vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-05-19 07:54:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Keep track of how many dissectors calls we made for each flow (#1657)

Browse source
This commit is contained in:
Ivan Nardi 2022-07-11 09:47:47 +02:00 • committed by GitHub
parent df599e5eff
commit b4cb14ec19
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
357 changed files with 382 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
example/ndpiReader.c
View file

@ -1398,6 +1398,12 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
flow->detected_protocol) ? "Encrypted" : "ClearText");
fprintf(out, "[Confidence: %s]", ndpi_confidence_get_name(flow->confidence));
/* If someone wants to have the num_dissector_calls variable per flow, he can print it here.
Disabled by default to avoid too many diffs in the unit tests...
*/
#if 0
fprintf(out, "[Num calls: %d]", flow->num_dissector_calls);
#endif
if(flow->detected_protocol.category != 0)
fprintf(out, "[cat: %s/%u]",
@ -1977,6 +1983,7 @@ static void node_proto_guess_walker(const void *node, ndpi_VISIT which, int dept
ndpi_thread_info[thread_id].workflow->stats.protocol_counter_bytes[proto] += flow->src2dst_bytes + flow->dst2src_bytes;
ndpi_thread_info[thread_id].workflow->stats.protocol_flows[proto]++;
ndpi_thread_info[thread_id].workflow->stats.flow_confidence[flow->confidence]++;
ndpi_thread_info[thread_id].workflow->stats.num_dissector_calls += flow->num_dissector_calls;
}
}
@ -3482,6 +3489,8 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us
for(i = 0; i < sizeof(cumulative_stats.flow_confidence)/sizeof(cumulative_stats.flow_confidence[0]); i++)
cumulative_stats.flow_confidence[i] += ndpi_thread_info[thread_id].workflow->stats.flow_confidence[i];
cumulative_stats.num_dissector_calls += ndpi_thread_info[thread_id].workflow->stats.num_dissector_calls;
}
if(cumulative_stats.total_wire_bytes == 0)
@ -3589,6 +3598,11 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us
printf("\tConfidence: %-10s %-13llu (flows)\n", ndpi_confidence_get_name(i),
(long long unsigned int)cumulative_stats.flow_confidence[i]);
}
if(cumulative_stats.ndpi_flow_count)
printf("\tNum dissector calls: %-13llu (%.2f diss/flow)\n",
(long long unsigned int)cumulative_stats.num_dissector_calls,
cumulative_stats.num_dissector_calls / (float)cumulative_stats.ndpi_flow_count);
}
if(results_file) {
@ -3615,6 +3629,11 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us
(long long unsigned int)cumulative_stats.flow_confidence[i]);
}
if(cumulative_stats.ndpi_flow_count)
fprintf(results_file, "Num dissector calls: %llu (%.2f diss/flow)\n",
(long long unsigned int)cumulative_stats.num_dissector_calls,
cumulative_stats.num_dissector_calls / (float)cumulative_stats.ndpi_flow_count);
fprintf(results_file, "\n");
}

1
example/reader_util.c
View file

@ -1050,6 +1050,7 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
flow->risk_str = ndpi_strdup(s);
flow->confidence = flow->ndpi_flow->confidence;
flow->num_dissector_calls = flow->ndpi_flow->num_dissector_calls;
ndpi_snprintf(flow->host_server_name, sizeof(flow->host_server_name), "%s",
flow->ndpi_flow->host_server_name);

2
example/reader_util.h
View file

@ -203,6 +203,7 @@ typedef struct ndpi_flow_info {
// result only, not used for flow identification
ndpi_protocol detected_protocol;
ndpi_confidence_t confidence;
u_int16_t num_dissector_calls;
// Flow data analysis
pkt_timeval src2dst_last_pkt_time, dst2src_last_pkt_time, flow_last_pkt_time;
@ -296,6 +297,7 @@ typedef struct ndpi_stats {
u_int16_t max_packet_len;
u_int64_t dpi_packet_count[3];
u_int64_t flow_confidence[NDPI_CONFIDENCE_MAX];
u_int64_t num_dissector_calls;
} ndpi_stats_t;

