vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-05-02 00:40:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Rework the old MapleStory code to identify traffic from generic Nexon games (#2773)

Browse source 
Remove `NDPI_PROTOCOL_MAPLESTORY` and add a generic
`NDPI_PROTOCOL_NEXON`
This commit is contained in:
Ivan Nardi 2025-03-19 17:58:42 +01:00 • committed by GitHub
parent 70728b3425
commit 91fd1bccd2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
105 changed files with 218 additions and 223 deletions
Download patch file Download diff file Expand all files Collapse all files

9
doc/protocols.rst
View file

@ -68,6 +68,15 @@ TFTP is a very simple protocol used to transfer files. It is from this that its
References: `RFC1350 <https://datatracker.ietf.org/doc/html/rfc1350>`_ and `RFC2347 <https://datatracker.ietf.org/doc/html/rfc2347>`_ and `RFC2349 <https://datatracker.ietf.org/doc/html/rfc2349>`_
.. _Proto 113:
`NDPI_PROTOCOL_NEXON`
=====================
Nexon is a South Korean video game developer and publisher. It develops and publishes titles including MapleStory, Crazyracing Kartrider, Sudden Attack, Dungeon & Fighter, and Blue Archive.
References: `Main site: <https://www.nexon.com>`_
.. _Proto 125:
`NDPI_PROTOCOL_MOZILLA`

2
src/include/ndpi_private.h
View file

@ -789,7 +789,7 @@ void init_lotus_notes_dissector(struct ndpi_detection_module_struct *ndpi_struct
void init_mail_imap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_mail_pop_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_mail_smtp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_maplestory_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_nexon_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_megaco_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_mgcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_mining_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);

2
src/include/ndpi_protocol_ids.h
View file

@ -141,7 +141,7 @@ typedef enum {
NDPI_PROTOCOL_AMAZON_ALEXA = 110,
NDPI_PROTOCOL_KERBEROS = 111,
NDPI_PROTOCOL_LDAP = 112,
NDPI_PROTOCOL_MAPLESTORY = 113,
NDPI_PROTOCOL_NEXON = 113,
NDPI_PROTOCOL_MSSQL_TDS = 114,
NDPI_PROTOCOL_PPTP = 115,
NDPI_PROTOCOL_WARCRAFT3 = 116,

5
src/lib/ndpi_content_match.c.inc
View file

@ -1349,6 +1349,11 @@ static ndpi_protocol_match host_match[] =
{ "epicgames.net", "EpicGames", NDPI_PROTOCOL_EPICGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
{ "epicgames.dev", "EpicGames", NDPI_PROTOCOL_EPICGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
{ "nexon.com", "Nexon", NDPI_PROTOCOL_NEXON, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
{ "nexoncdn.co.kr", "Nexon", NDPI_PROTOCOL_NEXON, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
{ "nxm-maplemgl-staticweb.s3.amazonaws.com", "Nexon", NDPI_PROTOCOL_NEXON, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
{ "nexon.io", "Nexon", NDPI_PROTOCOL_NEXON, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
{ "ea.com", "ElectronicArts", NDPI_PROTOCOL_ELECTRONICARTS, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
{ "origin-a.akamaihd.net", "ElectronicArts", NDPI_PROTOCOL_ELECTRONICARTS, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},

10
src/lib/ndpi_main.c
View file

@ -1147,7 +1147,7 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
NDPI_PROTOCOL_WEBSOCKET,
NDPI_PROTOCOL_CROSSFIRE, NDPI_PROTOCOL_SOAP,
NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_GNUTELLA,
NDPI_PROTOCOL_MAPLESTORY, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_WORLDOFWARCRAFT,
NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_WORLDOFWARCRAFT,
NDPI_PROTOCOL_IRC,
NDPI_PROTOCOL_IPP,
NDPI_PROTOCOL_MPEGDASH,
@ -1542,8 +1542,8 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"LDAP", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, NDPI_PROTOCOL_QOE_CATEGORY_UNSPECIFIED,
ndpi_build_default_ports(ports_a, 389, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 389, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_MAPLESTORY,
"MapleStory", NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_QOE_CATEGORY_ONLINE_GAMING,
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 1 /* app proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_NEXON,
"Nexon", NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_QOE_CATEGORY_ONLINE_GAMING,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MSSQL_TDS,
@ -5815,8 +5815,8 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
/* cpha */
init_cpha_dissector(ndpi_str, &a);
/* MAPLESTORY */
init_maplestory_dissector(ndpi_str, &a);
/* NEXON */
init_nexon_dissector(ndpi_str, &a);
/* DOFUS */
init_dofus_dissector(ndpi_str, &a);

