Skip to content

Commit 33f11cb

Browse files
0xA50C1A10xA50C1A1
authored
Add OpenFlow protocol dissector (#2222)
1 parent 8aa09f9 commit 33f11cb

File tree

101 files changed

+215
-99
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

101 files changed

+215
-99
lines changed

‎doc/protocols.rst

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -368,3 +368,12 @@ References: `Protocol Specs: <https://www.ivifoundation.org/downloads/Protocol%2
368368
Encrypted UDP based FTP with multicast.
369369

370370
References: `Protocol Specs: <https://uftp-multicast.sourceforge.net/protocol.txt>`_.
371+
372+
373+
.. _Proto 374:
374+
375+
`NDPI_PROTOCOL_OPENFLOW`
376+
======================
377+
OpenFlow protocol is a network protocol closely associated with Software-Defined Networking (SDN).
378+
379+
References: `Protocol Specs: <https://opennetworking.org/wp-content/uploads/2014/10/openflow-switch-v1.5.1.pdf>`_.

‎src/include/ndpi_protocol_ids.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -402,6 +402,7 @@ typedef enum {
402402
NDPI_PROTOCOL_PROFINET_IO = 371,
403403
NDPI_PROTOCOL_HISLIP = 372,
404404
NDPI_PROTOCOL_UFTP = 373,
405+
NDPI_PROTOCOL_OPENFLOW = 374,
405406

406407
#ifdef CUSTOM_NDPI_PROTOCOLS
407408
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"

‎src/lib/ndpi_main.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2198,6 +2198,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
21982198
"UFTP", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT,
21992199
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
22002200
ndpi_build_default_ports(ports_b, 1044, 0, 0, 0, 0) /* UDP */);
2201+
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_OPENFLOW,
2202+
"OpenFlow", NDPI_PROTOCOL_CATEGORY_NETWORK,
2203+
ndpi_build_default_ports(ports_a, 6653, 0, 0, 0, 0) /* TCP */,
2204+
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
22012205

22022206
#ifdef CUSTOM_NDPI_PROTOCOLS
22032207
#include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -5695,6 +5699,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
56955699
/* UFTP */
56965700
init_uftp_dissector(ndpi_str, &a);
56975701

5702+
/* OpenFlow */
5703+
init_openflow_dissector(ndpi_str, &a);
5704+
56985705
#ifdef CUSTOM_NDPI_PROTOCOLS
56995706
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
57005707
#endif

‎src/lib/ndpi_private.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -637,6 +637,7 @@ void init_ethersbus_dissector(struct ndpi_detection_module_struct *ndpi_struct,
637637
void init_profinet_io_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
638638
void init_hislip_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
639639
void init_uftp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
640+
void init_openflow_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
640641

641642
#endif
642643

‎src/lib/protocols/openflow.c

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
/*
2+
* openflow.c
3+
*
4+
* Copyright (C) 2023 - ntop.org
5+
* Copyright (C) 2023 - V.G <[email protected]>
6+
*
7+
* This file is part of nDPI, an open source deep packet inspection
8+
* library based on the OpenDPI and PACE technology by ipoque GmbH
9+
*
10+
* nDPI is free software: you can redistribute it and/or modify
11+
* it under the terms of the GNU Lesser General Public License as published by
12+
* the Free Software Foundation, either version 3 of the License, or
13+
* (at your option) any later version.
14+
*
15+
* nDPI is distributed in the hope that it will be useful,
16+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
17+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18+
* GNU Lesser General Public License for more details.
19+
*
20+
* You should have received a copy of the GNU Lesser General Public License
21+
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
22+
*
23+
*/
24+
25+
#include "ndpi_protocol_ids.h"
26+
27+
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_OPENFLOW
28+
29+
#include "ndpi_api.h"
30+
#include "ndpi_private.h"
31+
32+
static void ndpi_int_openflow_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
33+
struct ndpi_flow_struct *flow)
34+
{
35+
NDPI_LOG_INFO(ndpi_struct, "found OpenFlow\n");
36+
ndpi_set_detected_protocol(ndpi_struct, flow,
37+
NDPI_PROTOCOL_OPENFLOW, NDPI_PROTOCOL_UNKNOWN,
38+
NDPI_CONFIDENCE_DPI);
39+
}
40+
41+
static void ndpi_search_openflow(struct ndpi_detection_module_struct *ndpi_struct,
42+
struct ndpi_flow_struct *flow)
43+
{
44+
struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
45+
46+
NDPI_LOG_DBG(ndpi_struct, "search OpenFlow\n");
47+
48+
if (packet->payload_packet_len >= 8 &&
49+
packet->payload[0] == 0x06 && packet->payload[1] < 36 &&
50+
packet->payload_packet_len == ntohs(get_u_int16_t(packet->payload, 2)))
51+
{
52+
ndpi_int_openflow_add_connection(ndpi_struct, flow);
53+
return;
54+
}
55+
56+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
57+
}
58+
59+
void init_openflow_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id)
60+
{
61+
ndpi_set_bitmask_protocol_detection("OpenFlow", ndpi_struct, *id,
62+
NDPI_PROTOCOL_OPENFLOW,
63+
ndpi_search_openflow,
64+
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
65+
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
66+
ADD_TO_DETECTION_BITMASK);
67+
68+
*id += 1;
69+
}
70+

