Skip to content

Commit 6127e04

Browse files
mmaatuqmmaatuq
authored
support rtp/rtcp over tcp (#2422) (#2457)
Support rtp/rtcp over tcp as per rfc4571. Signed-off-by: mmaatuq <[email protected]>
1 parent 80171db commit 6127e04

File tree

155 files changed

+256
-210
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

155 files changed

+256
-210
lines changed

‎src/include/ndpi_typedefs.h

+8-10
Original file line numberDiff line numberDiff line change
@@ -902,12 +902,6 @@ struct ndpi_flow_udp_struct {
902902
/* NDPI_PROTOCOL_XBOX */
903903
u_int32_t xbox_stage:1;
904904

905-
/* NDPI_PROTOCOL_RTP */
906-
u_int32_t rtp_stage:2;
907-
908-
/* NDPI_PROTOCOL_RTCP */
909-
u_int32_t rtcp_stage:2;
910-
911905
/* NDPI_PROTOCOL_QUIC */
912906
u_int32_t quic_0rtt_found:1;
913907
u_int32_t quic_vn_pair:1;
@@ -922,10 +916,6 @@ struct ndpi_flow_udp_struct {
922916
/* NDPI_PROTOCOL_RAKNET */
923917
u_int32_t raknet_custom:1;
924918

925-
/* NDPI_PROTOCOL_RTP */
926-
u_int16_t rtp_seq[2];
927-
u_int8_t rtp_seq_set[2];
928-
929919
/* NDPI_PROTOCOL_EAQ */
930920
u_int8_t eaq_pkt_id;
931921
u_int32_t eaq_sequence;
@@ -1492,6 +1482,14 @@ struct ndpi_flow_struct {
14921482

14931483
/* NDPI_PROTOCOL_TINC */
14941484
u_int8_t tinc_state;
1485+
1486+
/* NDPI_PROTOCOL_RTCP */
1487+
u_int8_t rtcp_stage:2;
1488+
1489+
/* NDPI_PROTOCOL_RTP */
1490+
u_int8_t rtp_stage:2;
1491+
u_int8_t rtp_seq_set[2];
1492+
u_int16_t rtp_seq[2];
14951493

14961494
/* Flow payload */
14971495
u_int16_t flow_payload_len;

‎src/lib/protocols/protobuf.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ static void ndpi_search_protobuf(struct ndpi_detection_module_struct *ndpi_struc
228228
#endif
229229
if ((protobuf_elements >= PROTOBUF_REQUIRED_ELEMENTS && protobuf_len_elements > 0 &&
230230
/* (On UDP) this packet might be also a RTP/RTCP one. Wait for the next one */
231-
(flow->packet_counter > 1 || flow->l4_proto == IPPROTO_TCP || flow->l4.udp.rtp_stage == 0))
231+
(flow->packet_counter > 1 || flow->l4_proto == IPPROTO_TCP || flow->rtp_stage == 0))
232232
|| (flow->packet_counter >= PROTOBUF_MIN_PACKETS && protobuf_elements >= PROTOBUF_MIN_ELEMENTS))
233233
{
234234
#ifdef DEBUG_PROTOBUF

‎src/lib/protocols/raknet.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ static void ndpi_search_raknet(struct ndpi_detection_module_struct *ndpi_struct,
295295
if (frame_offset == packet->payload_packet_len)
296296
{
297297
/* This packet might also be a RTP/RTCP one: give precedence to RTP/RTCP dissector */
298-
if(flow->l4.udp.rtp_stage == 0 && flow->l4.udp.rtcp_stage == 0)
298+
if(flow->rtp_stage == 0 && flow->rtcp_stage == 0)
299299
ndpi_int_raknet_add_connection(ndpi_struct, flow);
300300
} else {
301301
exclude_proto(ndpi_struct, flow);
@@ -366,7 +366,7 @@ static void ndpi_search_raknet(struct ndpi_detection_module_struct *ndpi_struct,
366366
if (record_index == record_count && record_offset == packet->payload_packet_len)
367367
{
368368
/* This packet might also be a RTP/RTCP one: give precedence to RTP/RTCP dissector */
369-
if(flow->l4.udp.rtp_stage == 0 && flow->l4.udp.rtcp_stage == 0)
369+
if(flow->rtp_stage == 0 && flow->rtcp_stage == 0)
370370
ndpi_int_raknet_add_connection(ndpi_struct, flow);
371371
} else {
372372
exclude_proto(ndpi_struct, flow);