95
src/lib/protocols/maplestory.c
View file

@ -1,95 +0,0 @@
/*
* maplestory.c
*
* Copyright (C) 2009-11 - ipoque GmbH
* Copyright (C) 2011-25 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
*
*/
#include "ndpi_protocol_ids.h"
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_MAPLESTORY
#include "ndpi_api.h"
#include "ndpi_private.h"
static void ndpi_int_maplestory_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MAPLESTORY, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
}
static void ndpi_search_maplestory(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
NDPI_LOG_DBG(ndpi_struct, "search maplestory\n");
if (packet->payload_packet_len == 16
&& (ntohl(get_u_int32_t(packet->payload, 0)) == 0x0e003a00 || ntohl(get_u_int32_t(packet->payload, 0)) == 0x0e003b00
|| ntohl(get_u_int32_t(packet->payload, 0)) == 0x0e004200)
&& ntohs(get_u_int16_t(packet->payload, 4)) == 0x0100 && (packet->payload[6] == 0x32 || packet->payload[6] == 0x33)) {
NDPI_LOG_INFO(ndpi_struct, "found maplestory\n");
ndpi_int_maplestory_add_connection(ndpi_struct, flow);
return;
}
if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /maple")
&& memcmp(packet->payload, "GET /maple", NDPI_STATICSTRING_LEN("GET /maple")) == 0) {
ndpi_parse_packet_line_info(ndpi_struct, flow);
/* Maplestory update */
if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /maple/patch")
&& packet->payload[NDPI_STATICSTRING_LEN("GET /maple")] == '/') {
if (packet->user_agent_line.ptr != NULL && packet->host_line.ptr != NULL
&& packet->user_agent_line.len == NDPI_STATICSTRING_LEN("Patcher")
&& packet->host_line.len > NDPI_STATICSTRING_LEN("patch.")
&& memcmp(&packet->payload[NDPI_STATICSTRING_LEN("GET /maple/")], "patch",
NDPI_STATICSTRING_LEN("patch")) == 0
&& memcmp(packet->user_agent_line.ptr, "Patcher", NDPI_STATICSTRING_LEN("Patcher")) == 0
&& memcmp(packet->host_line.ptr, "patch.", NDPI_STATICSTRING_LEN("patch.")) == 0) {
NDPI_LOG_INFO(ndpi_struct, "found maplestory update\n");
ndpi_int_maplestory_add_connection(ndpi_struct, flow);
return;
}
} else if (packet->user_agent_line.ptr != NULL && packet->user_agent_line.len == NDPI_STATICSTRING_LEN("AspINet")
&& memcmp(&packet->payload[NDPI_STATICSTRING_LEN("GET /maple")], "story/",
NDPI_STATICSTRING_LEN("story/")) == 0
&& memcmp(packet->user_agent_line.ptr, "AspINet", NDPI_STATICSTRING_LEN("AspINet")) == 0) {
NDPI_LOG_INFO(ndpi_struct, "found maplestory update\n");
ndpi_int_maplestory_add_connection(ndpi_struct, flow);
return;
}
}
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}
void init_maplestory_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id)
{
ndpi_set_bitmask_protocol_detection("MapleStory", ndpi_struct, *id,
NDPI_PROTOCOL_MAPLESTORY,
ndpi_search_maplestory,
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
ADD_TO_DETECTION_BITMASK);
*id += 1;
}

