Skip to content

Commit 149067b

Browse files
0xA50C1A10xA50C1A1
authored
Add JSON-RPC protocol dissector (#2217)
* Add JSON-RPC protocol dissector * Small fixes * Improve detection
1 parent 33f11cb commit 149067b

File tree

148 files changed

+268
-149
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

148 files changed

+268
-149
lines changed

‎doc/protocols.rst

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -377,3 +377,12 @@ References: `Protocol Specs: <https://uftp-multicast.sourceforge.net/protocol.tx
377377
OpenFlow protocol is a network protocol closely associated with Software-Defined Networking (SDN).
378378

379379
References: `Protocol Specs: <https://opennetworking.org/wp-content/uploads/2014/10/openflow-switch-v1.5.1.pdf>`_.
380+
381+
382+
.. _Proto 375:
383+
384+
`NDPI_PROTOCOL_JSON_RPC`
385+
======================
386+
JSON-RPC is a remote procedure call protocol encoded in JSON.
387+
388+
References: `Protocol Specs: <https://www.jsonrpc.org/specification>`_.

‎src/include/ndpi_protocol_ids.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -403,6 +403,7 @@ typedef enum {
403403
NDPI_PROTOCOL_HISLIP = 372,
404404
NDPI_PROTOCOL_UFTP = 373,
405405
NDPI_PROTOCOL_OPENFLOW = 374,
406+
NDPI_PROTOCOL_JSON_RPC = 375,
406407

407408
#ifdef CUSTOM_NDPI_PROTOCOLS
408409
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"

‎src/lib/ndpi_main.c

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1085,6 +1085,7 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
10851085
NDPI_PROTOCOL_MPEGDASH,
10861086
NDPI_PROTOCOL_RTSP,
10871087
NDPI_PROTOCOL_APACHE_THRIFT,
1088+
NDPI_PROTOCOL_JSON_RPC,
10881089
NDPI_PROTOCOL_MATCHED_BY_CONTENT,
10891090
NDPI_PROTOCOL_NO_MORE_SUBPROTOCOLS); /* NDPI_PROTOCOL_HTTP can have (content-matched) subprotocols */
10901091
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MDNS,
@@ -2195,13 +2196,17 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
21952196
ndpi_build_default_ports(ports_a, 4880, 0, 0, 0, 0) /* TCP */,
21962197
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
21972198
ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_UFTP,
2198-
"UFTP", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT,
2199-
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
2200-
ndpi_build_default_ports(ports_b, 1044, 0, 0, 0, 0) /* UDP */);
2199+
"UFTP", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT,
2200+
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
2201+
ndpi_build_default_ports(ports_b, 1044, 0, 0, 0, 0) /* UDP */);
22012202
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_OPENFLOW,
22022203
"OpenFlow", NDPI_PROTOCOL_CATEGORY_NETWORK,
22032204
ndpi_build_default_ports(ports_a, 6653, 0, 0, 0, 0) /* TCP */,
22042205
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
2206+
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_JSON_RPC,
2207+
"JSON-RPC", NDPI_PROTOCOL_CATEGORY_RPC,
2208+
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
2209+
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
22052210

22062211
#ifdef CUSTOM_NDPI_PROTOCOLS
22072212
#include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -5702,6 +5707,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
57025707
/* OpenFlow */
57035708
init_openflow_dissector(ndpi_str, &a);
57045709

5710+
/* JSON-RPC */
5711+
init_json_rpc_dissector(ndpi_str, &a);
5712+
57055713
#ifdef CUSTOM_NDPI_PROTOCOLS
57065714
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
57075715
#endif

‎src/lib/ndpi_private.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -638,6 +638,7 @@ void init_profinet_io_dissector(struct ndpi_detection_module_struct *ndpi_struct
638638
void init_hislip_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
639639
void init_uftp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
640640
void init_openflow_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
641+
void init_json_rpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
641642

