# Flow States

Flows in ntopng follow the following logical states:

 - *undetected*: nDPI protocol detection is still in progress.
   Flow::isDetectionCompleted() returns *false* and Flow::get_detected_protocol() will return *Unkwnown*.

 - *detection_completed*: The nDPI protocol detection is complete.
   Flow::isDetectionCompleted() returns *true* and Flow::get_detected_protocol() returns the
   detected protocol. Flow::processDetectedProtocol() is called. However, the nDPI memory is not deallocated
   yet as the nDPI detection callback may still may be called (for example to extract the SSL server certificate).

 - *extra_dissection_completed*: nDPI will not be called anymore for the flow. All the flow information has been
   extracted. Flow::processExtraDissectedInformation() is called. The nDPI memory is deallocated.

# Processing Detected Protocols

As explained above, there are two callbacks which are used to process the protocol
information previously detected on a Flow:

 - Flow::processDetectedProtocol(): will be called as soon as a protocol is detected
   on the flow. This is an initial hook for protocol specific logic.

 - Flow::processExtraDissectedInformation(): will be called after additional dissection
   has been performed on the flow (or immediately if such dissection won't occurr).
   This hook is suitable to process the additional metadata (e.g. the SSH/TLS fingerprints)