From ae2bedce3aa151d55e7bce46188d206f9fe0abec Mon Sep 17 00:00:00 2001 From: Toni Date: Wed, 13 Jul 2022 17:55:33 +0200 Subject: [PATCH] Improved Jabber/XMPP detection. (#1661) Signed-off-by: Toni Uhlig --- src/lib/protocols/jabber.c | 63 +++++++++++++----- tests/pcap/jabber.pcap | Bin 1133 -> 75040 bytes tests/result/1kxun.pcap.out | 2 +- tests/result/443-curl.pcap.out | 2 +- tests/result/443-firefox.pcap.out | 2 +- tests/result/443-git.pcap.out | 2 +- tests/result/443-opvn.pcap.out | 2 +- tests/result/443-safari.pcap.out | 2 +- tests/result/4in4tunnel.pcap.out | 2 +- tests/result/4in6tunnel.pcap.out | 2 +- tests/result/6in4tunnel.pcap.out | 2 +- tests/result/BGP_Cisco_hdlc_slarp.pcap.out | 2 +- tests/result/EAQ.pcap.out | 2 +- tests/result/IEC104.pcap.out | 2 +- tests/result/KakaoTalk_chat.pcap.out | 2 +- tests/result/KakaoTalk_talk.pcap.out | 2 +- tests/result/Oscar.pcap.out | 2 +- tests/result/WebattackSQLinj.pcap.out | 2 +- tests/result/WebattackXSS.pcap.out | 2 +- tests/result/aimini-http.pcap.out | 2 +- tests/result/ajp.pcap.out | 2 +- tests/result/alexa-app.pcapng.out | 2 +- tests/result/amqp.pcap.out | 2 +- tests/result/android.pcap.out | 2 +- tests/result/anyconnect-vpn.pcap.out | 2 +- tests/result/anydesk-2.pcap.out | 2 +- tests/result/anydesk.pcap.out | 2 +- tests/result/bot.pcap.out | 2 +- tests/result/cachefly.pcapng.out | 2 +- tests/result/cassandra.pcap.out | 2 +- tests/result/check_mk_new.pcap.out | 2 +- tests/result/chrome.pcap.out | 2 +- tests/result/citrix.pcap.out | 2 +- tests/result/cloudflare-warp.pcap.out | 24 +++---- tests/result/coap_mqtt.pcap.out | 2 +- tests/result/collectd.pcap.out | 2 +- tests/result/corba.pcap.out | 2 +- tests/result/dazn.pcapng.out | 2 +- tests/result/discord.pcap.out | 2 +- tests/result/dnp3.pcap.out | 2 +- tests/result/dns_doh.pcap.out | 2 +- tests/result/dns_dot.pcap.out | 2 +- tests/result/dns_fragmented.pcap.out | 2 +- tests/result/drda_db2.pcap.out | 2 +- tests/result/emotet.pcap.out | 2 +- tests/result/ethereum.pcap.out | 2 +- tests/result/exe_download.pcap.out | 2 +- tests/result/exe_download_as_png.pcap.out | 2 +- tests/result/facebook.pcap.out | 2 +- tests/result/firefox.pcap.out | 2 +- tests/result/fix2.pcap.out | 2 +- tests/result/forticlient.pcap.out | 2 +- tests/result/ftp-start-tls.pcap.out | 2 +- tests/result/ftp.pcap.out | 2 +- tests/result/ftp_failed.pcap.out | 2 +- tests/result/fuzz-2006-06-26-2594.pcap.out | 2 +- tests/result/fuzz-2006-09-29-28586.pcap.out | 2 +- tests/result/genshin-impact.pcap.out | 2 +- tests/result/git.pcap.out | 2 +- tests/result/gnutella.pcap.out | 2 +- tests/result/google_ssl.pcap.out | 2 +- tests/result/googledns_android10.pcap.out | 2 +- tests/result/gtp_false_positive.pcapng.out | 2 +- tests/result/hpvirtgrp.pcap.out | 2 +- .../http-crash-content-disposition.pcap.out | 2 +- tests/result/http-lines-split.pcap.out | 2 +- tests/result/http-manipulated.pcap.out | 2 +- tests/result/http_auth.pcap.out | 2 +- tests/result/http_connect.pcap.out | 2 +- tests/result/http_ipv6.pcap.out | 2 +- tests/result/iec60780-5-104.pcap.out | 2 +- tests/result/imap-starttls.pcap.out | 2 +- tests/result/imap.pcap.out | 2 +- tests/result/imaps.pcap.out | 2 +- tests/result/instagram.pcap.out | 2 +- tests/result/iphone.pcap.out | 2 +- tests/result/ipp.pcap.out | 2 +- tests/result/irc.pcap.out | 2 +- .../result/ja3_lots_of_cipher_suites.pcap.out | 2 +- .../ja3_lots_of_cipher_suites_2_anon.pcap.out | 2 +- tests/result/jabber.pcap.out | 21 ++++-- tests/result/kerberos-login.pcap.out | 2 +- tests/result/kerberos.pcap.out | 2 +- tests/result/lisp_registration.pcap.out | 2 +- tests/result/log4j-webapp-exploit.pcap.out | 2 +- tests/result/long_tls_certificate.pcap.out | 2 +- tests/result/malware.pcap.out | 2 +- tests/result/memcached.cap.out | 2 +- tests/result/monero.pcap.out | 2 +- tests/result/mongodb.pcap.out | 2 +- tests/result/mpeg-dash.pcap.out | 2 +- tests/result/mpeg.pcap.out | 2 +- tests/result/mqtt.pcap.out | 2 +- tests/result/mssql_tds.pcap.out | 2 +- tests/result/mysql-8.pcap.out | 2 +- tests/result/nats.pcap.out | 2 +- ...match_string_subprotocol__error.pcapng.out | 2 +- tests/result/nest_log_sink.pcap.out | 2 +- tests/result/netbios.pcap.out | 2 +- tests/result/netflix.pcap.out | 2 +- tests/result/nintendo.pcap.out | 2 +- tests/result/nntp.pcap.out | 2 +- tests/result/no_sni.pcap.out | 2 +- tests/result/ocs.pcap.out | 2 +- tests/result/ocsp.pcapng.out | 2 +- tests/result/ookla.pcap.out | 2 +- tests/result/openvpn.pcap.out | 2 +- tests/result/oracle12.pcapng.out | 2 +- tests/result/pgsql.pcap.out | 2 +- tests/result/pinterest.pcap.out | 2 +- tests/result/pluralsight.pcap.out | 2 +- tests/result/pop3.pcap.out | 2 +- tests/result/pops.pcapng.out | 2 +- tests/result/pps.pcap.out | 2 +- tests/result/pptp.pcap.out | 2 +- tests/result/psiphon3.pcap.out | 2 +- tests/result/punycode-idn.pcap.out | 2 +- tests/result/radius_false_positive.pcapng.out | 2 +- tests/result/rdp.pcap.out | 2 +- tests/result/reasm_crash_anon.pcapng.out | 2 +- tests/result/reasm_segv_anon.pcapng.out | 2 +- tests/result/reddit.pcap.out | 2 +- tests/result/rsh.pcap.out | 2 +- tests/result/rsync.pcap.out | 2 +- tests/result/rtmp.pcap.out | 2 +- tests/result/rtsp.pcap.out | 2 +- tests/result/safari.pcap.out | 2 +- tests/result/salesforce.pcap.out | 2 +- tests/result/sccp_hw_conf_register.pcapng.out | 2 +- tests/result/selfsigned.pcap.out | 2 +- tests/result/signal.pcap.out | 2 +- tests/result/simple-dnscrypt.pcap.out | 2 +- tests/result/sip_hello.pcapng.out | 2 +- tests/result/sites.pcapng.out | 2 +- tests/result/skype.pcap.out | 2 +- tests/result/skype_no_unknown.pcap.out | 2 +- tests/result/smb_frags.pcap.out | 2 +- tests/result/smpp_in_general.pcap.out | 2 +- tests/result/smtp-starttls.pcap.out | 2 +- tests/result/smtp.pcap.out | 2 +- tests/result/smtps.pcapng.out | 2 +- tests/result/snapchat.pcap.out | 2 +- tests/result/soap.pcap.out | 2 +- tests/result/socks-http-example.pcap.out | 2 +- tests/result/softether-http.pcap.out | 2 +- tests/result/ssh.pcap.out | 2 +- tests/result/ssl-cert-name-mismatch.pcap.out | 2 +- tests/result/starcraft_battle.pcap.out | 2 +- tests/result/stun_signal.pcapng.out | 2 +- tests/result/synscan.pcap.out | 2 +- tests/result/syslog.pcap.out | 2 +- tests/result/teams.pcap.out | 2 +- tests/result/teamviewer.pcap.out | 2 +- tests/result/telegram.pcap.out | 2 +- tests/result/telnet.pcap.out | 2 +- tests/result/tftp.pcap.out | 2 +- tests/result/threema.pcap.out | 2 +- tests/result/tinc.pcap.out | 2 +- tests/result/tls_alert.pcap.out | 2 +- .../result/tls_certificate_too_long.pcap.out | 2 +- tests/result/tls_esni_sni_both.pcap.out | 2 +- tests/result/tls_false_positives.pcapng.out | 2 +- tests/result/tls_invalid_reads.pcap.out | 2 +- tests/result/tls_long_cert.pcap.out | 2 +- tests/result/tls_port_80.pcapng.out | 2 +- tests/result/tls_torrent.pcapng.out | 2 +- .../result/tls_verylong_certificate.pcap.out | 2 +- tests/result/tor.pcap.out | 2 +- tests/result/trickbot.pcap.out | 2 +- tests/result/tumblr.pcap.out | 2 +- tests/result/tunnelbear.pcap.out | 2 +- tests/result/ultrasurf.pcap.out | 2 +- tests/result/viber.pcap.out | 2 +- tests/result/vnc.pcap.out | 2 +- tests/result/wa_video.pcap.out | 2 +- tests/result/wa_voice.pcap.out | 2 +- tests/result/waze.pcap.out | 2 +- tests/result/webex.pcap.out | 2 +- tests/result/wechat.pcap.out | 2 +- tests/result/weibo.pcap.out | 2 +- tests/result/whatsapp.pcap.out | 2 +- tests/result/whatsapp_login_call.pcap.out | 2 +- tests/result/whatsapp_login_chat.pcap.out | 2 +- .../whatsapp_voice_and_message.pcap.out | 2 +- tests/result/whatsappfiles.pcap.out | 2 +- tests/result/whois.pcapng.out | 2 +- tests/result/windowsupdate_over_http.pcap.out | 2 +- tests/result/wow.pcap.out | 2 +- tests/result/xiaomi.pcap.out | 2 +- tests/result/xss.pcap.out | 2 +- tests/result/youtubeupload.pcap.out | 2 +- tests/result/z3950.pcapng.out | 2 +- tests/result/zabbix.pcap.out | 2 +- tests/result/zattoo.pcap.out | 2 +- tests/result/zcash.pcap.out | 2 +- tests/result/zoom.pcap.out | 2 +- tests/result/zoom2.pcap.out | 2 +- 197 files changed, 266 insertions(+), 228 deletions(-) diff --git a/src/lib/protocols/jabber.c b/src/lib/protocols/jabber.c index 89dd3c8db..389d33625 100644 --- a/src/lib/protocols/jabber.c +++ b/src/lib/protocols/jabber.c @@ -65,20 +65,56 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &ndpi_struct->packet; + u_int16_t const max_packets = 4; + size_t i; + static uint8_t const valid_patterns[] = { 0x25, 0x26, 0x30 }; NDPI_LOG_DBG(ndpi_struct, "search JABBER\n"); - if (flow->packet_counter > 5) { - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - return; - } - - if (packet->tcp != 0 && packet->payload_packet_len == 0) { - return; + if (packet->payload_packet_len >= 3 && + packet->payload[1] == 0x00 && packet->payload[2] == packet->payload_packet_len) + { + /* Old style Jabber/XMPP SSL. */ + if (flow->packet_counter > max_packets - 1) + { + ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); + } + for (i = 0; i < NDPI_ARRAY_LENGTH(valid_patterns); ++i) + { + if (packet->payload[0] == valid_patterns[i]) + { + return; + } + } } /* search for jabber here */ /* this part is working asymmetrically */ + if (packet->payload_packet_len >= NDPI_STATICSTRING_LEN("payload, "payload[0], + "xmlns='http://jabber.org/protocol/caps'", packet->payload_packet_len) != NULL) + { + ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); + return; + } + + if (packet->payload_packet_len >= NDPI_STATICSTRING_LEN("payload_packet_len) != NULL) + { + ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); + return; + } + + if (packet->payload_packet_len == NDPI_STATICSTRING_LEN("") && + memcmp(packet->payload, "", NDPI_STATICSTRING_LEN("")) == 0) + { + ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); + return; + } + if ((packet->payload_packet_len > 13 && memcmp(packet->payload, "payload_packet_len >= NDPI_STATICSTRING_LEN("payload, "packet_counter < 3) { - NDPI_LOG_DBG2(ndpi_struct, "packet_counter: %u\n", flow->packet_counter); + + if (flow->packet_counter > max_packets) { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); return; } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); - - ndpi_exclude_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TRUPHONE, - __FILE__,__FUNCTION__,__LINE__); } @@ -113,7 +144,7 @@ void init_jabber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_i ndpi_set_bitmask_protocol_detection("Jabber", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_JABBER, ndpi_search_jabber_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); diff --git a/tests/pcap/jabber.pcap b/tests/pcap/jabber.pcap index 9d2e944520c1bce9ed71985c85aa748602f68c5c..def78d3e12d7407037c2d1a611c4dc995da4d109 100644 GIT binary patch literal 75040 zcmeIb30zd=_dkAd$6dlea~Tx{HI{*4bwH6#R7ONlQA>xJ0R|XmoEaRzN;I|9_OdiL z)Jojb%q&|}v``WEGShNj%FHy&%JhHEGjr$Oxtl;%pYQMQef8wM!_0H;d7t+==h^Oa zo40D!{8@^kQj~o=y1~D99Y;f|JvCHcSX3+v4Uh)~1o_K@{nZ9-m;%1jh)SeVbmknL zMs1S$jnbQSmRz+tzqc$TKmlKt`6cPCvPq5$lUkFn&e3UQYK!CV{y}}Ux-7Z8NZuPN zg9GKGY){9(C;`u#Kp6)GkKB=ssqO`TG*!YmmfW$SZ=I}AJ^o7X?lYS;q1>8LO&U>d z_Ukom-Dcx&C~8exD#m`s{y)}d-F@I1i@g@R1ZUk1?AKT$TME{Jb(x^x zfpxV!z1>{}=cJH3bks#9P}G2&iUHIB_zBj8cluou&+N*Ixi|6G?>4x5cg!Oc)u2)1 zO>PYvHga=o)?C%FkuUzOQ3L!x%0YPrcmW5>t2(pYeK4G3alr-U0az&S)M1o`GCi}u zYf`?e!8DNhYq>|nOYbDwe3!{DI0YSd9{xK+zt6QTBjBY#}6*V1DuE!1zj!#!syxy{`EoE-i z!7dkME&vSu7~PJ6EId#*CCJze=U8~URqP8C((Uz@1V7a6X&2oVC@ogAPHl*?|0A;+ zqkT0N|6+s56i}cp^p%0;g_daFJatx<&K#vF(CZ4Vj!zxGiT2I4T1`=bfjVoh&RiT| z|7w8IoD*oT)Z*)k9rzRK!^N)jq9k@533l5Buq#9CTD~oYoi_#sI1sy=UOU{;O|bCn zbFt>GxGZmV-L8r-8 z7wRnr3r*T0b77QTXU&c>sm*GGB?>Vv#D7dCe~a2u;LG|^OzP0sWR)_|SquAb@ySUE zBhvj-;zLEgFxr1uY)1N^V39wMh)au2@gFfL)?e=O4MrN=zgd@~w^(&%`tBWG#d0TF z*FgP5fBM_LfiX&lpGDDskD(BEu8p?<{^D`>SeclO8;t-Pw`SQm9BjObv2i1ojXitp za6bne!@`SAU)~Crkl_t7HaKGwk)c!#Aay~3 zt}sVeYan8>43R~d!5NXsc?t5A(%2AHdV*qDd`__{J=vC$ml2#&I=nbpUtF9O5*wLp zNR(@na`Z!!RL0EFgGN$l>p*Qe~j? zrXZlu7_f7^5ik(v+DC%zmp8hX?`m`dxYmfpwFuza8is3|SX@i)v%~#0xW>Zen%hij ztq|87GQ4Gt#;ToMBQn7KEGA>2r4BG_N2>}nhS1!sQ2=#e+N7)z$rg=aWNubc5WuP` z9XdMKsu>hpl$DfN1aKE+1&8L1Ne|Meq-T_-#B1a!={aB)Fi~D?i7Gv_R283qW^jIQ z%&3tCDe3vPF@_8t^NJQ~1b`xWZM#m_slQo^s4?n0cOXD#2=IKQlI*S}bPH68rw z4+g(^APWz~?-!6U3C^)_{ff$M`=^8qZy7Zv&goY~M&11?5Mm164_Eh)v5f9KyDDmA z#I9Ri?bnXa@H zX*4=Z?b{=$x}fe!Q>!HGKJ__4n^b_^7lYkzGj?x$nDVX}!svbs4>(+a^sA8wUGRkX!IT-oB*W?fwZ|W8vD@ZGDXo%4nx_ z#lFdKVqd_1eUcOVnW~0On$Wy;wxyNW?yF7P3%`f0acD5&I6-ZG;`l1`LyRUX{6<|s zTJ!b_Vw4)}H%I&C^o`4$m}k_a4IZ9gi_I;{$xO}G4A00Os+6+S`9w(2F5^2=k$?hh>p$}cnM_TfqwXPyS?t8!#Nh7j4d?;Ll3#24DiFl zFp}qpfxn;(219$7>;Ax)r`N_ZUn)&>SQ9tRXPy$J_4 zayal&WyPC1=>}FhybE;kLZEj}UHe>WFO+x2K%AEv3BocfJ>H z;r9Wz!fYc+u=ac)gxj|FByl4;d2A5C?FhlGHSIeDx1|hjsgS?%K)!YRdaru`Tw~$d z#!Xh!7jbL1Q&0x@XEaPx+4I4EU$D*6`uQg-&fn8F!ypRQhoCV^B&rOO2aLcQ3$t}* zU7-es7Fn|>5Gk4On2NG2MOoax2NKbA5=R`lTz?Ai6mJJT^`jsUkCg9ne+Od3&#V}+ z8hGf-*o-}Pvi#26Ejob_w<(GVaCo2nW}NL94ShShT0dPFf;} za3CKipW5sGePfEk!sTP*6E%;bZmpWS^3naB%8CUl6WMFg`fHSEx2XTb1r4(2k-vuzzOJnV~a+KXdeq zWRuj;H<1Y9Ft%<`7iviaukCLff!|@tI{u1I7q$JFF+00JUx>r_wbqFNueL($zv!VR z13~^cyI?fyOY0$&uEJ=73Bo$xGW}~4G)*u()xQQ?E`+iIn5n8y6-8E~zXs-;t@XMA z{55dbqA}~U>Qe#C?-b}X*wL;NDIF%n*sjm<$NqLbRJUvG4-VmPuLveB>t7AtM16G7 z>I!sLoxihXRYw*(eqLYc+4=&Q-_&UVL#sYp4>75prhq1=Ke&NbUzl?*3@Hk80Hy(U zE|?;n3;angXyTd++NkJUQ2Lc?E`XH|&H)n#S@ea_NiVb#w$#T^Xd!=n-GZk>bb;Ce z=oDpvkLK#gh*TY|3{e}FThX3I2Bzwxf5 z0@tRbej-nQ$4WZ=L|E=6(1>FGY%=R7sWl}M6|mO;xx{#;633!NUL^)gj#%@T4lTUj zI7j}o3XGb3q1@~IhDL49f>xG&g23h0oL?~sRWJ#DsP%{3XF}=4oZ&RbbcI8^;wY`! zs)qhfwq94DwRcAnhoz;APtQzEpgS?SdM)&Z;7gO#1x30Tes=|CNNh%PexSX7qlcb{ zGSL2AWgw{-y5z-BT)O8J@(0@#?D^9>z@shj85UmOdDXk;g!;}4ROP$csLH&%zCC7! zok!5OTm$`czkBtaBkg@>d(L+mO!zzfX4D7uVz1?Cc3NuOVdr!~y>^!GdiZM?cX*UF z?m+Zn#vRx)2208qIZH|gj61Y(#ZFj8$0w_u<0o7{hdB_kZq{RstDisoHTd~X?En9` z&FSaEiH)3dAgQca@(RcZgljBZ4m9Z2BUnNY7(W?%+o=c4)9)XCFAgC2C&hus&_k-O z?t{ao_o^Zbs&EpG!nza6re*!gYt zz(Q?qO$$1bkcGWg8Y*WTVh6L@)TVPdp4nJj5}+$$EqCTZDWPyyiB(50j&=Y{A&(5|x2+Pi#1LU;I0 zkD@|7#1@`NiC>v5q`~+OURcudJ~9s5$Vv{ z;9kBHd7peI)jrbTKf*aM=a7soDm{!evfRjin{^??