Skip to content

Commit 0aea509

Browse files
utoniutoni
authored
Add KCP protocol dissector. (#2257)
Signed-off-by: Toni Uhlig <[email protected]>
1 parent 75d3f78 commit 0aea509

File tree

155 files changed

+314
-154
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

155 files changed

+314
-154
lines changed

‎doc/protocols.rst

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -483,3 +483,12 @@ References: `IETF Draft <https://www.ietf.org/archive/id/draft-ietf-ntp-roughtim
483483
Private Internet Access (PIA) is a popular VPN service from Kape Technologies.
484484

485485
References: `Main site <https://www.privateinternetaccess.com/>`_
486+
487+
488+
.. _Proto 385:
489+
490+
`NDPI_PROTOCOL_KCP`
491+
===================
492+
KCP - A Fast and Reliable ARQ Protocol. It provides TCP-like stream support with low latency at the cost of bandwidth usage - used by lot's of Open Source / Third Party applications.
493+
494+
References: `Protocol Specs: <https://github.com/skywind3000/kcp/blob/master/protocol.txt>`_

‎src/include/ndpi_private.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -667,6 +667,7 @@ void init_iec62056_dissector(struct ndpi_detection_module_struct *ndpi_struct, u
667667
void init_hl7_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
668668
void init_ceph_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
669669
void init_roughtime_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
670+
void init_kcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
670671

671672
#endif
672673

‎src/include/ndpi_protocol_ids.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -413,6 +413,7 @@ typedef enum {
413413
NDPI_PROTOCOL_GOOGLE_CHAT = 382,
414414
NDPI_PROTOCOL_ROUGHTIME = 383,
415415
NDPI_PROTOCOL_PIA = 384,
416+
NDPI_PROTOCOL_KCP = 385,
416417

417418
#ifdef CUSTOM_NDPI_PROTOCOLS
418419
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"

‎src/lib/ndpi_main.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2239,6 +2239,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
22392239
"Roughtime", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS,
22402240
ndpi_build_default_ports(ports_a, 2002, 0, 0, 0, 0) /* TCP */,
22412241
ndpi_build_default_ports(ports_b, 2002, 0, 0, 0, 0) /* UDP */);
2242+
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_KCP,
2243+
"KCP", NDPI_PROTOCOL_CATEGORY_NETWORK,
2244+
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
2245+
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
22422246

22432247
#ifdef CUSTOM_NDPI_PROTOCOLS
22442248
#include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -5760,6 +5764,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
57605764
/* Roughtime */
57615765
init_roughtime_dissector(ndpi_str, &a);
57625766

5767+
/* KCP */
5768+
init_kcp_dissector(ndpi_str, &a);
5769+
57635770
#ifdef CUSTOM_NDPI_PROTOCOLS
57645771
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
57655772
#endif