75
src/lib/protocols/nexon.c Normal file
View file

@ -0,0 +1,75 @@
/*
* nexon.c
*
* Copyright (C) 2009-11 - ipoque GmbH
* Copyright (C) 2011-25 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
*
*/
#include "ndpi_protocol_ids.h"
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_NEXON
#include "ndpi_api.h"
#include "ndpi_private.h"
static void ndpi_int_nexon_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NEXON, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
}
static void ndpi_search_nexon(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
NDPI_LOG_DBG(ndpi_struct, "search nexon\n");
if(packet->payload_packet_len == 24 &&
ntohl(get_u_int32_t(packet->payload, 0)) == 0x18000000 &&
ntohl(get_u_int32_t(packet->payload, 4)) == 0x64000000) {
NDPI_LOG_INFO(ndpi_struct, "found nexon\n");
ndpi_int_nexon_add_connection(ndpi_struct, flow);
return;
}
if(packet->payload_packet_len == 20 &&
ntohl(get_u_int32_t(packet->payload, 4)) == 0x163A992E) {
NDPI_LOG_INFO(ndpi_struct, "found nexon\n");
ndpi_int_nexon_add_connection(ndpi_struct, flow);
return;
}
/* TODO: detect UDP traffic */
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}
void init_nexon_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id)
{
ndpi_set_bitmask_protocol_detection("Nexon", ndpi_struct, *id,
NDPI_PROTOCOL_NEXON,
ndpi_search_nexon,
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
ADD_TO_DETECTION_BITMASK);
*id += 1;
}

2
tests/cfgs/caches_cfg/result/ookla.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 5 (flows)
Num dissector calls: 585 (97.50 diss/flow)
Num dissector calls: 584 (97.33 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/caches_global/result/ookla.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence DPI (partial cache): 1 (flows)
Confidence DPI : 4 (flows)
Confidence DPI (aggressive) : 1 (flows)
Num dissector calls: 585 (97.50 diss/flow)
Num dissector calls: 584 (97.33 diss/flow)
LRU cache ookla: 4/2/2 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/classification_only/result/http-basic-auth.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 9
DPI Packets (TCP): 183 (7.32 pkts/flow)
Confidence Match by port : 9 (flows)
Confidence DPI : 16 (flows)
Num dissector calls: 256 (10.24 diss/flow)
Num dissector calls: 240 (9.60 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/27/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/classification_only/result/http-pwd.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 9 (9.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/classification_only/result/http_auth.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/classification_only/result/ookla.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 38 (6.33 pkts/flow)
Confidence DPI (partial cache): 1 (flows)
Confidence DPI : 4 (flows)
Confidence DPI (aggressive) : 1 (flows)
Num dissector calls: 585 (97.50 diss/flow)
Num dissector calls: 584 (97.33 diss/flow)
LRU cache ookla: 4/2/2 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

BIN
tests/cfgs/default/pcap/nexon.pcapng Normal file
View file

Binary file not shown.

BIN
tests/cfgs/default/pcap/ossfuzz_seed_fake_traces_3.pcapng
View file

Binary file not shown.

2
tests/cfgs/default/result/1kxun.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
Confidence Unknown : 9 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 182 (flows)
Num dissector calls: 4722 (23.97 diss/flow)
Num dissector calls: 4636 (23.53 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/45/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/6in4tunnel.pcap.out
View file

@ -2,7 +2,7 @@ DPI Packets (TCP): 29 (5.80 pkts/flow)
DPI Packets (UDP): 4 (2.00 pkts/flow)
DPI Packets (other): 3 (1.00 pkts/flow)
Confidence DPI : 10 (flows)
Num dissector calls: 29 (2.90 diss/flow)
Num dissector calls: 28 (2.80 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/EAQ.pcap.out
View file