{dXY=_SOCN*r~|HGbG&Vo;N^` z)jk+3elS@4V6d3ii+Al|-`kt&Fjy=w04X+*%Zw$kbHPFBTo8h7saEjZCi^+cu8+~V z;J9;M-QJeE=Me1bm$@ddQF}|T{xpqm*h>0ceD^5 z3>G^8aSpJu<|7^q7XOb87T00)k;w%INUz%7uRaX9U_D%8;r6Skr8NrDcaL(-1w9*+ zTmb#*YtCnl?YZFJ9pOYhxMLCRqW3$;&$we-l;Xlw)Q7t#!J-Z2yE?oN3V+Sk_|fc+tw&aB_KOn4{~Tw644T{tI1eJ+ulsp{}TNE^GZ{GtfB^ zuCZ`+c8jPXJZ)F*s&lW|w9Yo?bBqUC)Zf1BMU3|vP|!FB6mSx@c1y$P(O8LAJbO3{ z2JUdFrM-SKfh4o9T}#EuB*zj=)(A8Xt-4IyAijw6Ehu;(w^{4KdRf1wq0Lttkr_v13_mj{CMu)S~N!e32~7197EGN5YL+n z$MalC8P;#aWb~R1GOn^>t%MA{q>P-oVlsSR02$wMWV8_0BTrIBnXi}(zwRL8sJIOF zGlV@e_PayUr?Bwsae47n2^qNdcBh?(;OmH03nks?$H&NO`J9*Q)Qd^4&CwSI=ndSb z#>hiy@!G-??eL`Vw4~hB$b^vm$Pw9nv-)Nw29?69fAG6vS|~FT7F8ToWP&+c9Rvzf zF6_5}?um1&&RZ4Sn zG9H0zEL`l}T5WAAg#F^|@?BtG#QqWo`+Ge9m5l(9Ww3w11y@v-e`%6J-O)UT}r z^N+k4KSxf~naxJCz!Pd{2AA1Y2|IJ91WA=L4aua6AO$@!rBTD;UEH|FtTPy4C8vGa z0*;aSXB&%Z_n<1SOe|HC4kylYAv?HR4@LXp{HW;OIgScq;#DJL1x90jkx7=V))(ls zQNYeZe_b(5v_eLfX^jT8zEBy6Vt_$JCkK-#3hm3~(rK`>curdJqL3dh>0iF9_uCL> zFEVkqSwo0{Pcy!*WpPP8<+ytsTw~#JDYQmOxU|@nuf5+Ud<8BA{YZ1^&_z|lW(}Qj zmIGrwo*r{Pi3sNXKNPbOTeRZ@7RIvy;~2Qc!oxVICYoT(iP?SNSqq2>fN=*O4#xk= zvw8nsR3=XZhsGy_#tjUOjE@b+rvgPoF2R-SC-VVcaX-1$R?JWO;IlwKF@DlqOL-r< z$nq1gBOcf;UMMM}Z@HL^zRN(yDRCJsSv(n3cHI4YkcWkvcc~NQk4VVCy!(NjC#r^a zJ?^pCMGM>ZNxEh2gEhNTa_@x9o+Tt{ltK)+HhpX=V^glr!1|;Z#KL2dYh3EP41DGy zxHuf0WVgb3qy2)LXx;q-7i_KpFMR zqny4D6ZIU)RPcFHu-(699mI=kn?k@%+}~dMM3AQ!%Xd9m48Cxk@r4!_DDNW$jBV0c zwke!=$~_pav2cCC&FA+95;D*i?$W+sm%;dg*u%*Gy*oI%^W@1%aaOQ<_^h5khD?{f zJz~kV+kP`+H!k17rv?z8THwm}M~f>f%D)1iT2u9clkWyqL%`MPQ@Fn#9vCMd{o{-~ z<~}T38E$DcvBamI5R~Cft+{cAmT~kUl=08_lmrLpHZBDG#eMUl;COEN zSLM6>UkBf0jWM)@e)G|X7#o}HCMGtHeR-9S3a&}v?Z?~0jpLi$J+r5msrO?Ag8T8h ze+N&6OYO&d#G8J;`{Liytc|m z96z&6P`3jh?-7^%cu^;i#o$+rD#C$2G6`gihI1_3*hURbds;#Udp}->41xWTME2v| zJeSdphoi!a%*XGpVEHEE_z2*50sP@V7z&RG4ea?G@qKvAWf-+!F*lnM=$`Ig%@P51z!9hV05%S>RaJf7}t_XpKq2oab z$L`JoUE+UaH(tbo8_!MxCgT41f?0@9Sz~}tu-_4DFJ1?q7~I)8D{WW1u=otv$W>E{`|zsblNJB$Uc8+aOL1-c0zn?! z-g|ZBESJ4_-M^a(`Kb>RPd2gQ_%4v~8eC)Ha?Ne#lW`I<*n9ChWYm4n(3tw~#jBCS zzPrW4;`0@%^!yMN7zM6_Qu4@_$j-fZRi$b9De)<`l+sMcUc5QBlyr?evot4kOne6H zS z$komm#Pbb>7n%3mz1-C|R?eDUrX~BKT$$nYjWqC$sSGc0?-e{Szgxau?eh_wW8ukI z<3;9fcJ~pK0nb(rKJAn-8D-SR|1{3Mc!Ppcf|KQAMkSP_B%#4FY~*}YLeQ}E*`Pv*QQY5gB#&E3v(JKlp~xoo82tR}|jYZuXoHw5wOS0e7ZB z+i=1qtm9a( zkV=qKzXESze3`WuulwmV;O$)o`%^6JUj-TBd+~aaG3=`D9PBR=`vUf_b)d1|ND=IL z{fav6nhGO?_1M+&!Ct&DSQrDogLdWiO)pAvXv-!s4z0-o4xMz4gA)$nK9qFaKLzJ_ zp#OUB1rEVE7GBO<-~SB>85sL!J7XX4bR)%#gLC#i4by7n@Cq@U^{W%B{`OwH&sQ^k z$cs-3FER(Sd!eh3tjU^QrkjW{@O*O@A4y{{gheRiKn#;#c+cl^xWdAdvBhfuVz}E& zPzLzn_pO~Wtl)=f42Jx1RYxEYm()4S3*zd|LrB*1$Oyo{Ys_1Br}4K^efezJIvN zxG!@c^okiV$^z2Dd+~nA!i#5bMSPW@z4!0Ex)%3$X7=Lcaq0+Qg9qZ(=H>T%F#ciT z$#`qoFA_44Q&Yq^#hE*`J14$u>|fZ6Hzi<`(-(OhPNp7lm;Pz7M#u zHYJ67MqRi$H6ln7w|Iiv8v?kkL)=cUaKQ~$C(-`N-itR#waG_(FJ7+%lu@-xPzLyC zfYK@BZN#pA{#mQFy zDgMmAS0dtB`J*eI>y*HCVzY|=|2Ce%bzeR4U@zIaJnAU6nU=(YPshSu;G@gV0r&jH zgY5xu1LGbrAMs#&fCt+H{F~bYFwc3ibHO{(xgd$;f-A1M;JtHnE*KAwdpO!XB)8UK z3xWsR1K8jFT3Z|*Y!C2Ydw_fFS#QtDJs#{O>j1*JQ^AA1WI0=wGr54hm+WfD1>$?j zdJV!{@Ws2Xx!}X+NG^bW){z|7T;SR;e6W`+x2f#h!}0%#y=1Z9jt7npeF{7hAJ_b9 z2J(ot*8*8@n!RrC)pbf3gJRzG;(q!jjB~urj0v!1v>zrV!}m8a86Q3eGL)>bdyrS8Tedt zFZ}RnNq7obU~uQ}V0SO6_!hnT?#AmF_Ts&QinZTo?RMjJRCGVyA_flv!+xl>-^;-< z1#vH!aL?BJup6&KQFq}u40+$2>uP4n zN8lXqH53^;72N{FVU3W#J1I8TgOH*!)oR zpUR7_KKkhp;y>V{&s?Q_^zZnOK^2mA3p*pC-pfA?TNUg?*_Ix_5o0e1%w4+h-Ldh)(G{=9DOUkbwH z0(i8995@EG6LP_NxWd94=UVEeB7Jw6YcANmfbLfxo$Hzl{+s=Huh`WgV``s+KJfU6 z$o{Wh!-zf&UG>@1jMhg5PaHXN+qC+R6L5CzfN{4H6Kwq{y5_PLV`PH+zgB^+xc4g- zp6x2VQc>5c+Z_H|n@v6Uv1Qxx4@p~^Ziv}( zPcyJ3v#&MJmTVb+Ny?abUR1`*AfpvC*FrcsO_-Cd*GloeLAscXy)ux|sCF{CO3HZo z2{9SfK4opY{30&nmYw#5_bB5_xW>YZSyf(XD1*DVMYRvj`wlzr2k+||pX)X_FTAgC zxFohCdrD!;e$GsaBZ-nSP7D;4u?0BtgSh?J&k+W!|G)arJJK7yj6KtGw zAng5k&wvc^{dnhoC4_z6fW23%x4^qpe{t@|>we}SVE;5TB_;gK4em;BZ-3V!j@!Rz z|Hc30e!Sy1O4^6S&)v_s=3BH+eh0A6lCAIr0n0vMEsX!j0rq~pTYvn>M|?kCuMD(L z6{qd#kl{@&X}zD8v1t@=;2_$k?sHUi*^k#bTUh%scFv^W|3CNRy$yC2Z-Zu53i)Av zhrL&8`azs!_TzOwyNv3(X%xdH_I|uypW5Lgz8|mGNW!J*u6(WONB9a{Y9B^(Y4ZdX z$Z^KmdN7KUEt#Du|4+qiq5XJI0>=FzmSf?@Y&W^rD1tF3ChUjjRUjq+#$P%16QH^} zFs_%sa?rhJU-93I%FKSe@$$IvxS+&%sSSB22;{_mr*}yB2_@K8KtI`!>$RBuc-_yh zK#W;_0&y1)>_^2&%J@D}%oh(tf(&LqUY-p0e!Kx^cKCb`^04swoG1PwVp*QwCB;yYJ!I|kK+Eac%V%$eP88+Z7eKY8E(zJGKpWZ-$@Q@JsdK; zsg)aSw2Tj~pp5$EQBnAX_v3Y>Qr_EbB%WJhcYW)=pa}8ewn2OUP$l7SKjsSh!uGva z54HhcVD{s6zZgJu{Qw5l=r&F|%QpK!hWLKG@9dM1fxd8;_655P#ur2f$NqD7U_Tit z&WgXYAMeU5jNQ0=2cH^4d}^wzPaSMCy{rJ=XTEW5Pd48HSEt?Bdm9E#-s^)g8Vgs3 zTbkEc;!|0IGQ6pc%~NO@TV7KEKmHk?lHfq?Td4JPtNUqX#GUJ#Zvy_}ZN~T*A-^fu zu=naAfACFaKVJ8XN2#t`USn)*wTDd-HXio9Sa^9VzFizgMla9o_{)C1o?r6X zSdyo@I()OarI3<^Xq17Djb`ls#84E<;_5XJWQyyxtC670Fe0-ZYb~=wCZiX|9y~A~ z^x474;BuEz#9c%g3x8p8m*@n#g@J#pc?E`_NY0VPUsItRr+=_zJkFBA!%i{o<+|t* ze@$4%e3lFWJuVSFZV2cRUe*ruxarj6XK_8wuw?M{NN*^pM>yDH9PDeztSu+@i2s?< z!(=xHv4^4Zr(P9nn;h@(?)&+J2a1!FWvtDhshUf|$$3u-7Ot04RH+b3i=;~rYA zE+QyftG2hl*n{KH(=i$hYUV{U5^3G}S_4N;x4)20t+DEjh0(scVx6W4-u2{I7Hrp( z>rkOt*aL-CMkW z8M78;EcIt`k&)p|y??B|Q^vC>qkj2-4YBAPnbRta5#Uul)*?%^FF@{E0G{_L#75+`BRMPdN(ejDGSci^EG*m3`dd z8Vk=){)|~iIGpXu;eF2^$}>!X{`)6^1r82(>%UpmqTtW^aag=XC>3L{pYTs1Wygpc zQ*HuQ;#{0QNQftfDVn1->A=Ms&bfgW1-B`{i{YXl%N{%CSN3TF*I0O5yw#etV_E%V z5~m$9kc)?DE*jdP473OOGpvFEFL#82dlAqzjQo9&`Ju)h3LJ9uWIqszus|U`XbW~9 zYShBYJ_`683zxTUy<*lA-m>3;46(N+{ZL+E9PoD6r87?6?oqWcwE1Uv%WsQ2E%2YC zidb^_JqIuq=l85rLi{d_(;VHO2>iar@SAXN55w`X+96ivHw3lEh5Vn_9t%Ao<-GA=E9#4J%FCw4^A(_`N65R;~4M1r)5YMN^ZI+(~o?vmY z6=2|YIA$YaP(Ir=Hyr4AD9>mBAFDZi!r@~*n)XH(#Ni*9Ai@zf=<~_u7>7%ZG zd+@_Ud8X0ew_moKM*D5onTY9q^;^-D`0rVTH7Ao87omu#`#Tah1HR%uVR=o6ucpzO zqleyi$&;-HFQ%%bLVsVM%&b-KEL#9^z zwd;X(VtjxO4>_>z$x!z*aD|2IyHv@!9THfe@1{HQWa~*kAQp`83g$^2?qP}@Pui!P z4=&RCG>|83@&52WtD)e5_qi!|eb^c}$Krwk=JUldn}|<*;_4HJ-Upvpgg&t{#NiV@ zDIO}g*MG$)KwIH`L_PKE!^HV_bCDqCi!?_McLn}2`-rxl^dklOF#Kb4M!x4yY0mtO zcG@VYTaw%NXs5CLq+#dCD9O6&;3rXCBctx8pZGLH_SyM27V36`Yb;zpX>h|lQ^IE8 zC*xq)jA(PsDZ%kiqg6Ep`h10|N)acwCaMFfdRxOf@1YWvFZt zT*)TM1A+nr6I85sR|N;4>m{mU(sSX>%NAuIoGRhJ#MqSNp_wtMFoI;Z7~zG?jt`Vc z$s-fs+eU*j(0-~6#9t)G4N=9WB*f6U4nCznQf8zLjlqE=OH^Q>&1MVG6c~%NmRz+t zAD?wm2IAk9vGHj!$`R>l2?^;j^577KY=qIElcg4@H9FY{t68VBDgzyVRwj&2kByIy zi8ZOsR)en4D#ITr105eLhYpL29h#gDcW*RXEe2zeHCGwv{7{*ekd!=36{FJGWP{WO zlO9s>41feQAo4ogdlQNsTSq;Uw>2!u-+ zNPmWZ%upq#$Eb{jaP#yPIg3%IC#Mfhh#6dDvC1rnVop&B+zROa7)& zo2*5Uy#WFIi*jImY-UUXyxXiqtA<~ZOJ#h*h`5;KUTTxk($63R;|Bx;Ci;~So4v`NT1*F4r5h2 zqbJqt&BgbM(T=@j*aP^S8CupJExH_d@x9IrF}TR0Gh+_{1B5crd8IU|Ef$;6tc_uU z2E6&3{?O%(wx~1mwF(LzsC&D;83VE1goW2WdNXDV@jXua=*VM-@~maxdsm*H>+n6_ zL9e0y_47S86t07iyg^Kz0{jl|pX+ye&_mqsp6eiFLu(n>u+qiv+8Mnl(1r0k_S{{I z=K2H`$R>sN&ek8|I5PTqX7|7F^F#0h;di!rgyX|j6!yNExw`_qfCFtarj!q`TOiz4gYp0H^ceeU@$W$Ot{GF{&gDi3UR*e(X%@gDm!Q5wG zXMZ1c0$B`x#c=OKbVT0Sn%aiZjfbPc zmVt8h?B|6L$0ES756lUgr_t+|?HEGP$9RwYI|c<0)a_Z20Ym#D?`$1;UQo9_1V8pW zTWQ@~mJjgu+NZlgjzFO)&_gT7*Zyf8-YV+yhEiCgfckL#YExTD>_!soW^g!&*exd5 z6+7aCpGP;~9}7ENpN0owr*5ZDfC+k$_bb^(p^V&vf->OUp$+LdTZaq*UI@RlH8>YrU0nNQAM<` ztKk58vR;pi{dB-Z+$ZC*1Ua?X)+-zKQDeQg)y}DI3~zCb4IYU7S&%UvuCZ`^!)>^Y ztVzse&jW&QWcv~O0`?~u-yrs--wWp0Wyliq;JvN)cyH^&9#S@@PKwz$Cjo5SniY5V zK}=-Xm_4Vl1Z128dt>3n-7h!ylaRrFZ>vW*k)ixQ`QFy^UiySHpg$HaD}OcGD(L6IMyBF*uMI_HnKGp{BY*oPfTH%GE!$VTi zhwFz9N}QyL57K9j9vP&LOSWVN=jOuuCJVIja=A7s(>g4!I5#UvJ4s_G2vR2nMP`i} zE+0BtRiFt;iH21bx$1%fU15$60t(un8&4vX1?Q_e<9My{)QJcn4}aypJ_L7T(#K z1Mh3i2vWssidDo6p_8)UHJ+&>l7mx5C4^+A=M;}gPmrg?CzlR`@2BJq56aBTm&3bN zZK@H;mMlX`B%0S=5-gfgk+#%PiD1GU%b28s!ZD*&K|@E6EK#Qi>2*nRnys@S!^l!iQe=@PI3qG8Pi06+8f;J{je&Q@#s-gx&&|y=q!qyHM{O!Y zLaC~Bpdn>cW{4^{g-@B-XrKo4;7!Iti!KIj#pT7)O$;x1zM-&YiJ<{-fPIWJ zV0D{Ah81Nfv(@?n7?z+LLO33**IBcpV8};putedrUxoOO$>eWQTMD56gcEQWxr}Cg zsZI-P$gH|zEB>BI@G;4Slhg%zt&Hwn$&6+h-Ia3AojF8r+VI=f*OkS38i|#%@2ALnfma>W2sF6{u!p@HnEdjUzmq;u@oK^}xer z$ipXgIXPk@a-7()WtdnpxbcZnocTi#J25?Mj2`TM;*zX9XFrjr#{k=7L=Uro9?M~k z=d|zUyXt{!JW)p|%b9*6Tc&26)u#G1&pWxtFf;g46qoz&PIc4s0<-=$@ zL?W}AFpYqq3gdzgy` zPTsNGPSw8iJgQG{3G)mldF@=T+Ujr9TXX%%V7cI?)`8?ttgaWVyrQ#()T&jriMvIy zNw3Y(7Y67Jfxfa_wIw&&7v?7X;SG4ueUA2x*A|v&hbM)nCFQ0@CWPcij>ztt)i*0K zs1){#hAdND3!$+4DtD8*#<8Y0I>kn?#^Rf}s#FH$4 zh(xe6ZsY?jNDmQTu z%*F!PlL+4aqBEot>>O(5vn1)Qz@6s0j>eUjQl7!1u_~YTjpZIZpK|1B+da zk2Xi!pMZh~`n@~Y{v$ZY!nHlMW?l~3K8f9a0^2`)jkf)(s~oYAw!J}Tv8Z!&_s!V! z`m7wYvB(7d5Gx=FtIYCr8Y?R35C_CYow#kL{-7Hj=eek3 z^CAlLV{$S(M-G&fG2vk`8D6;{<2z^jg(rhOj&(P>I`tOlhlQud_Zcrs$iSHAXuqi1 zcd?=#%sc{TO+=PX9TuV1Y8=m6)WQ|P7eO~{jfKnI1`X%sA})z5Ju5e?*KH$ti_!}0UFDa%h5b~wDYnOEF5Dxx&mho5grQ1d(Cb0cgS=wm0 zxWBe*E+NCkUmx9zG8lj5tj%z+2cER4ZR4d5{)#SWPdKc$hGTfSI7+Lws%iQ_I5z05 zB;Sx=V27Xf*K>d~9_X))XEhqW9nP_E{grxe9%;KJv7fbrT+<=k3PpKW#IJsxQ94Ny0zK<0mVzP5+={3dCuzj=B|$8Il@w))$SwtAPr zN-CrU>s=~>exSo0!CbNtYr5P1N)mP>4BHY}YEAwCmuVFH6XQ@3X>Y_h{-zAHUpiOM zvUraAA_syXKjDFTj~}q#+8VC0aCz=V&9fp0k`}n;rEV{pd>7b&=K*m&96VPjUQ&VX z#Q&kuFWzjl&j)e-?sQKb%;4Fd*|FrpbW~_?m^>sbG$bMRj1}*P z8<)!AzQp6wsY`VK!@nzusfcwe&h>+k=xgs(&C@5GF8W9>19K?Iiv>5NzmVD@$JJGdw z;RK^co%{fCai4T^exLqvA~^|85_OE;%A{|zts%aSa|%@`c0LP zfo+riPJRwT8BE*6)lq~a4JJ*z7p~s@?=X6Ec|$4Y+3=nQXQCImi&#yFbu+0NfTn$%S&hBe`h7$t4{DTUWh}pf_0yX!kp=-a32r9mNyu>JCXpfTlR}8I zxmgAGg$L&3+i*`S;2aB=H`M%jrGz(}oa{4&=FK-zPTsfyZ`Lq*tnQgvFxEP{uFklu zg|tW3A9C&IdrQiG&t4bA7JR_x9N3R}w!v;c;0J9#{1*?zYA8zv4=csI$tYvc1Xn-y zIR{upqaV*&;))d`gWX0_fsEB44+~GmqIpjcd;BUW1N`{XI#(I@+a7`PAjqo`LE*uW zXTu|dB7=fp4HVi0b>P}$Dhn@O4pN*{h}ooPinL9xfGj-FCVh9mVcQMoSa>qFYM&I8 zF>Oi5o*$5S52JnL`G_uek5GzF#=~+W$GE0_!~_Q-S!+n`-9nw3>5222Y2*QISjWzK z*hp%+00iJDua1nWu!cFEd(N}@m#CX(qhl108;W^P5&k{q%8i~Mn0yzx1OFmAL9?68 zfh&IKu0nmC9KVHN!hv``vFx1fOE|~E!?Wt}JRv+6xjXS(?!dF_L-`cQsU4nPSw?M1Os)=|F(7B`F=W)2%T?uD=cKTmLa-etfbAl{Hujh6G`4qE zs8Dw&wwFK_9*FJBAmej5$HK#Q%Ony%xNVa~i=5cL%EtE2irQhz8s!z>YCW-K5f%00 zV)^ddl311zEXVS(T-*(?9Qcbt3`_QY%=2!aw{?U#jfLwAZY}4L_HEKMK^fj|gKt0N zlyMjB<;3#-q%Dy!Nsq${M-|+cq@MPW;5uT)wa+!cj*cTd9xAGr3HkWqZc94$deNn= z)AgZBN^$2d!*x1VwHV!)dOx$@B3cI3viGMRaw>J?HmX@Od~Q-(F^2acGlR(pb+(PbXywzG;IGN69@x^`N|IJ^xwP)5)j{T9*VW;{LoY#oUndpLTG z2086h+qzNx#@cJ5D6A9hP~i9g>+T124~1(iyt-p-kC3|G6RaDCT^Ga9puk#XSi_Do zP}XRy7Y>xw{mp)h!r&Z>-4ZOU{F3ejOK>_bfYW)zDe5x9K;y*5|MEzs1pb2vS8tyathXK1OVS8kFPopu zM=PcH*_q(~1qc80fd9kD&!~NPzj)C6%(Y(<+xAl{7bU_q7M^V*Y+Xp*n+59z+lGD! zw&m?(i1j1pY#r8u93^~)g(t_))|JTF#gTK9=+F*y_!xhN2iD28=W>k{?tVFF&rVNq zaDNzU!*w*9zriyaceXvxN!Lr}Bs)D>yL#!EaQA3qYM%P^+QA?bOYv))d>WNch&Z(? zw4B5=<>A-?RR1RZzS&mMKwJLk?(7+>Jaa}I`4k^0qRJcGz1wRz^URK0ucS@*ImS?X z++pL6vQ8a3y_Uw^F2yd9$a<6lPAZyo^hY@;&ogJns^3puQ-Zu<6Ci$Sx)51w__$-; z#k0?>rQ;1x55L0$i5^!udJKd5qf^`7y?f;>-Z_o?LcD+j>rFj(X6{SR7nn+$Fwh^-es9**CxVWvG8maF(i`IeNnJ(Z*$uL(Aw`swWZ$M ze9&{{7w2P=XTJk!nD#}Q*C?m$hv%g17EkcK!ol}7uv-eT8_|Kb8wG6-Jg{ExCoZl% z3FlaNcH4hAfz%r>STESE{c|v*K&@zUEN|l{38S?+KkWOg`k{r@p&cJrYCAV-ck}1R zE4sNgv%Pn{#|-O>vHKq#xAHB;gngz${g$t@-n^T>=a1868?SDP9$htI)7(=>4;Jb_ zJTQ9o#S5=KKCW$XO6oHcwtHJL-o3uFJbuxUz-t44OdFGZ;pt0p3w=vf7b?Hn^LG5< zS((3BW)*jgO*_%C^@LezO>CnV-uZC+z|sC2e)#i!%Kh4!izCXLHeInN{c}{<(dK#r z&*4D*C;WJE?N~U+!n0q>kSJomgB<&%j5zXHzf`cF*E6VpPqz6y3a@!)PP|g~+W9Gu zZOpsSdx9G^cK3D)Wj2Arwkc)3EM?O~g8lcd*nid!Y-&cE{;&h8bNXU2UciAml^X`E z!zLRRo=uYvCy{!q1nUKxR=_+!5Y=s>rg!Dx^trk#E3HiiZ(Uf`DRXIOYx4jR&rV0n~-r5UgshghD6F_Iuk#>UdK!=-_SoZPfK zU(WyadF$~(=j`&hIF9~xz&eSTHi+nZiKFj0!0{D=<5aj^K^#q8x^0udF`3l+xnRA3 zq~ynqAit@w0ym&tIBg@=#9wujW)O|V|zL(_0aj{DSS z%A+lQpD<zEH>&}bfrl0(A;+Hqywr)K+|K!?!Gj`=(dHtbqb;!e>}`wu(6WIjMV$VBO%?^MmaW-ZqJ(D&+Jjcm=o9Pm^5PbYjvWaNkLJyvs)I(;#^)vNLYpQPM= z<>tqkS1yh{@m7Nuc8*Xr`zZbTurcFPjt^P0>sIWItlTCBMaSW{CePcPlymB9+p=)| z-K^&a_UymUZ&F5Yb+3%Fk8-mkzW88fXmy9i&kWz9J9y#Q3(vP3Qq^ujpLcfnX!2)y zst&Ap_tod5Y`TxwRKvl31=#cy z+O*~;REf4}FQgj0U1{@)`3gdV{(I89$#{;C^ z{(|)aju$o(9FHttHZ$mjpPC*&ee1Qmt=@a8?Z+b)m-e3hOq&}kpL;b)5XV7_8-z*V z2r(LPOmfAs69qV4CODSW1xGr^4F?@fEAG$p-3=Kd6AUJ-cpPxhC}E%?%zhtRM2p&9{2>O^doYJ7KGO z&iC7=E?wVwWpPf`ANlRBG~nepytfIvW#V}HEqoL?^Hd{-GX&2c0na?lacw%Fj(CiN z!p?D6_n>{UE8;nBp+DCB{2WK@R?$t$Zl?*p z!#Mcnf!+Qhb|X5_cB69~)?3!1#})A$SA7QSja?yFFWBuZ_$lPLtLerVi~GQCS4@Z6 z{idFHWJB4n4Ln9&7*sGW{p847`HyU9aZELI$p??kG_>0{+q7|A+TaTlZ>{~l)Otws z+~H+DJ+7yWyZqvg(wu-Ko!}e)MyV?QHvDgPSZ2`m^SbVKUR> z+oKA=kTP4Q=>rQP&|WI-N;!=jAw*9rU4(lugePo2Iy8|6;p8Uun=CZCVE0VSJI! zaaeCv-i)8o)>wGHIJo*8ske_{yK8P5ku?elDEj zP?q;^3y#+%$1SaP54zbACFQEf*aZ&vBQ12|hao>jgfi#XR@KDP=6pb&Z9x7L^uWajKgzHRaCBvVG8(`!~QnDz5ypXYkFG<51Ut3!xkH802Ey={4NkvN`y z*ZUx6{F*SFA$UG=c+*BD=D084Lu=u|&2dM<%JCgQ61yzFBkpg?=?S9{np~QCtrN#NO+eXudY2- z)oXT>-=3X#VBp13a-X}4ii0XPE-G!%{JTDX?R4L{t7}dCFk5to^ol>4dXwwbK!aw(gUHiTaT0h^sg-#dDnYqKXDA0W0^w|M*HI?1WNCj{#T-|HBI z*!E<*p03x_4&(cLvNFN)=Ju18Ey*My@ zXk_c#2UnIh36*)r|MJtK)!Odak3^~6-(4P4+5K3*IaRHBIgVhOVRY_A&BN5sFdXyH z8dm#~VEO@IIv)M3yVb5G6C3IHPS=h34GXXC2tyjFyM|*gd)?q?KlHHYxTPEBzU2Gn zvOA3+ZZSE|#cn#Il-<+>-~AkX$AjIzAa)}<&~~F^Fy4P#jVVk#2A5=!dVK}!1-s>i zkQm%H&$e}C=kr-F?6~oAP4m&i8h`jn$H>p0OMHINn;&=o{pIg-`}IEUHlu&o+>M!xOZJZ_lboo{~otK8>#&DqX# zR@^#2>8a@EML%>K_}+!r-)gC@x*5ACyXBM1dT-6J9?g;6$O?R`r)olszyHOo0k?{O z9ILyYzj<&IpKCLEt#0HoY~;ovYhORHvH1N6G$N-Thx$_=n!?26q+tZH-xiMjzPPYC zy9u_LKORHkq>K4lG~bbVYW2AGTaS-FczEcwx7PSy890&`CsB5Jl}XB`8iM^kSM0N! zfK9KUO<%1*m1vt5;{_ZLpI@tKu{m!4 zg*=n$m2OMUf8F`_f|vKs`rg?OV9UMs@j;0(HbXkW@?#E`R{%?2#Ih%mD`R8Xr2p43 zMGO1}C@=25wdb2h9`|ATAE-ATsIP4OAt@YnMBlv}eSJ;3`7H^KIarSnjXpNr7BVrgFdzU610#?l`)_$E{_4HNhguNkDl4CPs)^ NOQ1aI>CH@x$^dHXPRjrQ diff --git a/tests/result/1kxun.pcap.out b/tests/result/1kxun.pcap.out index b59278927..6e7f824bf 100644 --- a/tests/result/1kxun.pcap.out +++ b/tests/result/1kxun.pcap.out @@ -6,7 +6,7 @@ Confidence Unknown : 14 (flows) Confidence Match by port : 5 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 177 (flows) -Num dissector calls: 5172 (26.25 diss/flow) +Num dissector calls: 5084 (25.81 diss/flow) Unknown 24 6428 14 DNS 2 378 1 diff --git a/tests/result/443-curl.pcap.out b/tests/result/443-curl.pcap.out index db264640d..a38f274f6 100644 --- a/tests/result/443-curl.pcap.out +++ b/tests/result/443-curl.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) ntop 109 73982 1 diff --git a/tests/result/443-firefox.pcap.out b/tests/result/443-firefox.pcap.out index dc8d2c6d2..8cc96a945 100644 --- a/tests/result/443-firefox.pcap.out +++ b/tests/result/443-firefox.