‎src/lib/protocols/kcp.c

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
/*
2+
* kcp.c
3+
*
4+
* Copyright (C) 2024 - ntop.org
5+
*
6+
* nDPI is free software: you can redistribute it and/or modify
7+
* it under the terms of the GNU Lesser General Public License as published by
8+
* the Free Software Foundation, either version 3 of the License, or
9+
* (at your option) any later version.
10+
*
11+
* nDPI is distributed in the hope that it will be useful,
12+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14+
* GNU Lesser General Public License for more details.
15+
*
16+
* You should have received a copy of the GNU Lesser General Public License
17+
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
18+
*
19+
*/
20+
21+
22+
#include "ndpi_protocol_ids.h"
23+
24+
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_KCP
25+
26+
#include "ndpi_api.h"
27+
#include "ndpi_private.h"
28+
29+
PACK_ON
30+
struct kcp_header {
31+
uint32_t conversation_id;
32+
uint8_t command;
33+
uint8_t fragment_count;
34+
uint16_t window_size;
35+
uint32_t timestamp;
36+
uint32_t serial_number;
37+
uint32_t unacknowledged_serial_number;
38+
uint32_t length;
39+
uint8_t data[0];
40+
} PACK_OFF;
41+
42+
enum kcp_commands {
43+
IKCP_CMD_PUSH = 81,
44+
IKCP_CMD_ACK = 82,
45+
IKCP_CMD_WASK = 83,
46+
IKCP_CMD_WINS = 84
47+
};
48+
49+
static void ndpi_int_kcp_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
50+
struct ndpi_flow_struct * const flow)
51+
{
52+
NDPI_LOG_INFO(ndpi_struct, "found kcp\n");
53+
ndpi_set_detected_protocol(ndpi_struct, flow,
54+
NDPI_PROTOCOL_KCP,
55+
NDPI_PROTOCOL_UNKNOWN,
56+
NDPI_CONFIDENCE_DPI);
57+
}
58+
59+
static void ndpi_search_kcp(struct ndpi_detection_module_struct *ndpi_struct,
60+
struct ndpi_flow_struct *flow)
61+
{
62+
struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
63+
struct kcp_header const * const kcp_header = (struct kcp_header *)packet->payload;
64+
65+
NDPI_LOG_INFO(ndpi_struct, "search kcp\n");
66+
67+
if (packet->payload_packet_len < sizeof(*kcp_header))
68+
{
69+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
70+
return;
71+
}
72+
73+
switch (kcp_header->command)
74+
{
75+
case IKCP_CMD_PUSH:
76+
case IKCP_CMD_ACK:
77+
case IKCP_CMD_WASK:
78+
case IKCP_CMD_WINS:
79+
break;
80+
default:
81+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
82+
return;
83+
}
84+
85+
uint32_t const kcp_pdu_length = le32toh(kcp_header->length);
86+
if (kcp_pdu_length + sizeof(*kcp_header) != packet->payload_packet_len)
87+
{
88+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
89+
return;
90+
}
91+
92+
ndpi_int_kcp_add_connection(ndpi_struct, flow);
93+
}
94+
95+
void init_kcp_dissector(struct ndpi_detection_module_struct *ndpi_struct,
96+
u_int32_t *id)
97+
{
98+
ndpi_set_bitmask_protocol_detection("KCP", ndpi_struct, *id,
99+
NDPI_PROTOCOL_KCP,
100+
ndpi_search_kcp,
101+
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
102+
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
103+
ADD_TO_DETECTION_BITMASK
104+
);
105+
106+
*id += 1;
107+
}

‎tests/cfgs/caches_cfg/result/ookla.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 559 (93.17 diss/flow)
6+
Num dissector calls: 562 (93.67 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_cfg/result/teams.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI : 80 (flows)
9-
Num dissector calls: 534 (6.43 diss/flow)
9+
Num dissector calls: 536 (6.46 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/9/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/pcap/kcp.pcap

