Skip to content

Commit c34bded

Browse files
0xA50C1A10xA50C1A1
authored
Add ISO 9506-1 MMS protocol dissector (#2189)
* Add ISO 9506-1 MMS protocol dissector * Fix detection on big-endian architectures
1 parent 983b8e8 commit c34bded

File tree

99 files changed

+233
-97
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

99 files changed

+233
-97
lines changed

‎doc/protocols.rst

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,3 +289,13 @@ References: `Unofficial article: <https://ics-cert.kaspersky.com/publications/re
289289
Automation Device Specification is the protocol used for interfacing with Beckhoff PLCs via TwinCAT.
290290

291291
References: `Protocol Specs: <https://infosys.beckhoff.com/english.php?content=../content/1033/tc3_ads_intro/115847307.html>`_.
292+
293+
294+
.. _Proto 366:
295+
296+
`NDPI_PROTOCOL_ISO9506_1_MMS`
297+
============================
298+
The international standard MMS (Manufacturing Message Specification) is an OSI application layer messaging protocol origionally designed for the remote control and monitoring of devices such as Remote Terminal Units (RTU),
299+
Programmable Logic Controllers (PLC), Numerical Controllers (NC), or Robot Controllers (RC).
300+
301+
References: `Paid Specs: <https://www.iso.org/ru/standard/37079.html>`_.

‎src/include/ndpi_protocol_ids.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -394,6 +394,7 @@ typedef enum {
394394
NDPI_PROTOCOL_ETHERSIO = 363,
395395
NDPI_PROTOCOL_UMAS = 364,
396396
NDPI_PROTOCOL_BECKHOFF_ADS = 365,
397+
NDPI_PROTOCOL_ISO9506_1_MMS = 366,
397398

398399
#ifdef CUSTOM_NDPI_PROTOCOLS
399400
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"

‎src/lib/ndpi_main.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2162,6 +2162,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
21622162
"BeckhoffADS", NDPI_PROTOCOL_CATEGORY_IOT_SCADA,
21632163
ndpi_build_default_ports(ports_a, 48898, 0, 0, 0, 0) /* TCP */,
21642164
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
2165+
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_ISO9506_1_MMS,
2166+
"ISO9506-1-MMS", NDPI_PROTOCOL_CATEGORY_IOT_SCADA,
2167+
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
2168+
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
21652169

21662170
#ifdef CUSTOM_NDPI_PROTOCOLS
21672171
#include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -5613,6 +5617,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
56135617
/* Automation Device Specification */
56145618
init_beckhoff_ads_dissector(ndpi_str, &a);
56155619

5620+
/* Manufacturing Message Specification */
5621+
init_iso9506_1_mms_dissector(ndpi_str, &a);
5622+
56165623
#ifdef CUSTOM_NDPI_PROTOCOLS
56175624
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
56185625
#endif

‎src/lib/ndpi_private.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -625,6 +625,7 @@ void init_opc_ua_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_i
625625
void init_fins_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
626626
void init_ethersio_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
627627
void init_beckhoff_ads_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
628+
void init_iso9506_1_mms_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
628629