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) ntop 667 458067 1 diff --git a/tests/result/443-git.pcap.out b/tests/result/443-git.pcap.out index dc12d8fdd..be0013599 100644 --- a/tests/result/443-git.pcap.out +++ b/tests/result/443-git.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Github 70 37189 1 diff --git a/tests/result/443-opvn.pcap.out b/tests/result/443-opvn.pcap.out index 2920e3b3d..a8bffe84f 100644 --- a/tests/result/443-opvn.pcap.out +++ b/tests/result/443-opvn.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 139 (139.00 diss/flow) +Num dissector calls: 135 (135.00 diss/flow) OpenVPN 46 11573 1 diff --git a/tests/result/443-safari.pcap.out b/tests/result/443-safari.pcap.out index de9f8520f..86f296621 100644 --- a/tests/result/443-safari.pcap.out +++ b/tests/result/443-safari.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) ntop 41 19929 1 diff --git a/tests/result/4in4tunnel.pcap.out b/tests/result/4in4tunnel.pcap.out index 55db50eaf..32e7fb8e0 100644 --- a/tests/result/4in4tunnel.pcap.out +++ b/tests/result/4in4tunnel.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 5 (5.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 169 (169.00 diss/flow) +Num dissector calls: 171 (171.00 diss/flow) Unknown 5 850 1 diff --git a/tests/result/4in6tunnel.pcap.out b/tests/result/4in6tunnel.pcap.out index 8ec4f6314..08f1f609d 100644 --- a/tests/result/4in6tunnel.pcap.out +++ b/tests/result/4in6tunnel.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 13 (13.00 diss/flow) +Num dissector calls: 11 (11.00 diss/flow) Microsoft 4 2188 1 diff --git a/tests/result/6in4tunnel.pcap.out b/tests/result/6in4tunnel.pcap.out index 83d0aa9c2..5c3f5c298 100644 --- a/tests/result/6in4tunnel.pcap.out +++ b/tests/result/6in4tunnel.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 27 (5.40 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) DPI Packets (other): 3 (1.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 67 (6.70 diss/flow) +Num dissector calls: 58 (5.80 diss/flow) HTTP 10 1792 1 IMAPS 4 516 2 diff --git a/tests/result/BGP_Cisco_hdlc_slarp.pcap.out b/tests/result/BGP_Cisco_hdlc_slarp.pcap.out index 2b2865dcc..cdfc3f56a 100644 --- a/tests/result/BGP_Cisco_hdlc_slarp.pcap.out +++ b/tests/result/BGP_Cisco_hdlc_slarp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) BGP 14 969 1 diff --git a/tests/result/EAQ.pcap.out b/tests/result/EAQ.pcap.out index c0e5c6932..5a778bb5b 100644 --- a/tests/result/EAQ.pcap.out +++ b/tests/result/EAQ.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) DPI Packets (UDP): 116 (4.00 pkts/flow) Confidence DPI : 31 (flows) -Num dissector calls: 4108 (132.52 diss/flow) +Num dissector calls: 4102 (132.32 diss/flow) Google 23 11743 2 EAQ 174 10092 29 diff --git a/tests/result/IEC104.pcap.out b/tests/result/IEC104.pcap.out index fac53756c..2c12494ad 100644 --- a/tests/result/IEC104.pcap.out +++ b/tests/result/IEC104.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (2.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 16 (8.00 diss/flow) +Num dissector calls: 14 (7.00 diss/flow) IEC60870 15 1431 2 diff --git a/tests/result/KakaoTalk_chat.pcap.out b/tests/result/KakaoTalk_chat.pcap.out index 6907d0b9b..26f193fec 100644 --- a/tests/result/KakaoTalk_chat.pcap.out +++ b/tests/result/KakaoTalk_chat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 949 (24.97 diss/flow) +Num dissector calls: 894 (23.53 diss/flow) DNS 2 217 1 HTTP 1 56 1 diff --git a/tests/result/KakaoTalk_talk.pcap.out b/tests/result/KakaoTalk_talk.pcap.out index 853c6b13b..00c6824c1 100644 --- a/tests/result/KakaoTalk_talk.pcap.out +++ b/tests/result/KakaoTalk_talk.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 6 (1.20 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 5 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 1027 (51.35 diss/flow) +Num dissector calls: 999 (49.95 diss/flow) HTTP 5 280 1 QQ 15 1727 1 diff --git a/tests/result/Oscar.pcap.out b/tests/result/Oscar.pcap.out index 654c69ba9..7593d578a 100644 --- a/tests/result/Oscar.pcap.out +++ b/tests/result/Oscar.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 71 (71.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 367 (367.00 diss/flow) +Num dissector calls: 365 (365.00 diss/flow) TLS 71 9386 1 diff --git a/tests/result/WebattackSQLinj.pcap.out b/tests/result/WebattackSQLinj.pcap.out index bde47e2d0..3414f7742 100644 --- a/tests/result/WebattackSQLinj.pcap.out +++ b/tests/result/WebattackSQLinj.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 54 (6.00 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 288 (32.00 diss/flow) +Num dissector calls: 261 (29.00 diss/flow) HTTP 94 30008 9 diff --git a/tests/result/WebattackXSS.pcap.out b/tests/result/WebattackXSS.pcap.out index 3120cddee..4840014f8 100644 --- a/tests/result/WebattackXSS.pcap.out +++ b/tests/result/WebattackXSS.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 639 DPI Packets (TCP): 3972 (6.01 pkts/flow) Confidence Match by port : 639 (flows) Confidence DPI : 22 (flows) -Num dissector calls: 21182 (32.05 diss/flow) +Num dissector calls: 17276 (26.14 diss/flow) HTTP 9374 4721148 661 diff --git a/tests/result/aimini-http.pcap.out b/tests/result/aimini-http.pcap.out index 3129503e6..f4f6aed31 100644 --- a/tests/result/aimini-http.pcap.out +++ b/tests/result/aimini-http.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (9.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 164 (41.00 diss/flow) +Num dissector calls: 148 (37.00 diss/flow) Aimini 133 86722 4 diff --git a/tests/result/ajp.pcap.out b/tests/result/ajp.pcap.out index 4513f7f40..e8fa2ea1b 100644 --- a/tests/result/ajp.pcap.out +++ b/tests/result/ajp.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 8 (4.00 pkts/flow) DPI Packets (other): 6 (3.00 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 36 (9.00 diss/flow) +Num dissector calls: 30 (7.50 diss/flow) Unknown 6 2200 2 AJP 26 4446 2 diff --git a/tests/result/alexa-app.pcapng.out b/tests/result/alexa-app.pcapng.out index af520b480..fc9d85dc8 100644 --- a/tests/result/alexa-app.pcapng.out +++ b/tests/result/alexa-app.pcapng.out @@ -6,7 +6,7 @@ DPI Packets (other): 6 (1.00 pkts/flow) Confidence Match by port : 5 (flows) Confidence Match by IP : 9 (flows) Confidence DPI : 146 (flows) -Num dissector calls: 2719 (16.99 diss/flow) +Num dissector calls: 2329 (14.56 diss/flow) DNS 4 400 2 DHCP 3 1056 2 diff --git a/tests/result/amqp.pcap.out b/tests/result/amqp.pcap.out index a0013433f..13ab8aec4 100644 --- a/tests/result/amqp.pcap.out +++ b/tests/result/amqp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (3.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 401 (133.67 diss/flow) +Num dissector calls: 400 (133.33 diss/flow) AMQP 160 23514 3 diff --git a/tests/result/android.pcap.out b/tests/result/android.pcap.out index 153931e68..beaf7ffe0 100644 --- a/tests/result/android.pcap.out +++ b/tests/result/android.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 52 (1.68 pkts/flow) DPI Packets (other): 4 (1.00 pkts/flow) Confidence Match by IP : 3 (flows) Confidence DPI : 60 (flows) -Num dissector calls: 668 (10.60 diss/flow) +Num dissector calls: 600 (9.52 diss/flow) DNS 4 390 2 MDNS 2 174 2 diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out index 3355c4780..d5c6c41ba 100644 --- a/tests/result/anyconnect-vpn.pcap.out +++ b/tests/result/anyconnect-vpn.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 2 (flows) Confidence Match by port : 5 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 61 (flows) -Num dissector calls: 1226 (17.77 diss/flow) +Num dissector calls: 1176 (17.04 diss/flow) Unknown 19 1054 2 DNS 32 3655 16 diff --git a/tests/result/anydesk-2.pcap.out b/tests/result/anydesk-2.pcap.out index 3ff3683dc..4d9b88a10 100644 --- a/tests/result/anydesk-2.pcap.out +++ b/tests/result/anydesk-2.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 13 (6.50 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 42 (10.50 diss/flow) +Num dissector calls: 36 (9.00 diss/flow) AnyDesk 2083 346113 4 diff --git a/tests/result/anydesk.pcap.out b/tests/result/anydesk.pcap.out index b1c0e3fa8..5c167e2da 100644 --- a/tests/result/anydesk.pcap.out +++ b/tests/result/anydesk.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 21 (10.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 23 (11.50 diss/flow) +Num dissector calls: 20 (10.00 diss/flow) AnyDesk 6963 2795460 2 diff --git a/tests/result/bot.pcap.out b/tests/result/bot.pcap.out index 514f8d5be..3479fe143 100644 --- a/tests/result/bot.pcap.out +++ b/tests/result/bot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) Azure 402 431124 1 diff --git a/tests/result/cachefly.pcapng.out b/tests/result/cachefly.pcapng.out index 5d921ba0d..a1d8613d5 100644 --- a/tests/result/cachefly.pcapng.out +++ b/tests/result/cachefly.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 8 (8.00 diss/flow) +Num dissector calls: 7 (7.00 diss/flow) Cachefly 6 6163 1 diff --git a/tests/result/cassandra.pcap.out b/tests/result/cassandra.pcap.out index 2627bb21c..c6a679059 100644 --- a/tests/result/cassandra.pcap.out +++ b/tests/result/cassandra.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 36 (18.00 diss/flow) +Num dissector calls: 30 (15.00 diss/flow) Cassandra 286 126016 2 diff --git a/tests/result/check_mk_new.pcap.out b/tests/result/check_mk_new.pcap.out index 966551a9d..12feec0f2 100644 --- a/tests/result/check_mk_new.pcap.out +++ b/tests/result/check_mk_new.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) CHECKMK 98 20242 1 diff --git a/tests/result/chrome.pcap.out b/tests/result/chrome.pcap.out index e8e62e628..5c6bd80ca 100644 --- a/tests/result/chrome.pcap.out +++ b/tests/result/chrome.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (6.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 108 (18.00 diss/flow) +Num dissector calls: 90 (15.00 diss/flow) TLS 5633 4985157 6 diff --git a/tests/result/citrix.pcap.out b/tests/result/citrix.pcap.out index 5da530a5b..7f02a3e74 100644 --- a/tests/result/citrix.pcap.out +++ b/tests/result/citrix.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Citrix 100 11332 1 diff --git a/tests/result/cloudflare-warp.pcap.out b/tests/result/cloudflare-warp.pcap.out index 75fe88b77..fffdf6aeb 100644 --- a/tests/result/cloudflare-warp.pcap.out +++ b/tests/result/cloudflare-warp.pcap.out @@ -1,12 +1,11 @@ -Guessed flow protos: 5 +Guessed flow protos: 4 -DPI Packets (TCP): 42 (5.25 pkts/flow) -Confidence Unknown : 1 (flows) +DPI Packets (TCP): 41 (5.12 pkts/flow) Confidence Match by IP : 3 (flows) -Confidence DPI : 4 (flows) -Num dissector calls: 328 (41.00 diss/flow) +Confidence DPI : 5 (flows) +Num dissector calls: 285 (35.62 diss/flow) -Unknown 11 890 1 +Jabber 11 890 1 Google 8 476 3 Messenger 17 2369 1 GoogleServices 5 492 1 @@ -20,11 +19,8 @@ JA3 Host Stats: 1 TCP 10.8.0.1:45606 <-> 104.18.47.234:443 [proto: 91.300/TLS.CloudflareWarp][Encrypted][Confidence: DPI][cat: VPN/2][6 pkts/924 bytes <-> 5 pkts/3107 bytes][Goodput ratio: 63/91][0.16 sec][Hostname/SNI: api.cloudflareclient.com][ALPN: http/1.1][bytes ratio: -0.542 (Download)][IAT c2s/s2c min/avg/max/stddev: 1/2 31/50 75/75 36/34][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 154/621 355/2891 111/1135][TLSv1.2][JA3C: 6f5e62edfa5933b1332ddf8b9fb3ef9d][ServerNames: cloudflareclient.com,*.cloudflareclient.com][JA3S: 9ebc57def2efb523f25c77af13aa6d48][Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3][Subject: C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=cloudflareclient.com][Certificate SHA-1: E6:54:3B:82:07:1E:29:C4:57:8C:B4:9E:64:38:11:38:9B:FC:66:98][Safari][Validity: 2022-05-19 00:00:00 - 2023-05-19 23:59:59][Cipher: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,0,25,0,0,25,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25] 2 TCP 10.8.0.1:45610 <-> 104.18.47.234:443 [proto: 91.300/TLS.CloudflareWarp][Encrypted][Confidence: DPI][cat: VPN/2][6 pkts/623 bytes <-> 5 pkts/3108 bytes][Goodput ratio: 45/91][0.15 sec][Hostname/SNI: api.cloudflareclient.com][ALPN: http/1.1][bytes ratio: -0.666 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/50 29/48 143/93 57/38][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 104/622 240/2854 69/1116][TLSv1.2][JA3C: 6f5e62edfa5933b1332ddf8b9fb3ef9d][ServerNames: cloudflareclient.com,*.cloudflareclient.com][JA3S: 9ebc57def2efb523f25c77af13aa6d48][Issuer: C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3][Subject: C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=cloudflareclient.com][Certificate SHA-1: E6:54:3B:82:07:1E:29:C4:57:8C:B4:9E:64:38:11:38:9B:FC:66:98][Safari][Validity: 2022-05-19 00:00:00 - 2023-05-19 23:59:59][Cipher: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,25,25,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25] 3 TCP 10.8.0.1:40214 <-> 157.240.16.32:443 [proto: 91.157/TLS.Messenger][Encrypted][Confidence: DPI][cat: Chat/9][9 pkts/1498 bytes <-> 8 pkts/871 bytes][Goodput ratio: 66/50][0.90 sec][Hostname/SNI: mqtt-mini.facebook.com][bytes ratio: 0.265 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/6 113/132 238/257 88/85][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 166/109 576/290 191/89][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.3][JA3C: 159db30fc8fac7fb58bcaeee8785a687][JA3S: fcb2d4d0991292272fcb1e464eedfd43][Cipher: TLS_AES_128_GCM_SHA256][Plen Bins: 28,14,0,0,0,14,0,14,0,0,0,0,14,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 4 TCP 10.8.0.1:51296 <-> 142.250.183.163:443 [proto: 91.239/TLS.GoogleServices][Encrypted][Confidence: DPI][cat: Web/5][3 pkts/384 bytes <-> 2 pkts/108 bytes][Goodput ratio: 52/0][0.00 sec][Hostname/SNI: crashlyticsreports-pa.googleapis.com][ALPN: http/1.1][TLSv1.2][JA3C: d8c87b9bfde38897979e41242626c2f3][Safari][Plen Bins: 0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 5 TCP 10.158.134.93:40454 <-> 216.58.196.68:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/120 bytes <-> 2 pkts/108 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 