@ -1,7 +1,7 @@
DPI Packets (TCP): 12 (6.00 pkts/flow)
DPI Packets (UDP): 116 (4.00 pkts/flow)
Confidence DPI : 31 (flows)
Num dissector calls: 5186 (167.29 diss/flow)
Num dissector calls: 5184 (167.23 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/KakaoTalk_chat.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 5 (flows)
Confidence DPI : 33 (flows)
Num dissector calls: 554 (14.58 diss/flow)
Num dissector calls: 552 (14.53 diss/flow)
LRU cache ookla: 0/1/0 (insert/search/found)
LRU cache bittorrent: 0/15/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/WebattackRCE.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 797 (1.00 pkts/flow)
Confidence DPI : 797 (flows)
Num dissector calls: 12752 (16.00 diss/flow)
Num dissector calls: 11955 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/WebattackSQLinj.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 54 (6.00 pkts/flow)
Confidence DPI : 9 (flows)
Num dissector calls: 144 (16.00 diss/flow)
Num dissector calls: 135 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/WebattackXSS.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 639
DPI Packets (TCP): 3972 (6.01 pkts/flow)
Confidence Match by port : 639 (flows)
Confidence DPI : 22 (flows)
Num dissector calls: 352 (0.53 diss/flow)
Num dissector calls: 330 (0.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/1917/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/alexa-app.pcapng.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow)
DPI Packets (other): 6 (1.00 pkts/flow)
Confidence Match by port : 14 (flows)
Confidence DPI : 146 (flows)
Num dissector calls: 591 (3.69 diss/flow)
Num dissector calls: 572 (3.58 diss/flow)
LRU cache ookla: 0/5/0 (insert/search/found)
LRU cache bittorrent: 0/42/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/android.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 4 (1.00 pkts/flow)
Confidence Match by port : 2 (flows)
Confidence DPI : 60 (flows)
Confidence Match by IP : 1 (flows)
Num dissector calls: 244 (3.87 diss/flow)
Num dissector calls: 241 (3.83 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/anyconnect-vpn.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 61 (flows)
Num dissector calls: 819 (11.87 diss/flow)
Num dissector calls: 815 (11.81 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/24/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/bot.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/bt-http.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 21 (21.00 diss/flow)
Num dissector calls: 20 (20.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 5/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/conncheck.pcap.out
View file

@ -1,7 +1,7 @@
DPI Packets (TCP): 65 (7.22 pkts/flow)
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 10 (flows)
Num dissector calls: 145 (14.50 diss/flow)
Num dissector calls: 136 (13.60 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/crawler_false_positive.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 8 (8.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/dotenv.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/emotet.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 48 (8.00 pkts/flow)
Confidence DPI : 6 (flows)
Num dissector calls: 231 (38.50 diss/flow)
Num dissector calls: 228 (38.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/exe_download.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/exe_download_as_png.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/false_positives.pcapng.out
View file

@ -2,7 +2,7 @@ DPI Packets (TCP): 9 (4.50 pkts/flow)
DPI Packets (UDP): 54 (10.80 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence DPI : 6 (flows)
Num dissector calls: 875 (125.00 diss/flow)
Num dissector calls: 874 (124.86 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out
View file

@ -6,7 +6,7 @@ Confidence Unknown : 3 (flows)
Confidence Match by port : 22 (flows)
Confidence DPI : 13 (flows)
Confidence Match by custom rule: 1 (flows)
Num dissector calls: 999 (25.62 diss/flow)
Num dissector calls: 986 (25.28 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/75/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/gnutella.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow)
Confidence Unknown : 389 (flows)
Confidence Match by port : 1 (flows)
Confidence DPI : 370 (flows)
Num dissector calls: 52647 (69.27 diss/flow)
Num dissector calls: 52644 (69.27 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/1170/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/heuristic_tcp_ack_payload.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 67 (11.17 pkts/flow)
Confidence DPI : 6 (flows)
Num dissector calls: 21 (3.50 diss/flow)
Num dissector calls: 20 (3.33 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/hls.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http-basic-auth.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 9
DPI Packets (TCP): 183 (7.32 pkts/flow)
Confidence Match by port : 9 (flows)
Confidence DPI : 16 (flows)
Num dissector calls: 256 (10.24 diss/flow)
Num dissector calls: 240 (9.60 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/27/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http-crash-content-disposition.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 8 (8.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http-lines-split.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 8 (8.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http-manipulated.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 12 (6.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 32 (16.00 diss/flow)
Num dissector calls: 30 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http-pwd.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 9 (9.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http_asymmetric.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 18 (9.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 32 (16.00 diss/flow)
Num dissector calls: 30 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http_auth.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http_invalid_server.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http_on_sip_port.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 17 (17.00 diss/flow)
Num dissector calls: 16 (16.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http_origin_different_than_host.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 22 (22.00 diss/flow)
Num dissector calls: 21 (21.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http_starting_with_reply.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/http_ua_splitted_in_two_pkts.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 5 (5.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/instagram.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 7 (flows)
Confidence DPI : 30 (flows)
Num dissector calls: 1342 (35.32 diss/flow)
Num dissector calls: 1335 (35.13 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/24/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/iphone.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 55 (1.77 pkts/flow)
DPI Packets (other): 5 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 50 (flows)
Num dissector calls: 361 (7.08 diss/flow)
Num dissector calls: 360 (7.06 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/ipp.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 21 (7.00 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 66 (22.00 diss/flow)
Num dissector calls: 63 (21.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/jsonrpc.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 10 (5.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 151 (75.50 diss/flow)
Num dissector calls: 150 (75.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/log4j-webapp-exploit.pcap.out
View file