629630
#endif
630631

‎src/lib/protocols/iso9506-1-mms.c

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
/*
2+
* iso9506-1-mms.c
3+
*
4+
* ISO 9506-1:2003 Manufacturing Message Specification
5+
*
6+
* Copyright (C) 2023 - ntop.org
7+
* Copyright (C) 2023 - V.G <[email protected]>
8+
*
9+
* This file is part of nDPI, an open source deep packet inspection
10+
* library based on the OpenDPI and PACE technology by ipoque GmbH
11+
*
12+
* nDPI is free software: you can redistribute it and/or modify
13+
* it under the terms of the GNU Lesser General Public License as published by
14+
* the Free Software Foundation, either version 3 of the License, or
15+
* (at your option) any later version.
16+
*
17+
* nDPI is distributed in the hope that it will be useful,
18+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
19+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20+
* GNU Lesser General Public License for more details.
21+
*
22+
* You should have received a copy of the GNU Lesser General Public License
23+
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
24+
*
25+
*/
26+
27+
#include "ndpi_protocol_ids.h"
28+
29+
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_ISO9506_1_MMS
30+
31+
#include "ndpi_api.h"
32+
#include "ndpi_private.h"
33+
34+
static void ndpi_int_iso9506_1_mms_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
35+
struct ndpi_flow_struct *flow)
36+
{
37+
NDPI_LOG_INFO(ndpi_struct, "found ISO 9506-1 MMS\n");
38+
ndpi_set_detected_protocol(ndpi_struct, flow,
39+
NDPI_PROTOCOL_ISO9506_1_MMS, NDPI_PROTOCOL_UNKNOWN,
40+
NDPI_CONFIDENCE_DPI);
41+
}
42+
43+
static void ndpi_search_iso9506_1_mms(struct ndpi_detection_module_struct *ndpi_struct,
44+
struct ndpi_flow_struct *flow)
45+
{
46+
struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
47+
48+
NDPI_LOG_DBG(ndpi_struct, "search ISO 9506-1 MMS\n");
49+
50+
if ((packet->payload_packet_len > 60) && (packet->payload[0] == 3) &&
51+
(packet->payload[1] == 0) &&
52+
(get_u_int16_t(packet->payload, 2) == htons(packet->payload_packet_len)))
53+
{
54+
if (current_pkt_from_client_to_server(ndpi_struct, flow)) {
55+
/* Check COTP and ISO 8327-1 headers */
56+
if ((packet->payload[4] == 2) && (packet->payload[5] == 0xF0) &&
57+
(packet->payload[6] == 0x80) && (packet->payload[7] - 13 <= 1) &&
58+
(packet->payload[8] == (packet->payload_packet_len - 9)))
59+
{
60+
/* Search for a MMS signature in initiate request from client */
61+
if ((get_u_int16_t(packet->payload, packet->payload_packet_len-37) == le16toh(0x280)) ||
62+
(get_u_int16_t(packet->payload, packet->payload_packet_len-38) == le16toh(0x380)) ||
63+
(get_u_int16_t(packet->payload, packet->payload_packet_len-40) == le16toh(0x280)))
64+
{
65+
ndpi_int_iso9506_1_mms_add_connection(ndpi_struct, flow);
66+
return;
67+
}
68+
}
69+
}
70+
}
71+
72+
if (flow->packet_direction_counter[packet->packet_direction] > 2) {
73+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
74+
}
75+
}
76+
77+
void init_iso9506_1_mms_dissector(struct ndpi_detection_module_struct *ndpi_struct,
78+
u_int32_t *id)
79+
{
80+
ndpi_set_bitmask_protocol_detection("ISO9506-1-MMS", ndpi_struct, *id,
81+
NDPI_PROTOCOL_ISO9506_1_MMS,
82+
ndpi_search_iso9506_1_mms,
83+
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
84+
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
85+
ADD_TO_DETECTION_BITMASK);
86+
*id += 1;
87+
}

‎tests/cfgs/caches_cfg/result/ookla.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 518 (86.33 diss/flow)
6+
Num dissector calls: 525 (87.50 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_cfg/result/teams.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI : 80 (flows)
9-
Num dissector calls: 514 (6.19 diss/flow)
9+
Num dissector calls: 516 (6.22 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/9/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/pcap/iso9506-1-mms.pcap

2.23 KB
Binary file not shown.

‎tests/cfgs/default/result/1kxun.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
55
Confidence Unknown : 14 (flows)
66
Confidence Match by port : 6 (flows)
77
Confidence DPI : 177 (flows)
8-
Num dissector calls: 4590 (23.30 diss/flow)
8+
Num dissector calls: 4597 (23.34 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/60/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-chrome.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 1 (1.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 127 (127.00 diss/flow)
5+
Num dissector calls: 128 (128.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-opvn.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 0
22

33
DPI Packets (TCP): 6 (6.00 pkts/flow)
44
Confidence DPI : 1 (flows)
5-
Num dissector calls: 128 (128.00 diss/flow)
5+
Num dissector calls: 129 (129.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_chat.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow)
55
DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Match by port : 5 (flows)
77
Confidence DPI : 33 (flows)
8-
Num dissector calls: 545 (14.34 diss/flow)
8+
Num dissector calls: 555 (14.61 diss/flow)
99
LRU cache ookla: 0/1/0 (insert/search/found)
1010
LRU cache bittorrent: 0/15/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_talk.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 10 (2.00 pkts/flow)
55
Confidence Match by port : 8 (flows)
66
Confidence DPI : 11 (flows)
77
Confidence Match by IP : 1 (flows)
8-
Num dissector calls: 1120 (56.00 diss/flow)
8+
Num dissector calls: 1132 (56.60 diss/flow)
99
LRU cache ookla: 0/2/0 (insert/search/found)
1010
LRU cache bittorrent: 0/27/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/Oscar.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 21 (21.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 253 (253.00 diss/flow)
5+
Num dissector calls: 258 (258.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/alexa-app.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 64 (1.94 pkts/flow)
55
DPI Packets (other): 6 (1.00 pkts/flow)
66
Confidence Match by port : 14 (flows)
77
Confidence DPI : 146 (flows)
8-
Num dissector calls: 503 (3.14 diss/flow)
8+
Num dissector calls: 504 (3.15 diss/flow)
99
LRU cache ookla: 0/5/0 (insert/search/found)
1010
LRU cache bittorrent: 0/42/0 (insert/search/found)
1111
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/amqp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 0
22

33
DPI Packets (TCP): 9 (3.00 pkts/flow)
44
Confidence DPI : 3 (flows)
5-
Num dissector calls: 374 (124.67 diss/flow)
5+
Num dissector calls: 377 (125.67 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/anyconnect-vpn.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 10 (1.00 pkts/flow)
66
Confidence Unknown : 2 (flows)
77
Confidence Match by port : 6 (flows)
88
Confidence DPI : 61 (flows)
9-
Num dissector calls: 851 (12.33 diss/flow)
9+
Num dissector calls: 854 (12.38 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/24/0 (insert/search/found)
1212
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/bittorrent_tcp_miss.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 0
22