6 TCP 10.8.0.1:43600 <-> 172.217.194.188:5228 [proto: 126/Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/128 bytes <-> 1 pkts/54 bytes][Goodput ratio: 0/0][0.00 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 7 TCP 10.158.134.93:55512 -> 142.251.42.106:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][1 pkts/66 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - - -Undetected flows: - 1 TCP 10.8.0.1:42344 <-> 159.138.85.48:5223 [proto: 0/Unknown][ClearText][Confidence: Unknown][6 pkts/567 bytes <-> 5 pkts/323 bytes][Goodput ratio: 39/16][0.37 sec][bytes ratio: 0.274 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/50 56/79 122/101 56/20][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 94/65 208/91 56/15][Plen Bins: 25,25,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 4 TCP 10.8.0.1:42344 <-> 159.138.85.48:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][6 pkts/567 bytes <-> 5 pkts/323 bytes][Goodput ratio: 39/16][0.37 sec][bytes ratio: 0.274 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/50 56/79 122/101 56/20][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 94/65 208/91 56/15][Plen Bins: 25,25,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 TCP 10.8.0.1:51296 <-> 142.250.183.163:443 [proto: 91.239/TLS.GoogleServices][Encrypted][Confidence: DPI][cat: Web/5][3 pkts/384 bytes <-> 2 pkts/108 bytes][Goodput ratio: 52/0][0.00 sec][Hostname/SNI: crashlyticsreports-pa.googleapis.com][ALPN: http/1.1][TLSv1.2][JA3C: d8c87b9bfde38897979e41242626c2f3][Safari][Plen Bins: 0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 6 TCP 10.158.134.93:40454 <-> 216.58.196.68:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/120 bytes <-> 2 pkts/108 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 7 TCP 10.8.0.1:43600 <-> 172.217.194.188:5228 [proto: 126/Google][Encrypted][Confidence: Match by IP][cat: Web/5][2 pkts/128 bytes <-> 1 pkts/54 bytes][Goodput ratio: 0/0][0.00 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 8 TCP 10.158.134.93:55512 -> 142.251.42.106:443 [proto: 91.126/TLS.Google][Encrypted][Confidence: Match by IP][cat: Web/5][1 pkts/66 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/coap_mqtt.pcap.out b/tests/result/coap_mqtt.pcap.out index 4e8c0314c..ace83cad9 100644 --- a/tests/result/coap_mqtt.pcap.out +++ b/tests/result/coap_mqtt.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (1.75 pkts/flow) DPI Packets (UDP): 12 (1.00 pkts/flow) Confidence DPI : 16 (flows) -Num dissector calls: 364 (22.75 diss/flow) +Num dissector calls: 361 (22.56 diss/flow) COAP 19 1614 8 Dropbox 800 80676 4 diff --git a/tests/result/collectd.pcap.out b/tests/result/collectd.pcap.out index f0e526673..27b4ce8cf 100644 --- a/tests/result/collectd.pcap.out +++ b/tests/result/collectd.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 13 (1.62 pkts/flow) Confidence Match by port : 3 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 376 (47.00 diss/flow) +Num dissector calls: 378 (47.25 diss/flow) collectd 81 109386 8 diff --git a/tests/result/corba.pcap.out b/tests/result/corba.pcap.out index 465bd8c38..73ea64b1c 100644 --- a/tests/result/corba.pcap.out +++ b/tests/result/corba.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 273 (91.00 diss/flow) +Num dissector calls: 264 (88.00 diss/flow) Corba 22 3681 3 diff --git a/tests/result/dazn.pcapng.out b/tests/result/dazn.pcapng.out index 2cda8609b..ddf8fb043 100644 --- a/tests/result/dazn.pcapng.out +++ b/tests/result/dazn.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 39 (13.00 diss/flow) +Num dissector calls: 33 (11.00 diss/flow) Dazn 12 6675 3 diff --git a/tests/result/discord.pcap.out b/tests/result/discord.pcap.out index b371ad7ce..3c01e6653 100644 --- a/tests/result/discord.pcap.out +++ b/tests/result/discord.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 13 (13.00 diss/flow) +Num dissector calls: 11 (11.00 diss/flow) Discord 7 3708 1 diff --git a/tests/result/dnp3.pcap.out b/tests/result/dnp3.pcap.out index 7c33c704a..5022498ae 100644 --- a/tests/result/dnp3.pcap.out +++ b/tests/result/dnp3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 80 (10.00 pkts/flow) Confidence DPI : 8 (flows) -Num dissector calls: 408 (51.00 diss/flow) +Num dissector calls: 352 (44.00 diss/flow) DNP3 543 38754 8 diff --git a/tests/result/dns_doh.pcap.out b/tests/result/dns_doh.pcap.out index f8a59533c..eb8a008e5 100644 --- a/tests/result/dns_doh.pcap.out +++ b/tests/result/dns_doh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) DoH_DoT 142 20362 1 diff --git a/tests/result/dns_dot.pcap.out b/tests/result/dns_dot.pcap.out index 9033ba782..12f211a7e 100644 --- a/tests/result/dns_dot.pcap.out +++ b/tests/result/dns_dot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 20 (20.00 diss/flow) +Num dissector calls: 17 (17.00 diss/flow) DoH_DoT 24 5869 1 diff --git a/tests/result/dns_fragmented.pcap.out b/tests/result/dns_fragmented.pcap.out index b0e344079..61790c607 100644 --- a/tests/result/dns_fragmented.pcap.out +++ b/tests/result/dns_fragmented.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 12 (6.00 pkts/flow) DPI Packets (UDP): 39 (2.05 pkts/flow) Confidence DPI : 21 (flows) -Num dissector calls: 51 (2.43 diss/flow) +Num dissector calls: 45 (2.14 diss/flow) DNS 53 16888 18 Google 6 4807 3 diff --git a/tests/result/drda_db2.pcap.out b/tests/result/drda_db2.pcap.out index 88cfbbf7e..c6660f3e1 100644 --- a/tests/result/drda_db2.pcap.out +++ b/tests/result/drda_db2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 103 (103.00 diss/flow) +Num dissector calls: 100 (100.00 diss/flow) DRDA 38 6691 1 diff --git a/tests/result/emotet.pcap.out b/tests/result/emotet.pcap.out index 44f8f3167..06a71411f 100644 --- a/tests/result/emotet.pcap.out +++ b/tests/result/emotet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 48 (8.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 300 (50.00 diss/flow) +Num dissector calls: 281 (46.83 diss/flow) SMTP 626 438465 1 HTTP 1601 1581542 3 diff --git a/tests/result/ethereum.pcap.out b/tests/result/ethereum.pcap.out index 0db358b57..897de8459 100644 --- a/tests/result/ethereum.pcap.out +++ b/tests/result/ethereum.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 18 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence Match by IP : 2 (flows) Confidence DPI : 71 (flows) -Num dissector calls: 1515 (20.47 diss/flow) +Num dissector calls: 1353 (18.28 diss/flow) Mining 1997 215877 72 AmazonAWS 1 78 1 diff --git a/tests/result/exe_download.pcap.out b/tests/result/exe_download.pcap.out index 059e5720d..9fb6e10be 100644 --- a/tests/result/exe_download.pcap.out +++ b/tests/result/exe_download.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 703 717463 1 diff --git a/tests/result/exe_download_as_png.pcap.out b/tests/result/exe_download_as_png.pcap.out index 5c474e5fc..d175c0c1e 100644 --- a/tests/result/exe_download_as_png.pcap.out +++ b/tests/result/exe_download_as_png.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 534 529449 1 diff --git a/tests/result/facebook.pcap.out b/tests/result/facebook.pcap.out index b364ecb13..d2b670da2 100644 --- a/tests/result/facebook.pcap.out +++ b/tests/result/facebook.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 16 (8.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 36 (18.00 diss/flow) +Num dissector calls: 30 (15.00 diss/flow) Facebook 60 30511 2 diff --git a/tests/result/firefox.pcap.out b/tests/result/firefox.pcap.out index 1abaa0fed..72941a642 100644 --- a/tests/result/firefox.pcap.out +++ b/tests/result/firefox.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (6.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 108 (18.00 diss/flow) +Num dissector calls: 90 (15.00 diss/flow) TLS 5441 4952732 6 diff --git a/tests/result/fix2.pcap.out b/tests/result/fix2.pcap.out index 63ec519f0..fd7102646 100644 --- a/tests/result/fix2.pcap.out +++ b/tests/result/fix2.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 212 (106.00 diss/flow) +Num dissector calls: 206 (103.00 diss/flow) FIX 3046 246540 2 diff --git a/tests/result/forticlient.pcap.out b/tests/result/forticlient.pcap.out index c2275d3b6..6b94d82a7 100644 --- a/tests/result/forticlient.pcap.out +++ b/tests/result/forticlient.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 35 (7.00 pkts/flow) Confidence DPI (cache) : 4 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 100 (20.00 diss/flow) +Num dissector calls: 85 (17.00 diss/flow) FortiClient 2000 430931 5 diff --git a/tests/result/ftp-start-tls.pcap.out b/tests/result/ftp-start-tls.pcap.out index 7f2486b6f..ef8df8bc4 100644 --- a/tests/result/ftp-start-tls.pcap.out +++ b/tests/result/ftp-start-tls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 181 (181.00 diss/flow) +Num dissector calls: 177 (177.00 diss/flow) FTP_CONTROL 51 7510 1 diff --git a/tests/result/ftp.pcap.out b/tests/result/ftp.pcap.out index 57cdff806..f83c57f2f 100644 --- a/tests/result/ftp.pcap.out +++ b/tests/result/ftp.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 97 (32.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 701 (233.67 diss/flow) +Num dissector calls: 691 (230.33 diss/flow) Unknown 1115 1122198 1 FTP_CONTROL 68 5571 1 diff --git a/tests/result/ftp_failed.pcap.out b/tests/result/ftp_failed.pcap.out index 8c52a2454..3944a87a0 100644 --- a/tests/result/ftp_failed.pcap.out +++ b/tests/result/ftp_failed.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 166 (166.00 diss/flow) +Num dissector calls: 161 (161.00 diss/flow) FTP_CONTROL 18 1700 1 diff --git a/tests/result/fuzz-2006-06-26-2594.pcap.out b/tests/result/fuzz-2006-06-26-2594.pcap.out index 134c969f3..530fd71e9 100644 --- a/tests/result/fuzz-2006-06-26-2594.pcap.out +++ b/tests/result/fuzz-2006-06-26-2594.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 30 (flows) Confidence Match by port : 28 (flows) Confidence DPI : 193 (flows) -Num dissector calls: 5319 (21.19 diss/flow) +Num dissector calls: 5311 (21.16 diss/flow) Unknown 30 3356 30 FTP_CONTROL 36 2569 12 diff --git a/tests/result/fuzz-2006-09-29-28586.pcap.out b/tests/result/fuzz-2006-09-29-28586.pcap.out index 7ee7eec2e..162bb275f 100644 --- a/tests/result/fuzz-2006-09-29-28586.pcap.out +++ b/tests/result/fuzz-2006-09-29-28586.pcap.out @@ -6,7 +6,7 @@ Confidence Unknown : 3 (flows) Confidence Match by port : 23 (flows) Confidence Match by IP : 2 (flows) Confidence DPI : 12 (flows) -Num dissector calls: 1274 (31.85 diss/flow) +Num dissector calls: 1229 (30.73 diss/flow) Unknown 3 655 3 HTTP 116 27378 35 diff --git a/tests/result/genshin-impact.pcap.out b/tests/result/genshin-impact.pcap.out index e33e550b8..9bf666902 100644 --- a/tests/result/genshin-impact.pcap.out +++ b/tests/result/genshin-impact.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (4.00 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 565 (94.17 diss/flow) +Num dissector calls: 556 (92.67 diss/flow) GenshinImpact 90 18405 6 diff --git a/tests/result/git.pcap.out b/tests/result/git.pcap.out index 07187d19c..479f556cb 100644 --- a/tests/result/git.pcap.out +++ b/tests/result/git.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Git 90 74005 1 diff --git a/tests/result/gnutella.pcap.out b/tests/result/gnutella.pcap.out index 14e624d64..31e305a35 100644 --- a/tests/result/gnutella.pcap.out +++ b/tests/result/gnutella.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 595 (flows) Confidence Match by port : 1 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 163 (flows) -Num dissector calls: 64871 (85.36 diss/flow) +Num dissector calls: 64728 (85.17 diss/flow) Unknown 1423 119577 595 MDNS 18 1632 2 diff --git a/tests/result/google_ssl.pcap.out b/tests/result/google_ssl.pcap.out index 0612f182c..0dca16854 100644 --- a/tests/result/google_ssl.pcap.out +++ b/tests/result/google_ssl.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 28 (28.00 pkts/flow) Confidence Match by IP : 1 (flows) -Num dissector calls: 268 (268.00 diss/flow) +Num dissector calls: 261 (261.00 diss/flow) Google 28 9108 1 diff --git a/tests/result/googledns_android10.pcap.out b/tests/result/googledns_android10.pcap.out index 9b0f6a433..80c091efc 100644 --- a/tests/result/googledns_android10.pcap.out +++ b/tests/result/googledns_android10.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 42 (6.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 6 (flows) -Num dissector calls: 145 (18.12 diss/flow) +Num dissector calls: 122 (15.25 diss/flow) ICMP 4 392 1 Google 8 504 2 diff --git a/tests/result/gtp_false_positive.pcapng.out b/tests/result/gtp_false_positive.pcapng.out index 671adee97..96fd44a2d 100644 --- a/tests/result/gtp_false_positive.pcapng.out +++ b/tests/result/gtp_false_positive.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (UDP): 7 (2.33 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) -Num dissector calls: 371 (123.67 diss/flow) +Num dissector calls: 373 (124.33 diss/flow) Unknown 5 428 1 GTP 2 424 2 diff --git a/tests/result/hpvirtgrp.pcap.out b/tests/result/hpvirtgrp.pcap.out index de31113dd..bb289b7ce 100644 --- a/tests/result/hpvirtgrp.pcap.out +++ b/tests/result/hpvirtgrp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 37 (4.11 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 1143 (127.00 diss/flow) +Num dissector calls: 1116 (124.00 diss/flow) HP_VIRTGRP 135 12739 9 diff --git a/tests/result/http-crash-content-disposition.pcap.out b/tests/result/http-crash-content-disposition.pcap.out index 65edad719..afd31f6fe 100644 --- a/tests/result/http-crash-content-disposition.pcap.out +++ b/tests/result/http-crash-content-disposition.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) AmazonAWS 9 3328 1 diff --git a/tests/result/http-lines-split.pcap.out b/tests/result/http-lines-split.pcap.out index dcd4da415..7554868b8 100644 --- a/tests/result/http-lines-split.pcap.out +++ b/tests/result/http-lines-split.