1
src/include/ndpi_typedefs.h
View file

@ -1179,6 +1179,7 @@ struct ndpi_flow_struct {
u_int16_t guessed_protocol_id, guessed_host_protocol_id, guessed_category, guessed_header_category;
u_int8_t l4_proto, protocol_id_already_guessed:1, host_already_guessed:1, fail_with_unknown:1,
init_finished:1, setup_packet_direction:1, packet_direction:1, check_extra_packets:1, is_ipv6:1;
u_int16_t num_dissector_calls;
ndpi_confidence_t confidence; /* ndpi_confidence_t */
/*

14
src/lib/ndpi_main.c
View file

@ -5187,7 +5187,7 @@ static u_int32_t check_ndpi_detection_func(struct ndpi_detection_module_struct *
{
void *func = NULL;
u_int8_t is_tcp_without_payload = (callback_buffer == ndpi_str->callback_buffer_tcp_no_payload);
u_int32_t num_calls = (is_tcp_without_payload != 0 ? 1 : 0);
u_int32_t num_calls = 0;
u_int16_t proto_index = ndpi_str->proto_defaults[flow->guessed_protocol_id].protoIdx;
u_int16_t proto_id = ndpi_str->proto_defaults[flow->guessed_protocol_id].protoId;
NDPI_PROTOCOL_BITMASK detection_bitmask;
@ -6045,14 +6045,12 @@ static int ndpi_do_guess(struct ndpi_detection_module_struct *ndpi_str, struct n
}
if(flow->guessed_host_protocol_id >= NDPI_MAX_SUPPORTED_PROTOCOLS) {
//u_int32_t num_calls;
NDPI_SELECTION_BITMASK_PROTOCOL_SIZE ndpi_selection_packet = {0};
/* This is a custom protocol and it has priority over everything else */
ret->master_protocol = flow->guessed_protocol_id, ret->app_protocol = flow->guessed_host_protocol_id;
//num_calls =
ndpi_check_flow_func(ndpi_str, flow, &ndpi_selection_packet);
flow->num_dissector_calls += ndpi_check_flow_func(ndpi_str, flow, &ndpi_selection_packet);
//if(ndpi_str->ndpi_num_custom_protocols != 0)
ndpi_fill_protocol_category(ndpi_str, flow, ret);
@ -6311,10 +6309,12 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
flow->tree_risk_checked = 1;
}
ndpi_reconcile_protocols(ndpi_str, flow, &ret);
if(num_calls == 0)
/* It is common to not trigger any dissectors for pure TCP ACK packets */
if(num_calls == 0 && packet->payload_packet_len != 0)
flow->fail_with_unknown = 1;
flow->num_dissector_calls += num_calls;
ndpi_reconcile_protocols(ndpi_str, flow, &ret);
/* Zoom cache */
if((ret.app_protocol == NDPI_PROTOCOL_ZOOM)

1
tests/result/1kxun.pcap.out
View file

@ -6,6 +6,7 @@ Confidence Unknown : 14 (flows)
Confidence Match by port : 5 (flows)
Confidence Match by IP : 1 (flows)
Confidence DPI : 177 (flows)
Num dissector calls: 5172 (26.25 diss/flow)
Unknown 24 6428 14
DNS 2 378 1

1
tests/result/443-chrome.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 1 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
Num dissector calls: 121 (121.00 diss/flow)
TLS 1 1506 1

1
tests/result/443-curl.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 18 (18.00 diss/flow)
ntop 109 73982 1

1
tests/result/443-firefox.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 18 (18.00 diss/flow)
ntop 667 458067 1

1
tests/result/443-git.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 18 (18.00 diss/flow)
Github 70 37189 1

1
tests/result/443-opvn.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 139 (139.00 diss/flow)
OpenVPN 46 11573 1

1
tests/result/443-safari.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 18 (18.00 diss/flow)
ntop 41 19929 1