‎src/lib/protocols/rtp.c

+86-40
Original file line numberDiff line numberDiff line change
@@ -90,10 +90,15 @@ int is_rtp_or_rtcp(struct ndpi_detection_module_struct *ndpi_struct, u_int16_t *
9090
u_int16_t ext_len;
9191
u_int32_t min_len;
9292
const u_int8_t *payload = packet->payload;
93-
const u_int16_t payload_len = packet->payload_packet_len;
93+
u_int16_t payload_len = packet->payload_packet_len;
9494

9595
if(payload_len < 2)
9696
return NO_RTP_RTCP;
97+
98+
if(packet->tcp != NULL) {
99+
payload_len -= 2;
100+
payload += 2; /* Skip the length field */
101+
}
97102

98103
if((payload[0] & 0xC0) != 0x80) { /* Version 2 */
99104
NDPI_LOG_DBG(ndpi_struct, "Not version 2\n");
@@ -142,29 +147,23 @@ int is_rtp_or_rtcp(struct ndpi_detection_module_struct *ndpi_struct, u_int16_t *
142147
static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
143148
struct ndpi_flow_struct *flow) {
144149
u_int8_t is_rtp;
145-
u_int16_t d_port = ntohs(ndpi_struct->packet.udp->dest);
146150
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
147151
const u_int8_t *payload = packet->payload;
148152
u_int16_t seq;
149153

150-
NDPI_LOG_DBG(ndpi_struct, "search RTP (stage %d/%d)\n", flow->l4.udp.rtp_stage, flow->l4.udp.rtcp_stage);
151-
152-
if(d_port == 5355 || /* LLMNR_PORT */
153-
d_port == 5353 || /* MDNS_PORT */
154-
d_port == 9600 /* FINS_PORT */) {
155-
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
156-
NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
157-
return;
154+
if(packet->tcp != NULL) {
155+
payload += 2; /* Skip the length field */
158156
}
157+
NDPI_LOG_DBG(ndpi_struct, "search RTP (stage %d/%d)\n", flow->rtp_stage, flow->rtcp_stage);
159158

160159
/* * Let some "unknown" packets at the beginning:
161160
* search for 3/4 consecutive RTP/RTCP packets.
162161
* Wait a little longer (4 vs 3 pkts) for RTCP to try to tell if there are only
163162
* RTCP packets in the flow or if RTP/RTCP are multiplexed together */
164163

165164
if(flow->packet_counter > 3 &&
166-
flow->l4.udp.rtp_stage == 0 &&
167-
flow->l4.udp.rtcp_stage == 0) {
165+
flow->rtp_stage == 0 &&
166+
flow->rtcp_stage == 0) {
168167
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
169168
NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
170169
return;
@@ -173,19 +172,19 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
173172
is_rtp = is_rtp_or_rtcp(ndpi_struct, &seq);
174173