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 14 2503 1 diff --git a/tests/result/http-manipulated.pcap.out b/tests/result/http-manipulated.pcap.out index 801cb5e50..835b9ccf3 100644 --- a/tests/result/http-manipulated.pcap.out +++ b/tests/result/http-manipulated.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 64 (32.00 diss/flow) +Num dissector calls: 58 (29.00 diss/flow) HTTP 328 959347 2 diff --git a/tests/result/http_auth.pcap.out b/tests/result/http_auth.pcap.out index a264630b2..a19d2405a 100644 --- a/tests/result/http_auth.pcap.out +++ b/tests/result/http_auth.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 33 20574 1 diff --git a/tests/result/http_connect.pcap.out b/tests/result/http_connect.pcap.out index c1130c4b4..d4fb2debe 100644 --- a/tests/result/http_connect.pcap.out +++ b/tests/result/http_connect.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 37 (12.33 diss/flow) +Num dissector calls: 31 (10.33 diss/flow) DNS 2 178 1 TLS 58 36496 1 diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out index e05b3ed55..a90b1a160 100644 --- a/tests/result/http_ipv6.pcap.out +++ b/tests/result/http_ipv6.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 6 (flows) Confidence DPI : 8 (flows) -Num dissector calls: 264 (17.60 diss/flow) +Num dissector calls: 234 (15.60 diss/flow) Unknown 3 502 1 ntop 80 36401 4 diff --git a/tests/result/iec60780-5-104.pcap.out b/tests/result/iec60780-5-104.pcap.out index d036befeb..f68628337 100644 --- a/tests/result/iec60780-5-104.pcap.out +++ b/tests/result/iec60780-5-104.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 24 (4.00 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 108 (18.00 diss/flow) +Num dissector calls: 90 (15.00 diss/flow) IEC60870 147 9033 6 diff --git a/tests/result/imap-starttls.pcap.out b/tests/result/imap-starttls.pcap.out index 100f28744..65dd10236 100644 --- a/tests/result/imap-starttls.pcap.out +++ b/tests/result/imap-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 198 (198.00 diss/flow) +Num dissector calls: 193 (193.00 diss/flow) IMAPS 32 7975 1 diff --git a/tests/result/imap.pcap.out b/tests/result/imap.pcap.out index 27bf7ba31..2cd1781ca 100644 --- a/tests/result/imap.pcap.out +++ b/tests/result/imap.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 218 (218.00 diss/flow) +Num dissector calls: 215 (215.00 diss/flow) IMAP 33 3774 1 diff --git a/tests/result/imaps.pcap.out b/tests/result/imaps.pcap.out index 989991de4..003572281 100644 --- a/tests/result/imaps.pcap.out +++ b/tests/result/imaps.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 20 (20.00 diss/flow) +Num dissector calls: 17 (17.00 diss/flow) ntop 20 5196 1 diff --git a/tests/result/instagram.pcap.out b/tests/result/instagram.pcap.out index 71c738e71..100ab28eb 100644 --- a/tests/result/instagram.pcap.out +++ b/tests/result/instagram.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by port : 6 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 30 (flows) -Num dissector calls: 2166 (57.00 diss/flow) +Num dissector calls: 2126 (55.95 diss/flow) Unknown 1 66 1 HTTP 116 91784 6 diff --git a/tests/result/iphone.pcap.out b/tests/result/iphone.pcap.out index 754e51322..4edd7738c 100644 --- a/tests/result/iphone.pcap.out +++ b/tests/result/iphone.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 55 (1.77 pkts/flow) DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 50 (flows) -Num dissector calls: 608 (11.92 diss/flow) +Num dissector calls: 563 (11.04 diss/flow) Unknown 2 120 1 MDNS 17 7012 5 diff --git a/tests/result/ipp.pcap.out b/tests/result/ipp.pcap.out index c82cecde4..85a64b9c5 100644 --- a/tests/result/ipp.pcap.out +++ b/tests/result/ipp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 21 (7.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 108 (36.00 diss/flow) +Num dissector calls: 99 (33.00 diss/flow) IPP 277 248554 3 diff --git a/tests/result/irc.pcap.out b/tests/result/irc.pcap.out index 84fb273f1..bb49ebbfe 100644 --- a/tests/result/irc.pcap.out +++ b/tests/result/irc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 172 (172.00 diss/flow) +Num dissector calls: 168 (168.00 diss/flow) IRC 29 8945 1 diff --git a/tests/result/ja3_lots_of_cipher_suites.pcap.out b/tests/result/ja3_lots_of_cipher_suites.pcap.out index 5cacdb0f3..69ed2a11a 100644 --- a/tests/result/ja3_lots_of_cipher_suites.pcap.out +++ b/tests/result/ja3_lots_of_cipher_suites.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) TLS 11 5132 1 diff --git a/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out b/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out index a09964eb1..484917416 100644 --- a/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out +++ b/tests/result/ja3_lots_of_cipher_suites_2_anon.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) TLS 27 6966 1 diff --git a/tests/result/jabber.pcap.out b/tests/result/jabber.pcap.out index a2b5d9f58..7139acbc1 100644 --- a/tests/result/jabber.pcap.out +++ b/tests/result/jabber.pcap.out @@ -1,9 +1,20 @@ Guessed flow protos: 0 -DPI Packets (TCP): 6 (6.00 pkts/flow) -Confidence DPI : 1 (flows) -Num dissector calls: 142 (142.00 diss/flow) +DPI Packets (TCP): 74 (6.17 pkts/flow) +Confidence DPI : 12 (flows) +Num dissector calls: 1525 (127.08 diss/flow) -Jabber 13 901 1 +Jabber 358 61304 12 - 1 TCP 192.168.58.1:53460 <-> 192.168.58.153:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][7 pkts/565 bytes <-> 6 pkts/336 bytes][Goodput ratio: 28/0][0.07 sec][bytes ratio: 0.254 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/14 13/7 48/14 18/7][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 81/56 173/66 38/4][PLAIN TEXT (xml version)][Plen Bins: 66,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 TCP 172.16.0.62:57094 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][44 pkts/5701 bytes <-> 42 pkts/13807 bytes][Goodput ratio: 49/80][2.17 sec][bytes ratio: -0.416 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 36/39 611/611 109/111][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 130/329 559/1514 104/415][PLAIN TEXT (xml version)][Plen Bins: 2,4,2,24,9,13,4,6,9,0,2,2,2,0,0,4,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0] + 2 TCP 172.16.0.62:57122 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][44 pkts/5701 bytes <-> 42 pkts/13806 bytes][Goodput ratio: 49/80][2.16 sec][bytes ratio: -0.415 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 36/39 521/520 99/101][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 130/329 677/1514 116/415][PLAIN TEXT (xml version)][Plen Bins: 2,4,2,22,9,15,4,7,9,0,2,2,2,0,0,2,0,0,0,2,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0] + 3 TCP 172.16.0.62:57149 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][21 pkts/2752 bytes <-> 17 pkts/3414 bytes][Goodput ratio: 50/67][656.22 sec][bytes ratio: -0.107 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 35858/700 600484/4996 141164/1575][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 131/201 305/529 77/137][PLAIN TEXT (presence to)][Plen Bins: 0,18,0,22,18,9,18,4,0,0,0,0,4,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 4 TCP 172.16.0.62:57129 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][16 pkts/2866 bytes <-> 9 pkts/2273 bytes][Goodput ratio: 63/74][423.43 sec][bytes ratio: 0.115 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/2 23604/41249 136091/136094 40743/50152][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 179/253 769/481 173/115][PLAIN TEXT (iq type)][Plen Bins: 0,0,6,18,18,6,12,18,6,0,0,0,6,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 TCP 172.16.0.62:57147 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][16 pkts/1698 bytes <-> 12 pkts/1584 bytes][Goodput ratio: 38/49][0.42 sec][bytes ratio: 0.035 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 32/52 333/333 89/108][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 106/132 404/351 90/93][PLAIN TEXT (xml version)][Plen Bins: 30,0,0,10,10,30,0,0,10,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 6 TCP 192.168.2.100:58388 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][9 pkts/809 bytes <-> 6 pkts/455 bytes][Goodput ratio: 37/26][300.65 sec][bytes ratio: 0.280 (Upload)][IAT c2s/s2c min/avg/max/stddev: 13/1 30058/52574 209840/209871 73396/90816][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/76 221/91 51/13][Plen Bins: 12,63,12,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 7 TCP 192.168.2.100:34070 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][9 pkts/808 bytes <-> 6 pkts/455 bytes][Goodput ratio: 37/26][279.71 sec][bytes ratio: 0.279 (Upload)][IAT c2s/s2c min/avg/max/stddev: 26/0 39051/68333 273088/273176 95545/118266][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/76 221/91 51/12][Plen Bins: 12,63,12,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 8 TCP 192.168.2.100:41420 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][8 pkts/791 bytes <-> 7 pkts/471 bytes][Goodput ratio: 43/15][35.65 sec][bytes ratio: 0.254 (Upload)][IAT c2s/s2c min/avg/max/stddev: 31/0 5924/67 35140/231 13066/91][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 99/67 221/91 53/11][Plen Bins: 28,28,28,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 9 TCP 192.168.2.100:34218 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][9 pkts/808 bytes <-> 6 pkts/453 bytes][Goodput ratio: 37/26][306.20 sec][bytes ratio: 0.282 (Upload)][IAT c2s/s2c min/avg/max/stddev: 23/1 42924/75084 299903/299938 104911/129819][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/76 221/91 51/13][Plen Bins: 12,63,12,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 10 TCP 192.168.2.100:37614 <-> 160.44.201.102:5223 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][9 pkts/808 bytes <-> 6 pkts/453 bytes][Goodput ratio: 37/26][393.79 sec][bytes ratio: 0.282 (Upload)][IAT c2s/s2c min/avg/max/stddev: 24/1 13370/23387 93313/93412 32637/40429][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 90/76 221/91 51/13][Plen Bins: 12,63,12,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 11 TCP 192.168.58.1:53460 <-> 192.168.58.153:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][7 pkts/565 bytes <-> 6 pkts/336 bytes][Goodput ratio: 28/0][0.07 sec][bytes ratio: 0.254 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/14 13/7 48/14 18/7][Pkt Len c2s/s2c min/avg/max/stddev: 60/54 81/56 173/66 38/4][PLAIN TEXT (xml version)][Plen Bins: 66,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 12 TCP 172.16.0.62:57126 <-> 172.16.1.138:5222 [proto: 67/Jabber][ClearText][Confidence: DPI][cat: Web/5][4 pkts/280 bytes <-> 3 pkts/210 bytes][Goodput ratio: 6/0][0.00 sec][bytes ratio: 0.143 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 70/70 82/78 7/6][PLAIN TEXT (/stream)][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/result/kerberos-login.pcap.out b/tests/result/kerberos-login.pcap.out index d305f3b2d..fa15d673a 100644 --- a/tests/result/kerberos-login.pcap.out +++ b/tests/result/kerberos-login.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) DPI Packets (UDP): 12 (1.00 pkts/flow) Confidence DPI : 13 (flows) -Num dissector calls: 35 (2.69 diss/flow) +Num dissector calls: 31 (2.38 diss/flow) Kerberos 39 37272 13 diff --git a/tests/result/kerberos.pcap.out b/tests/result/kerberos.pcap.out index 5ab16f635..e5b7ab086 100644 --- a/tests/result/kerberos.pcap.out +++ b/tests/result/kerberos.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 77 (2.14 pkts/flow) Confidence Unknown : 2 (flows) Confidence Match by port : 23 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 3863 (107.31 diss/flow) +Num dissector calls: 3865 (107.36 diss/flow) Unknown 9 3031 2 SMBv23 6 1914 3 diff --git a/tests/result/lisp_registration.pcap.out b/tests/result/lisp_registration.pcap.out index 6fe6db23f..134ed6b69 100644 --- a/tests/result/lisp_registration.pcap.out +++ b/tests/result/lisp_registration.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 232 (58.00 diss/flow) +Num dissector calls: 226 (56.50 diss/flow) LISP 30 5266 4 diff --git a/tests/result/log4j-webapp-exploit.pcap.out b/tests/result/log4j-webapp-exploit.pcap.out index 817084f4a..aa5170e9e 100644 --- a/tests/result/log4j-webapp-exploit.pcap.out +++ b/tests/result/log4j-webapp-exploit.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 111 (15.86 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 569 (81.29 diss/flow) +Num dissector calls: 549 (78.43 diss/flow) Unknown 356 25081 2 HTTP 34 6741 3 diff --git a/tests/result/long_tls_certificate.pcap.out b/tests/result/long_tls_certificate.pcap.out index c82ad1250..c5b18b67e 100644 --- a/tests/result/long_tls_certificate.pcap.out +++ b/tests/result/long_tls_certificate.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (12.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Alibaba 47 14812 1 diff --git a/tests/result/malware.pcap.out b/tests/result/malware.pcap.out index a759a779c..83539ecf0 100644 --- a/tests/result/malware.pcap.out +++ b/tests/result/malware.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 2 (2.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 42 (8.40 diss/flow) +Num dissector calls: 38 (7.60 diss/flow) DNS 2 216 1 HTTP 1 66 1 diff --git a/tests/result/memcached.cap.out b/tests/result/memcached.cap.out index 315c18e59..3b61ed2ee 100644 --- a/tests/result/memcached.cap.out +++ b/tests/result/memcached.cap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 139 (139.00 diss/flow) +Num dissector calls: 135 (135.00 diss/flow) Memcached 10 1711 1 diff --git a/tests/result/monero.pcap.out b/tests/result/monero.pcap.out index 8f9a8a1e2..37c9d46da 100644 --- a/tests/result/monero.pcap.out +++ b/tests/result/monero.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 94 (47.00 diss/flow) +Num dissector calls: 88 (44.00 diss/flow) Mining 319 166676 2 diff --git a/tests/result/mongodb.pcap.out b/tests/result/mongodb.pcap.out index 41bb93a32..217e7ae43 100644 --- a/tests/result/mongodb.pcap.out +++ b/tests/result/mongodb.