@ -1,7 +1,7 @@
DPI Packets (TCP): 56 (8.00 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence DPI : 5 (flows)
Num dissector calls: 358 (51.14 diss/flow)
Num dissector calls: 355 (50.71 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/malware.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 2 (2.00 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 5 (flows)
Num dissector calls: 20 (3.33 diss/flow)
Num dissector calls: 19 (3.17 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/mpeg-dash.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 13 (3.25 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 88 (22.00 diss/flow)
Num dissector calls: 84 (21.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/mpeg.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/ndpi_match_string_subprotocol__error.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 3 (3.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 21 (21.00 diss/flow)
Num dissector calls: 20 (20.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/netflix.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (2.08 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 60 (flows)
Num dissector calls: 474 (7.77 diss/flow)
Num dissector calls: 448 (7.34 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

28
tests/cfgs/default/result/nexon.pcapng.out Normal file
View file

@ -0,0 +1,28 @@
DPI Packets (TCP): 8 (4.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 88 (44.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache fpc_dns: 0/2/0 (insert/search/found)
Automa host: 0/0 (search/found)
Automa domain: 0/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 0/0 (search/found)
Patricia risk mask IPv6: 0/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia risk IPv6: 0/0 (search/found)
Patricia protocols: 2/2 (search/found)
Patricia protocols IPv6: 0/0 (search/found)
Nexon 128 13740 2
Fun 128 13740 2
1 TCP 192.168.12.67:46824 <-> 54.64.252.215:9995 [proto: 113/Nexon][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Game/8][50 pkts/7428 bytes <-> 48 pkts/3212 bytes][Goodput ratio: 55/1][199.97 sec][bytes ratio: 0.396 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 4456/4681 46914/46915 10741/10973][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 149/67 290/94 46/4][TCP Fingerprint: 2_64_65535_685ad951a756/Android][Plen Bins: 6,16,50,0,25,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 192.168.12.67:39908 <-> 18.185.38.147:7500 [proto: 113/Nexon][IP: 265/AmazonAWS][ClearText][Confidence: DPI][FPC: 265/AmazonAWS, Confidence: IP address][DPI packets: 4][cat: Game/8][17 pkts/1307 bytes <-> 13 pkts/1793 bytes][Goodput ratio: 28/60][13.45 sec][bytes ratio: -0.157 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 957/1201 5759/5709 1612/1783][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 77/138 325/891 63/219][TCP Fingerprint: 2_64_65535_685ad951a756/Android][Plen Bins: 75,6,6,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

2
tests/cfgs/default/result/ocs.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 117 (9.75 pkts/flow)
DPI Packets (UDP): 8 (1.00 pkts/flow)
Confidence DPI : 18 (flows)
Confidence Match by IP : 2 (flows)
Num dissector calls: 93 (4.65 diss/flow)
Num dissector calls: 88 (4.40 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/ocsp.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 60 (6.00 pkts/flow)
Confidence DPI : 10 (flows)
Num dissector calls: 160 (16.00 diss/flow)
Num dissector calls: 150 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/ookla.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence DPI (partial cache): 1 (flows)
Confidence DPI : 4 (flows)
Confidence DPI (aggressive) : 1 (flows)
Num dissector calls: 585 (97.50 diss/flow)
Num dissector calls: 584 (97.33 diss/flow)
LRU cache ookla: 4/2/2 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