175174
if(is_rtp == IS_RTP) {
176-
if(flow->l4.udp.rtp_stage == 2) {
175+
if(flow->rtp_stage == 2) {
177176
if(flow->l4.udp.line_pkts[0] >= 2 && flow->l4.udp.line_pkts[1] >= 2) {
178177
/* It seems that it is a LINE stuff; let its dissector to evaluate */
179178
} else if(flow->l4.udp.epicgames_stage > 0) {
180179
/* It seems that it is a EpicGames stuff; let its dissector to evaluate */
181-
} else if(flow->l4.udp.rtp_seq_set[packet->packet_direction] &&
182-
flow->l4.udp.rtp_seq[packet->packet_direction] == seq) {
180+
} else if(flow->rtp_seq_set[packet->packet_direction] &&
181+
flow->rtp_seq[packet->packet_direction] == seq) {
183182
/* Simple heuristic to avoid false positives. tradeoff between:
184183
* consecutive RTP packets should have different sequence number
185184
* we should handle duplicated traffic */
186185
NDPI_LOG_DBG(ndpi_struct, "Same seq on consecutive pkts\n");
187-
flow->l4.udp.rtp_stage = 0;
188-
flow->l4.udp.rtcp_stage = 0;
186+
flow->rtp_stage = 0;
187+
flow->rtcp_stage = 0;
189188
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
190189
NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
191190
} else {
@@ -198,32 +197,32 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
198197
}
199198
return;
200199
}
201-
if(flow->l4.udp.rtp_stage == 0) {
202-
flow->l4.udp.rtp_seq[packet->packet_direction] = seq;
203-
flow->l4.udp.rtp_seq_set[packet->packet_direction] = 1;
200+
if(flow->rtp_stage == 0) {
201+
flow->rtp_seq[packet->packet_direction] = seq;
202+
flow->rtp_seq_set[packet->packet_direction] = 1;
204203
}
205-
flow->l4.udp.rtp_stage += 1;
206-
} else if(is_rtp == IS_RTCP && flow->l4.udp.rtp_stage > 0) {
204+
flow->rtp_stage += 1;
205+
} else if(is_rtp == IS_RTCP && flow->rtp_stage > 0) {
207206
/* RTCP after (some) RTP. Keep looking for RTP */
208-
} else if(is_rtp == IS_RTCP && flow->l4.udp.rtp_stage == 0) {
209-
if(flow->l4.udp.rtcp_stage == 3) {
207+
} else if(is_rtp == IS_RTCP && flow->rtp_stage == 0) {
208+
if(flow->rtcp_stage == 3) {
210209
NDPI_LOG_INFO(ndpi_struct, "Found RTCP\n");
211210
ndpi_set_detected_protocol(ndpi_struct, flow,
212211
NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_RTCP,
213212
NDPI_CONFIDENCE_DPI);
214213
return;
215214
}
216-
flow->l4.udp.rtcp_stage += 1;
215+
flow->rtcp_stage += 1;
217216
} else {
218-
if(flow->l4.udp.rtp_stage || flow->l4.udp.rtcp_stage) {
217+
if(flow->rtp_stage || flow->rtcp_stage) {
219218
u_int16_t app_proto; /* unused */
220219
u_int32_t unused;
221220

222221
/* TODO: we should switch to the demultiplexing-code in stun dissector */
223222
if(is_stun(ndpi_struct, flow, &app_proto) != 0 &&
224223
!is_dtls(packet->payload, packet->payload_packet_len, &unused)) {
225-
flow->l4.udp.rtp_stage = 0;
226-
flow->l4.udp.rtcp_stage = 0;
224+
flow->rtp_stage = 0;
225+
flow->rtcp_stage = 0;
227226
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
228227
NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
229228
}
@@ -235,33 +234,80 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
235234
}
236235

237236
/* *************************************************************** */
237+
/* https://datatracker.ietf.org/doc/html/rfc4571
238+
* message format for RTP/RTCP over TCP:
239+
* 0 1 2 3
240+
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
241+
* ---------------------------------------------------------------
242+
* | LENGTH | RTP or RTCP packet ... |
243+
* ---------------------------------------------------------------
244+
*/
245+
static void ndpi_search_rtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
246+
struct ndpi_flow_struct *flow)
247+
{
248+
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
249+
const u_int8_t *payload = packet->payload;
250+
251+
if(packet->payload_packet_len < 4){ /* (2) len field + (2) min rtp/rtcp*/
252+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
253+
NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
254+
return;
255+
}
238256