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 27 (3.38 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 5 (flows) -Num dissector calls: 239 (29.88 diss/flow) +Num dissector calls: 217 (27.12 diss/flow) Unknown 3 230 1 MongoDB 24 2510 7 diff --git a/tests/result/mpeg-dash.pcap.out b/tests/result/mpeg-dash.pcap.out index 9ccf2c17f..4289fc287 100644 --- a/tests/result/mpeg-dash.pcap.out +++ b/tests/result/mpeg-dash.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (2.50 pkts/flow) Confidence DPI : 4 (flows) -Num dissector calls: 93 (23.25 diss/flow) +Num dissector calls: 88 (22.00 diss/flow) AmazonAWS 9 2693 3 MpegDash 4 1976 1 diff --git a/tests/result/mpeg.pcap.out b/tests/result/mpeg.pcap.out index 966b42c6a..dbac65857 100644 --- a/tests/result/mpeg.pcap.out +++ b/tests/result/mpeg.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) ntop 19 10643 1 diff --git a/tests/result/mqtt.pcap.out b/tests/result/mqtt.pcap.out index 2f7add490..8dfc471fc 100644 --- a/tests/result/mqtt.pcap.out +++ b/tests/result/mqtt.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (1.50 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 9 (4.50 diss/flow) +Num dissector calls: 8 (4.00 diss/flow) MQTT 9 1481 2 diff --git a/tests/result/mssql_tds.pcap.out b/tests/result/mssql_tds.pcap.out index 7afca8fa3..678fa52d9 100644 --- a/tests/result/mssql_tds.pcap.out +++ b/tests/result/mssql_tds.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 18 (1.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 11 (flows) -Num dissector calls: 285 (23.75 diss/flow) +Num dissector calls: 287 (23.92 diss/flow) MsSQL-TDS 38 16260 12 diff --git a/tests/result/mysql-8.pcap.out b/tests/result/mysql-8.pcap.out index 5210a832e..b7f3f0beb 100644 --- a/tests/result/mysql-8.pcap.out +++ b/tests/result/mysql-8.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) MySQL 4 367 1 diff --git a/tests/result/nats.pcap.out b/tests/result/nats.pcap.out index cc329c0da..2d5e55056 100644 --- a/tests/result/nats.pcap.out +++ b/tests/result/nats.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 64 (32.00 diss/flow) +Num dissector calls: 56 (28.00 diss/flow) Nats 27 2460 2 diff --git a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out index c68fc0818..86a5158c2 100644 --- a/tests/result/ndpi_match_string_subprotocol__error.pcapng.out +++ b/tests/result/ndpi_match_string_subprotocol__error.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 25 (25.00 diss/flow) +Num dissector calls: 24 (24.00 diss/flow) SOAP 13 2935 1 diff --git a/tests/result/nest_log_sink.pcap.out b/tests/result/nest_log_sink.pcap.out index 92367ca22..fed1d3419 100644 --- a/tests/result/nest_log_sink.pcap.out +++ b/tests/result/nest_log_sink.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 176 (13.54 pkts/flow) DPI Packets (UDP): 2 (2.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 2195 (156.79 diss/flow) +Num dissector calls: 2104 (150.29 diss/flow) DNS 15 1612 1 NestLogSink 676 112058 12 diff --git a/tests/result/netbios.pcap.out b/tests/result/netbios.pcap.out index 1d5a27846..5d31a930b 100644 --- a/tests/result/netbios.pcap.out +++ b/tests/result/netbios.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 2 (2.00 pkts/flow) DPI Packets (UDP): 14 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 14 (flows) -Num dissector calls: 137 (9.13 diss/flow) +Num dissector calls: 136 (9.07 diss/flow) NetBIOS 258 24196 13 SMBv1 2 486 2 diff --git a/tests/result/netflix.pcap.out b/tests/result/netflix.pcap.out index 394360cef..341e1f477 100644 --- a/tests/result/netflix.pcap.out +++ b/tests/result/netflix.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (2.08 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 60 (flows) -Num dissector calls: 1250 (20.49 diss/flow) +Num dissector calls: 1110 (18.20 diss/flow) DNS 4 386 2 SSDP 16 2648 1 diff --git a/tests/result/nintendo.pcap.out b/tests/result/nintendo.pcap.out index 573f5e82e..54016ff23 100644 --- a/tests/result/nintendo.pcap.out +++ b/tests/result/nintendo.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 35 (2.33 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by IP : 6 (flows) Confidence DPI : 15 (flows) -Num dissector calls: 1314 (62.57 diss/flow) +Num dissector calls: 1310 (62.38 diss/flow) ICMP 30 2100 2 Nintendo 890 320242 12 diff --git a/tests/result/nntp.pcap.out b/tests/result/nntp.pcap.out index 32a122e87..43a7e1a1d 100644 --- a/tests/result/nntp.pcap.out +++ b/tests/result/nntp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 145 (145.00 diss/flow) +Num dissector calls: 141 (141.00 diss/flow) Usenet 32 7037 1 diff --git a/tests/result/no_sni.pcap.out b/tests/result/no_sni.pcap.out index bf05e1f48..a806185f7 100644 --- a/tests/result/no_sni.pcap.out +++ b/tests/result/no_sni.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 51 (6.38 pkts/flow) Confidence DPI : 8 (flows) -Num dissector calls: 127 (15.88 diss/flow) +Num dissector calls: 106 (13.25 diss/flow) DoH_DoT 268 31882 1 Cloudflare 917 562254 7 diff --git a/tests/result/ocs.pcap.out b/tests/result/ocs.pcap.out index 1a7c4e2a7..d5d25cb93 100644 --- a/tests/result/ocs.pcap.out +++ b/tests/result/ocs.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 92 (7.67 pkts/flow) DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 18 (flows) -Num dissector calls: 222 (11.10 diss/flow) +Num dissector calls: 200 (10.00 diss/flow) Google 29 3320 5 OCS 863 57552 7 diff --git a/tests/result/ocsp.pcapng.out b/tests/result/ocsp.pcapng.out index 4061abd12..8db082c9e 100644 --- a/tests/result/ocsp.pcapng.out +++ b/tests/result/ocsp.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 60 (6.00 pkts/flow) Confidence DPI : 10 (flows) -Num dissector calls: 320 (32.00 diss/flow) +Num dissector calls: 290 (29.00 diss/flow) HTTP 23 10871 1 OCSP 321 62776 9 diff --git a/tests/result/ookla.pcap.out b/tests/result/ookla.pcap.out index 477103dd9..6c33fdd4c 100644 --- a/tests/result/ookla.pcap.out +++ b/tests/result/ookla.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 16 (8.00 pkts/flow) Confidence DPI (cache) : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 145 (72.50 diss/flow) +Num dissector calls: 139 (69.50 diss/flow) Ookla 5086 4689745 2 diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out index f3b34fc66..a8eb736cc 100644 --- a/tests/result/openvpn.pcap.out +++ b/tests/result/openvpn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) DPI Packets (UDP): 5 (2.50 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 399 (133.00 diss/flow) +Num dissector calls: 395 (131.67 diss/flow) OpenVPN 298 57111 3 diff --git a/tests/result/oracle12.pcapng.out b/tests/result/oracle12.pcapng.out index 6038f6900..db76f0737 100644 --- a/tests/result/oracle12.pcapng.out +++ b/tests/result/oracle12.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 20 (20.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 314 (314.00 diss/flow) +Num dissector calls: 311 (311.00 diss/flow) Oracle 20 2518 1 diff --git a/tests/result/pgsql.pcap.out b/tests/result/pgsql.pcap.out index e78f56619..2a19914b7 100644 --- a/tests/result/pgsql.pcap.out +++ b/tests/result/pgsql.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 278 (139.00 diss/flow) +Num dissector calls: 270 (135.00 diss/flow) PostgreSQL 39 4709 2 diff --git a/tests/result/pinterest.pcap.out b/tests/result/pinterest.pcap.out index 61cd55954..650960951 100644 --- a/tests/result/pinterest.pcap.out +++ b/tests/result/pinterest.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 16 DPI Packets (TCP): 224 (6.05 pkts/flow) Confidence Match by port : 16 (flows) Confidence DPI : 21 (flows) -Num dissector calls: 425 (11.49 diss/flow) +Num dissector calls: 333 (9.00 diss/flow) TLS 979 1924858 20 Facebook 242 237988 2 diff --git a/tests/result/pluralsight.pcap.out b/tests/result/pluralsight.pcap.out index 19415d334..2d4995bc0 100644 --- a/tests/result/pluralsight.pcap.out +++ b/tests/result/pluralsight.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 33 (5.50 pkts/flow) Confidence DPI : 6 (flows) -Num dissector calls: 78 (13.00 diss/flow) +Num dissector calls: 66 (11.00 diss/flow) Pluralsight 44 29652 6 diff --git a/tests/result/pop3.pcap.out b/tests/result/pop3.pcap.out index 89f65c615..8171df058 100644 --- a/tests/result/pop3.pcap.out +++ b/tests/result/pop3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 196 (196.00 diss/flow) +Num dissector calls: 191 (191.00 diss/flow) POP3 31 3915 1 diff --git a/tests/result/pops.pcapng.out b/tests/result/pops.pcapng.out index 4407b2750..0ec1ad423 100644 --- a/tests/result/pops.pcapng.out +++ b/tests/result/pops.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 13 (13.00 diss/flow) POPS 5 2998 1 diff --git a/tests/result/pps.pcap.out b/tests/result/pps.pcap.out index 4f3d7ceb6..4bf187ab9 100644 --- a/tests/result/pps.pcap.out +++ b/tests/result/pps.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 201 (4.57 pkts/flow) Confidence Unknown : 34 (flows) Confidence Match by port : 2 (flows) Confidence DPI : 71 (flows) -Num dissector calls: 6416 (59.96 diss/flow) +Num dissector calls: 6427 (60.07 diss/flow) Unknown 990 378832 34 HTTP 377 402676 46 diff --git a/tests/result/pptp.pcap.out b/tests/result/pptp.pcap.out index c65c847a3..e321170f5 100644 --- a/tests/result/pptp.pcap.out +++ b/tests/result/pptp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 66 (66.00 diss/flow) +Num dissector calls: 63 (63.00 diss/flow) PPTP 24 2328 1 diff --git a/tests/result/psiphon3.pcap.out b/tests/result/psiphon3.pcap.out index afd80def8..cdad295eb 100644 --- a/tests/result/psiphon3.pcap.out +++ b/tests/result/psiphon3.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (12.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 23 (23.00 diss/flow) +Num dissector calls: 19 (19.00 diss/flow) Psiphon 62 11818 1 diff --git a/tests/result/punycode-idn.pcap.out b/tests/result/punycode-idn.pcap.out index 86b2f11c4..e7dc4475f 100644 --- a/tests/result/punycode-idn.pcap.out +++ b/tests/result/punycode-idn.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 4 (2.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 34 (11.33 diss/flow) +Num dissector calls: 31 (10.33 diss/flow) DNS 2 162 1 HTTP 12 1597 1 diff --git a/tests/result/radius_false_positive.pcapng.out b/tests/result/radius_false_positive.pcapng.out index 511e6637f..6b7f1d774 100644 --- a/tests/result/radius_false_positive.pcapng.out +++ b/tests/result/radius_false_positive.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (UDP): 10 (10.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 180 (180.00 diss/flow) +Num dissector calls: 182 (182.00 diss/flow) Unknown 10 7479 1 diff --git a/tests/result/rdp.pcap.out b/tests/result/rdp.pcap.out index 8533a8fbd..f0bc275a0 100644 --- a/tests/result/rdp.pcap.out +++ b/tests/result/rdp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) RDP 2010 622743 1 diff --git a/tests/result/reasm_crash_anon.pcapng.out b/tests/result/reasm_crash_anon.pcapng.out index 66c11808f..7c223a646 100644 --- a/tests/result/reasm_crash_anon.pcapng.out +++ b/tests/result/reasm_crash_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 81 (81.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 335 (335.00 diss/flow) +Num dissector calls: 337 (337.00 diss/flow) Unknown 200 20067 1 diff --git a/tests/result/reasm_segv_anon.pcapng.out b/tests/result/reasm_segv_anon.pcapng.out index cfed4a73d..73a0cdfe4 100644 --- a/tests/result/reasm_segv_anon.pcapng.out +++ b/tests/result/reasm_segv_anon.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 81 (81.00 pkts/flow) Confidence Match by port : 1 (flows) -Num dissector calls: 338 (338.00 diss/flow) +Num dissector calls: 336 (336.00 diss/flow) HTTP 82 77940 1 diff --git a/tests/result/reddit.pcap.out b/tests/result/reddit.pcap.out index 399fcba38..b7816cb49 100644 --- a/tests/result/reddit.pcap.out +++ b/tests/result/reddit.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 445 (7.42 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 59 (flows) -Num dissector calls: 839 (13.98 diss/flow) +Num dissector calls: 659 (10.98 diss/flow) TLS 508 331149 13 Twitter 863 686585 3 diff --git a/tests/result/rsh.pcap.out b/tests/result/rsh.pcap.out index 7796b2f4e..f319d3470 100644 --- a/tests/result/rsh.pcap.out +++ b/tests/result/rsh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 332 (166.00 diss/flow) +Num dissector calls: 324 (162.00 diss/flow) RSH 24 1721 2 diff --git a/tests/result/rsync.pcap.out b/tests/result/rsync.pcap.out index 323118a22..0153b6e26 100644 --- a/tests/result/rsync.pcap.out +++ b/tests/result/rsync.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 188 (188.00 diss/flow) +Num dissector calls: 183 (183.00 diss/flow) RSYNC 30 2493 1 diff --git a/tests/result/rtmp.pcap.out b/tests/result/rtmp.pcap.out index c78fd4d33..d34e8e54c 100644 --- a/tests/result/rtmp.pcap.out +++ b/tests/result/rtmp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 170 (170.00 diss/flow) +Num dissector calls: 165 (165.00 diss/flow) RTMP 26 8368 1 diff --git a/tests/result/rtsp.pcap.out b/tests/result/rtsp.pcap.out index a59a794f2..d9feb9fd7 100644 --- a/tests/result/rtsp.pcap.out +++ b/tests/result/rtsp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 87 (12.43 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 310 (44.29 diss/flow) +Num dissector calls: 256 (36.57 diss/flow) RTSP 568 100872 7 diff --git a/tests/result/safari.pcap.out b/tests/result/safari.pcap.out index 2aece435a..18654eebb 100644 --- a/tests/result/safari.pcap.out +++ b/tests/result/safari.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 46 (6.57 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 126 (18.00 diss/flow) +Num dissector calls: 105 (15.00 diss/flow) TLS 6019 5570309 7 diff --git a/tests/result/salesforce.pcap.out b/tests/result/salesforce.pcap.out index eb832c64b..12f0b9c86 100644 --- a/tests/result/salesforce.pcap.out +++ b/tests/result/salesforce.