36.2 KB
Binary file not shown.

‎tests/cfgs/default/result/1kxun.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
55
Confidence Unknown : 14 (flows)
66
Confidence Match by port : 6 (flows)
77
Confidence DPI : 177 (flows)
8-
Num dissector calls: 4900 (24.87 diss/flow)
8+
Num dissector calls: 4917 (24.96 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/60/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-chrome.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 1 (1.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 139 (139.00 diss/flow)
5+
Num dissector calls: 140 (140.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-opvn.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 6 (6.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 140 (140.00 diss/flow)
3+
Num dissector calls: 141 (141.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/4in4tunnel.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (UDP): 5 (5.00 pkts/flow)
22
Confidence Unknown : 1 (flows)
3-
Num dissector calls: 192 (192.00 diss/flow)
3+
Num dissector calls: 193 (193.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/3/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/6in6tunnel.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (UDP): 2 (2.00 pkts/flow)
22
Confidence Unknown : 1 (flows)
3-
Num dissector calls: 141 (141.00 diss/flow)
3+
Num dissector calls: 142 (142.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/3/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/EAQ.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
DPI Packets (TCP): 12 (6.00 pkts/flow)
22
DPI Packets (UDP): 116 (4.00 pkts/flow)
33
Confidence DPI : 31 (flows)
4-
Num dissector calls: 4778 (154.13 diss/flow)
4+
Num dissector calls: 4807 (155.06 diss/flow)
55
LRU cache ookla: 0/0/0 (insert/search/found)
66
LRU cache bittorrent: 0/0/0 (insert/search/found)
77
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (UDP): 7 (1.40 pkts/flow)
22
Confidence DPI : 5 (flows)
3-
Num dissector calls: 150 (30.00 diss/flow)
3+
Num dissector calls: 151 (30.20 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_chat.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow)
55
DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Match by port : 5 (flows)
77
Confidence DPI : 33 (flows)
8-
Num dissector calls: 581 (15.29 diss/flow)
8+
Num dissector calls: 583 (15.34 diss/flow)
99
LRU cache ookla: 0/1/0 (insert/search/found)
1010
LRU cache bittorrent: 0/15/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_talk.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 10 (2.00 pkts/flow)
55
Confidence Match by port : 8 (flows)
66
Confidence DPI : 11 (flows)
77
Confidence Match by IP : 1 (flows)
8-
Num dissector calls: 1189 (59.45 diss/flow)
8+
Num dissector calls: 1195 (59.75 diss/flow)
99
LRU cache ookla: 0/2/0 (insert/search/found)
1010
LRU cache bittorrent: 0/27/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/Oscar.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 21 (21.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 269 (269.00 diss/flow)
5+
Num dissector calls: 270 (270.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/alexa-app.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow)
55
DPI Packets (other): 6 (1.00 pkts/flow)
66
Confidence Match by port : 14 (flows)
77
Confidence DPI : 146 (flows)
8-
Num dissector calls: 553 (3.46 diss/flow)
8+
Num dissector calls: 554 (3.46 diss/flow)
99
LRU cache ookla: 0/5/0 (insert/search/found)
1010
LRU cache bittorrent: 0/42/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/amqp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 9 (3.00 pkts/flow)
22
Confidence DPI : 3 (flows)
3-
Num dissector calls: 388 (129.33 diss/flow)
3+
Num dissector calls: 389 (129.67 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/anyconnect-vpn.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow)
66
Confidence Unknown : 2 (flows)
77
Confidence Match by port : 6 (flows)
88
Confidence DPI : 61 (flows)
9-
Num dissector calls: 874 (12.67 diss/flow)
9+
Num dissector calls: 876 (12.70 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/24/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 10 (10.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 244 (244.00 diss/flow)
3+
Num dissector calls: 245 (245.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 5/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/bittorrent_utp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (UDP): 10 (5.00 pkts/flow)
22
Confidence DPI : 2 (flows)
3-
Num dissector calls: 233 (116.50 diss/flow)
3+
Num dissector calls: 234 (117.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 10/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/cassandra.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 16 (8.00 pkts/flow)
22
Confidence DPI : 2 (flows)
3-
Num dissector calls: 332 (166.00 diss/flow)
3+
Num dissector calls: 334 (167.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/cloudflare-warp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow)
44
Confidence Match by port : 2 (flows)
55
Confidence DPI : 5 (flows)
66
Confidence Match by IP : 1 (flows)
7-
Num dissector calls: 198 (24.75 diss/flow)
7+
Num dissector calls: 199 (24.88 diss/flow)
88
LRU cache ookla: 0/0/0 (insert/search/found)
99
LRU cache bittorrent: 0/9/0 (insert/search/found)
1010
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/collectd.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 3
33
DPI Packets (UDP): 13 (1.62 pkts/flow)
44
Confidence Match by port : 3 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 453 (56.62 diss/flow)
6+
Num dissector calls: 456 (57.00 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/9/0 (insert/search/found)
99
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/custom_rules_ipv6.pcapng.out

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ CustomProtocolH 1 318 1
2929

3030
Acceptable 6 3810 5
3131

32-
1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 395/CustomProtocolE][IP: 395/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
33-
2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 396/CustomProtocolF][IP: 396/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
34-
3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 394/CustomProtocolD][IP: 394/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
35-
4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 397/CustomProtocolG][IP: 397/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
36-
5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 398/CustomProtocolH][IP: 398/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
32+
1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 396/CustomProtocolE][IP: 396/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
33+
2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 397/CustomProtocolF][IP: 397/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
34+
3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 395/CustomProtocolD][IP: 395/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
35+
4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 398/CustomProtocolG][IP: 398/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
36+
5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 399/CustomProtocolH][IP: 399/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,6 @@ Unknown 3 222 1
2828
Acceptable 5 370 2
2929
Unrated 3 222 1
3030

31-
1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.391/TLS.CustomProtocolA][IP: 391/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
32-
2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 393/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
33-
3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 392/CustomProtocolB][IP: 392/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
31+
1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.392/TLS.CustomProtocolA][IP: 392/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
32+
2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 394/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
33+
3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 393/CustomProtocolB][IP: 393/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/default/result/dhcp-fuzz.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (UDP): 1 (1.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 127 (127.00 diss/flow)
5+
Num dissector calls: 128 (128.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

0 commit comments

Comments
 (0)