642643
#endif
643644

‎src/lib/protocols/json-rpc.c

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/*
2+
* json-rpc.c
3+
*
4+
* Copyright (C) 2023 - ntop.org
5+
* Copyright (C) 2023 - V.G <[email protected]>
6+
*
7+
* This file is part of nDPI, an open source deep packet inspection
8+
* library based on the OpenDPI and PACE technology by ipoque GmbH
9+
*
10+
* nDPI is free software: you can redistribute it and/or modify
11+
* it under the terms of the GNU Lesser General Public License as published by
12+
* the Free Software Foundation, either version 3 of the License, or
13+
* (at your option) any later version.
14+
*
15+
* nDPI is distributed in the hope that it will be useful,
16+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
17+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18+
* GNU Lesser General Public License for more details.
19+
*
20+
* You should have received a copy of the GNU Lesser General Public License
21+
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
22+
*
23+
*/
24+
25+
#include "ndpi_protocol_ids.h"
26+
27+
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_JSON_RPC
28+
29+
#include "ndpi_api.h"
30+
#include "ndpi_private.h"
31+
32+
static void ndpi_search_json_rpc(struct ndpi_detection_module_struct *ndpi_struct,
33+
struct ndpi_flow_struct *flow)
34+
{
35+
struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
36+
37+
if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
38+
flow->detected_protocol_stack[1] == NDPI_PROTOCOL_HTTP)
39+
{
40+
if ((packet->content_line.ptr != NULL) &&
41+
(LINE_ENDS(packet->content_line, "application/json-rpc") != 0))
42+
{
43+
NDPI_LOG_INFO(ndpi_struct, "found JSON-RPC over HTTP\n");
44+
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_JSON_RPC,
45+
NDPI_PROTOCOL_HTTP, NDPI_CONFIDENCE_DPI);
46+
}
47+
return;
48+
}
49+
50+
if ((packet->payload_packet_len > 30) && (packet->payload[0] == '{') &&
51+
(ndpi_strnstr((const char *)packet->payload, "\"jsonrpc\":", packet->payload_packet_len)))
52+
{
53+
NDPI_LOG_INFO(ndpi_struct, "found JSON-RPC over TCP\n");
54+
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_JSON_RPC,
55+
NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
56+
return;
57+
}
58+
59+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
60+
}
61+
62+
void init_json_rpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id)
63+
{
64+
ndpi_set_bitmask_protocol_detection("JSON-RPC", ndpi_struct, *id,
65+
NDPI_PROTOCOL_JSON_RPC,
66+
ndpi_search_json_rpc,
67+
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
68+
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
69+
ADD_TO_DETECTION_BITMASK);
70+
*id += 1;
71+
}

‎tests/cfgs/caches_cfg/result/ookla.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 536 (89.33 diss/flow)
6+
Num dissector calls: 540 (90.00 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_cfg/result/teams.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI : 80 (flows)
9-
Num dissector calls: 524 (6.31 diss/flow)
9+
Num dissector calls: 525 (6.33 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/9/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/pcap/jsonrpc.pcap