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Salesforce 15 5205 1 diff --git a/tests/result/sccp_hw_conf_register.pcapng.out b/tests/result/sccp_hw_conf_register.pcapng.out index 26f83a155..d2f013bee 100644 --- a/tests/result/sccp_hw_conf_register.pcapng.out +++ b/tests/result/sccp_hw_conf_register.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) CiscoSkinny 17 1522 1 diff --git a/tests/result/selfsigned.pcap.out b/tests/result/selfsigned.pcap.out index 2e2adf081..3d433501a 100644 --- a/tests/result/selfsigned.pcap.out +++ b/tests/result/selfsigned.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 25 (25.00 diss/flow) +Num dissector calls: 21 (21.00 diss/flow) ntop 20 3766 1 diff --git a/tests/result/signal.pcap.out b/tests/result/signal.pcap.out index d76d87f3b..6feaef838 100644 --- a/tests/result/signal.pcap.out +++ b/tests/result/signal.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 97 (6.47 pkts/flow) DPI Packets (UDP): 5 (1.67 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence DPI : 19 (flows) -Num dissector calls: 223 (11.74 diss/flow) +Num dissector calls: 187 (9.84 diss/flow) DNS 2 186 1 DHCP 4 1368 1 diff --git a/tests/result/simple-dnscrypt.pcap.out b/tests/result/simple-dnscrypt.pcap.out index 9c69a8afe..4b804b84a 100644 --- a/tests/result/simple-dnscrypt.pcap.out +++ b/tests/result/simple-dnscrypt.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 47 (11.75 pkts/flow) Confidence DPI (cache) : 3 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 72 (18.00 diss/flow) +Num dissector calls: 60 (15.00 diss/flow) DNScrypt 111 44676 4 diff --git a/tests/result/sip_hello.pcapng.out b/tests/result/sip_hello.pcapng.out index 3dd0e2f29..5f4797eb8 100644 --- a/tests/result/sip_hello.pcapng.out +++ b/tests/result/sip_hello.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 208 (208.00 diss/flow) +Num dissector calls: 210 (210.00 diss/flow) SIP 30 5592 1 diff --git a/tests/result/sites.pcapng.out b/tests/result/sites.pcapng.out index 4f5397832..90f173ca6 100644 --- a/tests/result/sites.pcapng.out +++ b/tests/result/sites.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence Match by IP : 3 (flows) Confidence DPI : 43 (flows) -Num dissector calls: 630 (13.40 diss/flow) +Num dissector calls: 533 (11.34 diss/flow) HTTP 2 148 1 Xbox 4 2245 1 diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out index fbb332b2e..db9211b9a 100644 --- a/tests/result/skype.pcap.out +++ b/tests/result/skype.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 61 (flows) Confidence Match by port : 27 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 204 (flows) -Num dissector calls: 32494 (110.90 diss/flow) +Num dissector calls: 32126 (109.65 diss/flow) Unknown 1575 272476 61 DNS 2 267 1 diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out index 3c83f3c36..65719b382 100644 --- a/tests/result/skype_no_unknown.pcap.out +++ b/tests/result/skype_no_unknown.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow) Confidence Unknown : 45 (flows) Confidence Match by port : 22 (flows) Confidence DPI : 200 (flows) -Num dissector calls: 26571 (99.52 diss/flow) +Num dissector calls: 26274 (98.40 diss/flow) Unknown 850 152468 45 DNS 2 267 1 diff --git a/tests/result/smb_frags.pcap.out b/tests/result/smb_frags.pcap.out index 69a0164b4..09aab382e 100644 --- a/tests/result/smb_frags.pcap.out +++ b/tests/result/smb_frags.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 5 (5.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 161 (161.00 diss/flow) +Num dissector calls: 159 (159.00 diss/flow) SMBv1 8 2763 1 diff --git a/tests/result/smpp_in_general.pcap.out b/tests/result/smpp_in_general.pcap.out index 57ba71483..334d974c6 100644 --- a/tests/result/smpp_in_general.pcap.out +++ b/tests/result/smpp_in_general.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 104 (104.00 diss/flow) +Num dissector calls: 101 (101.00 diss/flow) SMPP 17 1144 1 diff --git a/tests/result/smtp-starttls.pcap.out b/tests/result/smtp-starttls.pcap.out index 4211cd474..bb240e768 100644 --- a/tests/result/smtp-starttls.pcap.out +++ b/tests/result/smtp-starttls.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Google 36 8403 1 diff --git a/tests/result/smtp.pcap.out b/tests/result/smtp.pcap.out index 9e70e354e..5bbe595e7 100644 --- a/tests/result/smtp.pcap.out +++ b/tests/result/smtp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 212 (212.00 diss/flow) +Num dissector calls: 208 (208.00 diss/flow) SMTP 95 23157 1 diff --git a/tests/result/smtps.pcapng.out b/tests/result/smtps.pcapng.out index 6ce445685..670ed2419 100644 --- a/tests/result/smtps.pcapng.out +++ b/tests/result/smtps.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 3 (3.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 15 (15.00 diss/flow) +Num dissector calls: 13 (13.00 diss/flow) SMTPS 4 936 1 diff --git a/tests/result/snapchat.pcap.out b/tests/result/snapchat.pcap.out index a2781a132..6ff4f180b 100644 --- a/tests/result/snapchat.pcap.out +++ b/tests/result/snapchat.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 18 (6.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 54 (18.00 diss/flow) +Num dissector calls: 45 (15.00 diss/flow) Google 22 2879 1 Snapchat 34 7320 2 diff --git a/tests/result/soap.pcap.out b/tests/result/soap.pcap.out index 5e6d6b8b4..b3b914695 100644 --- a/tests/result/soap.pcap.out +++ b/tests/result/soap.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (3.67 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 369 (123.00 diss/flow) +Num dissector calls: 366 (122.00 diss/flow) Microsoft 1 1506 1 SOAP 19 9442 2 diff --git a/tests/result/socks-http-example.pcap.out b/tests/result/socks-http-example.pcap.out index 16aab48eb..dcadc21e8 100644 --- a/tests/result/socks-http-example.pcap.out +++ b/tests/result/socks-http-example.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 29 (9.67 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 531 (177.00 diss/flow) +Num dissector calls: 520 (173.33 diss/flow) SOCKS 46 8383 3 diff --git a/tests/result/softether-http.pcap.out b/tests/result/softether-http.pcap.out index 702d3a2d6..95d83222d 100644 --- a/tests/result/softether-http.pcap.out +++ b/tests/result/softether-http.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) Softether 4 1392 1 diff --git a/tests/result/ssh.pcap.out b/tests/result/ssh.pcap.out index 0e3295097..7e85e85c4 100644 --- a/tests/result/ssh.pcap.out +++ b/tests/result/ssh.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) SSH 258 35546 1 diff --git a/tests/result/ssl-cert-name-mismatch.pcap.out b/tests/result/ssl-cert-name-mismatch.pcap.out index 264617bed..80ba311e2 100644 --- a/tests/result/ssl-cert-name-mismatch.pcap.out +++ b/tests/result/ssl-cert-name-mismatch.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (10.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) GoogleCloud 21 5412 1 diff --git a/tests/result/starcraft_battle.pcap.out b/tests/result/starcraft_battle.pcap.out index 71d76cc25..7e996c351 100644 --- a/tests/result/starcraft_battle.pcap.out +++ b/tests/result/starcraft_battle.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 8 (flows) Confidence Match by IP : 5 (flows) Confidence DPI : 39 (flows) -Num dissector calls: 1954 (37.58 diss/flow) +Num dissector calls: 1873 (36.02 diss/flow) DNS 26 2848 7 HTTP 450 294880 19 diff --git a/tests/result/stun_signal.pcapng.out b/tests/result/stun_signal.pcapng.out index ddf62cc95..426da18fa 100644 --- a/tests/result/stun_signal.pcapng.out +++ b/tests/result/stun_signal.pcapng.out @@ -5,7 +5,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence DPI (partial) : 1 (flows) Confidence DPI (cache) : 2 (flows) Confidence DPI : 20 (flows) -Num dissector calls: 1838 (79.91 diss/flow) +Num dissector calls: 1846 (80.26 diss/flow) ICMP 53 5186 2 GoogleHangoutDuo 40 2720 4 diff --git a/tests/result/synscan.pcap.out b/tests/result/synscan.pcap.out index 9f67e2214..c6b391182 100644 --- a/tests/result/synscan.pcap.out +++ b/tests/result/synscan.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1992 DPI Packets (TCP): 2011 (1.01 pkts/flow) Confidence Unknown : 1868 (flows) Confidence Match by port : 126 (flows) -Num dissector calls: 13987 (7.01 diss/flow) +Num dissector calls: 11984 (6.01 diss/flow) Unknown 1872 108584 1868 FTP_CONTROL 2 116 2 diff --git a/tests/result/syslog.pcap.out b/tests/result/syslog.pcap.out index 7d794c4db..546e7982e 100644 --- a/tests/result/syslog.pcap.out +++ b/tests/result/syslog.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 10 (5.00 pkts/flow) DPI Packets (UDP): 20 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 21 (flows) -Num dissector calls: 75 (3.41 diss/flow) +Num dissector calls: 73 (3.32 diss/flow) Unknown 1 78 1 Syslog 93 20321 21 diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out index c44fdba1b..b29ff3448 100644 --- a/tests/result/teams.pcap.out +++ b/tests/result/teams.pcap.out @@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows) Confidence Match by IP : 1 (flows) Confidence DPI (partial) : 1 (flows) Confidence DPI : 80 (flows) -Num dissector calls: 1283 (15.46 diss/flow) +Num dissector calls: 1166 (14.05 diss/flow) Unknown 4 456 1 DNS 10 1357 5 diff --git a/tests/result/teamviewer.pcap.out b/tests/result/teamviewer.pcap.out index e2cb0a102..4c0e93893 100644 --- a/tests/result/teamviewer.pcap.out +++ b/tests/result/teamviewer.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) DPI Packets (UDP): 4 (4.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 161 (80.50 diss/flow) +Num dissector calls: 159 (79.50 diss/flow) TeamViewer 1298 704218 2 diff --git a/tests/result/telegram.pcap.out b/tests/result/telegram.pcap.out index 284f205d3..57abf22e1 100644 --- a/tests/result/telegram.pcap.out +++ b/tests/result/telegram.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 5 DPI Packets (UDP): 93 (1.94 pkts/flow) Confidence Unknown : 2 (flows) Confidence DPI : 46 (flows) -Num dissector calls: 1676 (34.92 diss/flow) +Num dissector calls: 1678 (34.96 diss/flow) Unknown 304 72496 2 DNS 8 716 4 diff --git a/tests/result/telnet.pcap.out b/tests/result/telnet.pcap.out index c32e97589..03dab2978 100644 --- a/tests/result/telnet.pcap.out +++ b/tests/result/telnet.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 33 (33.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 167 (167.00 diss/flow) +Num dissector calls: 163 (163.00 diss/flow) Telnet 87 7418 1 diff --git a/tests/result/tftp.pcap.out b/tests/result/tftp.pcap.out index 9aa19884c..765bfcdb4 100644 --- a/tests/result/tftp.pcap.out +++ b/tests/result/tftp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (UDP): 13 (1.86 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 300 (42.86 diss/flow) +Num dissector calls: 302 (43.14 diss/flow) TFTP 107 31296 7 diff --git a/tests/result/threema.pcap.out b/tests/result/threema.pcap.out index 5ed877b48..3063bb027 100644 --- a/tests/result/threema.pcap.out +++ b/tests/result/threema.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 66 (11.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 4 (flows) -Num dissector calls: 1348 (224.67 diss/flow) +Num dissector calls: 1334 (222.33 diss/flow) Threema 83 11578 6 diff --git a/tests/result/tinc.pcap.out b/tests/result/tinc.pcap.out index 3673c2105..972426f23 100644 --- a/tests/result/tinc.pcap.out +++ b/tests/result/tinc.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 19 (9.50 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI (cache) : 2 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 565 (141.25 diss/flow) +Num dissector calls: 557 (139.25 diss/flow) TINC 317 352291 4 diff --git a/tests/result/tls_alert.pcap.out b/tests/result/tls_alert.pcap.out index 6726ca2b0..830dcdde0 100644 --- a/tests/result/tls_alert.pcap.out +++ b/tests/result/tls_alert.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 19 (9.50 diss/flow) +Num dissector calls: 16 (8.00 diss/flow) TLS 7 533 1 Google 11 952 1 diff --git a/tests/result/tls_certificate_too_long.pcap.out b/tests/result/tls_certificate_too_long.pcap.out index f3c6e29c0..8c4385eaa 100644 --- a/tests/result/tls_certificate_too_long.pcap.out +++ b/tests/result/tls_certificate_too_long.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 2 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by IP : 1 (flows) Confidence DPI : 33 (flows) -Num dissector calls: 784 (22.40 diss/flow) +Num dissector calls: 751 (21.46 diss/flow) Unknown 13 5582 1 MDNS 5 983 3 diff --git a/tests/result/tls_esni_sni_both.pcap.out b/tests/result/tls_esni_sni_both.pcap.out index ffc582aa1..55447114f 100644 --- a/tests/result/tls_esni_sni_both.pcap.out +++ b/tests/result/tls_esni_sni_both.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 12 (6.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 36 (18.00 diss/flow) +Num dissector calls: 30 (15.00 diss/flow) Cloudflare 38 15899 2 diff --git a/tests/result/tls_false_positives.pcapng.out b/tests/result/tls_false_positives.pcapng.out index 5b13c02a8..fd047dade 100644 --- a/tests/result/tls_false_positives.pcapng.out +++ b/tests/result/tls_false_positives.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 30 (30.00 pkts/flow) Confidence Unknown : 1 (flows) -Num dissector calls: 407 (407.00 diss/flow) +Num dissector calls: 408 (408.00 diss/flow) Unknown 30 37313 1 diff --git a/tests/result/tls_invalid_reads.pcap.out b/tests/result/tls_invalid_reads.pcap.out index 3ff497c2f..837c43721 100644 --- a/tests/result/tls_invalid_reads.pcap.out +++ b/tests/result/tls_invalid_reads.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 10 (3.33 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 147 (49.00 diss/flow) +Num dissector calls: 143 (47.67 diss/flow) TLS 7 1827 1 Crashlytics 3 560 1 diff --git a/tests/result/tls_long_cert.pcap.out b/tests/result/tls_long_cert.pcap.out index ae1ee5a6d..4251e3d83 100644 --- a/tests/result/tls_long_cert.pcap.out +++ b/tests/result/tls_long_cert.