 (flows)
Confidence Match by port : 26 (flows)
Confidence DPI : 11 (flows)
Num dissector calls: 976 (24.40 diss/flow)
Num dissector calls: 978 (24.45 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/87/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/google_ssl.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 24 (24.00 pkts/flow)
Confidence Match by port : 1 (flows)
Num dissector calls: 188 (188.00 diss/flow)
Num dissector calls: 191 (191.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/imap-starttls.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 19 (19.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 199 (199.00 diss/flow)
Num dissector calls: 202 (202.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/imap.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 11 (11.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 199 (199.00 diss/flow)
Num dissector calls: 202 (202.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/instagram.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 7 (flows)
Confidence DPI : 30 (flows)
Num dissector calls: 1351 (35.55 diss/flow)
Num dissector calls: 1359 (35.76 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/24/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/irc.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 157 (157.00 diss/flow)
Num dissector calls: 158 (158.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/jabber.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 74 (6.17 pkts/flow)
Confidence DPI : 12 (flows)
Num dissector calls: 1409 (117.42 diss/flow)
Num dissector calls: 1418 (118.17 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/kerberos.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (2.14 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence Match by port : 23 (flows)
Confidence DPI : 11 (flows)
Num dissector calls: 3885 (107.92 diss/flow)
Num dissector calls: 3913 (108.69 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/75/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/mongo_false_positive.pcapng.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 14 (14.00 pkts/flow)
Confidence Match by port : 1 (flows)
Num dissector calls: 263 (263.00 diss/flow)
Num dissector calls: 267 (267.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/mssql_tds.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 18 (1.50 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 11 (flows)
Num dissector calls: 269 (22.42 diss/flow)
Num dissector calls: 270 (22.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/nest_log_sink.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 130 (10.00 pkts/flow)
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 13 (flows)
Num dissector calls: 1837 (131.21 diss/flow)
Num dissector calls: 1849 (132.07 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/ookla.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence DPI (partial cache): 1 (flows)
Confidence DPI : 4 (flows)
Confidence DPI (aggressive) : 1 (flows)
Num dissector calls: 508 (84.67 diss/flow)
Num dissector calls: 512 (85.33 diss/flow)
LRU cache ookla: 4/2/2 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/oracle12.pcapng.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 20 (20.00 pkts/flow)
Confidence Match by port : 1 (flows)
Num dissector calls: 258 (258.00 diss/flow)
Num dissector calls: 259 (259.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/pop3.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 2
DPI Packets (TCP): 83 (13.83 pkts/flow)
Confidence DPI : 6 (flows)
Num dissector calls: 1140 (190.00 diss/flow)
Num dissector calls: 1147 (191.17 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/pop3_stls.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 18 (18.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 192 (192.00 diss/flow)
Num dissector calls: 193 (193.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/protobuf.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 26 (5.20 pkts/flow)
Confidence DPI : 5 (flows)
Num dissector calls: 694 (138.80 diss/flow)
Num dissector calls: 696 (139.20 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/reasm_crash_anon.pcapng.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 23 (23.00 pkts/flow)
Confidence Unknown : 1 (flows)
Num dissector calls: 244 (244.00 diss/flow)
Num dissector calls: 248 (248.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/reasm_segv_anon.pcapng.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 21 (21.00 pkts/flow)
Confidence Match by port : 1 (flows)
Num dissector calls: 193 (193.00 diss/flow)
Num dissector calls: 194 (194.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/riot.pcapng.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 7 (3.50 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 1 (flows)
Num dissector calls: 181 (90.50 diss/flow)
Num dissector calls: 183 (91.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/rtmp.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 8 (8.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 152 (152.00 diss/flow)
Num dissector calls: 153 (153.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/shadowsocks.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 21 (10.50 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence DPI : 1 (flows)
Num dissector calls: 328 (164.00 diss/flow)
Num dissector calls: 331 (165.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/skype.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow)
Confidence Unknown : 59 (flows)
Confidence Match by port : 28 (flows)
Confidence DPI : 206 (flows)
Num dissector calls: 26574 (90.70 diss/flow)
Num dissector calls: 26749 (91.29 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/261/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/skype_no_unknown.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow)
Confidence Unknown : 44 (flows)
Confidence Match by port : 22 (flows)
Confidence DPI : 201 (flows)
Num dissector calls: 22138 (82.91 diss/flow)
Num dissector calls: 22253 (83.34 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/198/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/smb_frags.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 5 (5.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 152 (152.00 diss/flow)
Num dissector calls: 153 (153.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/smbv1.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 3 (3.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 154 (154.00 diss/flow)
Num dissector calls: 155 (155.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/smtp-starttls.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 26 (13.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 150 (75.00 diss/flow)
Num dissector calls: 151 (75.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/smtp.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 11 (11.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 193 (193.00 diss/flow)
Num dissector calls: 196 (196.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/soap.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 2
DPI Packets (TCP): 20 (6.67 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 2 (flows)
Num dissector calls: 372 (124.00 diss/flow)
Num dissector calls: 375 (125.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/starcraft_battle.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 12 (flows)
Confidence DPI : 39 (flows)
Confidence Match by IP : 1 (flows)
Num dissector calls: 1487 (28.60 diss/flow)
Num dissector calls: 1490 (28.65 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/39/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/teams.pcap.out
View file