1
tests/result/4in4tunnel.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (UDP): 5 (5.00 pkts/flow)
Confidence Unknown : 1 (flows)
Num dissector calls: 169 (169.00 diss/flow)
Unknown 5 850 1

1
tests/result/4in6tunnel.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 13 (13.00 diss/flow)
Microsoft 4 2188 1

1
tests/result/6in4tunnel.pcap.out
View file

@ -4,6 +4,7 @@ DPI Packets (TCP): 27 (5.40 pkts/flow)
DPI Packets (UDP): 4 (2.00 pkts/flow)
DPI Packets (other): 3 (1.00 pkts/flow)
Confidence DPI : 10 (flows)
Num dissector calls: 67 (6.70 diss/flow)
HTTP 10 1792 1
IMAPS 4 516 2

1
tests/result/6in6tunnel.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence Unknown : 1 (flows)
Num dissector calls: 112 (112.00 diss/flow)
Unknown 2 212 1

1
tests/result/BGP_Cisco_hdlc_slarp.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 18 (18.00 diss/flow)
BGP 14 969 1

1
tests/result/BGP_redist.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 2 (1.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 2 (1.00 diss/flow)
BGP 2 322 2

1
tests/result/EAQ.pcap.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 12 (6.00 pkts/flow)
DPI Packets (UDP): 116 (4.00 pkts/flow)
Confidence DPI : 31 (flows)
Num dissector calls: 4108 (132.52 diss/flow)
Google 23 11743 2
EAQ 174 10092 29

1
tests/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 5 (1.00 pkts/flow)
Confidence DPI : 5 (flows)
Num dissector calls: 7 (1.40 diss/flow)
RTP 6995 1395012 1
SIP 92 52851 3

1
tests/result/IEC104.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 4 (2.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 16 (8.00 diss/flow)
IEC60870 15 1431 2

1
tests/result/KakaoTalk_chat.pcap.out
View file

@ -6,6 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Match by port : 4 (flows)
Confidence Match by IP : 1 (flows)
Confidence DPI : 33 (flows)
Num dissector calls: 949 (24.97 diss/flow)
DNS 2 217 1
HTTP 1 56 1

1
tests/result/KakaoTalk_talk.pcap.out
View file

@ -5,6 +5,7 @@ DPI Packets (UDP): 6 (1.20 pkts/flow)
Confidence Match by port : 4 (flows)
Confidence Match by IP : 5 (flows)
Confidence DPI : 11 (flows)
Num dissector calls: 1027 (51.35 diss/flow)
HTTP 5 280 1
QQ 15 1727 1

1
tests/result/NTPv2.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
NTP 1 410 1

1
tests/result/NTPv3.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
NTP 1 90 1

1
tests/result/NTPv4.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
NTP 1 90 1

1
tests/result/Oscar.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 71 (71.00 pkts/flow)
Confidence Match by port : 1 (flows)
Num dissector calls: 367 (367.00 diss/flow)
TLS 71 9386 1

1
tests/result/WebattackRCE.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 797
DPI Packets (TCP): 797 (1.00 pkts/flow)
Confidence DPI : 797 (flows)
Num dissector calls: 11955 (15.00 diss/flow)
HTTP 797 191003 797

1
tests/result/WebattackSQLinj.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 54 (6.00 pkts/flow)
Confidence DPI : 9 (flows)
Num dissector calls: 288 (32.00 diss/flow)
HTTP 94 30008 9

1
tests/result/WebattackXSS.pcap.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 639
DPI Packets (TCP): 3972 (6.01 pkts/flow)
Confidence Match by port : 639 (flows)
Confidence DPI : 22 (flows)
Num dissector calls: 21182 (32.05 diss/flow)
HTTP 9374 4721148 661

1
tests/result/afp.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
AFP 16 1218 1

1
tests/result/agora-sd-rtn.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 26 (1.00 pkts/flow)
Confidence DPI : 26 (flows)
Num dissector calls: 2444 (94.00 diss/flow)
SD-RTN 403 112365 26