‎tests/cfgs/caches_cfg/result/ookla.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 533 (88.83 diss/flow)
6+
Num dissector calls: 536 (89.33 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_cfg/result/teams.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI : 80 (flows)
9-
Num dissector calls: 523 (6.30 diss/flow)
9+
Num dissector calls: 524 (6.31 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/9/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/pcap/openflow.pcap

2.13 KB
Binary file not shown.

‎tests/cfgs/default/result/1kxun.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
55
Confidence Unknown : 14 (flows)
66
Confidence Match by port : 6 (flows)
77
Confidence DPI : 177 (flows)
8-
Num dissector calls: 4660 (23.65 diss/flow)
8+
Num dissector calls: 4663 (23.67 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/60/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-chrome.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 1 (1.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 131 (131.00 diss/flow)
5+
Num dissector calls: 132 (132.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-opvn.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 6 (6.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 132 (132.00 diss/flow)
3+
Num dissector calls: 133 (133.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_chat.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow)
55
DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Match by port : 5 (flows)
77
Confidence DPI : 33 (flows)
8-
Num dissector calls: 561 (14.76 diss/flow)
8+
Num dissector calls: 563 (14.82 diss/flow)
99
LRU cache ookla: 0/1/0 (insert/search/found)
1010
LRU cache bittorrent: 0/15/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_talk.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 10 (2.00 pkts/flow)
55
Confidence Match by port : 8 (flows)
66
Confidence DPI : 11 (flows)
77
Confidence Match by IP : 1 (flows)
8-
Num dissector calls: 1151 (57.55 diss/flow)
8+
Num dissector calls: 1155 (57.75 diss/flow)
99
LRU cache ookla: 0/2/0 (insert/search/found)
1010
LRU cache bittorrent: 0/27/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/Oscar.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 21 (21.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 261 (261.00 diss/flow)
5+
Num dissector calls: 262 (262.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/alexa-app.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow)
55
DPI Packets (other): 6 (1.00 pkts/flow)
66
Confidence Match by port : 14 (flows)
77
Confidence DPI : 146 (flows)
8-
Num dissector calls: 507 (3.17 diss/flow)
8+
Num dissector calls: 508 (3.17 diss/flow)
99
LRU cache ookla: 0/5/0 (insert/search/found)
1010
LRU cache bittorrent: 0/42/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/amqp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 9 (3.00 pkts/flow)
22
Confidence DPI : 3 (flows)
3-
Num dissector calls: 380 (126.67 diss/flow)
3+
Num dissector calls: 381 (127.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/anyconnect-vpn.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow)
66
Confidence Unknown : 2 (flows)
77
Confidence Match by port : 6 (flows)
88
Confidence DPI : 61 (flows)
9-
Num dissector calls: 855 (12.39 diss/flow)
9+
Num dissector calls: 856 (12.41 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/24/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 10 (10.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 236 (236.00 diss/flow)
3+
Num dissector calls: 237 (237.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 5/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/cassandra.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 16 (8.00 pkts/flow)
22
Confidence DPI : 2 (flows)
3-
Num dissector calls: 316 (158.00 diss/flow)
3+
Num dissector calls: 318 (159.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/cloudflare-warp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow)
44
Confidence Match by port : 2 (flows)
55
Confidence DPI : 5 (flows)
66
Confidence Match by IP : 1 (flows)
7-
Num dissector calls: 190 (23.75 diss/flow)
7+
Num dissector calls: 191 (23.88 diss/flow)
88
LRU cache ookla: 0/0/0 (insert/search/found)
99
LRU cache bittorrent: 0/9/0 (insert/search/found)
1010
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/custom_rules_ipv6.pcapng.out