33
DPI Packets (TCP): 10 (10.00 pkts/flow)
44
Confidence DPI : 1 (flows)
5-
Num dissector calls: 228 (228.00 diss/flow)
5+
Num dissector calls: 233 (233.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 5/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/cassandra.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 0
22

33
DPI Packets (TCP): 16 (8.00 pkts/flow)
44
Confidence DPI : 2 (flows)
5-
Num dissector calls: 308 (154.00 diss/flow)
5+
Num dissector calls: 312 (156.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/cloudflare-warp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 41 (5.12 pkts/flow)
44
Confidence Match by port : 2 (flows)
55
Confidence DPI : 5 (flows)
66
Confidence Match by IP : 1 (flows)
7-
Num dissector calls: 184 (23.00 diss/flow)
7+
Num dissector calls: 187 (23.38 diss/flow)
88
LRU cache ookla: 0/0/0 (insert/search/found)
99
LRU cache bittorrent: 0/9/0 (insert/search/found)
1010
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/custom_rules_ipv6.pcapng.out

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,8 @@ CustomProtocolF 1 1287 1
2929
CustomProtocolG 1 318 1
3030
CustomProtocolH 1 318 1
3131

32-
1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 376/CustomProtocolE][IP: 376/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
33-
2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 377/CustomProtocolF][IP: 377/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
34-
3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 375/CustomProtocolD][IP: 375/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
35-
4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 378/CustomProtocolG][IP: 378/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
36-
5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 379/CustomProtocolH][IP: 379/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
32+
1 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:100 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:1991 [proto: 377/CustomProtocolE][IP: 377/CustomProtocolE][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No client to server traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
33+
2 UDP [247f:855b:5e16:3caf:3f2c:4134:9592:661b]:36098 -> [21bc:b273:7f68:88d7:77a8:585:3990:927b]:50621 [proto: 378/CustomProtocolF][IP: 378/CustomProtocolF][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/1287 bytes -> 0 pkts/0 bytes][Goodput ratio: 95/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0]
34+
3 UDP [3ffe:507::1:200:86ff:fe05:80da]:21554 <-> [3ffe:501:4819::42]:5333 [proto: 376/CustomProtocolD][IP: 376/CustomProtocolD][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/90 bytes <-> 1 pkts/510 bytes][Goodput ratio: 31/88][0.07 sec][PLAIN TEXT (itojun)][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
35+
4 UDP [fe80::76ac:b9ff:fe6c:c124]:12717 -> [ff02::1]:64315 [proto: 379/CustomProtocolG][IP: 379/CustomProtocolG][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
36+
5 UDP [fe80::76ac:b9ff:fe6c:c124]:12718 -> [ff02::1]:26993 [proto: 380/CustomProtocolH][IP: 380/CustomProtocolH][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/318 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,6 @@ CustomProtocolA 3 222 1
2727
CustomProtocolB 2 148 1
2828
Unknown 3 222 1
2929

30-
1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.372/TLS.CustomProtocolA][IP: 372/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
31-
2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 374/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
32-
3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 373/CustomProtocolB][IP: 373/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
30+
1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.373/TLS.CustomProtocolA][IP: 373/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
31+
2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 375/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
32+
3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 374/CustomProtocolB][IP: 374/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/default/result/edonkey.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 0
22

33
DPI Packets (TCP): 5 (5.00 pkts/flow)
44
Confidence DPI : 1 (flows)
5-
Num dissector calls: 130 (130.00 diss/flow)
5+
Num dissector calls: 131 (131.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/emotet.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 0
22

33
DPI Packets (TCP): 48 (8.00 pkts/flow)
44
Confidence DPI : 6 (flows)
5-
Num dissector calls: 196 (32.67 diss/flow)
5+
Num dissector calls: 198 (33.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/fastcgi.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 0
22

33
DPI Packets (TCP): 6 (6.00 pkts/flow)
44
Confidence DPI : 1 (flows)
5-
Num dissector calls: 155 (155.00 diss/flow)
5+
Num dissector calls: 156 (156.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/ftp-start-tls.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 0
22

33
DPI Packets (TCP): 17 (17.00 pkts/flow)
44
Confidence DPI : 1 (flows)
5-
Num dissector calls: 155 (155.00 diss/flow)
5+
Num dissector calls: 157 (157.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/0/0 (insert/search/found)
88
LRU cache zoom: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/ftp.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 39 (13.00 pkts/flow)
44
Confidence Unknown : 1 (flows)
55
Confidence DPI : 2 (flows)
6-
Num dissector calls: 523 (174.33 diss/flow)
6+
Num dissector calls: 529 (176.33 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache zoom: 0/0/0 (insert/search/found)

0 commit comments

Comments
 (0)