1
tests/result/ah.pcapng.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 2 (1.00 diss/flow)
IPSec 6 1768 2

1
tests/result/aimini-http.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 36 (9.00 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 164 (41.00 diss/flow)
Aimini 133 86722 4

1
tests/result/ajp.pcap.out
View file

@ -4,6 +4,7 @@ DPI Packets (TCP): 8 (4.00 pkts/flow)
DPI Packets (other): 6 (3.00 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence DPI : 2 (flows)
Num dissector calls: 36 (9.00 diss/flow)
Unknown 6 2200 2
AJP 26 4446 2

1
tests/result/alexa-app.pcapng.out
View file

@ -6,6 +6,7 @@ DPI Packets (other): 6 (1.00 pkts/flow)
Confidence Match by port : 5 (flows)
Confidence Match by IP : 9 (flows)
Confidence DPI : 146 (flows)
Num dissector calls: 2719 (16.99 diss/flow)
DNS 4 400 2
DHCP 3 1056 2

1
tests/result/among_us.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
AmongUs 1 57 1

1
tests/result/amqp.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 9 (3.00 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 401 (133.67 diss/flow)
AMQP 160 23514 3

1
tests/result/android.pcap.out
View file

@ -5,6 +5,7 @@ DPI Packets (UDP): 52 (1.68 pkts/flow)
DPI Packets (other): 4 (1.00 pkts/flow)
Confidence Match by IP : 3 (flows)
Confidence DPI : 60 (flows)
Num dissector calls: 668 (10.60 diss/flow)
DNS 4 390 2
MDNS 2 174 2

1
tests/result/anyconnect-vpn.pcap.out
View file

@ -7,6 +7,7 @@ Confidence Unknown : 2 (flows)
Confidence Match by port : 5 (flows)
Confidence Match by IP : 1 (flows)
Confidence DPI : 61 (flows)
Num dissector calls: 1226 (17.77 diss/flow)
Unknown 19 1054 2
DNS 32 3655 16

1
tests/result/anydesk-2.pcap.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 13 (6.50 pkts/flow)
DPI Packets (UDP): 4 (2.00 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 42 (10.50 diss/flow)
AnyDesk 2083 346113 4

1
tests/result/anydesk.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 21 (10.50 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 23 (11.50 diss/flow)
AnyDesk 6963 2795460 2

1
tests/result/avast_securedns.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 39 (1.00 pkts/flow)
Confidence DPI : 39 (flows)
Num dissector calls: 3549 (91.00 diss/flow)
AVASTSecureDNS 77 11443 39

1
tests/result/bad-dns-traffic.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 11 (3.67 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 3 (1.00 diss/flow)
DNS 382 99374 3

1
tests/result/bitcoin.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 6 (1.00 pkts/flow)
Confidence DPI : 6 (flows)
Num dissector calls: 6 (1.00 diss/flow)
Mining 637 581074 6

1
tests/result/bittorrent.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 24 (1.00 pkts/flow)
Confidence DPI (cache) : 24 (flows)
Num dissector calls: 2114 (88.08 diss/flow)
BitTorrent 299 305728 24

1
tests/result/bittorrent_utp.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 4 (4.00 pkts/flow)
Confidence DPI (cache) : 1 (flows)
Num dissector calls: 81 (81.00 diss/flow)
BitTorrent 86 41489 1

1
tests/result/bjnp.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 10 (1.00 pkts/flow)
Confidence DPI : 10 (flows)
Num dissector calls: 10 (1.00 diss/flow)
BJNP 10 460 10

1
tests/result/bot.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 32 (32.00 diss/flow)
Azure 402 431124 1

1
tests/result/bt_search.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI (cache) : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
BitTorrent 2 322 1

1
tests/result/cachefly.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 8 (8.00 diss/flow)
Cachefly 6 6163 1

1
tests/result/capwap.pcap.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 1
DPI Packets (UDP): 6 (1.20 pkts/flow)
DPI Packets (other): 4 (1.00 pkts/flow)
Confidence DPI : 9 (flows)
Num dissector calls: 9 (1.00 diss/flow)
DNS 2 166 1
DHCP 5 2090 1