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ CustomProtocolF 1 1287 1
2727
CustomProtocolG 1 318 1
2828
CustomProtocolH 1 318 1
2929

30-
1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 384/CustomProtocolE][IP: 384/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
31-
2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 385/CustomProtocolF][IP: 385/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
32-
3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 383/CustomProtocolD][IP: 383/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
33-
4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 386/CustomProtocolG][IP: 386/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
34-
5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 387/CustomProtocolH][IP: 387/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
30+
1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 385/CustomProtocolE][IP: 385/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
31+
2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 386/CustomProtocolF][IP: 386/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
32+
3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 384/CustomProtocolD][IP: 384/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
33+
4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 387/CustomProtocolG][IP: 387/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
34+
5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 388/CustomProtocolH][IP: 388/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,6 @@ CustomProtocolA 3 222 1
2525
CustomProtocolB 2 148 1
2626
Unknown 3 222 1
2727

28-
1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.380/TLS.CustomProtocolA][IP: 380/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
29-
2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 382/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
30-
3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 381/CustomProtocolB][IP: 381/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
28+
1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.381/TLS.CustomProtocolA][IP: 381/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
29+
2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 383/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
30+
3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 382/CustomProtocolB][IP: 382/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/default/result/edonkey.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 5 (5.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 134 (134.00 diss/flow)
3+
Num dissector calls: 135 (135.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/emotet.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 48 (8.00 pkts/flow)
22
Confidence DPI : 6 (flows)
3-
Num dissector calls: 201 (33.50 diss/flow)
3+
Num dissector calls: 202 (33.67 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/fastcgi.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 6 (6.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 158 (158.00 diss/flow)
3+
Num dissector calls: 159 (159.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/ftp-start-tls.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 17 (17.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 160 (160.00 diss/flow)
3+
Num dissector calls: 161 (161.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/ftp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
DPI Packets (TCP): 39 (13.00 pkts/flow)
22
Confidence Unknown : 1 (flows)
33
Confidence DPI : 2 (flows)
4-
Num dissector calls: 532 (177.33 diss/flow)
4+
Num dissector calls: 534 (178.00 diss/flow)
55
LRU cache ookla: 0/0/0 (insert/search/found)
66
LRU cache bittorrent: 0/3/0 (insert/search/found)
77
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/ftp_failed.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 8 (8.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 159 (159.00 diss/flow)
3+
Num dissector calls: 160 (160.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/fuzz-2006-06-26-2594.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 5 (1.00 pkts/flow)
66
Confidence Unknown : 34 (flows)
77
Confidence Match by port : 27 (flows)
88
Confidence DPI : 190 (flows)
9-
Num dissector calls: 6750 (26.89 diss/flow)
9+
Num dissector calls: 6762 (26.94 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/189/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/fuzz-2006-09-29-28586.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
55
Confidence Unknown : 3 (flows)
66
Confidence Match by port : 26 (flows)
77
Confidence DPI : 11 (flows)
8-
Num dissector calls: 1023 (25.58 diss/flow)
8+
Num dissector calls: 1029 (25.73 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/87/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/fuzz-2021-10-13.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 1 (1.00 pkts/flow)
22
Confidence Unknown : 1 (flows)
3-
Num dissector calls: 130 (130.00 diss/flow)
3+
Num dissector calls: 131 (131.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/3/0 (insert/search/found)
66
LRU cache zoom: 0/0/0 (insert/search/found)

0 commit comments

Comments
 (0)