27
tests/cfgs/default/result/ossfuzz_seed_fake_traces_3.pcapng.out
View file

@ -1,27 +0,0 @@
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache fpc_dns: 0/1/0 (insert/search/found)
Automa host: 1/0 (search/found)
Automa domain: 1/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 0/0 (search/found)
Patricia risk mask IPv6: 0/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia risk IPv6: 0/0 (search/found)
Patricia protocols: 1/1 (search/found)
Patricia protocols IPv6: 0/0 (search/found)
MapleStory 4 362 1
Fun 4 362 1
1 TCP 192.168.16.173:60546 <-> 93.184.216.34:80 [proto: 113/MapleStory][IP: 288/Edgecast][ClearText][Confidence: DPI][FPC: 288/Edgecast, Confidence: IP address][DPI packets: 4][cat: Game/8][3 pkts/288 bytes <-> 1 pkts/74 bytes][Goodput ratio: 28/0][0.10 sec][Hostname/SNI: example.com][User-Agent: AspINet][TCP Fingerprint: 2_64_64240_2e3cee914fc1/Linux][PLAIN TEXT (pGET /maplestory/ HTTP/1.1)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

2
tests/cfgs/default/result/paltalk.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 17 (4.25 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 333 (83.25 diss/flow)
Num dissector calls: 332 (83.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/punycode-idn.pcap.out
View file

@ -1,7 +1,7 @@
DPI Packets (TCP): 8 (8.00 pkts/flow)
DPI Packets (UDP): 4 (2.00 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 18 (6.00 diss/flow)
Num dissector calls: 17 (5.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/quickplay.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 78 (3.71 pkts/flow)
Confidence DPI : 21 (flows)
Num dissector calls: 261 (12.43 diss/flow)
Num dissector calls: 245 (11.67 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/sites.pcapng.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 336 (5.51 pkts/flow)
DPI Packets (UDP): 4 (1.00 pkts/flow)
Confidence Match by port : 4 (flows)
Confidence DPI : 61 (flows)
Num dissector calls: 76 (1.17 diss/flow)
Num dissector calls: 75 (1.15 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/12/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/sites2.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 31 (6.20 pkts/flow)
Confidence DPI : 5 (flows)
Num dissector calls: 20 (4.00 diss/flow)
Num dissector calls: 19 (3.80 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/soap.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 11 (3.67 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 416 (138.67 diss/flow)
Num dissector calls: 415 (138.33 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/softether.pcap.out
View file

@ -1,7 +1,7 @@
DPI Packets (TCP): 4 (4.00 pkts/flow)
DPI Packets (UDP): 31 (10.33 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 431 (107.75 diss/flow)
Num dissector calls: 430 (107.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/sql_injection.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 3 (3.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/starcraft_battle.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 12 (flows)
Confidence DPI : 39 (flows)
Confidence Match by IP : 1 (flows)
Num dissector calls: 1742 (33.50 diss/flow)
Num dissector calls: 1722 (33.12 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/39/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/steam.pcapng.out
View file

@ -1,7 +1,7 @@
DPI Packets (TCP): 28 (5.60 pkts/flow)
DPI Packets (UDP): 2 (1.00 pkts/flow)
Confidence DPI : 7 (flows)
Num dissector calls: 114 (16.29 diss/flow)
Num dissector calls: 113 (16.14 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/tls_certificate_too_long.pcap.out
View file

@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 1 (flows)
Confidence DPI : 33 (flows)
Num dissector calls: 661 (18.89 diss/flow)
Num dissector calls: 659 (18.83 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/tls_heur__vmess-websocket.pcapng.out
View file

@ -1,7 +1,7 @@
DPI Packets (TCP): 18 (6.00 pkts/flow)
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 183 (45.75 diss/flow)
Num dissector calls: 182 (45.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/trickbot.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 8 (8.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/waze.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by port : 9 (flows)
Confidence DPI : 23 (flows)
Num dissector calls: 400 (12.12 diss/flow)
Num dissector calls: 392 (11.88 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/30/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/webdav.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 41 (5.12 pkts/flow)
Confidence DPI : 8 (flows)
Num dissector calls: 128 (16.00 diss/flow)
Num dissector calls: 120 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/webex.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 8 (4.00 pkts/flow)
Confidence Match by port : 3 (flows)
Confidence DPI : 53 (flows)
Confidence Match by IP : 1 (flows)
Num dissector calls: 271 (4.75 diss/flow)
Num dissector calls: 269 (4.72 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/12/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/websocket-chisel-ssh.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 8 (4.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 44 (22.00 diss/flow)
Num dissector calls: 42 (21.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/weibo.pcap.out
View file