239-
static void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
257+
u_int16_t len = ntohs(get_u_int16_t(payload, 0));
258+
if(len + sizeof(len) != packet->payload_packet_len) { /*fragmented packets are not handled*/
259+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
260+
NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
261+
} else {
262+
ndpi_rtp_search(ndpi_struct, flow);
263+
}
264+
265+
}
266+
267+
/* *************************************************************** */
268+
static void ndpi_search_rtp_udp(struct ndpi_detection_module_struct *ndpi_struct,
269+
struct ndpi_flow_struct *flow)
240270
{
241271
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
242272
u_int16_t source = ntohs(packet->udp->source);
243273
u_int16_t dest = ntohs(packet->udp->dest);
244-
245-
if((source != 30303) && (dest != 30303 /* Avoid to mix it with Ethereum that looks alike */)
246-
&& (dest > 1023)
247-
)
248-
ndpi_rtp_search(ndpi_struct, flow);
249-
else {
274+
/*
275+
* XXX: not sure if rtp/rtcp over tcp will also mix with Ethereum
276+
* for now, will not add it unitl we have a false positive.
277+
*/
278+
if((source == 30303) || (dest == 30303 /* Avoid to mix it with Ethereum that looks alike */)
279+
|| (dest == 5355 /* LLMNR_PORT */)
280+
|| (dest == 5353 /* MDNS_PORT */)
281+
|| (dest == 9600 /* FINS_PORT */)
282+
|| (dest <= 1023)){
250283
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
251284
NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
285+
return;
252286
}
287+
ndpi_rtp_search(ndpi_struct, flow);
288+
}
289+
290+
/* *************************************************************** */
291+
static void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
292+
{
293+
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
294+
if(packet->tcp != NULL) {
295+
ndpi_search_rtp_tcp(ndpi_struct, flow);
296+
} else {
297+
ndpi_search_rtp_udp(ndpi_struct, flow);
298+
}
253299
}
254300

255301
/* *************************************************************** */
256302

257303
void init_rtp_dissector(struct ndpi_detection_module_struct *ndpi_struct,
258304
u_int32_t *id) {
259305
ndpi_set_bitmask_protocol_detection("RTP", ndpi_struct, *id,
260-
NDPI_PROTOCOL_RTP,
261-
ndpi_search_rtp,
262-
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
263-
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
264-
ADD_TO_DETECTION_BITMASK);
306+
NDPI_PROTOCOL_RTP,
307+
ndpi_search_rtp,
308+
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
309+
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
310+
ADD_TO_DETECTION_BITMASK);
265311

266312
*id += 1;
267313
}

‎src/lib/protocols/viber.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ static void ndpi_search_viber(struct ndpi_detection_module_struct *ndpi_struct,
7070
if((packet->udp != NULL) && (packet->payload_packet_len > 5)) {
7171
NDPI_LOG_DBG2(ndpi_struct, "calculating dport over udp\n");
7272

73-
if((flow->l4.udp.rtp_stage == 0) && (flow->l4.udp.rtcp_stage == 0) /* Avoid collisions with RTP/RTCP */ &&
73+
if((flow->rtp_stage == 0) && (flow->rtcp_stage == 0) /* Avoid collisions with RTP/RTCP */ &&
7474
((packet->payload[2] == 0x03 && packet->payload[3] == 0x00)
7575
|| (packet->payload_packet_len == 20 && packet->payload[2] == 0x09 && packet->payload[3] == 0x00)
7676
|| (packet->payload[2] == 0x01 && packet->payload[3] == 0x00 && packet->payload[4] == 0x05 && packet->payload[5] == 0x00)