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 9 (9.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) TLS 182 117601 1 diff --git a/tests/result/tls_port_80.pcapng.out b/tests/result/tls_port_80.pcapng.out index d498233dd..586a6e683 100644 --- a/tests/result/tls_port_80.pcapng.out +++ b/tests/result/tls_port_80.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 13 (13.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 20 (20.00 diss/flow) +Num dissector calls: 17 (17.00 diss/flow) TLS 13 2439 1 diff --git a/tests/result/tls_torrent.pcapng.out b/tests/result/tls_torrent.pcapng.out index c80af76a0..f4852eb48 100644 --- a/tests/result/tls_torrent.pcapng.out +++ b/tests/result/tls_torrent.pcapng.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 7 (7.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 13 (13.00 diss/flow) +Num dissector calls: 11 (11.00 diss/flow) BitTorrent 7 6308 1 diff --git a/tests/result/tls_verylong_certificate.pcap.out b/tests/result/tls_verylong_certificate.pcap.out index 8f74dda01..f0d348799 100644 --- a/tests/result/tls_verylong_certificate.pcap.out +++ b/tests/result/tls_verylong_certificate.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 11 (11.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) TLS 48 22229 1 diff --git a/tests/result/tor.pcap.out b/tests/result/tor.pcap.out index 28806f21e..549b17689 100644 --- a/tests/result/tor.pcap.out +++ b/tests/result/tor.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 43 (5.38 pkts/flow) DPI Packets (UDP): 3 (1.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 10 (flows) -Num dissector calls: 177 (16.09 diss/flow) +Num dissector calls: 155 (14.09 diss/flow) SMBv1 1 252 1 TLS 2028 1601908 4 diff --git a/tests/result/trickbot.pcap.out b/tests/result/trickbot.pcap.out index d4aea00d4..d4b7f3595 100644 --- a/tests/result/trickbot.pcap.out +++ b/tests/result/trickbot.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) HTTP 74 62002 1 diff --git a/tests/result/tumblr.pcap.out b/tests/result/tumblr.pcap.out index 0b351ebbf..d9ffdd088 100644 --- a/tests/result/tumblr.pcap.out +++ b/tests/result/tumblr.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 32 DPI Packets (TCP): 237 (5.04 pkts/flow) Confidence Match by port : 28 (flows) Confidence DPI : 19 (flows) -Num dissector calls: 411 (8.74 diss/flow) +Num dissector calls: 323 (6.87 diss/flow) Yahoo 31 9933 1 Tumblr 1733 1208864 2 diff --git a/tests/result/tunnelbear.pcap.out b/tests/result/tunnelbear.pcap.out index 109e3b5c6..bf168ff0d 100644 --- a/tests/result/tunnelbear.pcap.out +++ b/tests/result/tunnelbear.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 3 DPI Packets (TCP): 125 (5.95 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 20 (flows) -Num dissector calls: 379 (18.05 diss/flow) +Num dissector calls: 316 (15.05 diss/flow) TLS 34 13737 2 Google 5 306 1 diff --git a/tests/result/ultrasurf.pcap.out b/tests/result/ultrasurf.pcap.out index 45bbc93f4..6fe3c1363 100644 --- a/tests/result/ultrasurf.pcap.out +++ b/tests/result/ultrasurf.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 13 (4.33 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 160 (53.33 diss/flow) +Num dissector calls: 154 (51.33 diss/flow) TLS 5171 5127023 2 UltraSurf 2971 2991918 1 diff --git a/tests/result/viber.pcap.out b/tests/result/viber.pcap.out index cfd203dff..31236788f 100644 --- a/tests/result/viber.pcap.out +++ b/tests/result/viber.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 27 (1.93 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by IP : 4 (flows) Confidence DPI : 25 (flows) -Num dissector calls: 757 (26.10 diss/flow) +Num dissector calls: 719 (24.79 diss/flow) DNS 8 1267 4 MDNS 4 412 1 diff --git a/tests/result/vnc.pcap.out b/tests/result/vnc.pcap.out index 760f06f35..593745647 100644 --- a/tests/result/vnc.pcap.out +++ b/tests/result/vnc.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 286 (143.00 diss/flow) +Num dissector calls: 280 (140.00 diss/flow) VNC 4551 329158 2 diff --git a/tests/result/wa_video.pcap.out b/tests/result/wa_video.pcap.out index 0d490880b..6cfc8d954 100644 --- a/tests/result/wa_video.pcap.out +++ b/tests/result/wa_video.pcap.out @@ -4,7 +4,7 @@ DPI Packets (TCP): 81 (81.00 pkts/flow) DPI Packets (UDP): 13 (1.00 pkts/flow) Confidence Match by IP : 1 (flows) Confidence DPI : 13 (flows) -Num dissector calls: 545 (38.93 diss/flow) +Num dissector calls: 546 (39.00 diss/flow) SSDP 8 1377 3 DHCP 2 684 1 diff --git a/tests/result/wa_voice.pcap.out b/tests/result/wa_voice.pcap.out index 02d1f638e..b9d6f7ebb 100644 --- a/tests/result/wa_voice.pcap.out +++ b/tests/result/wa_voice.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 33 (1.57 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence DPI : 27 (flows) -Num dissector calls: 508 (18.14 diss/flow) +Num dissector calls: 497 (17.75 diss/flow) Unknown 2 120 1 MDNS 10 1188 2 diff --git a/tests/result/waze.pcap.out b/tests/result/waze.pcap.out index 54d289469..74f86de6d 100644 --- a/tests/result/waze.pcap.out +++ b/tests/result/waze.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence Unknown : 1 (flows) Confidence Match by port : 9 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 990 (30.00 diss/flow) +Num dissector calls: 887 (26.88 diss/flow) Unknown 10 786 1 HTTP 65 64777 8 diff --git a/tests/result/webex.pcap.out b/tests/result/webex.pcap.out index 12c19e46a..e9bc2c5b2 100644 --- a/tests/result/webex.pcap.out +++ b/tests/result/webex.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 17 (8.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence Match by IP : 3 (flows) Confidence DPI : 53 (flows) -Num dissector calls: 1247 (21.88 diss/flow) +Num dissector calls: 1087 (19.07 diss/flow) HTTP 22 3182 2 TLS 106 11841 8 diff --git a/tests/result/wechat.pcap.out b/tests/result/wechat.pcap.out index faa9524f8..15b2e5c9f 100644 --- a/tests/result/wechat.pcap.out +++ b/tests/result/wechat.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 7 (1.00 pkts/flow) Confidence Match by port : 17 (flows) Confidence Match by IP : 8 (flows) Confidence DPI : 78 (flows) -Num dissector calls: 1811 (17.58 diss/flow) +Num dissector calls: 1531 (14.86 diss/flow) DNS 13 1075 8 HTTP 70 4620 8 diff --git a/tests/result/weibo.pcap.out b/tests/result/weibo.pcap.out index 93549c109..363cfeff9 100644 --- a/tests/result/weibo.pcap.out +++ b/tests/result/weibo.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 44 (3.14 pkts/flow) Confidence Match by port : 13 (flows) Confidence Match by IP : 8 (flows) Confidence DPI : 23 (flows) -Num dissector calls: 987 (22.43 diss/flow) +Num dissector calls: 925 (21.02 diss/flow) DNS 6 630 3 HTTP 19 2275 5 diff --git a/tests/result/whatsapp.pcap.out b/tests/result/whatsapp.pcap.out index 5fb2e26a1..adef2b112 100644 --- a/tests/result/whatsapp.pcap.out +++ b/tests/result/whatsapp.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 344 (4.00 pkts/flow) Confidence DPI : 86 (flows) -Num dissector calls: 13330 (155.00 diss/flow) +Num dissector calls: 13158 (153.00 diss/flow) WhatsApp 679 96293 86 diff --git a/tests/result/whatsapp_login_call.pcap.out b/tests/result/whatsapp_login_call.pcap.out index 9ad6d881e..632cece10 100644 --- a/tests/result/whatsapp_login_call.pcap.out +++ b/tests/result/whatsapp_login_call.pcap.out @@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by port : 4 (flows) Confidence Match by IP : 16 (flows) Confidence DPI : 37 (flows) -Num dissector calls: 767 (13.46 diss/flow) +Num dissector calls: 690 (12.11 diss/flow) HTTP 11 726 3 MDNS 8 952 4 diff --git a/tests/result/whatsapp_login_chat.pcap.out b/tests/result/whatsapp_login_chat.pcap.out index 529977ee5..ad80872b4 100644 --- a/tests/result/whatsapp_login_chat.pcap.out +++ b/tests/result/whatsapp_login_chat.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 2 DPI Packets (TCP): 25 (8.33 pkts/flow) DPI Packets (UDP): 7 (1.17 pkts/flow) Confidence DPI : 9 (flows) -Num dissector calls: 320 (35.56 diss/flow) +Num dissector calls: 316 (35.11 diss/flow) MDNS 2 202 2 DHCP 6 2052 1 diff --git a/tests/result/whatsapp_voice_and_message.pcap.out b/tests/result/whatsapp_voice_and_message.pcap.out index 35f953260..ea8787fd4 100644 --- a/tests/result/whatsapp_voice_and_message.pcap.out +++ b/tests/result/whatsapp_voice_and_message.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 20 (4.00 pkts/flow) DPI Packets (UDP): 8 (1.00 pkts/flow) Confidence DPI : 13 (flows) -Num dissector calls: 568 (43.69 diss/flow) +Num dissector calls: 553 (42.54 diss/flow) WhatsAppCall 44 5916 8 WhatsApp 217 22139 5 diff --git a/tests/result/whatsappfiles.pcap.out b/tests/result/whatsappfiles.pcap.out index 86152b7a0..927310911 100644 --- a/tests/result/whatsappfiles.pcap.out +++ b/tests/result/whatsappfiles.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 14 (7.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 36 (18.00 diss/flow) +Num dissector calls: 30 (15.00 diss/flow) WhatsAppFiles 620 452233 2 diff --git a/tests/result/whois.pcapng.out b/tests/result/whois.pcapng.out index 5bd20e422..7050cd29a 100644 --- a/tests/result/whois.pcapng.out +++ b/tests/result/whois.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 16 (5.33 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 222 (74.00 diss/flow) +Num dissector calls: 215 (71.67 diss/flow) TLS 7 2046 1 Whois-DAS 16 4294 2 diff --git a/tests/result/windowsupdate_over_http.pcap.out b/tests/result/windowsupdate_over_http.pcap.out index 215aba005..c55aba02f 100644 --- a/tests/result/windowsupdate_over_http.pcap.out +++ b/tests/result/windowsupdate_over_http.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 32 (32.00 diss/flow) +Num dissector calls: 29 (29.00 diss/flow) WindowsUpdate 20 15975 1 diff --git a/tests/result/wow.pcap.out b/tests/result/wow.pcap.out index 1c8107121..972e454fa 100644 --- a/tests/result/wow.pcap.out +++ b/tests/result/wow.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 36 (7.20 pkts/flow) Confidence DPI : 5 (flows) -Num dissector calls: 237 (47.40 diss/flow) +Num dissector calls: 217 (43.40 diss/flow) WorldOfWarcraft 95 10688 5 diff --git a/tests/result/xiaomi.pcap.out b/tests/result/xiaomi.pcap.out index 9ee5e97ed..73bbb1682 100644 --- a/tests/result/xiaomi.pcap.out +++ b/tests/result/xiaomi.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 19 (2.71 pkts/flow) Confidence DPI : 7 (flows) -Num dissector calls: 779 (111.29 diss/flow) +Num dissector calls: 767 (109.57 diss/flow) Xiaomi 52 11467 7 diff --git a/tests/result/xss.pcap.out b/tests/result/xss.pcap.out index 60ca773de..ca3f0c265 100644 --- a/tests/result/xss.pcap.out +++ b/tests/result/xss.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 9 (4.50 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 49 (24.50 diss/flow) +Num dissector calls: 43 (21.50 diss/flow) HTTP 11 3209 2 diff --git a/tests/result/youtubeupload.pcap.out b/tests/result/youtubeupload.pcap.out index 1e9e69b24..00f6cfb00 100644 --- a/tests/result/youtubeupload.pcap.out +++ b/tests/result/youtubeupload.pcap.out @@ -3,7 +3,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 8 (8.00 pkts/flow) DPI Packets (UDP): 2 (1.00 pkts/flow) Confidence DPI : 3 (flows) -Num dissector calls: 20 (6.67 diss/flow) +Num dissector calls: 17 (5.67 diss/flow) YouTubeUpload 137 127038 3 diff --git a/tests/result/z3950.pcapng.out b/tests/result/z3950.pcapng.out index 89c9cdf84..3e2e6aedf 100644 --- a/tests/result/z3950.pcapng.out +++ b/tests/result/z3950.pcapng.out @@ -3,7 +3,7 @@ Guessed flow protos: 1 DPI Packets (TCP): 26 (13.00 pkts/flow) Confidence Match by port : 1 (flows) Confidence DPI : 1 (flows) -Num dissector calls: 502 (251.00 diss/flow) +Num dissector calls: 497 (248.50 diss/flow) Z3950 31 6308 2 diff --git a/tests/result/zabbix.pcap.out b/tests/result/zabbix.pcap.out index de10216f7..c907c5830 100644 --- a/tests/result/zabbix.pcap.out +++ b/tests/result/zabbix.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 18 (18.00 diss/flow) +Num dissector calls: 15 (15.00 diss/flow) Zabbix 10 715 1 diff --git a/tests/result/zattoo.pcap.out b/tests/result/zattoo.pcap.out index 1ebbdef98..77e208862 100644 --- a/tests/result/zattoo.pcap.out +++ b/tests/result/zattoo.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 10 (5.00 pkts/flow) Confidence DPI : 2 (flows) -Num dissector calls: 49 (24.50 diss/flow) +Num dissector calls: 43 (21.50 diss/flow) Zattoo 32 13467 2 diff --git a/tests/result/zcash.pcap.out b/tests/result/zcash.pcap.out index a17fc501a..2167c29c1 100644 --- a/tests/result/zcash.pcap.out +++ b/tests/result/zcash.pcap.out @@ -2,7 +2,7 @@ Guessed flow protos: 0 DPI Packets (TCP): 4 (4.00 pkts/flow) Confidence DPI : 1 (flows) -Num dissector calls: 47 (47.00 diss/flow) +Num dissector calls: 44 (44.00 diss/flow) Mining 145 20644 1 diff --git a/tests/result/zoom.pcap.out b/tests/result/zoom.pcap.out index c9c40ec39..b9873da96 100644 --- a/tests/result/zoom.pcap.out +++ b/tests/result/zoom.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 25 (1.47 pkts/flow) DPI Packets (other): 2 (1.00 pkts/flow) Confidence Match by IP : 2 (flows) Confidence DPI : 31 (flows) -Num dissector calls: 971 (29.42 diss/flow) +Num dissector calls: 942 (28.55 diss/flow) DNS 2 205 1 MDNS 1 87 1 diff --git a/tests/result/zoom2.pcap.out b/tests/result/zoom2.pcap.out index aeaa48b98..007b4edea 100644 --- a/tests/result/zoom2.pcap.out +++ b/tests/result/zoom2.pcap.out @@ -5,7 +5,7 @@ DPI Packets (UDP): 75 (25.00 pkts/flow) DPI Packets (other): 1 (1.00 pkts/flow) Confidence Match by IP : 3 (flows) Confidence DPI : 2 (flows) -Num dissector calls: 940 (188.00 diss/flow) +Num dissector calls: 943 (188.60 diss/flow) ICMP 27 1890 1 Zoom 11950 9004950 4