@ -4,7 +4,7 @@ DPI Packets (TCP): 100 (3.33 pkts/flow)
DPI Packets (UDP): 35 (2.50 pkts/flow)
Confidence Match by port : 21 (flows)
Confidence DPI : 23 (flows)
Num dissector calls: 547 (12.43 diss/flow)
Num dissector calls: 537 (12.20 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/63/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/windowsupdate_over_http.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/wow.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 36 (7.20 pkts/flow)
Confidence DPI : 5 (flows)
Num dissector calls: 114 (22.80 diss/flow)
Num dissector calls: 112 (22.40 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/xiaomi.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 19 (2.71 pkts/flow)
Confidence DPI : 7 (flows)
Num dissector calls: 616 (88.00 diss/flow)
Num dissector calls: 615 (87.86 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/xss.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 9 (4.50 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (8.00 diss/flow)
Num dissector calls: 15 (7.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/default/result/zattoo.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 10 (5.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 16 (8.00 diss/flow)
Num dissector calls: 15 (7.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/disable_aggressiveness/result/ookla.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 40 (6.67 pkts/flow)
Confidence DPI (partial cache): 1 (flows)
Confidence DPI : 5 (flows)
Num dissector calls: 585 (97.50 diss/flow)
Num dissector calls: 584 (97.33 diss/flow)
LRU cache ookla: 4/1/1 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/disable_protocols/result/soap.pcap.out
View file

@ -3,7 +3,7 @@ Guessed flow protos: 2
DPI Packets (TCP): 20 (6.67 pkts/flow)
Confidence Match by port : 2 (flows)
Confidence DPI : 1 (flows)
Num dissector calls: 457 (152.33 diss/flow)
Num dissector calls: 456 (152.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/disable_use_client_ip/result/bot.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/disable_use_client_port/result/iphone.pcap.out
View file

@ -3,7 +3,7 @@ DPI Packets (UDP): 55 (1.77 pkts/flow)
DPI Packets (other): 5 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence DPI : 50 (flows)
Num dissector calls: 361 (7.08 diss/flow)
Num dissector calls: 360 (7.06 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/3/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/enable_payload_stat/result/1kxun.pcap.out
View file

@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
Confidence Unknown : 9 (flows)
Confidence Match by port : 6 (flows)
Confidence DPI : 182 (flows)
Num dissector calls: 4722 (23.97 diss/flow)
Num dissector calls: 4636 (23.53 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/45/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/flow_risk_infos_disabled/result/http_invalid_server.pcap.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/fpc/result/1kxun.pcap.out
View file

@ -9,7 +9,7 @@ FPC Confidence Unknown : 20 (flows)
FPC Confidence IP address : 4 (flows)
FPC Confidence DNS : 13 (flows)
FPC Confidence DPI : 160 (flows)
Num dissector calls: 4722 (23.97 diss/flow)
Num dissector calls: 4636 (23.53 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/45/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/guess_ip_before_port_enabled/result/1kxun.pcap.out
View file

@ -6,7 +6,7 @@ Confidence Unknown : 9 (flows)
Confidence Match by port : 4 (flows)
Confidence DPI : 182 (flows)
Confidence Match by IP : 2 (flows)
Num dissector calls: 4722 (23.97 diss/flow)
Num dissector calls: 4636 (23.53 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/45/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/guessing_disable/result/webex.pcap.out
View file

@ -2,7 +2,7 @@ DPI Packets (TCP): 393 (7.15 pkts/flow)
DPI Packets (UDP): 8 (4.00 pkts/flow)
Confidence Unknown : 4 (flows)
Confidence DPI : 53 (flows)
Num dissector calls: 271 (4.75 diss/flow)
Num dissector calls: 269 (4.72 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/12/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/http_process_response_disable/result/http.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 16 (16.00 diss/flow)
Num dissector calls: 15 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

2
tests/cfgs/http_process_response_disable/result/http_asymmetric.pcapng.out
View file

@ -1,6 +1,6 @@
DPI Packets (TCP): 6 (3.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 32 (16.00 diss/flow)
Num dissector calls: 30 (15.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)

Some files were not shown because too many files have changed in this diff Show more