1
tests/result/cassandra.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 8 (4.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 36 (18.00 diss/flow)
Cassandra 286 126016 2

1
tests/result/check_mk_new.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 18 (18.00 diss/flow)
CHECKMK 98 20242 1

1
tests/result/chrome.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 36 (6.00 pkts/flow)
Confidence DPI : 6 (flows)
Num dissector calls: 108 (18.00 diss/flow)
TLS 5633 4985157 6

1
tests/result/citrix.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 18 (18.00 diss/flow)
Citrix 100 11332 1

1
tests/result/cloudflare-warp.pcap.out
View file

@ -4,6 +4,7 @@ DPI Packets (TCP): 42 (5.25 pkts/flow)
Confidence Unknown : 1 (flows)
Confidence Match by IP : 3 (flows)
Confidence DPI : 4 (flows)
Num dissector calls: 328 (41.00 diss/flow)
Unknown 11 890 1
Google 8 476 3

1
tests/result/coap_mqtt.pcap.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 7 (1.75 pkts/flow)
DPI Packets (UDP): 12 (1.00 pkts/flow)
Confidence DPI : 16 (flows)
Num dissector calls: 364 (22.75 diss/flow)
COAP 19 1614 8
Dropbox 800 80676 4

1
tests/result/collectd.pcap.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 3
DPI Packets (UDP): 13 (1.62 pkts/flow)
Confidence Match by port : 3 (flows)
Confidence DPI : 5 (flows)
Num dissector calls: 376 (47.00 diss/flow)
collectd 81 109386 8

1
tests/result/corba.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 12 (4.00 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 273 (91.00 diss/flow)
Corba 22 3681 3

1
tests/result/cpha.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
CPHA 1 96 1

1
tests/result/dazn.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 12 (4.00 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 39 (13.00 diss/flow)
Dazn 12 6675 3

1
tests/result/dcerpc.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 4 (1.00 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 216 (54.00 diss/flow)
RPC 16 6866 4

1
tests/result/dhcp-fuzz.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
Num dissector calls: 99 (99.00 diss/flow)
DHCP 1 342 1

1
tests/result/diameter.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
Diameter 6 1980 1

1
tests/result/discord.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 5 (5.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 13 (13.00 diss/flow)
Discord 7 3708 1

1
tests/result/dlt_ppp.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
QUIC 1 1230 1

1
tests/result/dnp3.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 80 (10.00 pkts/flow)
Confidence DPI : 8 (flows)
Num dissector calls: 408 (51.00 diss/flow)
DNP3 543 38754 8

1
tests/result/dns-invalid-chars.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
DNS 2 196 1

1
tests/result/dns-tunnel-iodine.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
DNS 434 70252 1

1
tests/result/dns_ambiguous_names.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 20 (2.00 pkts/flow)
Confidence DPI : 10 (flows)
Num dissector calls: 10 (1.00 diss/flow)
QQ 2 212 1
Google 2 208 1

1
tests/result/dns_doh.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 18 (18.00 diss/flow)
DoH_DoT 142 20362 1

1
tests/result/dns_dot.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 20 (20.00 diss/flow)
DoH_DoT 24 5869 1

1
tests/result/dns_exfiltration.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
DNS 300 73545 1

1
tests/result/dns_fragmented.pcap.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 1
DPI Packets (TCP): 12 (6.00 pkts/flow)
DPI Packets (UDP): 39 (2.05 pkts/flow)
Confidence DPI : 21 (flows)
Num dissector calls: 51 (2.43 diss/flow)
DNS 53 16888 18
Google 6 4807 3

1
tests/result/dns_invert_query.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
DNS 2 134 1

1
tests/result/dns_long_domainname.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
Google 2 262 1

1
tests/result/dnscrypt-v1-and-resolver-pings.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 256 (1.04 pkts/flow)
Confidence DPI : 245 (flows)
Num dissector calls: 21885 (89.33 diss/flow)
DNScrypt 488 309562 245