3.02 KB
Binary file not shown.

‎tests/cfgs/default/result/1kxun.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
55
Confidence Unknown : 14 (flows)
66
Confidence Match by port : 6 (flows)
77
Confidence DPI : 177 (flows)
8-
Num dissector calls: 4663 (23.67 diss/flow)
8+
Num dissector calls: 4753 (24.13 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/60/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-chrome.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 1 (1.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 132 (132.00 diss/flow)
5+
Num dissector calls: 133 (133.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-opvn.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 6 (6.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 133 (133.00 diss/flow)
3+
Num dissector calls: 134 (134.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/6in4tunnel.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ DPI Packets (TCP): 29 (5.80 pkts/flow)
22
DPI Packets (UDP): 4 (2.00 pkts/flow)
33
DPI Packets (other): 3 (1.00 pkts/flow)
44
Confidence DPI : 10 (flows)
5-
Num dissector calls: 26 (2.60 diss/flow)
5+
Num dissector calls: 27 (2.70 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/EAQ.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
DPI Packets (TCP): 12 (6.00 pkts/flow)
22
DPI Packets (UDP): 116 (4.00 pkts/flow)
33
Confidence DPI : 31 (flows)
4-
Num dissector calls: 4687 (151.19 diss/flow)
4+
Num dissector calls: 4689 (151.26 diss/flow)
55
LRU cache ookla: 0/0/0 (insert/search/found)
66
LRU cache bittorrent: 0/0/0 (insert/search/found)
77
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_chat.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow)
55
DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Match by port : 5 (flows)
77
Confidence DPI : 33 (flows)
8-
Num dissector calls: 563 (14.82 diss/flow)
8+
Num dissector calls: 567 (14.92 diss/flow)
99
LRU cache ookla: 0/1/0 (insert/search/found)
1010
LRU cache bittorrent: 0/15/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_talk.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 10 (2.00 pkts/flow)
55
Confidence Match by port : 8 (flows)
66
Confidence DPI : 11 (flows)
77
Confidence Match by IP : 1 (flows)
8-
Num dissector calls: 1155 (57.75 diss/flow)
8+
Num dissector calls: 1159 (57.95 diss/flow)
99
LRU cache ookla: 0/2/0 (insert/search/found)
1010
LRU cache bittorrent: 0/27/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/Oscar.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 21 (21.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 262 (262.00 diss/flow)
5+
Num dissector calls: 263 (263.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/WebattackRCE.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 797 (1.00 pkts/flow)
22
Confidence DPI : 797 (flows)
3-
Num dissector calls: 10361 (13.00 diss/flow)
3+
Num dissector calls: 11158 (14.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/WebattackSQLinj.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 54 (6.00 pkts/flow)
22
Confidence DPI : 9 (flows)
3-
Num dissector calls: 117 (13.00 diss/flow)
3+
Num dissector calls: 126 (14.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/WebattackXSS.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 639
33
DPI Packets (TCP): 3972 (6.01 pkts/flow)
44
Confidence Match by port : 639 (flows)
55
Confidence DPI : 22 (flows)
6-
Num dissector calls: 286 (0.43 diss/flow)
6+
Num dissector calls: 308 (0.47 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/1917/0 (insert/search/found)
99
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/alexa-app.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow)
55
DPI Packets (other): 6 (1.00 pkts/flow)
66
Confidence Match by port : 14 (flows)
77
Confidence DPI : 146 (flows)
8-
Num dissector calls: 508 (3.17 diss/flow)
8+
Num dissector calls: 528 (3.30 diss/flow)
99
LRU cache ookla: 0/5/0 (insert/search/found)
1010
LRU cache bittorrent: 0/42/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/amqp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 9 (3.00 pkts/flow)
22
Confidence DPI : 3 (flows)
3-
Num dissector calls: 381 (127.00 diss/flow)
3+
Num dissector calls: 382 (127.33 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/android.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 4 (1.00 pkts/flow)
66
Confidence Match by port : 2 (flows)
77
Confidence DPI : 60 (flows)
88
Confidence Match by IP : 1 (flows)
9-
Num dissector calls: 250 (3.97 diss/flow)
9+
Num dissector calls: 253 (4.02 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/9/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/anyconnect-vpn.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow)
66
Confidence Unknown : 2 (flows)
77
Confidence Match by port : 6 (flows)
88
Confidence DPI : 61 (flows)
9-
Num dissector calls: 856 (12.41 diss/flow)
9+
Num dissector calls: 861 (12.48 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/24/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 10 (10.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 237 (237.00 diss/flow)
3+
Num dissector calls: 238 (238.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 5/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/bot.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 6 (6.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 13 (13.00 diss/flow)
3+
Num dissector calls: 14 (14.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/bt-http.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 7 (7.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 16 (16.00 diss/flow)
3+
Num dissector calls: 18 (18.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 5/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/cassandra.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 16 (8.00 pkts/flow)
22
Confidence DPI : 2 (flows)
3-
Num dissector calls: 318 (159.00 diss/flow)
3+
Num dissector calls: 320 (160.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/cloudflare-warp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow)
44
Confidence Match by port : 2 (flows)
55
Confidence DPI : 5 (flows)
66
Confidence Match by IP : 1 (flows)
7-
Num dissector calls: 191 (23.88 diss/flow)
7+
Num dissector calls: 192 (24.00 diss/flow)
88
LRU cache ookla: 0/0/0 (insert/search/found)
99
LRU cache bittorrent: 0/9/0 (insert/search/found)
1010
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/crawler_false_positive.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 8 (8.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 13 (13.00 diss/flow)
3+
Num dissector calls: 14 (14.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/custom_rules_ipv6.pcapng.out

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ CustomProtocolF 1 1287 1
2727
CustomProtocolG 1 318 1
2828
CustomProtocolH 1 318 1
2929

30-
1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 385/CustomProtocolE][IP: 385/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
31-
2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 386/CustomProtocolF][IP: 386/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
32-
3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 384/CustomProtocolD][IP: 384/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
33-
4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 387/CustomProtocolG][IP: 387/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
34-
5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 388/CustomProtocolH][IP: 388/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
30+
1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 386/CustomProtocolE][IP: 386/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
31+
2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 387/CustomProtocolF][IP: 387/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
32+
3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 385/CustomProtocolD][IP: 385/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
33+
4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 388/CustomProtocolG][IP: 388/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
34+
5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 389/CustomProtocolH][IP: 389/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

0 commit comments

Comments
 (0)