‎tests/cfgs/caches_cfg/result/ookla.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 565 (94.17 diss/flow)
6+
Num dissector calls: 568 (94.67 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_cfg/result/teams.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
77
Confidence Match by port : 1 (flows)
88
Confidence DPI (partial) : 1 (flows)
99
Confidence DPI : 80 (flows)
10-
Num dissector calls: 511 (6.16 diss/flow)
10+
Num dissector calls: 512 (6.17 diss/flow)
1111
LRU cache ookla: 0/0/0 (insert/search/found)
1212
LRU cache bittorrent: 0/9/0 (insert/search/found)
1313
LRU cache stun: 30/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/bittorrent.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 24 (1.00 pkts/flow)
22
Confidence DPI : 24 (flows)
3-
Num dissector calls: 1718 (71.58 diss/flow)
3+
Num dissector calls: 1740 (72.50 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 120/0/0 (insert/search/found)
66
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/mining.pcapng.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 17 (4.25 pkts/flow)
22
Confidence DPI : 4 (flows)
3-
Num dissector calls: 97 (24.25 diss/flow)
3+
Num dissector calls: 101 (25.25 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/ookla.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence DPI (partial cache): 1 (flows)
55
Confidence DPI : 4 (flows)
66
Confidence DPI (aggressive) : 1 (flows)
7-
Num dissector calls: 565 (94.17 diss/flow)
7+
Num dissector calls: 568 (94.67 diss/flow)
88
LRU cache ookla: 4/2/2 (insert/search/found)
99
LRU cache bittorrent: 0/3/0 (insert/search/found)
1010
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/teams.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
77
Confidence Match by port : 1 (flows)
88
Confidence DPI (partial) : 5 (flows)
99
Confidence DPI : 76 (flows)
10-
Num dissector calls: 511 (6.16 diss/flow)
10+
Num dissector calls: 512 (6.17 diss/flow)
1111
LRU cache ookla: 0/0/0 (insert/search/found)
1212
LRU cache bittorrent: 0/9/0 (insert/search/found)
1313
LRU cache stun: 30/0/0 (insert/search/found)

‎tests/cfgs/default/pcap/rtp.pcapng

23.9 KB
Binary file not shown.

‎tests/cfgs/default/result/1kxun.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
55
Confidence Unknown : 14 (flows)
66
Confidence Match by port : 6 (flows)
77
Confidence DPI : 177 (flows)
8-
Num dissector calls: 4934 (25.05 diss/flow)
8+
Num dissector calls: 4937 (25.06 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/60/0 (insert/search/found)
1111
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-chrome.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 1 (1.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 148 (148.00 diss/flow)
5+
Num dissector calls: 149 (149.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/443-opvn.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 6 (6.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 149 (149.00 diss/flow)
3+
Num dissector calls: 150 (150.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_chat.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 36 (2.00 pkts/flow)
55
DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Match by port : 5 (flows)
77
Confidence DPI : 33 (flows)
8-
Num dissector calls: 547 (14.39 diss/flow)
8+
Num dissector calls: 549 (14.45 diss/flow)
99
LRU cache ookla: 0/1/0 (insert/search/found)
1010
LRU cache bittorrent: 0/15/0 (insert/search/found)
1111
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/KakaoTalk_talk.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 10 (2.00 pkts/flow)
55
Confidence Match by port : 8 (flows)
66
Confidence DPI : 11 (flows)
77
Confidence Match by IP : 1 (flows)
8-
Num dissector calls: 1203 (60.15 diss/flow)
8+
Num dissector calls: 1207 (60.35 diss/flow)
99
LRU cache ookla: 0/2/0 (insert/search/found)
1010
LRU cache bittorrent: 0/27/0 (insert/search/found)
1111
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/Oscar.pcap.out

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (TCP): 21 (21.00 pkts/flow)
44
Confidence Match by port : 1 (flows)
5-
Num dissector calls: 254 (254.00 diss/flow)
5+
Num dissector calls: 255 (255.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache stun: 0/0/0 (insert/search/found)

0 commit comments

Comments
 (0)