1
tests/result/dnscrypt-v2-doh.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 70 (2.06 pkts/flow)
Confidence DPI : 34 (flows)
Num dissector calls: 40 (1.18 diss/flow)
DoH_DoT 577 216583 34

1
tests/result/dnscrypt-v2.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 6 (2.00 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 351 (117.00 diss/flow)
DNScrypt 6 4300 3

1
tests/result/dnscrypt_skype_false_positive.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 118 (118.00 diss/flow)
DNScrypt 6 2380 1

1
tests/result/doq.pcapng.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 65 (32.50 diss/flow)
ICMPV6 6 1170 1
DoH_DoT 14 4788 1

1
tests/result/doq_adguard.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 66 (66.00 diss/flow)
DoH_DoT 296 44445 1

1
tests/result/dos_win98_smb_netbeui.pcap.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 3 (1.00 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 4 (1.00 diss/flow)
NetBIOS 46 5060 2
SMBv1 15 3447 1

1
tests/result/drda_db2.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 103 (103.00 diss/flow)
DRDA 38 6691 1

1
tests/result/dropbox.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 27 (1.80 pkts/flow)
Confidence DPI : 15 (flows)
Num dissector calls: 15 (1.00 diss/flow)
Dropbox 848 90532 15

1
tests/result/dtls.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (UDP): 2 (2.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 2 (2.00 diss/flow)
DTLS 2 394 1

1
tests/result/dtls2.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 2 (2.00 diss/flow)
DTLS 30 4991 1

1
tests/result/dtls_certificate.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 3 (3.00 diss/flow)
WindowsUpdate 1 1486 1

1
tests/result/dtls_certificate_fragments.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 2 (2.00 diss/flow)
GoogleCloud 20 5978 1

1
tests/result/dtls_mid_sessions.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 4 (1.00 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 12 (3.00 diss/flow)
DTLS 91 37868 4

1
tests/result/dtls_old_version.pcapng.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 1
DPI Packets (UDP): 7 (7.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 3 (3.00 diss/flow)
DTLS 7 994 1

1
tests/result/dtls_session_id_and_coockie_both.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 4 (4.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 2 (2.00 diss/flow)
DTLS 4 604 1

1
tests/result/emotet.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 48 (8.00 pkts/flow)
Confidence DPI : 6 (flows)
Num dissector calls: 300 (50.00 diss/flow)
SMTP 626 438465 1
HTTP 1601 1581542 3

1
tests/result/encrypted_sni.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 3
DPI Packets (TCP): 3 (1.00 pkts/flow)
Confidence DPI : 3 (flows)
Num dissector calls: 3 (1.00 diss/flow)
Cloudflare 3 2310 3

1
tests/result/esp.pcapng.out
View file

@ -3,6 +3,7 @@ Guessed flow protos: 0
DPI Packets (UDP): 1 (1.00 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 2 (1.00 diss/flow)
IPSec 6 1856 2

1
tests/result/ethereum.pcap.out
View file

@ -5,6 +5,7 @@ DPI Packets (UDP): 18 (1.00 pkts/flow)
Confidence Match by port : 1 (flows)
Confidence Match by IP : 2 (flows)
Confidence DPI : 71 (flows)
Num dissector calls: 1515 (20.47 diss/flow)
Mining 1997 215877 72
AmazonAWS 1 78 1

1
tests/result/ethernetIP.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 4 (1.00 pkts/flow)
Confidence DPI : 4 (flows)
Num dissector calls: 4 (1.00 diss/flow)
EthernetIP 100 17384 4

1
tests/result/exe_download.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 32 (32.00 diss/flow)
HTTP 703 717463 1

1
tests/result/exe_download_as_png.pcap.out
View file

@ -2,6 +2,7 @@ Guessed flow protos: 0
DPI Packets (TCP): 6 (6.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 32 (32.00 diss/flow)
HTTP 534 529449 1

Some files were not shown because too many files have changed in this diff Show more