@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
Confidence Match by port : 2 (flows)
Confidence DPI (partial) : 4 (flows)
Confidence DPI : 76 (flows)
Num dissector calls: 505 (6.08 diss/flow)
Num dissector calls: 506 (6.10 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/telegram_videocall.pcapng.out
View file

@ -7,7 +7,7 @@ Confidence Match by port : 8 (flows)
Confidence DPI (cache) : 10 (flows)
Confidence DPI : 15 (flows)
Confidence Match by IP : 1 (flows)
Num dissector calls: 1867 (54.91 diss/flow)
Num dissector calls: 1892 (55.65 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/27/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/telnet.pcap.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 33 (33.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 151 (151.00 diss/flow)
Num dissector calls: 152 (152.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/threema.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 2
DPI Packets (TCP): 66 (11.00 pkts/flow)
Confidence DPI : 4 (flows)
Confidence Match by IP : 2 (flows)
Num dissector calls: 1224 (204.00 diss/flow)
Num dissector calls: 1246 (207.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/tinc.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 19 (9.50 pkts/flow)
DPI Packets (UDP): 2 (1.00 pkts/flow)
Confidence DPI (cache) : 2 (flows)
Confidence DPI : 2 (flows)
Num dissector calls: 504 (126.00 diss/flow)
Num dissector calls: 506 (126.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/tls_certificate_too_long.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 1 (flows)
Confidence DPI : 33 (flows)
Num dissector calls: 577 (16.49 diss/flow)
Num dissector calls: 581 (16.60 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/tls_false_positives.pcapng.out
View file

@ -2,7 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 13 (13.00 pkts/flow)
Confidence Unknown : 1 (flows)
Num dissector calls: 252 (252.00 diss/flow)
Num dissector calls: 255 (255.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/viber.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (1.93 pkts/flow)
DPI Packets (other): 2 (1.00 pkts/flow)
Confidence Match by port : 4 (flows)
Confidence DPI : 25 (flows)
Num dissector calls: 446 (15.38 diss/flow)
Num dissector calls: 449 (15.48 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/12/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/wa_video.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 13 (1.00 pkts/flow)
Confidence DPI (cache) : 2 (flows)
Confidence DPI : 11 (flows)
Confidence Match by IP : 1 (flows)
Num dissector calls: 390 (27.86 diss/flow)
Num dissector calls: 393 (28.07 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/waze.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 9 (flows)
Confidence DPI : 23 (flows)
Num dissector calls: 351 (10.64 diss/flow)
Num dissector calls: 352 (10.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/30/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/whois.pcapng.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 16 (5.33 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 2 (flows)
Num dissector calls: 182 (60.67 diss/flow)
Num dissector calls: 184 (61.33 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/z3950.pcapng.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 26 (13.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 1 (flows)
Num dissector calls: 446 (223.00 diss/flow)
Num dissector calls: 453 (226.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/zoom.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 23 (1.35 pkts/flow)
DPI Packets (other): 2 (1.00 pkts/flow)
Confidence Match by port : 2 (flows)
Confidence DPI : 31 (flows)
Num dissector calls: 650 (19.70 diss/flow)
Num dissector calls: 653 (19.79 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache zoom: 7/0/0 (insert/search/found)